Summary

  • Resolution 201401.199, grouped in AFRINIC’s Board register under June 2014, said Ernst & Young had audited the company since inception and recommended KPMG after an Audit Committee RFP, shortlist and selection exercise. Rotation was presented as best practice, but the Board’s act was a recommendation, not the ordinary annual appointment.
  • Registered Members and Resource Members held the appointment power under article 7.6(vii). At the 2014 AGMM they challenged a proposed 2015–2017 term, amended it to preserve annual appointment, and passed AGMM201402-03 without objection, appointing KPMG for 2015 and to audit the 2014 financial year.
  • KPMG’s resulting work supplied reasonable assurance about material misstatement in AFRINIC’s financial statements. It did not provide a universal opinion on internal-control effectiveness, registry operations, governance or every institutional act, and it did not turn either the auditor or AFRINIC into a public authority.
  • Rotation is credible when the reason, criteria, conflicts, independence, term, fee, scope, opinion, committee response, corrective ownership and next appointment can be followed over time. A new name alone may refresh appearances while leaving the actual control untested.

A June decision, and a verb that limits it

In June 2014, AFRINIC’s published Board register recorded Resolution 201401.199. Its recitals described an unusually long relationship: Ernst & Young, the entry said, had audited AFRINIC since the organisation’s inception. The Board recognised rotation of auditors as best practice. It also recorded that the Audit Committee had conducted an RFP, shortlist and external-auditor selection process. On that foundation, the resolution recommended KPMG for appointment to replace Ernst & Young for AFRINIC’s financial audit.

The concrete change was therefore clear. An incumbent identified by AFRINIC as having served from the beginning was to give way to a new firm. The public rationale was also clear enough to be tested: rotation, rather than an accusation against the incumbent. And the institutional reason for caring was practical. Members depend on accounts to understand how a private technical coordinator represents dues, reserves, liabilities, expenditure and financial performance. Independent assurance cannot make those judgements for members, but it can reduce the risk that decisions are made against materially misstated financial statements.

Yet the most important word in the resolution is not “KPMG” or “rotation.” It is “recommend.” The Board did not, through that resolution alone, complete the ordinary annual appointment. The then-effective bylaws put that act in the hands of Registered Members and Resource Members at the Annual General Members’ Meeting. KPMG, once appointed, would in turn express a bounded private-company financial opinion. It would not become an all-purpose examiner of AFRINIC, and the Board would not become the final owner of a power the bylaws assigned annually to members.

That distinction keeps a modest corporate control at its proper scale. It also makes the control more interesting. The value of the 2014 change lies in a sequence of separate decisions: the Audit Committee searched and selected; the Board recommended; members appointed; management prepared the accounts and maintained the controls it considered necessary; KPMG performed audit procedures and gave an opinion; the committee reviewed the result; and members faced the appointment question again. Compress those acts into “AFRINIC appointed a new auditor” and the sentence becomes easy to read but institutionally wrong.

The authority chain was designed to be visible

Article 7.6(vii) of the 2012 bylaws gave Registered Members and Resource Members the right to appoint the company’s auditor by ordinary resolution at each AGMM, with the appointment running until the conclusion of the next AGMM. The annual rhythm is not a decorative detail. It prevents an initial choice from silently becoming an indefinite mandate and gives members a recurring point at which to consider independence, work quality, cost, scope and follow-through.

The bylaws also contained a different provision. Article 15.3(v) allowed the directors to fill a casual vacancy in the office of auditor. That power answers a continuity problem: what happens if the office unexpectedly becomes vacant between the ordinary annual decisions? Nothing in the available record establishes that Resolution 201401.199 concerned such a vacancy. The exception therefore cannot be used to transform a Board recommendation in the normal appointment cycle into the appointment itself.

This separation is more than legal grammar. A committee can do concentrated work that a general meeting cannot efficiently perform. It can contact firms, receive material, form a shortlist and compare offers. A board can examine that work and decide what recommendation it is prepared to defend. Members can then decide whether to confer the annual office on the proposed firm. The auditor, finally, must exercise professional judgement in an engagement whose subject and limits are its own. Each actor can inform the next without swallowing the next actor’s role.

