Auditor Johan van der Walt, the man at the centre of the controversial SARS KPMG report, has told an Independent Inquiry, chaired by Advocate Dumisa Ntsebeza, and investigating the conduct of members of the South African Institute for Chartered Accountants employed by KPMG South Africa, that he had viewed the reputational risk to the accounting giant in doing work for SARS as “potentially significant”.

While KPMG had rated its engagement with SARS to conduct a documentary review of evidence presented at two previous committees – the Khanyane and Sikhakhane panels into alleged misconduct by SARS officials – with a 1- rating (least risk), Van der Walt was of the view that a 3-rating (the highest risk) would have been more appropriate.

SARS had approached KPMG in 2014 after the suspension of four of its executives, Ivan Pillay, Johan van Loggerenberg, Peter Richer and Yolisa Pike, to review the evidence and present this in “an organised format”, said Van der Walt.

In general, reputational risks, he said, included the danger that the firm might act for the “wrong people”, that a conflict of interest might arise or that an assignment involving high-profile individuals might attract public interest which could impact negatively on the firm’s reputation. Litigation risks would have included the danger that the firm might be sued for alleged negligence or for providing incorrect advice.

Van der Walt’s warning would later prove to be prophetic as KPMG indeed did suffer serious reputational risk not only for its involvement with the SARS report, but also for work conducted for Gupta-related businesses.

Van der Walt’s account to the Ntsebeza Inquiry is the first time the former KPMG SARS “engagement partner” has set out his version of the accounting giant’s engagement with SARS and its role in producing the now infamous “Rogue Unit Report”. The auditor has also made a submission to the Commission on Inquiry into Tax Administration and Governance in SARS and chaired by retired judge Robert Nugent.

Van der Walt said that when he took over the engagement from Herman de Beer, the managing partner for forensic services at KPMG and who had signed the original service agreement with SARS, he had met with the firm’s Country Risk Partner “and informed him of my view”.

After Van der Walt had flagged the potential fallout or consequences, KPMG’s engagement with SARS had been altered to “3-”, he said in his submission.

He also rubbished the “media narrative” that the KPMG SARS Report had been used to build a case against former SARS officials. He maintains that the SARS Report, including the first draft submitted on 30 June 2015, had been done “approximately a month and a half after criminal charges were laid against certain ex-SARS officials”.

“Therefore, the media narrative that the report was used to build a case against ex SARS officials is also not true,” submitted Van der Walt.

He added that the “timing of the sequence of events” as he had set out in his submission “makes nonsense” of KPMG’s claims to the inquiry that the SARS report had caused “damage”.

“If damage was ever caused it would have been caused by the leaking of the SARS Report which is a confidential document,” said Van der Walt.

The source of the leak of the SARS KPMG report to the media has never been named but the consequences were devastating.

“In the event that the SARS Report had been used by any person outside of its intended purpose and accordingly for an unsanctioned purpose, it was without my knowledge,” said Van der Walt.

Van der Walt tore into KPMG, accusing his former employer of being less than candid when the firm announced in September 2017 that it was withdrawing the “recommendations and findings” of its SARS report.

Making the announcement to the media in September, KPMG had said it was withdrawing only the findings and recommendations of the report due to the fact that “during the course of the engagement the scope of the work changed” and that Van der Walt and the team “did not fully grasp the new risks associated with this change”.

To this Van der Walt responded:

“I point out firstly, that there is no description of what this ‘scope of change’ was, nor is there an an attempt to describe the ‘new risk’.”

Van der Walt also informed the Ntsebeza Inquiry that KPMG had consistently refused him access to documents pertaining to SARS Report and which would have supported his submission.

With regard to the “change in scope” referred to by KPMG in its public announcement, Van der Walt said he assumed this could only have been “the request by SARS to KPMG during the second quarter of 2015 to look in more detail at instances of possible corporate governance breaches that had been, or would be, apparent from media reports and/or specifically advised to us by SARS”.

He said that the exclusive focus of the investigation “at the inception” had been to find documentary evidence (“if such existed”) among the 1.2-million documents which would support, or counter, allegations against Van Loggerenberg, Pillay and Pike. The only change in focus, said Van der Walt, had been to create new search terms in order to scan the body of documents.

“Given the confined nature of the change in scope of the work and given that such additional work would still only lead to a confidential, if not privileged, report to SARS, it is obvious that there are not fundamental ‘new risks associated with this change’ which ‘had to be grasped’.”

“Furthermore, given that this project was allocated a 3 risk rating, it accordingly already attracted the highest level of risk oversight,” he said.

Van der Walt said he had noted in evidence presented earlier to the commission that Roy Waligora, on behalf of KPMG, had said that the change in mandate had led the team to investigate the conduct of the Commissioner, the Deputy Commissioner and the Minister [Pravin Gordhan].

However, instructions from SARS, Van der Walt maintains, “were simply to report on whether the documentary evidence analysed by us did, or did not, support any conclusion as to knowledge and or involvement in any of the allegations researched by us. As an aside, it will be remembered that we expressly recorded that no documents were found which suggested knowledge of the unit as it existed, on the part of Mr Pravin Gordhan”.

Essentially, said Van der Walt, KPMG had lied in its statement to the public that the report’s recommendations and findings had been withdrawn because “appropriate consultation with risk management did not take place” and that “quality controls associated with the version of the report dated 3 September 2015 were not performed to the standard we expect”.

These were, said Van der Walt, “without foundation” and “factually incorrect”.

On the contrary, the 3 September 2015 draft report had been subjected “to the more rigorous and formal EQCR (Engagement Quality Control Review) by Mr Herman de Beer” (who was KPMG’s second partner to Van der Walt) in the period from 25 June 2015 to September when the draft was released.

