By CPA Frederick Wanume Kibbedi
Whenever headlines break about millions of dollars lost in contested government contracts or public procurement controversies, the public reaction follows a predictable, reflexive script: arrest the auditor, blame the audit team, and accuse the Office of the Auditor General of sleeping on the job. It makes for sensational headlines and easy political theatre, but it betrays a dangerous misunderstanding of what assurance is, where governance begins, and why an audit exists in the first place.
In professional practice and standard assurance engagements governed by the International Standards on Auditing (ISA 240)—which specifically addresses the auditor’s responsibilities relating to fraud—the line between management’s duty and an auditor’s mandate is unambiguous:
The primary responsibility for preventing and detecting fraud rests with both those charged with governance of the entity and management.
To put it plainly: the auditor is not the gatekeeper of the vault, nor the custodian of day-to-day procurement files. Management is.
When a project goes off the rails, four fundamental principles explain why an auditor cannot be held retrospectively liable as the author of the crime:
1. Reasonable Assurance vs. Absolute Guarantee
An external audit is designed to provide reasonable assurance that financial statements and compliance schedules are free from material misstatement, whether caused by error or fraud. It is not—and has never been—an absolute guarantee. Absolute assurance would require an army of investigators to audit 100% of all vouchers, sign-offs, and email threads in real time, a model that would paralyse public administration and exhaust national budgets.
2. The Nature of Concealment and Collusion
Fraud, by its very architecture, relies on sophisticated deception, forgery, deliberate omissions, and collusion among senior decision-makers. An audit relies heavily on representations, corroborating paper trails, and system checks. If senior accounting officers, legal teams, and contract signatories deliberately bypass internal controls or structure agreements behind closed doors, no routine statutory audit sampling technique will unearth a concealed paper trail on day one. Auditing is built on professional scepticism, not forensic wiretapping.
3. The Watchdog vs. The Bloodhound
As established in the classical common-law doctrine of Re Kingston Cotton Mill Co., an auditor is a watchdog, not a bloodhound. The watchdog barks when systems deviate from standard financial rules and established accounting treatments. If the state suspects active embezzlement, criminal conspiracy, or procurement syndicates, the correct instrument is a forensic investigation backed by subpoena power, asset tracing, and police powers—not routine statutory post-audits. Blaming a statutory auditor for not acting as a criminal investigator is a conflation of roles that weakens institutional accountability.
4. Diluting the True Fiduciary Duty
When parliamentarians and the public rush to interrogate and detain audit personnel over stalled or questionable mega-deals, they unintentionally provide cover for the real culprits. The primary questions must always be directed at the accounting officer:
- Who prepared the feasibility study?
- Who negotiated the contractual terms and signed the agreement?
- Who verified delivery and authorised payments against the project's milestones?
- Why were internal control mechanisms and enterprise risk frameworks ignored within the procuring entity?
Holding the auditor responsible for the procuring entity's failures flips corporate governance on its head. If we establish a precedent where the independent auditor is treated as a scapegoat for executive failures and fraudulent collusion, we destroy the independence of the supreme audit institution.
Accountability does not begin when the auditor walks into the room at the end of the year; it begins with the official who holds the chequebook, signs the contract, and manages public funds day in and day out.