The 2014 AGMM record shows that this was not merely a neat chart of responsibilities. The RFP was sent to 44 audit firms. The proposed sequence was to offer the engagement first to KPMG, then to PwC, and then to Ernst & Young if agreement could not be reached with the firms ahead in that order. That is useful evidence of reach and a preferred sequence. It does not disclose the other recipients, the full shortlist, the evaluation criteria, the firms’ responses, their proposed fees, conflict checks or the reason for each ranking.

“Sent to 44” is a fact; “fair,” “open,” “independent” or “best value” would require evidence the number alone cannot supply.

Nor did the meeting simply receive a finished decision. The initial resolution proposed that KPMG be appointed for 2015 through 2017 and audit the 2014 financial year. Members challenged the multi-year duration against the bylaw requirement for appointment at each AGMM until the next. The minutes record Alan Barrett agreeing that article 7.6(vii) required annual appointment. The proposed text was amended. AGMM201402-03 then passed without objection, appointing KPMG as external auditor for 2015 and to audit the 2014 financial year.

The difference between proposal and adoption is decisive. KPMG was not granted the proposed 2015–2017 term. Members corrected the duration before approving the resolution. The record does not provide the electorate denominator, a full attendance roll or individual votes, so “without objection” should not be inflated into a claim about every eligible member’s personal support. But it does establish that the final wording preserved the annual appointment principle. The following AGMM approved the minutes of the 6 June 2014 meeting as presented, even though the retrieved 2014 document itself remains labelled as draft minutes.

This moment makes the governance control concrete. Member authority was not honoured merely by placing a name before the meeting. It had substance because members could test the term against the bylaws and change it. The amendment did not overturn rotation; it fitted rotation into the constitutional cadence. A new auditor could be tried without allowing the first appointment to remove the next year’s decision.

Rotation is a hypothesis, not proof

The strongest case for rotation begins with familiarity risk. A firm that has worked with the same organisation for many years may accumulate valuable knowledge of systems, accounting choices and recurring weaknesses. Yet longevity may also dull surprise. Assumptions become inherited. Explanations that once required evidence can become familiar stories. A new firm can revisit those assumptions, ask elementary questions without embarrassment and bring different professional judgement to the same statements.

That is why AFRINIC’s stated reason was plausible. If Ernst & Young had audited the company since inception, as the Board register recited, a change could create a useful break in continuity. The preceding report confirms Ernst & Young as the immediate predecessor: its independent auditor’s report on AFRINIC’s 2013 financial statements was dated 1 June 2014. The record, however, does not justify a conclusion that the firm was dismissed for cause, that its work was deficient or that its relationship with AFRINIC was improper. Rotation can be worthwhile without being an accusation.

A new firm also brings costs. It must learn the organisation, understand the accounting environment, identify relevant controls and distinguish genuine anomalies from unfamiliarity. Management and staff must spend time explaining processes that the incumbent already knew. Transition can delay work or shift attention away from deeper testing. A higher fee may reflect that burden, a different scope, market pricing or something else. No sound judgement can be made from the logo or price alone.

So rotation is best understood as a governance hypothesis: changing the firm may improve independence and renew scrutiny. The hypothesis becomes credible only when the engagement produces reviewable evidence. Were objective selection considerations used? Were conflicts addressed? Was the firm’s independence stated? Was the term valid? What work was commissioned? What fee and non-audit services were involved? What opinion followed? How did the Audit Committee respond? Who owned any corrective action, on what timetable? What did members decide at the next annual appointment?

The 2014 chain answers some of those questions and leaves others open. It gives a tenure rationale, an RFP recipient count, a selection sequence, a Board recommendation, a member resolution, a term, a reported fee, the auditor’s stated independence, the engagement’s general scope and the financial opinion. It also provides immediate evidence of committee review and a subsequent member decision. It does not publish a full tender file, all conflict checks, the engagement letter, possible non-audit services or detailed reasons for later choices.

