Deloitte fined $7.9M by UK regulator for failed audits

Deloitte UK faced a $7.9 million fine for failing to detect that Go-Ahead Group's railway subsidiaries retained $39.6 million in erroneous government overpayments, illustrating how auditors' lack of professional skepticism and failure to question management decisions directly compromise the reliability of financial statements.

Read article

Teaching notes are auto-generated. Worth a fact-check before class.

Why this matters

Deloitte is one of the world's largest professional services firms, including a major accounting and audit division. An audit is an independent review of a company's financial statements by a qualified firm to verify that the numbers are accurate and presented fairly. Go-Ahead Group is a transport company that operated two UK railway subsidiaries under government contracts. Between 2016 and 2020, these railways received regular subsidy payments from the UK Department of Transport but mistakenly received $39.6 million more than they were contractually owed. Instead of reporting this error and returning the money, the company recorded the overpayments as revenue (profit), making the financial statements misleading. Deloitte, hired to audit these statements, failed to catch this fraud, which the UK Financial Reporting Council (an independent accounting regulator) discovered and punished with a fine.

Key points

Deloitte audited Go-Ahead's subsidiaries for four years but never questioned why government overpayments appeared as profit → auditors must actively challenge suspicious transactions, not passively accept management's explanations.
The $39.6M in erroneous payments sat on the balance sheet unchallenged → professional skepticism means assuming fraud risk factors exist and investigating them, especially when contracts impose specific payment obligations.
Deloitte was fined $7.9M partly because taxpayer money was at risk → auditors protect not just shareholders but the public when public funds are involved in the company being audited.
The FRC reduced the original $14.5M fine because Deloitte cooperated and admitted fault → regulatory enforcement recognizes that early disclosure and remediation matter, but negligence still carries significant penalties.

Key terms

audit: An independent review of a company's financial records and statements by a trained external firm to verify accuracy and detect fraud or error.
professional skepticism: An auditor's duty to question management's assertions and evidence with a healthy dose of doubt, rather than accepting explanations at face value.
fraud risk factors: Red flags or warning signs in a company's operations, contracts, or transactions that might indicate intentional deception or theft by management.
Financial Reporting Council (FRC): An independent UK regulator that oversees and enforces audit standards, investigating firms that fail to meet professional requirements.
auditor's role: The responsibility to examine a company's financial statements and internal controls, form an independent opinion on their accuracy, and communicate any material errors or fraud risk to stakeholders and regulators.
material: Important enough to change a user's decision — a $39.6 million error in a financial statement is material if it would influence someone's choice to invest, lend, or transact with the company.
revenue: Money or value received by a company from selling goods or services; in this case, the railways improperly recorded overpayments as revenue instead of returning them.
regulatory sanction: A penalty imposed by a government or industry regulator on a firm for breaking rules; here, the $7.9 million fine is a monetary sanction.

Discussion prompts

01
Deloitte failed to question why LSER and LM reported $39.6 million in government overpayments as profit—what should 'professional skepticism' have looked like?
Answer: Students should recognize that professional skepticism means Deloitte should have asked: 'Why did government overpayments appear as revenue instead of triggering questions about what was owed?' The auditors should have read the contracts, calculated what was contractually due each month, and investigated discrepancies rather than accepting management's classification. The lesson: trust, but verify.
02
The FRC said Deloitte 'failed to appreciate that the company was under a contractual obligation to act in good faith'—why does an auditor need to review contracts?
Answer: Contracts define the terms of business relationships and set boundaries on what is lawful and expected. If LSER and LM had a contractual duty to act in good faith and return overpayments, Deloitte's audit should have tested whether they complied. This ties auditing to contract review—auditors need to understand the legal and operational context, not just the numbers in the ledger.
03
If you were auditing railways that receive government subsidies, what specific steps would you take to verify that subsidy revenue matches the contract terms?
Answer: Key steps: (1) Obtain and read the government subsidy contract to understand formula and payment terms; (2) Reconcile monthly subsidy revenue in the financial records to government payment schedules; (3) Investigate any variances; (4) Confirm whether overpayments existed and were properly disclosed or returned. This tests whether students understand that audit procedures are risk-driven—government contracts are high-risk areas because of public money and potential for fraud.
04
The FRC reduced Deloitte's fine from $14.5M to $7.9M for 'early disposal' and cooperation—does this suggest auditors who self-report are treated more leniently than those caught by regulators?
Answer: Yes, the reduced penalty suggests the regulator incentivizes self-disclosure and cooperation. This is common in regulatory enforcement: prompt admission and remediation can lower sanctions. However, the $7.9M fine still stands, so cooperation doesn't eliminate accountability. The takeaway: auditors who discover their own failures and act quickly face lighter penalties, but negligence is never cost-free.

Bringing it to class

Start by drawing a simple timeline on the board: government sends subsidy payment → railways receive it → Deloitte audits the financial statement. Ask: 'Where should Deloitte's red flag go up?' Highlight the $39.6M number prominently and connect it to one line: 'This stayed on the books as profit.' Then ask: 'What one thing would you do next if you were the auditor?' Push students to say 'check the contract' or 'ask why the overpayment wasn't returned.' This primes them to see auditing as active investigation, not passive rubber-stamping. Close by noting the fine wasn't small—$7.9M is real money—to underscore that regulators treat professional skepticism failures seriously.