The litigation surrounding Malaysia’s collapsed Serba Dinamik presents an extraordinary audit paradox. KPMG was sued after reporting serious concerns to the securities regulator in 2021. Five years later, the company’s liquidator alleges that it should have discovered the problems years earlier. And an investor says that, having finally raised the alarm, KPMG did not disclose or escalate it sufficiently.
There are plenty of cases in which auditors are sued for failing to raise the alarm.
What happened at Serba Dinamik is considerably more complicated.
In May 2021, while auditing the Malaysian oil and gas services group, KPMG encountered serious problems verifying billions of ringgit of transactions. It escalated its concerns and filed a statutory report with both Malaysia’s Securities Commission and Bursa Malaysia.
Serba Dinamik responded by suing KPMG.
Five years later, Serba Dinamik is in liquidation and KPMG is being sued again — this time on almost the opposite basis.
Serba Dinamik and three subsidiaries allege that KPMG should have uncovered extensive misstatements during its audits between FY2016 and FY2019, years before it eventually raised the alarm. The companies, acting through their liquidator, are seeking at least RM1.56 billion in damages, plus interest.
And in a separate case, AmanahRaya Investment Management alleges that when KPMG finally did identify problems in 2021, it failed to disclose or escalate its concerns before AmanahRaya invested almost RM96 million (~ US$23.5 million) in Serba Dinamik debt. KPMG denies that it owed AmanahRaya a duty of care and says it had no involvement in the issuance of the debt instrument.
The three sets of proceedings concern different periods, different alleged duties and different claimants. The two 2026 cases contain allegations that have not been tested at trial.
But put them alongside one another and they create an extraordinary sequence.
KPMG was sued for raising the alarm.
It is now being sued for allegedly raising it too late.
And, in another case, it is being sued because the alarm it did raise was allegedly not loud enough.
What KPMG found
By FY2020, KPMG had been Serba Dinamik’s statutory auditor for seven financial years. Through FY2019, the engagement had been led by a partner from KPMG’s Sarawak office. For FY2020, the firm changed the engagement partner to someone based in its Kuala Lumpur office.
The audit team soon encountered serious problems obtaining reliable evidence about substantial sales, receivables, suppliers and contracts.
Among the issues were confirmations relating to 12 customers. KPMG sent confirmation requests to all 12 but received only one response. After Serba Dinamik itself sent another round of confirmations to the remaining 11 customers, all 11 responded, but questions remained over whether the responses were authentic.
The transactions involved were substantial: RM2.32 billion (~ US$568 million) of sales, RM652 million (~ US$160 million) of trade receivables and RM569 million (~ US$139 million) of materials held on site.
KPMG also raised questions about local suppliers. Two had been incorporated on the same day, four used the same registered address, and five had paid-up capital of just RM100,000 (~ US$24,500) despite transactions with Serba Dinamik ranging from RM60 million to RM96 million (~ US$14.7 million to US$23.5 million).
There were other anomalies. KPMG could not locate the physical office of a customer and supplier in Bahrain. It identified issues with customer contact information. It also questioned IT contracts involving customers with limited corporate histories or apparently unrelated principal business activities.
Serba Dinamik provided explanations for the discrepancies and disputed KPMG’s concerns. Its position was that the issues could be resolved.
KPMG took a different view. It filed a report with the regulators.
The statutory duty to report
Under Section 320 of Malaysia’s Capital Markets and Services Act 2007, an auditor of a listed corporation who, in the course of the audit, forms the professional opinion that there has been a breach or non-performance of securities law or stock-exchange rules, or that a matter may materially adversely affect the company’s financial position, must immediately submit a written report to the relevant regulator or regulators.
The legislation also provides an important protection for the auditor: an auditor cannot be sued in court for a report submitted in good faith and in the intended performance of that statutory duty.
On 5 May 2021, KPMG submitted a Section 320 report to both the Securities Commission and Bursa Malaysia. The report prompted an investigation by the Securities Commission, and the regulator raided Serba Dinamik’s offices on 18 May 2021. The company’s share price subsequently fell by more than half.
The first case: KPMG is accused of raising the alarm too soon
Serba Dinamik sued KPMG a month later, on 22 June 2021. However, it faced an obvious obstacle: Parliament had expressly protected auditors making Section 320 reports in good faith.
Serba Dinamik’s answer was that KPMG did not qualify for that statutory protection because, it alleged, the conditions for making a Section 320 report had not been satisfied. The company also alleged negligence, breach of contract and breach of statutory duty.
According to Serba Dinamik’s legal claim, KPMG had gone to the Securities Commission before completing the audit and before conclusively establishing the status of the confirmations it was investigating — so it had not acted in good faith in the performance of its statutory duty.
