HP acquired Autonomy and all of the Big 4 auditors were dragged into the mess

More than ten years after a disastrous acquisition with a big dose of fraud, the case can still throw reputational zingers towards Deloitte, KPMG, and EY, and even PwC.

The disastrous acquisition in 2011, of Cambridge, UK software firm Autonomy by Hewlett Packard Enterprise is back in the news.

On January 28, 2022, in the U.K. Justice Robert Hildyard ruled that HPE had “substantially succeeded” in its claim, filed in May 2015 against former Autonomy CEO Mike Lynch and former CFO Sushovan Hussain while Hussain was in the U.S. facing criminal charges brought by the U.S. Department of Justice.

The judge said he would allow “considerably less” in damages than the $5 billion HPE had claimed but issued a damning preliminary decision. According to the FT:

He found that a hardware reselling programme by Autonomy was there to cover shortfalls in software revenue, that it was “dishonest” and that the defendants were “well aware of this”. These “lossmaking transactions were not commercially justified on any basis”, the judge said of the hardware reselling programme. They were concealed because their revelation would have revealed that Autonomy’s software business was not generating the accelerating profits “which heavily influenced its price”.

He found that HPE relied on what was said about Autonomy’s revenue in the accounting material and was induced to pay $11bn for Autonomy.

In November 2018 U.S. prosecutors criminally charged Lynch and former Autonomy vice president of finance Stephen Chamberlain over the HPE acquisition. Prosecutors claim the men allegedly engaged in a “scheme to defraud purchasers and sellers of Autonomy securities, including the Hewlett-Packard Company, about the true performance of Autonomy’s business, its financial condition, and its prospects for growth.”  

Chamberlain, Lynch’s co-defendant in United States v. Lynch (3:18-cr-00577), is maneuvering on his own while the court waits for Lynch to show up in the U.S..  He’s looking for demons under the sofa cushions. In a motion back in November Chamberlain claimed that Autonomy’s collapse came after two financial analysts badmouthed Autonomy for fun and profit.

There’s more detailed reporting about the HPE/Autonomy case in The Register than anywhere else, including details about the whistleblowers — plural — on both sides of the Atlantic who blew the case open.

You were expecting the Spanish Inquisition, I mean the auditors?

Lynch has continued to deny criminal wrongdoing and stayed in the U.K. to defend himself in the HP lawsuit, fighting extradition to the U.S. to face the DOJ charges. But hours after Lynch heard the judge’s decision in the HPE suit, the UK home secretary ordered his extradition. Lynch’s lawyer, Chris Morvillo, told Bloomberg he’ll file an appeal with the High Court in London. 

Former Autonomy chief financial officer Sushovan Hussain has already been convicted by a U.S. jury, in April 2018, of 16 counts of wire fraud, securities fraud and conspiracy and, in 2019, was sentenced to five years in prison. He was also fined $4 million and ordered to forfeit $6.1 million a judge in San Francisco. 

Hussain lost an appeal back in August of 2020 in a bid to overturn his criminal conviction for fraud.

I’ve been following this case since news of HPE’s $8 billion write down related to the acquisition broke in November of 2012. I wrote for Forbes:

HP,  in the understatement of the year, says it is “extremely disappointed” to find out some former members of Autonomy’s management team inflated Autonomy’s underlying financial metrics – GAAP and non-GAAP. HP boldly called it a “willful effort to mislead investors and potential buyers”.

That’s PR-speak for fraud.

Big 4 firm Deloitte UK signed the audit opinion for Autonomy with considerable assistance from Deloitte US. Autonomy had dual headquarters in Cambridge, UK and San Jose, CA. According to The Wall Street Journal at the time, Autonomy founder Lynch counted on Deloitte to get the accounting right. HPE’s CEO Meg Whitman told CNBC back in 2012 that HPE had also depended on Deloitte’s audited financial statements of Autonomy when it performed due diligence on the acquisition.  

A whistleblower warned HPE of the possibility it had overpaid for a fraud when it bought Autonomy in 2011. HPE chose another Big 4 firm, PwC, to investigate the whistleblower’s claims as its independent forensic consultant.

