While KPMG Australia Dominated the Global Headlines, South Africa Barred a Former Partner from Auditing for Life
Junior auditors escalated a R700m cash discrepancy at VBS Bank. The partner signed a clean opinion anyway — and has now been permanently barred from auditing
Key Takeaways
South Africa’s Independent Regulatory Board for Auditors ordered the permanent disqualification of former KPMG partner Nhlanhla Sipho Malaba, who had led the VBS Mutual Bank audit.
It directed that he be removed from the register of auditors and ordered him to pay R1.6 million in fines and more than R9.2 million in costs.
IRBA found that Malaba had knowingly suppressed red flags, participated in maintaining a false balance-sheet figure and acted dishonestly in the performance of his professional duties.
VBS’s collapse froze the savings of individuals and community groups and left municipalities and other unprotected creditors facing substantial losses.
Over the last four months, the eyes of the international business press have been focused on Australia, where the local KPMG firm is embroiled in a spiralling crisis. Meanwhile, an unusually severe disciplinary decision against a former KPMG partner received remarkably little notice outside South Africa.
On 15 April 2026, South Africa’s Independent Regulatory Board for Auditors ordered the permanent disqualification of former KPMG partner Nhlanhla Sipho Malaba.
The panel also imposed fines totalling R1.6 million (~ US$97,000) and ordered him to pay IRBA’s costs of R9,252,537.92 (~ US$559,000).
But the scale of the financial consequences is not the most important aspect of the case. What is extraordinary is the bluntness of the panel’s assessment. It did not stop at the familiar language of insufficient professional scepticism, inadequate audit evidence or failures of due care. It found that Malaba had acted dishonestly, was complicit in a cover-up, knowingly suppressed red flags identified by his audit team and devised an unlawful scheme to conceal VBS Mutual Bank’s true financial position. It described the resulting audit opinion as fraudulent and set out the evidence underpinning those conclusions in a 101-page merits ruling.
… perpetuate a patent fraudulent recordal in the VBS Mutual Bank’s audited financial statements amounting to approximately R500 million as an asset…
This recordal was a fictitious non-existent and fraudulent account of VBS Mutual Bank’s financial position. This financial hole was intentionally plugged into VBS Mutual Bank’s balance sheet to deceive not only the customers of VBS Mutual Bank but also the members of the public in general including IRBA and other financial regulatory bodies.
… the respondent’s conduct displays:
dishonesty and lack of integrity in having suppressed critical audit issues from governance reporting;
complicity in the maintenance of a false balance sheet figure;
the signing (and authorising publication) of a clean audit report despite known, unresolved cash discrepancies, as aforesaid; and
the failure to discharge the statutory duty to report a reportable irregularity to IRBA.
The only inescapable finding on this charge is to find the respondent guilty. The respondent is hereby found guilty as charged.
IRBA Merits Ruling, pp. 78-80
The panel concluded that Malaba was responsible for “devising an unlawful scheme” to conceal VBS’s true financial position, and that he had been complicit in a cover-up designed to secure a clean audit opinion for VBS, knowingly suppressing red flags identified by his audit team.
IRBA described Malaba’s conduct as “flagrant and appalling” and called him “a disgrace to the auditing profession”. It then ordered IRBA to take the steps necessary to secure his permanent disqualification as a registered auditor.
“A good bank for ordinary people”
To understand why Malaba’s conduct attracted such a severe response, it is essential to understand the nature of VBS bank, and who bore the consequences when it collapsed.
VBS began life in 1982 as the Venda Building Society. It later became a mutual bank, serving communities concentrated in South Africa’s Limpopo province. Its clients were ordinary retail customers, burial societies and stokvels (community savings clubs through which families pooled money), and it used those funds primarily to provide mortgages and short-term loans.
As President Cyril Ramaphosa told Parliament in November 2018, VBS had for much of its existence been ‘a good bank for ordinary people’ that provided loans and mortgages in rural areas.