“Indeed the pre-final version of the 3 September 2015 draft was amended by Mr Herman de Beer by way of handwritten edits … and that very document was contained in the bulk documentation packed for storage by the team when the project concluded.”

Van der Walt said when he visited IRBA to inspect documents provided by KPMG this 3 September pre-final version of the draft had been identified. He said that KPMG’s response as to why the findings and recommendations had been withdrawn had been raised at the SAICA Inquiry after the firm had been required to provide a list of the quality controls “to which (KPMG services) did not adhere”.

KPMG had testified to SAICA that an EQCR partner review of the 3 September draft report had been required but that this version of the report had not been “so reviewed”.

This statement, said Van der Walt, was false.

“I note that the allegation had then shifted from ‘no second partner review’ as per the September 2017 press release, to that of ‘no EQCR review’ as per submissions to SAICA.”

This allegation too, Van der Walt said, “is factually incorrect” and the 3 September draft report (as it developed over time) “was in fact subjected to a EQCR partner review which was performed by Mr Herman de Beer”. De Beer had “even signed the 3 September draft report on my behalf providing further evidence that as the EQCR he was aware of, and approved, the release of a deliverable to SARS.

“The 3 September draft report was no more than a further draft in the series of interactions with SARS aimed at eventually producing the formal and final report, which could be formally accepted by the client.”

The final report had been produced and submitted by KPMG in early December 2015. This report had been accepted by SARS in January 2016.

Van der Walt said KPMG’s allegation that the “final deliverable” of the report had not been subjected to review as well as evidence under oath by Waligora that Van der Walt had produced the report “off the grid” was a lie.

“It is of importance to note that the changes from the 3 September draft report to the final SARS Report were minimal,” he asserted.

The September draft report had been signed off by De Beer while the final SARS Report had been signed by Dean Friedman, “another experienced forensic partner”.

“The aforesaid facts accordingly make nonsense of the claim that the reports were not subject to second partner or EQCR review or that I ‘worked off the grid’.”

KPMG’s position with regard to a partial withdrawal of the SARS Report while it did not find “fault with, or purport to withdraw, chapters 1 to 11 of the SARS Report” was “absurd”.

“In fact it was confirmed by KPMG that the rest of the report stands and only some of the conclusions and recommendations were withdrawn.”

KPMG, said Van der Walt, had failed to demonstrate in which respects internal risk reviews may have enhanced the accuracy of “an evidence-based factual finding report and hence the value of the deliverable to the client.

“It is accordingly not surprising that when KPMG gave evidence via Mr Roy Waligora, at the SAICA Inquiry, they abandoned the claims of inadequate compliance with its internal processes and instead materially shifted the focus of the complaint to the ‘cut and paste’ line.”

Allegations that a memorandum of findings and recommendations by SARS legal representatives, Mashiane, Moodley and Monama (MMM), had simply been copied and pasted into the final report had first appeared in the media, Van der Walt told the inquiry.

“It should be noted that after this allegation in the media in January 2016, the entire SARS project was subjected to an internal KPMG Quality Performance Review in May 2016 by an independent partner regarding both process and substance.”

The review had been led by an international partner “providing additional independence” and no issues had been raised during the internal KPMG Quality Performance Review which suggested that the findings had been plagiarised from the MMM Memorandum.

“The project received a favourable review rating.”

He said that the entire project had again been subjected to an internal review by KPMG International in August/September 2017 “after which it publicly released its findings.

“Again, no finding was made that the findings in the SARS report had been plagiarised from the MMM memorandum.”

He said it was only in July 2018 at the SAICA hearing that Roy Waligora “for the first time makes the ‘cut and paste’ allegation. I say in advance that those allegations are without foundation”.

Mashiane, Moodley and Monama, he said, had been appointed as the SARS legal team at the early stages of the investigation.

“SARS instructed KPMG and Mashiane Moodley & Monama to work together on certain aspects of the investigation.”

These aspects were that MMM and Advocates Michael van As SC, Nadine Fourie and Gishatha Singh had been appointed to specifically manage the “entire disciplinary hearing process” [of the SARS executives implicated]. The law firm had been tasked with interviewing “all such witnesses as would be required for purposes of those hearings”.

The KPMG team’s focus, he said, had become “increasingly confined to the analysis of the documents and data in order for the legal team to conduct the interviews on the basis of the documentation identified by the team”.

He said that the findings made in the SARS Report “were based on documentary real evidence and not on oral presentations or interviews with persons”.

“Even in respect of ‘Project Sunday Evenings’, my interviews with the persons aforesaid led to the production of substantive additional documents and the SARS Report is based on a review of that documentation.”

During August 2015, said Van der Walt, various emails had been exchanged between SARS, MMM and himself relating to the finalisation of the SARS Report and what was required from both KPMG and Mashiane Moodley and Monama in order to complete the report.

“It was agreed between SARS, Mashiane Moodley & Monama and myself that we would provide Mashiane Moodley and Monama with a copy of the then latest draft SARS Report (being the 31 July draft report) in order for them to prepare their input and feedback on review.”

What had been “put forward” had been “little more than summaries to the substantive contents of the 31 July 2015 draft report based on the work the KPMG team had done and had expressly recorded in the 31 July draft report.”

In conclusion Van der Walt said that the use and distribution of the SARS Report “was expressly limited by KPMG to its intended purpose” which had been to inform management of SARS of the findings made after investigating documents relating to the “departure of the affected four individuals”.

These four SARS employees had already left SARS by the time the draft report had been submitted. He added that Waligora and otters who had “publicly expressed opinions and views on the conduct and carrying out of the investigation” had not been involved in the investigation and that they had not consulted with him or members of the investigative team. DM