According to HPE:

HP launched its internal investigation into these issues after a senior member of Autonomy’s leadership team came forward, following the departure of Autonomy founder Mike Lynch, alleging that there had been a series of questionable accounting and business practices at Autonomy prior to the acquisition by HP. This individual provided numerous details about which HP previously had no knowledge or visibility.

And what about HPE’s own audit firm, EY? Why did it take an Autonomy whistleblower to catch this issue? I wrote at Forbes:

As HP’s auditor, Ernst & Young audited HP’s full year results as of October 31, 2011 and signed off on December 14 on the audit opinion, issued after the Autonomy deal closed in October of 2011. From the 2011 annual report:

The acquisition date fair value consideration of $11 billion consisted of cash paid for outstanding common stock, convertible bonds, vested in-the-money stock awards and the estimated fair value of earned unvested stock awards assumed by HP. In connection with this acquisition, HP recorded approximately $6.6 billion of goodwill and amortizable purchased intangible assets of $4.6 billion.

EY is required to review HP’s quarterly financial statements and provide negative assurance that, based on their review, it is “not aware of any material modifications that should be made to the accompanying interim financial information (statements) for it (them) to be in conformity with accounting principles generally accepted in the United States of America.”

HPE said at the time that it had begun an investigation of the whistleblowers allegations in April of 2012, but there was no disclosure by HP of either PwC’s investigation or the possibility that goodwill or intangible assets had been overstated by more than $5 billion for the whole year, until 2012 year-end.

HPE’s financial statements were materially misstated from the time they closed the deal with Autonomy on August 18, 2011, at year end 2011, and every quarter until the announcement of the impairment of goodwill and other amortizable intangible assets on Nov 20, 2012. HPE did not restate prior period financial statements for the material “misstatements”. 

To round out the complete Big 4 involvement in the Autonomy fraud and its investigation, we must note that KPMG was the firm engaged on a consulting basis to review Deloitte’s audits as part of HPE’s acquisition due diligence effort.

The New York Times Dealbook reported at the time:

When the company assessed Autonomy before the acquisitions, the financial results appeared to pass muster. Ms. Whitman said H.P.’s board at the time – which remains the same now, except for the addition of the activist investor Ralph V. Whitworth – relied on Deloitte’s auditing of Autonomy’s financial statements. As part of the due diligence process for the deal, H.P. also hired KPMG to audit Deloitte’s work.

Neither Deloitte nor KPMG caught the accounting discrepancies. Deloitte said in a statement that it could not comment on the matter, citing client confidentiality. “We will cooperate with the relevant authorities with any investigations into these allegations,” the accounting firm said.

Whitman sounded quite angry at both Deloitte and KPMG in the November 20, 2012 earnings call where the write down of the acquisition was revealed:

What I will say is the board relied on audited financials, audited by Deloitte, not brand X accounting firm but Deloitte. And by the way, during our very extensive due diligence process, we hired KPMG to audit Deloitte, and neither of them saw what we now see after someone came forward to point us in the right direction.

Almost immediately after the write down in November of 2012 investors filed a derivative suit against HP’s board of directors, officers and former executives and also against Deloitte and KPMG. The suit also specifically named CEO Meg Whitman, HP Chief Financial Officer Catherine Lesjak, and former HP CEO Leo Apotheker as defendants. 

By the time a May 3 consolidated complaint was filed in the shareholders derivative case, the plaintiffs had dropped KPMG LLP and Deloitte as defendants. The case, Nicolow v. Hewlett-Packard, was settled for $100 million on November 16, 2015.

Audit firms are notoriously difficult to sue, unless you have an especially assertive and skillful set of lawyers, but a backroom deal often works to get the auditors to capitulate and cooperate. Sometimes all it takes is payment of what amounts to tea and scones money for a year to your defunct client to get the workpapers to a third-party for a private suit. (That way you stay in good graces with the third-party with whom you have a systems integration partner relationship.)