That mixture is normal enough to resist two opposite mistakes. One is to treat every undisclosed document as evidence of misconduct. The other is to treat the visible change of firm as proof that independence was achieved. The honest conclusion sits between them: AFRINIC activated a recognisable control, and the public record permits meaningful but incomplete testing of how that control worked.

What KPMG actually assured

The 2014 annual report closes an essential part of the loop: KPMG did perform the financial-statement audit. The report identifies the firm as auditor for the year and records a USD 10,000 audit fee for 2014, compared with USD 5,000 for 2013. The doubling is relevant to member oversight because price belongs in any assessment of an appointment. It is not self-explanatory. Without like-for-like scope, bids, staffing and engagement terms, the figures do not prove overcharging, waste, better work or worse value.

The opinion also needs to be read according to its stated subject. KPMG sought reasonable assurance that the financial statements were free from material misstatement. “Reasonable” is not absolute assurance, “material” does not mean every error, and “financial statements” does not mean every function of the organisation. The auditor obtained evidence, assessed relevant risks and considered internal control for the purpose of designing appropriate audit procedures. It expressly did not use that consideration to give an opinion on the effectiveness of internal control as a whole.

KPMG expressed a true-and-fair-view opinion on the 2014 financial statements under IFRS and the requirements of the Mauritius Companies Act. It also stated that it had no relationship with or interests in AFRINIC other than as auditor. Those are consequential statements. They give members an external professional view on a defined financial presentation and a disclosed assertion about the firm’s relationship. They do not certify every registry entry, operational choice, governance process, personnel decision or act by AFRINIC.

Management responsibility did not migrate to the auditor. AFRINIC’s directors were responsible for preparing and fairly presenting the financial statements and for such internal control as they considered necessary. KPMG was responsible for the audit procedures and its opinion. That division matters whenever an audit is invoked as a halo around the entire organisation. An auditor does not run the company by inspecting its accounts; management does not become independent merely because an outside firm checks a defined presentation.

It follows that “the accounts received a true-and-fair-view opinion” and “all internal controls were effective” are not equivalent statements. Neither are “KPMG reported no other relationship” and “every potential independence question across the selection and engagement was publicly documented.” The first proposition in each pair is supported by the report. The second exceeds it. Careful governance analysis respects what an assurance instrument says even when a broader conclusion would be rhetorically convenient.

The audit’s boundary also protects the usefulness of the opinion. If a financial audit were routinely described as certification of every organisational act, any later disagreement about an unrelated matter would seem to discredit the audit. That would be unfair to the engagement and unhelpful to members. A bounded opinion can be strong precisely because it does not pretend to resolve everything. Its value lies in disciplined confidence about a defined set of statements.

A private coordinator, not a public authority

AFRINIC’s importance to network operators does not change its institutional character. It is a private technical bookkeeper and coordinator. It is not a sovereign, government, legislature, regulator, police force, prosecutor, punishment authority, confiscator or court. Its records and coordination functions can have serious operational consequences, but practical dependence is not the same thing as public-law jurisdiction.

That boundary matters in an article about external audit because the language of “oversight” can quietly expand. KPMG was a private assurance provider engaged to audit financial statements. It was not a regulator, prosecutor, punishment authority or court. Its opinion did not license AFRINIC to police or punish others, and AFRINIC’s engagement of an auditor did not convert the company’s own coordination role into sovereignty.

The right way to connect financial assurance to operational stakes is narrower. Members, staff, suppliers and network operators benefit when a coordinating institution’s financial position is represented consistently and subjected to independent examination. Credible accounts can reduce uncertainty about continuity. They can help members decide whether governance bodies are stewarding dues and reserves responsibly. But the assurance supports confidence in private coordination; it does not confer authority over states, networks, operators, routing or number resources.