The situation changed dramatically after Andile Ramavhunga became chief executive in 2014 and accelerated after Tshifhiwa Matodzi became chairman in 2015. Under their leadership, VBS started pursuing a far more aggressive expansion strategy. Bank officials began paying commissions and bribes to induce municipalities to deposit billions of rand at VBS, even though municipalities were not legally permitted to place public money with mutual banks.
On paper, the transformation looked like a remarkable commercial success. In reality, money flowing into VBS was being looted from the bank.
Funds were siphoned out for the benefit of executives, associates and politically connected recipients, using fictitious deposits, fraudulent or unsupported loans and other transactions. False accounting entries were then used to conceal the resulting hole, making assets and cash appear to exist when they did not.
This led to a massive hole in the bank’s accounts.
The KPMG Audit
Zondi Nduli was a third-year KPMG audit clerk working on VBS’s 2017 audit. While checking the bank’s cash balances, he and a junior colleague discovered that the numbers in VBS’s accounts did not match the money actually held by the bank.
The clearest example was VBS’s settlement account. Its books said that about R414 million was sitting there. The bank statement showed just R4.3 million. That left a shortfall of roughly R410 million in that account alone.
When Nduli looked across VBS’s cash balances more broadly, the unexplained gap was even larger: about R700 million.
The junior auditors repeatedly sought information from VBS management to explain the discrepancies, but were not able to obtain the evidence needed to reconcile the balances.
The problem was then escalated to audit manager Kafuma Munalula, who realised that the missing cash was large enough to make the difference between VBS being solvent and insolvent.
The junior auditors had found the hole left by the looting.
Munalula escalated it to Nhlanhla Sipho Malaba, the engagement partner.
Inside VBS, chief financial officer Philip Truter was well aware of the problem. He later told the Prudential Authority that he telephoned Malaba, who came to his office. They closed the door, and Truter explained that the settlement account contained an unreconciled difference exceeding R400 million.
According to Truter’s account, Malaba asked him:
Do you want to tell me R½ billion is gone or missing?
The two discussed presenting the missing amount as a reconciling item between the general ledger and the bank statement, rather than adjusting the balance sheet to reflect the money actually held. Truter said he subsequently sent a WhatsApp message to chairman Matodzi, reporting that he had met Malaba and that the missing cash would be shown as a reconciling item, leaving the balance sheet unchanged.
In the meantime, audit manager Munalula was working to ensure that the unresolved reconciliations were recorded. She prepared a report for VBS’s audit committee stating that the bank reconciliations remained outstanding. Malaba reviewed the draft, crossed out the reference and told her that the issue had been resolved.
On 17 July 2017, with VBS pressing for the audit to be completed, Munalula sent Malaba a text message:
Are you okay for the VBS opinion to be signed in light of EMID report still outstanding and also if you’re happy that cash is fine? They want to print today.
A few hours later, Malaba replied:
Yes, happy to go ahead.
Nduli was troubled when he learned that a clean audit opinion had been signed. He returned to the audit file looking for evidence of the additional procedures he had been told Malaba and a VBS executive would perform. He found none.
Nduli later altered the cash working paper after being told that the partner was satisfied with the balance, a step the Motau investigation subsequently criticised as misleading.
Anatomy of a Cover-up
Philip Truter prepared the financial statements.
Matodzi and chief executive Ramavhunga signed the directors’ responsibility statement.
Malaba provided the “independent” assurance that the accounts fairly presented the bank’s position.
IRBA later found that Malaba’s independence was severely compromised because businesses associated with him had obtained about R25 million in credit facilities from VBS while he was responsible for auditing the bank. He had been actively involved in securing those facilities, had not disclosed them to KPMG, and later told the firm they had been restructured when their position had not materially changed.
VBS Collapses
Less than eight months after the audit opinion was signed, VBS could no longer meet its obligations to depositors. It was placed under curatorship on 11 March 2018 and into final liquidation that November.
The Motau investigation (The Great Bank Heist) identified approximately R1.9 billion in gratuitous receipts paid to 53 people and entities. The IRBA sanction panel referred more broadly to losses of approximately R2.3 billion arising from the fraud and collapse, equivalent to around US$139 million.
