While the primary headline concerned KPMG paying a $50 million penalty to settle Securities and Exchange Commission (SEC) charges that the firm used inside information to cheat on firm inspections, the agency also found that auditors were using inside information to cheat on internal training exams meant to reinforce professional work standards. 

The inspections cheating scheme involved confidential documents from the Public Company Accounting Oversight Board (PCAOB) that outlined its inspection plan for the Big Four firm. These documents were leaked by staffers to KPMG in exchange for jobs with the firm. This happened more than once, with the information each time being passed on by a PCAOB staffer who then went on to work for KPMG. A group of the firm's audit partners had known about this scheme, and indeed pressured the former staffers for additional inside information. Two of the defendants, a KPMG audit partner and a former PCOAB staffer, were convicted earlier this year on conspiracy and fraud charges. Other defendants had already pleaded guilty by then.

During the course of its investigation, however, the SEC also uncovered the internal cheating scandal. In addition to the regular CPE requirements that all auditors are required to complete, the firm also requires them to do training in excess of state requirements, and to take an exam at its conclusion. KPMG administers this training through an online program. Audit professionals are given three opportunities to pass each examination. If one of KPMG’s audit professionals is unable to pass after two attempts, that person's performance management leader is notified. If audit professionals are unable to pass after three attempts, the consequences are more significant: They are required to retake the training; they are prohibited from conducting audit work until they pass the exam; and others at the firm may be notified. Audit professionals also understood that failing to pass an exam could lead to their compensation being reduced

The SEC complaint said that "on numerous occasions" KPMG audit professionals who had passed their training exams sent the answers to their colleagues to help them pass too, primarily via email or printed answers. The SEC noted that this practice took place at all levels of seniority, from nervous first-year auditors to lead engagement partners who were responsible for compliance with PCAOB standards in auditing their clients’ financial statements. The senior cheaters not only sent exam answers to other partners, but even solicited answers from and sent answers to their subordinates. When word of this began getting through to senior leadership, KPMG launched its own internal investigation, which prompted the cheaters to hide the evidence. For example, in one case, a now-former junior partner sent another former partner the answers from his exam by text message. After receiving a document preservation notice from the firm, the partner deleted the text messages that the junior partner sent him, and encouraged his colleague to do the same. The partner also encouraged the junior partner to lie, saying that the texts were deleted by accident. When the partner was asked in a written questionnaire in December 2018 whether he had received any answers to KPMG training exams, he answered “no."

Beyond that, the SEC said audit professionals were also manipulating the scores of the training exam. They did so by looking at the URL for the exams. Embedded in the link was an instruction to the server specifying the minimum score needed to pass. By changing the number in the link, they were able to then manipulate the score required to pass. Twenty-eight of these auditors did this on four or more occasions. Certain audit professionals lowered the required score to the point of passing exams while answering less than 25 percent of the questions correctly

“The sanctions will protect our markets by promoting an ethical culture at KPMG,” said Melissa Hodgman, associate drector of the SEC’s Enforcement Division.  “To that end, KPMG will take additional remedial steps to address the misconduct and further strengthen its quality controls, all of which will be reviewed and assessed by an independent consultant.”

In addition to paying the $50 million penalty, KPMG is required to evaluate its quality controls relating to ethics and integrity, identify audit professionals who violated ethics and integrity requirements in connection with training examinations within the past three years, and comply with a cease-and-desist order.  The SEC’s order requires KPMG to retain an independent consultant to review and assess the firm’s ethics and integrity controls and its investigation.

KPMG has admitted the facts in the SEC’s order. It has also acknowledged that its conduct violated a PCAOB rule requiring the firm to maintain integrity in the performance of a professional service and provides a basis for the SEC to impose remedies against the firm pursuant to Sections 4C(a)(2) and (a)(3) of the Exchange Act and Rules 102(e)(1)(ii) and (iii) of the Commission’s Rules of Practice.