HPE’s suit against Autonomy, Lynch, and Hussain in the UK included a threat to add Deloitte to the suit, which wasn’t withdrawn until 2016. Deloitte, however, did not escape this threat for nothing. An exclusive report by The Register described who Deloitte had to pay off and how much it cost:

Hewlett Packard Enterprise settled its potential lawsuit against Autonomy auditors Deloitte for $45m in 2016, The Register can reveal – shedding new light on how the $5bn lawsuit against former Autonomy CEO Mike Lynch and ex-CFO Sushovan Hussain came about.

The amount of the settlement is less than 1 per cent of the $5bn for which HPE is pursuing Lynch and Hussain.

Although HPE and Deloitte signed a confidentiality agreement over the $45m, its main details were hiding in plain sight inside the last ever accounts filed by Autonomy Corporation Ltd (ACL) before it was merged away into HPE’s corporate structure, becoming known as ACL Netherlands BV.

The article also helps explain why Deloitte UK was never named as a defendant in the HP lawsuit against Autonomy in in the UK. The firm indirectly paid HPE $45m and agreed to hand over its Autonomy workpapers in return.

Although HPE and Deloitte signed a confidentiality agreement over the $45m, its main details were hiding in plain sight inside the last ever accounts filed by Autonomy Corporation Ltd (ACL) before it was merged away into HPE’s corporate structure, becoming known as ACL Netherlands BV.

A letter previously sent by HPE’s lawyers to Deloitte in 2014 alleged “there is evidence that Deloitte was complicit in aspects of the misstatements in Autonomy’s published information”.

That allegation would never be tested in court…

ACL’s [Autonomy] last ever annual accounts revealed how the Deloitte settlement came about. HP had, legally speaking, threatened to sue wholly owned subsidiary ACL for $4.55bn. The accounts explained that ACL (naturally) accepted liability, leading to the next steps:

HP Vision BV recognised that the company [ACL] does not have the means to discharge its estimated liability to HP Vision BV and requested that the company take steps (including litigation) to recover its losses from the parties responsible for the publication of the information described above.

That information was Autonomy’s pre-buyout accounts, which HPE claimed contain deliberate inaccuracies.

Accordingly, on 30 September 2014 the Company sent a pre-action letter to its former auditors, Deloitte LLP, in respect of losses suffered by the Company (including its liability to HP Vision BV under [the Financial Services and Markets Act]).

On 27 April 2016 the Company reached a satisfactory settlement with Deloitte LLP, including a payment by Deloitte LLP of $45,000,000 (£31,245,660). Following the settlement with Deloitte, the Company reimbursed HPE for legal costs of $8,741,549 (£6,069,677) previously funded by HPE. Also, on 31 August 2016, the Company made a partial settlement of the claim from HP Vision BV, in the amount of $35,293,502 (£26,576,432).

Deloitte also agreed to cooperate with the U.S. DOJ, according to The Register:

Deloitte’s former principals on Autonomy’s accounts have all signed cooperation agreements with the US Department of Justice. As we previously reported, these men are former lead auditors Richard Knights and Nigel Mercer, along with Lee Welham and Tom Murray.

During cross-examination in the High Court in 2019, Lynch’s barrister Robert Miles QC asked Welham: “Do you recall that during 2015 the American DoJ were looking for cooperation from Deloitte?” to which the auditor replied “Yes”.

“And,” continued Miles, “Deloitte had some concerns about agreeing to testify while the civil claim was still out there; do you recall that?”

Welham said he didn’t know for sure. Miles went on to show him a copy of the cooperation agreement, which was signed in 2016 as detailed in ACL’s accounts.

The Register has obtained a copy of that agreement from the High Court proceedings. Deloitte agreed to make a dozen auditors available for interview by HPE’s lawyers and, “so far as it is in Deloitte’s power to do so to procure that each Deloitte Interviewee” should provide:

… such assistance and co-operation in those interviews as if they were being interviewed by Deloitte, including providing testimony as to their recollection of events and comments upon (a) whether particular facts were or were not known to them; (b) whether particular documents were or were not shown to them during the course of their audit work, and (c) where such facts or documents were not known or shown to them (whilst not expressing an expert opinion, consistent with their status as witnesses of fact) whether such facts or documents were in their opinion relevant to their work and the potential impact of such facts or documents on their work…

In September 2020 the U.K. Financial Reporting Council ordered Deloitte UK to pay a record fine of £15 million plus the investigation legal costs of £5.6m for its Autonomy audit. Lead partner on the Autonomy account, Richard Knights, was banned from the accounting profession for five years and fined £500,000. Nigel Mercer was fined £250,000 and “severely reprimanded”. The two men left Deloitte in 2017 and 2016, respectively.