In essence, it accused KPMG of pulling the trigger prematurely and reporting the company to the regulator “without cause”.
At a press conference held the same day the company filed its legal complaint, Serba Dinamik’s newly appointed chairman, Mohamed Ilyas Pakeer Mohamed, described KPMG’s work as “substandard” and called the firm a “shoplot auditor”. He accused the firm of blowing relatively “trivial” issues out of proportion and described KPMG as “gangsters. Official gangsters.”
KPMG resigned. It said Serba Dinamik’s decision to sue over the continuing statutory audit had compromised its ability to continue the engagement independently and discharge its professional duties.
Four independent directors subsequently resigned, citing disagreement with the decision to commence legal action against KPMG. One of them was Hasman Yusri, the chairman of Serba Dinamik’s Audit and Risk Committee, and a former KPMG partner.
And the Securities Commission made an unusually pointed statement.
In the light of recent events the Securities Commission Malaysia (SC) wishes to reiterate that under the Capital Markets and Services Act 2007, auditors have a statutory obligation to immediately report to the SC, if they reasonably believe that there are any matters which may constitute a breach or non-performance of any requirement of securities laws, rules of the stock exchange or any matter which may adversely affect to a material extent the financial position of the listed company.
The SC’s Audit Oversight Board also stated that external auditors play an important role in promoting confidence in the quality and reliability of audited financial statements in Malaysia. As such, auditors should be allowed to carry out their responsibilities and render their independent opinion without fear or favour, and discharge their duties free from any retaliation. Auditors are also required to exercise their professional scepticism during their audit and always apply the International Standards of Auditing as adopted by the Malaysian Institute of Accountants.
EY Consulting gets involved — and also gets sued
Bursa Malaysia — the stock exchange and front-line regulator for listed companies — ordered Serba Dinamik to appoint an independent reviewer to investigate the issues identified by KPMG. After announcing the proposed appointment in June, Serba Dinamik formally appointed EY Consulting as the independent reviewer on 2 July 2021.
EY’s review reinforced many of KPMG’s concerns and identified additional anomalies. Bursa subsequently put the aggregate amount associated with EY’s factual findings at RM1.073 billion plus US$88 million — equivalent at the time to approximately RM1.438 billion.
The findings covered customer transactions, six local suppliers, the Bahrain entities and IT contracts. EY also identified anomalies involving customers and suppliers that had not originally been identified by KPMG.
The firm presented its findings to Bursa representatives in October, after which the stock exchange suspended trading in Serba Dinamik and ordered the company to disclose the material findings.
Serba Dinamik resisted. In November it sued Bursa Malaysia and, separately, EY, seeking to prevent the material findings from being disclosed — but details of EY’s findings became public through the court proceedings and reporting.
Meanwhile, the Securities Commission’s investigation progressed. In December 2021, it charged Serba Dinamik and senior executives over an allegedly false RM6.014 billion revenue figure contained in the company’s quarterly results for the period ended 31 December 2020.
In April 2022, following representations accepted by the Public Prosecutor, the Securities Commission imposed the maximum RM3 million compound on Serba Dinamik and RM3 million each on four senior executives over submission of the false statement. One executive received an additional RM1 million compound for falsification of accounting records. The executives were subsequently discharged and acquitted by the Sessions Court after the compounds were imposed, so the allegations were not determined at trial.
The subsequent EY findings and the Securities Commission’s enforcement action strongly reinforced the concerns that had led KPMG to escalate the matter.
The second case — KPMG is accused of raising the alarm too late
In August 2026, Serba Dinamik and three subsidiaries, all in liquidation, filed a new civil claim against KPMG.
This time they claimed the opposite of what they had sued the firm for five years earlier, alleging that KPMG should have uncovered serious misstatements years before 2021.
The claim concerns KPMG’s audits from FY2016 to FY2019 and seeks at least RM1.56 billion in damages plus interest.
According to the statement of claim reported by The Edge Malaysia, the liquidator alleges that Serba Dinamik’s reported revenue was overstated by between 62% and 87% in individual years during that period.
The figures alleged are enormous.
For FY2018, Serba Dinamik reported consolidated revenue of RM3.28 billion. The liquidator alleges that RM2.85 billion of it — 87% — was overstated.
For FY2019, the claim says a Serba Dinamik subsidiary reported RM1.13 billion of sales to seven domestic customers. According to the liquidator, those customers subsequently confirmed actual sales of only RM32.3 million.
The allegation is that KPMG did not obtain sufficient appropriate audit evidence, failed to exercise adequate professional scepticism despite unusual revenue growth, and allowed company personnel to interfere with the external confirmation process. Because of this failure, the companies continued operating and made payments they would otherwise not have made, including RM1.795 billion of dividends, RM851 million of finance costs and RM161.5 million of income tax.
