The Independent Regulatory Board for Auditors (IRBA) has permanently disqualified former KPMG audit partner Nhlanhla Sipho Malaba after finding him guilty on eight charges of improper conduct arising from audits of VBS Mutual Bank, Spectramed, and the Industrial Development Corporation (IDC).
In a sanction ruling issued on 15 April, the disciplinary panel imposed a lifetime ban from registration as an auditor, fines totalling R1.6 million, and a cost order of more than R9.2m. The matter has also been referred to the South African Institute of Chartered Accountants (SAICA) and the National Prosecuting Authority (NPA) for further consideration.
The outcome follows a merits ruling dated 19 March, in which Malaba was found guilty of all the charges brought against him.
Eight charges across three audits
The eight charges were not confined to a single engagement, but arose across three audits:
- Six sub-charges relating to VBS Mutual Bank.
- One charge relating to Spectramed.
- One charge relating to the IDC.
The VBS-related charges covered multiple forms of misconduct, including failure to act with integrity and independence, dishonesty in performing audit duties, failure to comply with auditing standards, issuing a misleading audit opinion, deficient agreed-upon procedures, and misrepresentation in external communications.
The Spectramed charge arose from failures in audit oversight and review, including inadequate engagement with actuarial evidence and key risk areas.
In the Spectramed audit, Malaba issued an unqualified opinion despite failing properly to review key audit work, including actuarial assessments and risk areas. Important evidence was either not reviewed or reviewed after the audit report had been issued.
In the IDC audit, the findings relate to failures to comply with auditing standards and to perform audit work with the required degree of professional competence, care and skill.
Taken together, the panel treated the conduct as a pattern of systemic failure rather than isolated lapses.
Sanctions: maximum fines and full cost recovery
The R1.6m fine was calculated at R200 000 per charge across eight charges, which the panel confirmed was the maximum permissible sanction per charge under the applicable regulatory framework at the time of the misconduct.
In addition, Malaba was ordered to pay 100% of IRBA’s costs, quantified at R9 252 537.92.
The cost order reflects the full cost of investigating and prosecuting the matter, including the disciplinary proceedings themselves. The panel’s approach indicates that the scale and complexity of the case – particularly the VBS component – justified full cost recovery.
Beyond the financial penalties, IRBA imposed:
- permanent disqualification from registration as a registered auditor;
- publication of the findings and sanctions; and
- referral of the matter to SAICA and the NPA.
The sanctions reflect both punitive and protective objectives, removing Malaba from the profession and signalling broader deterrence.
VBS scandal: scale, mechanics and impact
The most serious findings relate to Malaba’s role in the audit of VBS Mutual Bank for the year ended 31 March 2017.
At the time, Malaba was a senior partner at KPMG South Africa and the audit engagement partner responsible for the VBS audit.
The disciplinary panel found that the bank’s financial statements were materially misstated and that the audit failed to detect – or respond to – widespread irregularities.
Evidence before the panel showed that VBS was looted through a combination of:
- fictitious contract finance agreements used to inflate income;
- artificial deposits created without underlying funds; and
- accounting entries used to conceal losses and overstate balances.
These mechanisms formed the basis of a fraud estimated at approximately R2.3 billion.
The ruling records that fictitious loans and deposits were central to the scheme, and that the audit failed to identify them despite clear deficiencies in underlying data and controls.
VBS was placed under curatorship by the South African Reserve Bank on 11 March 2018, marking the point at which the regulators intervened, and the bank effectively collapsed, before it was later liquidated.
The collapse had direct consequences beyond the institution itself.
Municipal funds deposited with the bank were lost, affecting budgets allocated to service delivery. This had knock-on effects for infrastructure projects and basic services, particularly in poorer and rural communities.
The audit failures allowed the irregularities to persist, increasing the scale of losses before the bank was placed under curatorship.
KPMG has previously acknowledged failures in its work related to VBS. In its 2018 baseline report, the firm said it had launched an independent investigation into the audit, committed to co-operating with regulators, and took disciplinary steps after concerns were raised through a whistleblower process. It also indicated that it would pursue possible legal claims against those involved.
Subsequent developments included a confidential settlement between KPMG and VBS liquidators, reportedly in the region of R500m, aimed at compensating creditors.
What Malaba signed off
Despite the irregularities, Malaba signed an unmodified audit opinion on 17 July 2017, stating that the financial statements fairly presented the financial position of VBS.