The FRC report of its investigation was not made public until June of 2021. It was quite brutal in its assessment of what Knights and Mercer, as well as Deloitte overall, did not do to obtain evidence to support the accounting for what was allegedly fraudulent transactions. Autonomy had allegedly exaggerated revenue and overstated gross margins in 2009 and 2010 prior to the HPE acquisition.  ‘

Deloitte had been the Autonomy auditor since 2003 and the relationships was an important one, at least in terms of the financial benefits it provided to the firm and the lead partners. According to the investigative report:

In May 2009, Mr Knights (who had been the Engagement Partner for the Autonomy audit from FY 05 and Deloitte’s Cambridge Office Senior Partner since June 2007) reported to D3 ([a senior member of Deloitte]) that:

“At a personal level the Autonomy relationship is critical to the financial success of the Office…..We have set ourselves a target of increasing revenues to this FTSE company by >20%”

The FRC formal complaint made five allegations regarding the conduct of Knights, Mercer and Deloitte:

[Knights, Mercer, and Deloitte] fell significantly below the standards reasonably to be expected of them in that:

(i) they failed adequately to challenge Autonomy’s accounting and disclosure of its purchases and sales of “pure hardware” i.e. third-party computer hardware without any pre-installed Autonomy software;

(ii) they failed adequately to challenge Autonomy’s accounting for transactions with value-added resellers (“VARs”) and failed to ensure that the accounting treatment that it adopted was consistent with its disclosed accounting policy;

(iii) Mr Knights failed to correct a misleading statement made [on behalf of Autonomy] in a meeting with the Financial Reporting Review Panel (“the FRRP”) on 13 January 2010 (this is also said to have constituted a lack of integrity);

(iv) Mr Mercer failed to correct a false or misleading statement in a letter from Autonomy to the FRRP dated 3 March 2011; and

(v) Mr Knights lost his objectivity during his engagement with Autonomy in the period from the Q3 09 review to the end of the Q2 10 review.

The discussions of how Autonomy hid the fact it was selling a material amount of hardware at a loss to customers, while claiming everywhere it was a “pure” software firm, are particularly interesting for their straightforward simplicity.

The pure hardware sales were disguised in Autonomy’s Annual Reports and Accounts in two ways, which are both the subject of Allegations in the Amended Formal Complaint: (1) the costs of making the pure hardware sales were allocated in large part to S&M, rather than COGS, which reduced the impact on Autonomy’s closely-watched gross profit margin; and (2) the reports did not disclose the fact that Autonomy was making substantial pure hardware sales and described it as a pure software business (and equivalent expressions).

Deloitte and the partners argued they had really, really, really tried to get Autonomy to back up the transactions and provide support that they could use, but well, you know, the “relationship” was too important to push too hard. So, it appears, the Deloitte partner agreed to write-up the support himself in the client’s name.

(Readers may recall PwC whistleblower Mauro Botta had made a similar allegation in his tip to the SEC and during his trial for retaliatory termination.)

The FRC investigation included this excerpt from some Knights emails:

On the evening of 13 October 2009, Mr Knights emailed [Autonomy] what he called a “draft of your TP42 paper” from his wife’s email account. He wrote in his email:

“after a glass or two of red wine and a plate ful of Mrs K medieval pasta i’ve had a stab at writing the Autonomy paper on TP42 – This needs to come form [sic] you to us.

I need it to sqaure [sic] the position on COGS allocation – i’ve still not seen anything from TP42.

If it is useless please re-write but hopefully it points in the right direction. As per our discussion on [an individual at Autonomy]’s ideas the paper goes through this analysis – you need to beef it up – the one key area is setting out quite what “sales and marketing” type of stuff or further product development stuff TP42 might provide you.

Please improve this and together with the TP42 email I’m hoping this will move to where it needs to be.

