Can you show an auditor which contract term a rule enforces?

On 8 October 2026 the UK’s Financial Reporting Council fined Deloitte £6.05 million over its audits of Go-Ahead Group for the financial years 2016 to 2020. Two Go-Ahead rail subsidiaries had received erroneous overpayments from the Department for Transport and, instead of returning them, recorded them as profit. The fine was cut from £11 million for Deloitte’s cooperation and early admissions¹.

The regulator did not say the arithmetic was wrong. It said Deloitte overlooked key aspects of the contractual relationship between the railways and the Department, and failed to recognise that Go-Ahead was obliged to act in good faith, which for one subsidiary meant telling the Department about the overpayments¹.

What did the auditor miss?

A contract term. Somewhere in the franchise agreements was an obligation about overpayments. Somewhere in the finance systems was a treatment of them: keep it, book it, report it as profit. Nobody tied the two together, and the treatment ran through five years of audits¹.

Deloitte has said it regrets that aspects of its audit work did not meet the standards expected¹². The FRC called it “a highly concerning pattern of failure … to apply sufficient scrutiny”¹.

Is that an auditor problem or a company problem?

Both. The auditor is the one fined, but the question it failed to ask is one the company should be able to answer first. For a given rule in your billing, payments or revenue code, which contract term does it enforce, and who agreed that it does?

Most companies cannot answer quickly. The contract sits with legal. The rule sits in code. The person who connected them did it once, in a meeting or a ticket, and may have left since. What survives is the behaviour, not the obligation behind it.

Where does the link between contract and rule break?

• When the contract is signed. Terms are negotiated by one team and implemented by another. The handover is a summary.
• When the rule is written. The code records what to do, not which clause required it.
• When either side changes. A contract is amended or a rule is edited, and the other side never hears.
• When the owner moves on. The one person who knew why a treatment was correct is gone, and the treatment keeps running.

What would an auditor accept?

Not “the system has always done it this way”. An inspector wants, for each rule that moves money: what it does, the contract or policy it comes from, who owns it, who approved it, and when it last changed. Where any of that is missing, they want the gap stated, not smoothed over.

AppThentic keeps that record. For each rule, Organization Memory holds the reason, the owner, the approval date and every change since, with evidence links to the PR, ticket or document behind each answer. A rule with no owner or no approved reason is listed as exactly that. A rule whose code changed after approval is flagged until its owner confirms it again, so an approval never quietly outlives the rule it covered. See Audit and compliance.

What can you do this week?

Pick the five rules that decide what you charge, refund or retain. For each, write down the contract term or policy it implements and the person who would defend it. Any rule you cannot link, or whose linked person has left, is the one an auditor will find first.

Sources