The plaintiffs’ case is that if KPMG had performed its duties properly, the group would have been liquidated much sooner, limiting the subsequent destruction of value.
KPMG has faced a substantial liquidator claim elsewhere: the liquidator of VBS Mutual Bank pursued the firm over its audits of the collapsed South African bank, with KPMG reaching a confidential settlement over the civil claims in 2024.
And the issue extends beyond KPMG. Liquidators are also pursuing PwC over its audits of Evergrande in litigation seeking billions of dollars in damages.
That turns the original dispute almost on its head.
In 2021, Serba Dinamik’s case was essentially:
You escalated before you had done enough work.
The liquidator’s 2026 case is:
You should have uncovered this years earlier.
The fact that KPMG eventually raised serious concerns does not answer that allegation. An auditor can act appropriately when confronted with red flags in one audit and still face legitimate questions about whether earlier audits should have uncovered the underlying problem.
That is why the Serba Dinamik story cannot simply be written as one in which KPMG “did the right thing” and was punished for it.
What KPMG did in 2021 and what KPMG should have detected between 2016 and 2019 are separate questions.
The third case — KPMG should have raised the alarm louder
Then there is AmanahRaya Investment Management.
Its lawsuit raises an interesting question: once an auditor has reported a company to the regulator, what else is the auditor supposed to do?
AmanahRaya sued Serba Dinamik, KPMG and 11 other parties in April 2026 over its investment in RM100 million of Islamic Commercial Papers issued by Serba Dinamik.
According to its statement of claim, AmanahRaya paid RM95.77 million on 24 May 2021.
The timing is indeed unfortunate.
AmanahRaya alleges that KPMG had raised its audit concerns on 3 May and reported suspected irregularities to the Securities Commission on 5 May.
The Securities Commission raided Serba Dinamik’s offices on 18 May.
AmanahRaya paid for the investment on 24 May.
Serba Dinamik publicly disclosed the audit issues on 25 May.
AmanahRaya says it would not have invested had the relevant information been disclosed.
There is an important complication for that allegation. Bursa Malaysia’s subsequent court filing states that KPMG’s Section 320 report of 5 May had been submitted not only to the Securities Commission but also to Bursa itself.
AmanahRaya nevertheless alleges that KPMG failed to disclose or escalate its audit concerns in a way that could have affected investors’ decisions.
Translated into less legalistic language, AmanahRaya is effectively saying that KPMG raised the alarm — but not loudly enough for AmanahRaya to hear it before investing.
KPMG strongly disputes the claim. It says it had no involvement in the issuance of the Islamic Commercial Papers, did not consent to its audit report being used in connection with the offering and owed no duty of care to AmanahRaya. It also alleges that Serba Dinamik concealed from KPMG both the RM100 million issuance and the Securities Commission raid.
Whether KPMG owed AmanahRaya any relevant duty — and, if it did, what disclosure or escalation that duty required — is now one of the issues before the court.
Conclusion
The three cases do not necessarily contradict one another. They concern different periods, different claimants and different alleged duties. KPMG could ultimately be found to have acted entirely appropriately when it reported Serba Dinamik in 2021 while still facing legitimate questions about whether earlier audits should have detected problems sooner. Equally, the fact that AmanahRaya invested after KPMG had alerted both the Securities Commission and Bursa Malaysia raises a very different question about how far an auditor’s responsibility to escalate concerns can extend.
But taken together, the proceedings expose an uncomfortable position for auditors. Raise serious concerns too early and the client may accuse you of acting without sufficient evidence. Discover them too late and you may face claims that proper professional scepticism should have uncovered them years before. And even after reporting them to the regulators, a third party may argue that the warning did not travel far enough.
That is what makes Serba Dinamik more than another audit-failure lawsuit. It is a case study in where the boundaries of an auditor’s responsibility begin — and where they end. The second and third cases have yet to be tested at trial, and Big4News will follow the proceedings as they develop.
This article is part of the Big4News Case Watch series. Case Watch tracks significant regulatory investigations, enforcement actions and litigation involving Deloitte, PwC, EY and KPMG, focusing on matters that shed light on internal culture, governance and accountability.
About Claudine Cassar
I’m a corporate anthropologist and former Deloitte equity partner. I sold my technology business to Deloitte in 2016 and led the Malta Consulting team for five years. I am the founder and editor of Big4News, which provides independent, clear analysis of PwC, Deloitte, EY, and KPMG — free from corporate spin.
Find me on LinkedIn, X, Instagram, or my author website.
Feel free to reply to this newsletter — I read every reply.
An interesting mess. It raises questions about what was happening in the Sarawak office and why the audit was shifted to KL.