I do need to run through this with [the above individual at Autonomy] as well tomorrow.

As mentioned above this was rattled out pretty quickly and fortified with a few liveners so as a modest bookkeeper it would benefit from the cutting edge of you software gurus …..!!”

The email drips with sporty Britishisms that betray a pathetic deference to the client.  

The investigation report also says that Deloitte and its partners knew very well, based on their knowledge and documentation of the overall business environment, that Autonomy had enormous incentives to manage revenue and earnings. However, as in so many cases the end up in court, the auditors did nothing to audit more or better — to adjust the audit scope or tests — in the face of this higher fraud risk.

36. Deloitte knew that there was a risk that Autonomy might seek to overstate its revenue and was aware that analysts valued Autonomy based on its ability to grow revenue. For example, therefore, Deloitte recorded as the first of its external factors including key performance indicators in its Strategic Audit Planning for Q1 09 to Q3 09 words to the effect:

“Analysts value Autonomy based on its ability to grow revenue. They are concerned about operating profits but revenue has tended to be the main performance indicator in the past”.

37. Deloitte documented that Autonomy was under “considerable external pressure to meet revenue expectations” in each of the eight Interim Review Work Program documents prepared in the period Q1 09 to Q2 11.

38. Being a FTSE 100 company professing such exceptional results, Autonomy was subject to intense analyst interest and its share price was very sensitive to changes in both revenue and gross margins. Deloitte was aware of market expectations and the value of Autonomy’s share price. Thus, for example, it recorded in each of the Interim Review Work Program documents prepared in the period Q1 09 to Q3 09 that “The Group’s share price is extremely sensitive to changes in revenues which are outside market expectations.”

39. The extent of this sensitivity was apparent from, for example, the stock market’s reaction to Autonomy’s Q3 10 Trading Statement in which the company announced that it expected to “review [its] internal model for the full year with a revenue reduction of around 3% on current consensus and commensurate changes to other parameters.

On this basis, our internal model would show full year revenue growth of 17%, organic revenue growth of around 12% and year-on-year growth of profit before tax of approximately 20%.”

40. The share price immediately fell by 20%. This was described in an internal Deloitte email as the share price falling “off a cliff”. D10, Senior Manager on the audit engagement team, stated: “This [is] what a 3% revenue reduction to full year model does”.

Both Knights and Mercer, and Deloitte, asked for reductions in fines and sanctions based on their level of cooperation and contrition, which the FRC said was minimal considering they had all fought the proceeding at every turn. In particular, Knights sought relief based on the personal impact of the proceedings, including early retirement.

Thirdly, the FRC’s investigation and these proceedings have had a devastating effect on his personal and professional life. He describes this in some detail at paras 19 to 27 of his third witness statement. As a result of the investigation, he retired in July 2018, three years earlier than he had planned.

The investigation and the proceedings (over a seven year period) have been a “deeply hurtful, exposing and distressing experience, and a constant source of anxiety and stress”.

Fourthly, Mr Knights estimates that being forced to take early retirement will have reduced his pre-tax income between July 2018 and May 2021 (when he intended to retire) by more than £2 million. Moreover, he wanted to take on other work after leaving Deloitte, but he has found it impossible to do so in the light of these proceedings. He has not even been able to take on voluntary work, such as acting as a school governor.

The FRC Disciplinary Tribunal was not impressed.

We also refer to what Sir Thomas Bingham MR said in Bolton v Law Society [1994] 1 WLR 512 at 519B-F:

“Because orders made by the tribunal are not primarily punitive, it follows that considerations which would ordinarily weigh in mitigation of punishment have less effect on the exercise of this jurisdiction than on the ordinary run of sentences imposed in criminal cases.”

He said therefore that, unlike in a criminal context, it is not right in this context to put much weight on personal hardship as mitigation. The sanction is not imposed as punishment, but to protect the profession’s most valuable asset, its collective reputation.

He added: “The reputation of the profession is more important than the fortunes of any individual member. Membership of a profession brings many benefits, but that is a part of the price.”

Deloitte US and other Deloitte member firms played both sides of the fence with Autonomy – as its auditor in the UK and San Jose, as a vendor, and as a systems integration partner. I wrote in 2012 that, in my opinion, those activities pointed to several clear auditor independence violations.

