FRC fined Deloitte £6.05M over audits that missed Go-Ahead keeping £30M of public money

On 8 October 2026 the FRC's Executive Counsel imposed sanctions on Deloitte LLP over the statutory audits of Go-Ahead Group plc's consolidated accounts for FY16 to FY20. The sanctions: a £6,050,000 penalty — discounted from £11 million by 10% for exceptional cooperation and 35% for admissions and early disposal — plus a severe reprimand, a declaration that the FY16–FY20 audit reports did not satisfy the Relevant Requirements, and an order to deliver a root-cause report to its Firm Supervisor. A separate investigation into the FY21 audit was closed in December 2024 without action.

The breaches centred on three rail subsidiaries. London & South Eastern Railway had received erroneous overpayments from the Department for Transport under a franchise agreement and kept the money, releasing £2.4 million of accruals to profit in FY16 and accruing a further £27 million from FY16 to FY20 without telling the DfT — evidence even suggested an intent to release the second franchise's overpayments if undetected.

Sister company London & Birmingham Railway released £5.6 million of undisclosed DfT accruals to profit in FY20 and worded the accounts note to disguise it. When the DfT discovered the conduct in 2021 it refused to renew the franchise and fined LSER £23.5 million.

The third subsidiary, Go-Ahead Bayern, flipped during the FY20 audit from an €8 million projected loss to a €3 million positive value after Go-Ahead supplied different information; Deloitte applied insufficient scrutiny to the change and insufficient oversight of its German component team. The €8.1 million provision eventually booked was restated in FY21 to €49.5 million — more than €40 million higher. Executive Counsel Penrose Foss called it 'a highly concerning pattern of failure' that put very large amounts of UK taxpayers' money at risk.

A £6,050,000 penalty (discounted from £11M), a severe reprimand, and a declaration that the FY16–FY20 audit reports did not satisfy the Relevant Requirements.

Deloitte failed to enquire sufficiently into LSER and LM, failed to apply sufficient professional scepticism, and failed to evaluate evidence pointing to fraud risk factors.

The firm did not appreciate that Go-Ahead was contractually obliged to act in good faith — the very obligation that required LSER to disclose the DfT overpayments.

When the Bayern contracts swung from an €8 million loss to a €3 million positive, Deloitte accepted the new explanation without securing sufficient appropriate audit evidence.

The breaches persisted across five audit years, all on matters Deloitte itself had identified as significant audit risks — repetition, not a one-off slip.

Professional scepticism is the product an auditor sells: when management's story flatters the numbers, unchallenged accruals and revised valuations turn a clean opinion into a public sanction.

Deloitte's penalty reflects a 45% total discount for cooperation and early admission, and it paid the investigation costs on top. The underlying conduct was already public from the DfT's side: the franchise was stripped and the overpayments clawed back in 2021 (see southeastern-undeclared-funding-franchise-stripped-2014). The sanction adds a UK audit enforcement to the firm's run of audit failures recorded in this archive, from Hong Kong and China to Kenya and India's Zee.