The panel found that the audit failed across multiple material areas, with insufficient appropriate audit evidence obtained for cash balances, loans and advances, deposits, and income.
Several clear red flags were either missed or not acted on.
The loan book showed aggressive growth, with loans and advances increasing to more than R1.08bn, including a rise of approximately R386.9m (56%) in a single year. This was not identified as a significant risk.
Contract finance – the largest component of the loan book – was recorded in spreadsheets rather than robust systems, raising concerns about completeness and reliability. Investigators later found this category included fictitious agreements used to inflate income, yet the audit failed to detect them.
There were also unexplained discrepancies, including differences of tens of millions of rand between working papers and disclosed figures, which were not resolved.
Cash and cash equivalents were not properly verified. Bank confirmations were not obtained for key accounts, and reconciliation procedures were incomplete or absent. As a result, balances were overstated by a material, unquantified amount.
Deposits showed similarly concerning patterns. Amounts owed to depositors increased sharply, yet this was not treated as a risk. The audit failed to detect fictitious deposits running into hundreds of millions of rand, including a fabricated R250m deposit created without underlying funds.
Income patterns also raised red flags. Interest income increased by 187%, but the audit did not properly interrogate this spike or test the underlying assumptions.
Impairments were recorded at unusually low levels despite clear indicators of credit risk, including arrears, rescheduled loans and adverse economic conditions. These indicators were acknowledged but not properly tested.
Across these areas, the panel found that Malaba failed to apply professional scepticism, failed to design and perform appropriate audit procedures, and failed to respond to risks that were evident on the face of the financial information.
He also failed to report reportable irregularities, despite being alerted to discrepancies by the bank’s chief financial officer.
The ruling states that he “signed a fraudulent audit report” and failed to act even after discrepancies were brought to his attention.
Personal benefit and conflicts of interest
The panel found that Malaba personally benefited by about R25m from his improper conduct.
A central aggravating factor was his undisclosed financial relationship with VBS.
Evidence showed that he held multiple loan facilities with the bank, totalling more than R18m, through entities linked to him.
These included business, vehicle and mortgage loans. Some facilities:
- exceeded internal policy limits;
- lacked appropriate security; and
- were not serviced in line with normal repayment terms.
He also accessed facilities that were only available to VBS employees.
These interests were not disclosed.
The panel found that this created a self-interest threat that could not be mitigated, compromising his independence as auditor. His declaration of independence in the audit report was therefore false.
Absence from proceedings
Malaba did not participate in the disciplinary process.
He did not take part in the merits hearing and later declined to participate in the sanction hearing, despite initially indicating that he would.
He argued that the process was unfair and referred the matter to the Public Protector. He did not, however, obtain a court order interdicting the proceedings.
The panel proceeded in his absence, noting that:
- his non-participation had no legal effect on the validity of the proceedings;
- the disciplinary process was authorised to continue under the Auditing Profession Act; and
- the findings remain valid, binding and enforceable unless and until they are set aside on review by a court of competent authority.
It further records a pattern of delay and procedural resistance, describing his conduct as a self-imposed withdrawal.
The ruling emphasises that any challenge to the outcome must be pursued through judicial review, not by disengagement from the process.
Criminal proceedings and other role players
The VBS scandal remains before the courts, with further arrests expected.
In February 2025, Hawks spokesperson Brigadier Thandi Mbambo said 35 people had been arrested and six convicted, with 29 accused still on trial. Investigations into additional suspects are ongoing.
Read: VBS scandal: six convicted, 35 arrested – and more to come
Former chairperson Tshifhiwa Matodzi was sentenced in 2024 to an effective 15 years’ imprisonment after pleading guilty to fraud, corruption, racketeering and money laundering.
Former CFO Philip Truter was the first to be convicted in 2020. He received a 10-year sentence, with three years suspended, and has since been released on parole, according to IOL.
Other convictions involve municipal officials linked to unlawful investments of public funds, including officials from Collins Chabane, Fetakgomo-Tubatse and Thulamela municipalities.
Investigations have extended to politically connected individuals, intermediaries and others who facilitated or benefited from the scheme. Thousands of statements have been taken as part of the probe.
The NPA has brought charges including theft, fraud, corruption, and racketeering, pointing to an organised scheme involving multiple actors.
Malaba’s case now shifts to the criminal arena. The matter has been referred to the NPA to consider prosecution.
Whether charges are pursued will be decided in court. The IRBA findings remain binding unless set aside on review and may form part of future criminal proceedings.
