Deborah O'Neill (NSW, Australian Labor Party) Share this | Link to this | Hansard source

On 12 February, the Senate passed my motion to extend the joint parliamentary committee's inquiry into the regulation of auditing in Australia to 1 September. I thank the Senate for doing so. Further to my previous statement on the matter, I'll put more material on the record today that focuses on EY—Ernst & Young—as well as the auditing and consulting industry in general as an exemplar of the problems that need remediation in the national interest.

I first turn to EY's governance arrangements for performing the APRA CPS 220 risk review for NAB, which has been explored during previous hearings. I advise that Mr Scott Ward is a senior partner who, at the time of the CPS 220 review, led EY's financial services risk management technology risk and internal audit teams. Mr Ward's financial risk management team delivered the CPS 220 review for NAB at the same time his technology risk team performed the controls assurance review for NAB's external audit. This establishes a clear conflict of interest and a breach of professional standards. In addition, evidence heard at the auditing hearing on 9 December last year about Sarah Lowe, from EY, as lead auditor for NAB showed a deeply concerning conflict of interest.

We now know of two senior EY partners who were involved in NAB's external audit and were also directly involved in what was purported to be an independent CPS 220 review. This may explain why EY attempted to manage the optics by assigning Mr Ward the role of subject matter resource instead of engagement or delivery partner despite his financial services risk management team delivering the work in Melbourne; and they allocated Mr Doug Nixon, the partner assigned, as the engagement or delivery partner, being based in Sydney.

I have also been made aware that it is very difficult for EY officers to be promoted to senior manager, let alone director or partner, unless they can demonstrate consistent achievement of ever-increasing sales targets and an undying devotion to working extended hours, such as from 8.15 in the morning to midnight. Utilisation is a key performance measure for officers in the industry because it measures to what extent they are chargeable on client engagements. Despite officers charging all their time to charge sheets, as instructed, I am aware of isolated cases, but nonetheless cases, where officers have been stripped of utilisation hours when an engagement runs over budget. This practice does not accord with the evidence given by Ms Lowe during the public hearing into these matters in December. When utilisation hours are stripped to preserve the engagement margin, it is done so as to protect the performance measures of the engagement manager or partner at the expense of the officers concerned. This is a very sophisticated form of wage theft and gross exploitation.

During the hearing in December last year, EY CEO Tony Johnson asserted that officers and partners at EY act with the utmost professionalism. I hear that claim and acknowledge Mr Johnson's affirmation of the importance of professional standards and actions. Perhaps someone needs to remind Mr Johnson of an incident in 2014-15 at RACV in Healesville, Victoria, where members of the Melbourne financial services assurance team allegedly were involved in an alcohol fuelled bender resulting in the destruction of property to the value of $15,000 and a subsequent lifetime ban being imposed on EY by that venue. I have also been informed of claims of partners being under the influence of alcohol, behaving inappropriately and sometimes undermining, humiliating and ostracising officers in the presence of other employees while off premises as well as officers coming to work under the influence of illicit drugs in a desperate attempt to fiercely compete for that sales credit. This says a lot about the cultural tone set at the top by partners at EY and the relationship between power and alcohol in fuelling inappropriate workplace behaviour, which also allegedly included sexual harassment, assault and fraud over a number of years. I hear that the alcohol consumption of the cybersecurity practice in particular is considered legendary across the firm. This again maybes a mockery of the consulting business.

Why are people coming forward with these alarming concerns to a senator? What internal channels and practices are failing to such an extent that whistleblowers are turning in sheer desperation to the parliament to shine a light on this behaviour. If EY is concerned about the mental health of its workers then perhaps it should consider the introduction of random alcohol and drug testing. I say this mindful that EY is not the only company in this industry where this is embedded, and practices are reported across all of them.

I also have been contacted by many people across the broader auditing and consulting industry expressing serious concerns about breaches of confidentiality and subsequent victimisation when workplace complaints are made. Specific concerns raised with me include so-called independent investigations performed by third parties being far from independent when the same firm funds the investigation and classifies the report as privileged in order to prevent complainants from accessing it. It's been reported to me that, where investigations include a review of emails, instant messages and other communications, this is likely to be performed internally, raising further concerns about contagion. Partners talk about officers who raise workplace complaints amongst themselves sometimes overtly and vexatiously in front of the complainant on the open floor because they have no legal obligation to maintain confidentiality amongst themselves. Indeed, partners have a duty to protect each other given they are jointly and severally liable, so they share information with each other as they see fit. Such behaviour by partners increases the risk of breach of confidentiality of officers and the workforce in general. This propagates gossip, rumour and innuendo as well as other inappropriate behaviour towards the complainant by persons not a party to the matter. This creates a very uncomfortable and unsafe workplace environment for the complainant, despite being guaranteed confidentiality.

Partners are indifferent to confidentiality, because they have plausible deniability. The complainant typically ends up either resigning or being paid out through a redundancy, which is convenient for the partnership but often paralysing for the person who receives that payout. This covert and damning management behaviour is enabled by a partnership model where solidarity is the currency that all too often trumps ethical action and procedural fairness. I am also advised that controls are usually ineffective in preventing retaliation against a complainant by the respondent, despite reminding them of their confidentiality obligations under the various firms' codes of conduct.

In conclusion, a firm's values, culture and behaviour bleeds through to its business decisions, practices, risk profile and control posture. Enormous trust and reliance are placed on the character and integrity of partners for doing the right thing to prevent, or effectively manage, all conflicts regardless of how and when they manifest.

If there's anything that this government has learned from the banking royal commission it's got to be that where there's smoke there's fire. Quite frankly, the voluminous documents, dossiers, recordings and transcripts out there on this subject are enough to shock any reader, listener or viewer. The PJC must, therefore, continue its work and scrutiny of the audit sector in accordance with the will of the Senate, established in this chamber. I look forward to doing that work with my colleagues to further unearth the dangerous practices that are now being reported to me as a senator. It's frightening what's happening to people. There is much more work for us to do. I once again, in my closing remarks, encourage people of good character, people who have signed up to the auditing profession who want to act to the fullness of professional standards—they know what they are. Sadly, some of the people who are leading them have failed them.