EY continues as HPE auditor. Why would either of them give up such a mutually beneficial relationship?

KPMG faces many more battles — for example a £1.3 billion lawsuit by the receiver in the U.K. for Carillion collapse and in the U.S. to recover from its association with the Theranos fraud and the lingering practical and reputational damage of the KPMG-PCAOB scandal. That doesn’t seem to be putting a dent in its revenue generating machinery.

The Dig
KPMG’s rocky relationship with Banc of California
You may have heard about market ups and downs for Banc of California (BANC) because you saw the bank mentioned by Bloomberg on December 10, 2021, as an issuer the Department of Justice is reportedly investigating with regard to hedge funds and activist short-sellers…
Read more

PwC isn’t always the auditor, and isn’t trading places every year with Deloitte for the largest global firm by revenue spot anymore. (PwC lost the title in 2016.) When PwC is not the auditor it can provide lucrative advisory services like the Autonomy forensic investigation or the litigation support services mentioned during the trial of Elizabeth Holmes. For Theranos PwC was a well-paid “hired gun” that helped Elizabeth Holmes fend off regulators and litigation before her fraudulent company was shut down for good.  

The Dig
Elizabeth Holmes and her Big 4 audit firm buddies at Theranos
When auditors don’t look out for the public, everyone gets hurt. The injuries can be more than financial. The SEC’s chief enforcer Gurbir Grewal has been asking auditors to step up in almost every speech he’s made since joining the SEC six months ago…
Read more

Despite numerous reports of HPE and whistleblowers reporting the findings of fraud and lack of action by auditors and advisors to the SEC, the SEC and PCAOB never insisted on a restatement by HPE and hasn’t charged the firm or individual partners at Deloitte US, EY or KPMG with anything.

The FRC found that Deloitte and its partners failed to push back on how Autonomy hid its growing sales of hardware while claiming to be a software firm only, misallocated the costs of that hardware to misstate margins because they were selling the hardware at a loss, and hid the presence of side letters with third-parties related to marketing incentives paid to push sales to meet revenue goals.

That sounds a lot like the allegations that led to recent SEC enforcement actions against GE and Under Armour.

The Dig
A tale of two SEC enforcement actions, Part 1 – GE and Luckin Coffee
Part 1 is about the SEC’s enforcement action against GE, announced on December 9, 2020. Part 2, about Luckin Coffee, will follow. The SEC’s enforcement action and simultaneous settlement with GE was a classic case of the regulator downplaying actual accounting fraud by focusing on a lack of disclosure, instead…
Read more
The Dig
What do the Under Armour and GE SEC settlements tell us about trends in accounting fraud ?
Highly anticipated US Securities and Exchange Commission enforcement actions against Under Armour this past week and GE last December spotlight a negative trend for investors that started, in my opinion, right after the financial crisis: The SEC is more often prosecuting what looks like manipulation of financial activity and accounting to meet analyst e…
Read more

Oh, wait! The SEC didn’t charge GE and Under Armour auditors KPMG and PwC with anything in those cases either!

And the Big 4 continue to thrive, in particular in the US and UK.

[2021] is the strongest collective result since the Enron scandal led to the collapse of Arthur Andersen in 2002 and reduced the Big Five to the Big Four. The strong earnings come despite continued criticism of the structure and performance of the firms, especially in audits, including scrutiny of EY’s failure to identify fraud at Wirecard.

Postscript: In another example of failing up, Meg Whitman became CEO of media start-up Quibi after leaving HPE in November of 2017. Quibi shut down less than a year after launch despite $1.75 billion of initial investment raised by Whitman and Jeffrey Katzenberg. Roku bought the exclusive global distribution rights to the Quibi portfolio in early 2021. Financial terms were not disclosed, but Deadline reported the valuation is understood was less than $100 million. On December 8, 2021, Joe Biden nominated Meg Whitman to serve as United States ambassador to Kenya.

© Francine McKenna, The Digging Company LLC, 2022

0 replies

Leave a Reply

Want to join the discussion?
Feel free to contribute!

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.