My first engagement as an audit trainee with KPMG (now Grant Thornton) was a bank reconciliation. Not a system, not a policy-a reconciliation. My supervisor sat with me until every tambala tied out, and when one didn’t, we did not move on. We stayed with it until we knew whether it was a timing difference, a posting error, or something that needed to go into the management letter. That was the entire lesson, repeated for months across client after client: find the variance, explain the variance, do not let the variance go quiet.
Years later, in a donor-funded public finance management programme, I sat in a government reconciliation meeting where a materially larger variance was raised, discussed for perhaps four minutes, and then “carried forward to the next quarter.” Nobody in that room was negligent. Several people in it were technically as capable as the teams I had worked alongside in private practice. The forms were right. The IFMIS printouts were right. The variance simply had nowhere to go.
That gap, between technical competence and consequence, is the thing PFM training has never quite been able to export, no matter how well-designed the curriculum. I saw the gradient of it firsthand, across engagements that ran from fully private, through donor-linked, to fully public.
The market disciplines you immediately.
At Kawalazi Tea Estate, stock verification meant walking the factory floor and the withering lofts with the estate manager, weighing sheds, and reconciling made tea to the ledger before we left the site. A variance there was not an abstraction to be minuted; it went straight into cost of sales, and cost of sales went straight into what the shareholders saw. There was nowhere for a discrepancy to hide, because the estate’s own management wanted it found before the auditors did.
At Opportunity Bank and at Blue Financial, the discipline came from a different direction: loan book testing against IFRS 9 provisioning, ageing analyses on arrears, and disbursement files checked against collateral documentation. A qualified view on provisioning adequacy does not sit quietly in a file. It moves the bank’s reported capital position, and the regulator reads it within the reporting cycle, not within someone’s political term. Management fought hard over provisioning judgements precisely because the number mattered to people outside the room.
Chipiku Stores taught the same lesson from the retail side. Multi-branch stock counts and cash reconciliations exist because shrinkage is a direct, unhidden hit to profit, and because a store manager whose branch keeps producing unexplained variances has a career problem, not a training gap. The incentive to resolve a variance quickly did not need to be designed into the engagement. It was already sitting there, built into who owned the loss.
Where the discipline starts to thin.
CHAM sat closer to the public sector than any of the commercial clients, and the shift was already visible there. Grant compliance testing under donor funding is real, technically rigorous work, but the consequence of a finding runs through a donor relationship and a subsequent reporting cycle, not through a market reaction inside the same quarter. The finding still mattered. It simply travelled more slowly, and through more hands, before it changed anything.
By the time I was working inside government-facing PFM programmes, that chain had stretched almost to nothing. An Auditor General’s report can carry the same rigor as a KPMG management letter and land in a Parliament session where it is tabled, referenced, and moved past. Nobody downstream is pricing risk against it the way a bank prices risk against a qualified audit opinion. The finding is correct. It simply has no bill attached to it.
Two different relationships with the client.
Private-sector audit is, structurally, an adversarial relationship dressed as a professional one. The client wants a clean opinion; the auditor’s value depends entirely on being willing to withhold it when the evidence does not support one. PFM capacity building is built on the opposite relationship; the trainer needs the ministry’s continued cooperation to deliver the next module and the next workshop. Professional scepticism, the instinct to keep asking “how do you know that” until the answer holds, is a wonderful thing to teach in a classroom and a genuinely difficult thing to practise inside a relationship that depends on the other party’s goodwill.
Audit training also teaches materiality and risk-based sampling: direct scarce assurance effort at what would actually change a reader’s decision, and say nothing further about what would not. PFM capacity building, across the government programmes I have been part of, tends to spread evenly instead; every ministry gets the same modules and the same IFMIS refresher, regardless of where the actual risk sits, because a training programme has to be defensible to a donor board on the basis of coverage rather than on the basis of where the money was most likely to leak.
A live test case
As I finish this piece, that gap is playing out in real time. The National Audit Office’s letter of 2 July 2026 to the National Local Government Finance Committee flagged that of the local government authorities whose accounts it audited for the year ended 31 March 2025, unqualified opinions could not be obtained for the large majority. Nine councils received qualified opinions, and others drew disclaimers, the most serious finding an auditor can issue, meaning the accounting weaknesses were severe enough to prevent forming an opinion at all. The categories of irregularity read like a standard substantive-testing programme: roughly K807.5 million in funds transferred to untraceable sources, K752.5 million in unauthorised transfers between councils, K476 million tied to missing payment vouchers, K245.6 million in unsupported payment vouchers, K219 million in unauthorised transfers from council fund accounts, and K32.5 million that went to personal bank accounts. Across the councils under question, the sums in dispute totalled roughly K5.1 billion. This is exactly the kind of finding my KPMG training taught me to chase down to the tambala, and exactly the kind that, in my own public-sector experience, tends to get minuted and carried forward.
What makes this a live test rather than just another confirming anecdote is that the councils in question sit inside the World Bank-funded Governance to Enable Service Delivery programme, and a second tranche, roughly K140 billion, is being disbursed even as this audit lands. A governance watchdog, the Centre for Social Accountability, has publicly called for the affected councils to be subjected to stricter accountability measures, and the Ministry of Local Government signed a memorandum of understanding with the Anti-Corruption Bureau last month specifically to strengthen fraud prevention in this space. Whether that translates into consequences that actually reach back to the K5.1 billion already in question, disbursement conditions, individual accountability, a disbursement pause, or whether it settles into the familiar pattern of a competent report that changes nothing, is not yet decided. I would rather be wrong about the pessimistic reading of this piece than right about it, and this is as good a case as any to watch.
What I would actually import.
None of this is a criticism of the people doing the training. Several of the frameworks I encountered in government and donor-funded work were, on paper, better designed than what I saw in private practice. What was missing was never technique. It was the thing technique was always downstream of: a consequence that follows the finding home.
If I had to name the one thing worth transplanting from Kawalazi, Opportunity Bank, Blue Financial, and Chipiku Stores into public financial management, it would not be another training module. It would be the wiring between finding and consequence, tying audit findings to disbursement conditions rather than to a compliance report that few people outside the sector read, and protecting the official who raises the uncomfortable variance, so the professional-scepticism instinct we spend months building in trainees does not have to be unlearned the moment they move into public service.
Training builds capacity. It has never, on its own, built consequence. Until Malawi’s PFM reform agenda treats that distinction as the actual problem, rather than assuming better forms and more workshops will eventually close the gap, audits will keep finding the same variances, competently, and carrying them forward. The GESD audit now sitting on the National Local Government Finance Committee’s desk is as good a place as any to find out whether that is still true.
Leave a Reply