The paradoxical lessons from EY’s punishment over Wirecard

It was a landmark ruling that, at least at first glance, does look pretty draconian: Germany’s audit watchdog Apas last month banned EY from taking on any new large audit client in Europe’s largest economy for two years. The punishment was meted out by the regulator for violations of professional duties in its work for disgraced payments firm Wirecard.

The once high-flying company collapsed in 2020 in one of Europe’s biggest accounting scandals. EY had missed that half of Wirecard’s reported revenue over a number of years and up to €1.9bn of corporate cash holdings were fake. The Big Four firm has also been fined €500,000 over the undisclosed violations, and five current and former EY employees face penalties of between €23,000 to €300,000. Seven more former auditors have handed back their licences, according to people familiar with the matter.

While this is the toughest sanction against an audit firm in Germany, the Apas sanction might have more symbolic value than actual impact. In some ways, it even highlights the structural weaknesses of the wider audit industry.

From EY’s perspective, the ruling could have been much worse in several ways. Apas concluded that the flawed work was an idiosyncratic issue and limited to the Wirecard audits, according to people familiar with the matter. Had the watchdog concluded that the flaws reflected a broader weakness in quality controls that pervaded the entire firm in Germany, it could have banned EY from any audit work in the country.

Moreover, Apas did not really address a key question for determining EY’s financial liabilities. The firm is facing an avalanche of law suits from Wirecard investors and creditors seeking billions in damages. Under German law applicable at the time, EY will only face a big liability if it issued flawed audits with intent. Should it be found that it only acted negligently, EY would be basically off the hook, facing only a small fine and only if there was a direct link between the auditor’s acts and losses claimed in a lawsuit.

In its ruling, which came almost three years after the watchdog had opened the case, Apas did not address the thorny issue of intent or negligence at all. Legal experts said this decision could be based on the view that the watchdog had no legal obligation to investigate EY’s motivation. The lack of any stated opinion from Apas on that question could make it harder for prosecutors to pursue criminal prosecutions over the audits of the collapsed company.

The €500,000 penalty for EY is the maximum that was possible under German law at the time. But for a highly profitable company with more than €2.3bn annual revenue in Germany, that sum is not much more than a rounding error, and is dwarfed by its legal costs for the matter.

The two-year ban on taking on new listed companies will change little for EY in the short term. Since the Wirecard debacle, the firm has struggled to win any new high-profile audit client in Germany while losing several high-profile mandates including Commerzbank, KfW, DWS and Deutsche Telekom.

Over the medium term, the combination of the intricacies of the wider audit market with the Apas ruling should put EY Germany in a position to move on. Ironically, the tougher audit regulation that was introduced in the wake of the scandal should actually help. Listed companies are now legally obliged to replace their auditor every 10 years. Moreover, enhanced conflict-of-interest rules mean that Big Four firms must not both advise a company on tax matters while checking its books. Other advisory work is allowed under strict rules.

The snag is that only KPMG, PwC, Deloitte and EY are widely considered to have the skills and expertise to audit complex, multinational companies across all sectors. This creates the foundation for a rebound for EY as the choice for companies who need to switch their existing auditor is very narrow — in particular if they rely on consulting services from a different Big Four firm already. Only one of the 40 largest German blue-chips — software giant SAP — is relying on a non-Big-Four auditor, BDO. Over the coming two years, the Apas ban for EY narrows the choice for companies even further.

All this suggests that the regulatory reform of the audit industry in the wake of Wirecard is still unfinished business. One priority could be to increase rather than limit choice for large listed companies. This could be done by lowering barriers to entry for auditors or by facilitating mergers between midsized ones. Companies and investors would be better off with, say, a Big Five or Big Six roster of firms than a Big Three.

olaf.storbeck@ft.com