Much of the damage fell on public bodies and ordinary depositors.
Twenty municipalities had deposited approximately R3.7 billion with VBS. Although around R2.2 billion was returned, approximately R1.5 billion remained unrecovered. This was public money needed to support services such as water, sanitation, electricity and local infrastructure.
Thousands of retail depositors were also caught in the collapse. They included elderly customers, stokvels whose members relied on pooled savings to meet household emergencies, and burial societies. The South African authorities subsequently protected qualifying retail deposits up to R100,000 per depositor.
Of the original 18,300 retail deposit accounts, 17,750 accounts worth R260 million were transferred to Nedbank, allowing most of those customers to recover their money. The protection did not extend to municipal or corporate deposits, or fully cover retail creditors with balances above the guarantee.
It is particularly disturbing that many of the people who have suffered loss as a result of these crimes are poor rural residents.
It is critical that every effort is made to recover the stolen funds to minimise the losses suffered by the bank’s depositors.
For much of its existence, VBS was a good bank for ordinary people that gave loans and mortgages to people in rural areas – and now, through greed and deception, that bank has been destroyed.
The real tragedy of the VBS saga is that money was stolen from those people in our society who could least afford it.
The fallout for the auditors
KPMG’s audit opinion did not create the fraud at VBS. But it placed the credibility of a global audit brand behind financial statements that covered up looting on an industrial scale and made an insolvent bank appear financially sound.
Malaba resigned in April 2018, after the firm brought disciplinary charges concerning his failure to disclose financial interests connected with VBS. KPMG subsequently reported Malaba to South Africa’s Directorate for Priority Crime Investigation, known as the Hawks, and said it supported criminal action being taken.
The firm faced civil proceedings from the VBS liquidator, with the parties reaching a confidential settlement in 2024. South African media reported that KPMG agreed to pay R500 million against an original claim of approximately R864 million, although the settlement terms were not publicly disclosed.
Malaba was arrested in 2020 and charged, alongside other defendants, with offences including racketeering, theft, fraud, corruption and money laundering. As of April 2026, he continued to face those criminal charges, which are separate from IRBA’s disciplinary findings.
A global network, nationally contained scandals
The VBS ruling was widely reported in South Africa. As of 12 August 2026, a Big4News search found no report of the April sanction in Reuters, the Financial Times, Bloomberg, the Wall Street Journal, the BBC, the Guardian, AP, Accountancy Age or International Accounting Bulletin.
The conduct occurred within KPMG South Africa, but the questions it raises are not uniquely South African: whether junior auditors can challenge powerful partners, whether internal escalation mechanisms protect the public when concerns reach the top of an engagement, and whether global networks learn from serious failures that occur within individual member firms.
That matters because KPMG operates internationally under a common brand, even though its member firms are legally separate. A failure may occur inside one national firm, but the governance and audit-quality questions it exposes can have much wider relevance.
KPMG’s crisis in Australia is now being treated as a matter requiring the direct involvement of its global leadership. The VBS ruling shows why such crises cannot be understood only as local problems.
This article is part of the Big4News Case Watch series. Case Watch tracks significant regulatory investigations, enforcement actions and litigation involving Deloitte, PwC, EY and KPMG, focusing on matters that shed light on internal culture, governance and accountability.
About Claudine Cassar
I’m a corporate anthropologist and former Deloitte equity partner. I sold my technology business to Deloitte in 2016 and led the Malta Consulting team for five years. I am the founder and editor of Big4News, which provides independent, clear analysis of PwC, Deloitte, EY, and KPMG — free from corporate spin.
Find me on LinkedIn, X, Instagram, or my author website.
Feel free to reply to this newsletter — I read every reply.
Decidedly a hard time for KPMG globally. This quote stays with me: "IRBA described Malaba’s conduct as “flagrant and appalling” and called him “a disgrace to the auditing profession”". It's reassuring that some places of the world are capable of seeing clearly and calling it exactly what it is.