Illustrative image, sources: Former KPMG audit partner Sipho Malaba. (Photo: X) | VBS logo / South African currency. (Photo: Adobestock) Guilty parties involved in the VBS Mutual Bank scandal continue to be held accountable, with the Independent Regulatory Board for Auditors (Irba) censuring former KPMG audit partner Sipho Malaba on Friday over his role in signing off on the bank’s 2017 financial statements.
Malaba has been debarred for life, meaning he may never practise as an auditor again. He has to cough up R10.8-million (R1.6-million in fines and a costs order of more than R9.2-million). The case is also to be referred to the National Prosecuting Authority.
Although it has been several years since the collapse of VBS Mutual Bank, the wheels of justice are turning (albeit slowly).
VBS-related sentences and fines to date:
October 2020: Former VBS Mutual Bank CFO Philip Truter pled guilty to fraud, corruption, money laundering and racketeering charges and was sentenced to 10 years in prison, with three years suspended. He was released on parole in July 2024.
July 2022: Keaobaka Kgatitsoe, a businessman linked to the VBS scandal, received a five-year suspended sentence and was ordered to pay R460,000 for his role in a money-laundering scheme involving fictitious invoices submitted to the bank.
October 2023: Hlengani Maluleke, the former municipal manager of Thulamela Local Municipality in Limpopo, was sentenced to a five-year suspended sentence for approving an illegal R30-million investment in VBS.
July 2024: Tshifiwa Matodzi, former chairman of VBS Mutual Bank, was sentenced to 495 years in prison – although he will serve just 15 years – after pleading guilty to multiple charges, including fraud, corruption, money laundering and racketeering.
October 2024: The Financial Sector Conduct Authority (FSCA) fined Ralliom Razwinane to the tune of R3-million and debarred him for 10 years. During this time, he is prohibited from providing financial services to individuals or companies and may not act as a director or senior manager of a financial institution.
November 2024: Johannes Mohlala, the former manager of Fetakgomo-Tubatse Local Municipality in Limpopo, was sentenced to a five-year suspended sentence and ordered to pay R100,000 to the VBS curator.
November 2024: Eddie Makamu, the former chief financial officer of Collins Chabane Municipality in Limpopo, was sentenced to five years’ imprisonment, wholly suspended for five years, on the condition that he does not commit a similar offence during this period. He was also ordered to pay R150,000 to the VBS to partially compensate the victims of the bank’s collapse.
March 2026:
- The Gauteng high court ordered that Toni Mphephu be held personally liable to repay about R4.4-million of 57 individual payments made to him;
- The Dzata Trust, which was linked to Mphephu and had received money via bond payments and direct transfers, was ordered to repay just over R8-million;
- Oscar Thobakgale, who acted as an attorney, has to repay the just less than R3-million that he retained as fees; and
- Mphephu and Thobakgale were found jointly and severally liable to repay the R1.7-million that they were unable or refused to account for.
The Irba ruling
In a strongly phrased ruling, the Irba disciplinary panel described the case as “an auditor’s accomplished failure” to exercise the integrity, independence and professional scepticism expected of the profession. It is a damning assessment of the man who led the audit months before VBS collapsed into one of South Africa’s most notorious banking frauds.
The ruling revives painful questions about the gatekeepers who were meant to spot the rot.
VBS was eventually exposed as the site of a sprawling looting scheme in which more than R2-billion was siphoned off through fraudulent deposits, fictitious loans, insider dealings and governance failures. Municipal money was caught in the blast radius, depositors were burnt and public confidence in financial oversight took another hit.
Now, Irba has formally found that the lead auditor failed in his duties.
Clean opinion, dirty reality
Malaba was the engagement partner responsible for the VBS audit for the financial year ended March 2017. He signed an unmodified audit opinion in July that year, effectively certifying that the bank’s financial statements fairly presented its position.
But the disciplinary findings paint a very different picture.
The 101-page merits ruling says sufficient and appropriate audit evidence was not obtained across key areas, including cash balances, loans and advances, impairments, deposits, related-party dealings, journal entries and going-concern considerations. It found that fictitious contract-finance facilities and suspicious deposit activity were not properly identified or challenged.
The panel also noted that the South African Reserve Bank had already flagged serious concerns around VBS, including weak capital adequacy, poor controls, governance problems and compliance failures. Yet those warnings did not appear to translate into an audit approach calibrated to heightened risk.
For any auditor, but especially one auditing a bank, alarm bells from the prudential regulator should be an absolute red flag.
Seniority cuts both ways
In the sanction ruling, Irba said Malaba’s senior status at KPMG counted against him. He was a senior partner at one of the largest audit firms in South Africa, handling major public-interest work. The panel said such seniority was an aggravating factor.
In other words, this cannot be dismissed as the error of an inexperienced practitioner overwhelmed by complexity. Irba pointed out that it was viewed as a failure by someone expected to know better, ask harder questions and insist on stronger evidence.
The panel was also openly critical of Malaba’s conduct during the disciplinary process. It said he elected not to participate in the sanction hearing, describing it as a self-imposed “suspension”, and suggested there had been a pattern of delay in both the merits and sanction phases.
The ruling further notes that findings remain “valid and binding” unless set aside by a competent court.
KPMG’s old wound reopens
The censure also drags KPMG’s VBS chapter back into view.
Business Maverick previously reported that KPMG and the VBS liquidators reached a confidential out-of-court settlement over claims arising from the failed audit. The secrecy around that deal drew criticism from Cosatu and others who argued that public accountability was being traded for private closure.
The sanction against Malaba adds an individual reckoning to a scandal that has largely hovered over the firm as a corporate stain.
KPMG, like several major audit firms, has spent years trying to rebuild trust after a succession of reputational blows in the Gupta era and beyond.
A broader pattern in audit quality
The timing is awkward for the profession because Irba’s latest Public Inspections Report for 2025 suggests that some of the weaknesses exposed in VBS are not ancient history.
The regulator said its latest inspections again identified recurring deficiencies in revenue recognition, journal entries and reliance on IT controls. It also warned that professional scepticism and judgement remain problem areas, with persistent weaknesses in how auditors challenge management assumptions and document key decisions.
That sounds uncomfortably familiar.
The VBS case was, at its core, a story about insufficient challenge, inadequate scepticism and weak evidence gathering. When the same themes keep reappearing in modern inspections, the issue stops looking like isolated misconduct and starts looking structural.
Irba acknowledged some progress in parts of the market, but said “recurring deficiencies” and emerging weaknesses continued to show where improvement was needed. In layman’s terms, the industry has moved, but not far enough.
Why this still matters
Audits are one of capitalism’s trust machines. Investors, banks, pension funds and regulators all rely on them. So, when they fail, risk is mispriced, losses multiply and confidence drains slowly but deeply.
The censure of Sipho Malaba will not recover looted billions or reverse the damage inflicted on communities and institutions. But it does show that consequences, even delayed ones, can still arrive.
For the audit profession, the message is that the auditor’s signature on an audit report is not ceremonial ink, but a promise to the market.
And when that promise collapses, the paper trail can come back to bite the auditor. DM