This scale is especially important when examining a board resolution. The Board’s published act concerned AFRINIC’s own financial-accountability machinery. It did not make law for Africa. It did not create an investigative jurisdiction over network operators. It neither seized nor adjudicated anything. Resolution 201401.199 is worth close attention because even a private bookkeeper needs well-designed controls, not because the resolution was an exercise of public power.

Six acts that should never be collapsed

The 2014 rotation becomes easier to assess when divided into six acts. First came selection. The Audit Committee conducted the RFP, shortlist and selection work and recommended an order of firms. Selection is a comparative process, not a legal appointment. Its quality depends on the relevance of criteria, the handling of conflicts, the information supplied to bidders and the reasons supporting the preferred sequence.

Second came recommendation. The Board accepted the committee’s work and recommended KPMG to replace Ernst & Young. A recommendation bears responsibility: directors should be able to explain why they support it. But it leaves the formal decision with the organ authorised to make it. Resolution 201401.199 should therefore be read as a bridge from committee work to member choice.

Third came appointment. Registered Members and Resource Members exercised the article 7.6(vii) power through AGMM201402-03. Their amendment of the proposed duration is not a procedural footnote. It proves that appointing authority included the power to shape the term and that annual member control had practical effect. The appointment was for 2015 and covered the audit of the 2014 financial year; the discarded multi-year wording was not the decision.

Fourth came the engagement. An appointment names the office holder, while the engagement defines what the firm is to do. Scope, standards, timing, access, fee arrangements and non-audit services affect whether the arrangement is capable of supplying independent assurance. The available report establishes the financial-statement subject and relevant standards, but the engagement letter and negotiation record are not public in the materials considered here.

Fifth came audit work and opinion. KPMG gathered evidence and expressed its view on the statements. The report’s consideration of internal control served audit planning, not a separate verdict on all control effectiveness. This is the stage at which professional independence and judgement have operational meaning. Yet even an unmodified opinion cannot answer questions outside the engagement.

Sixth came review and reappointment. The Audit Committee could evaluate whether the engagement delivered what the company and its members needed. It could identify dissatisfaction, seek further work and recommend what should happen next. Members, however, retained the annual appointment decision. Review without ownership of follow-through becomes commentary; reappointment without review becomes habit. The control needs both.

These acts create useful friction. No single corporate organ owns the whole story. The committee’s preferred firm does not appoint itself. The Board’s acceptance does not cancel member authority. Members’ appointment does not dictate the auditor’s opinion. The opinion does not absolve management of responsibility. The committee’s later assessment does not predetermine the next member vote. This distribution can be slower than a single command, but the slowness is part of the safeguard.

Immediate feedback from the next annual cycle

The 2015 AGMM record provides a narrow but important test of the 2014 design. It records Audit Committee dissatisfaction with the 2014 financial statements and a proposal to give KPMG 60 additional days to produce a more satisfactory report. It also records a committee recommendation to appoint Deloitte for 2015. Members ultimately approved KPMG’s reappointment for 2015 and extended the timetable concerning the 2014 statements.

That sequence should be stated without embellishment. Deloitte was recommended but was not appointed in that vote. KPMG was reappointed. The record does not fully explain why members chose that course despite the committee’s recommendation, and dissatisfaction does not establish professional negligence or liability. The additional time does not, by itself, identify whose action or inaction caused the concern.

What the sequence does prove is that the rotation was not self-validating. A new firm could be assessed, questioned and considered again. The Audit Committee did not have to treat the KPMG name as the completion of its work. Members did not lose their appointment authority because the Board had favoured KPMG the year before. The exact result may invite further explanation, but the presence of review, recommendation and member choice demonstrates why their separation mattered.

This immediate feedback also discourages a simplistic narrative in either direction. It does not prove that the 2014 Board choice was wrongful, concealed or invalid. Nor does the eventual KPMG opinion prove that every concern was unfounded. The defensible reading is more useful: an auditor change begins a cycle of assurance; performance evidence, committee response, deadlines and the next appointment determine whether that cycle remains credible.