What Small Businesses Can Learn From Germany's Largest Accounting Scandal

Why a corporate scandal matters to small businesses

A listed payment services company and a trade business with 20 employees are worlds apart: supervisory board, statutory auditors, financial regulator, analysts. Yet both face the same basic question. Who checks whether a figure is correct, and by what route does the evidence reach them?

The collapse of Wirecard AG in June 2020 is the best-known German case for studying this question. In a commentary, Teichmann, Boticiu, and Sergi (2024) call it the biggest accounting fraud in Germany's post-war history and stress that the allegations had been known for years. This article therefore asks: What can a small business learn from this case, even though it has neither a stock listing nor a supervisory board?

To answer it, we first summarize the documented facts, then present principal-agent theory as the thinking model, go through the links of control one by one, and weigh two readings. At the end are five rules for your own business. The decisive week is described in detail in Chronicle of an Accounting Scandal.

What happened in June 2020, in a few sentences

On June 18, 2020, the auditor EY stated that it had not obtained sufficient audit evidence for bank balances of around 1.9 billion euros held in trust accounts. On June 22, the management board declared in a mandatory disclosure to the capital market that these balances in all likelihood do not exist. On June 25, the company filed for insolvency, the first member of the DAX index to do so.

The balances came from the so-called third-party partner business. In countries without a license of its own, partner firms were supposed to process payments and pass on commissions, and the proceeds were allegedly held by a trustee. A trustee manages money in its own name on behalf of someone else. For the auditor this means it sees no account of the company, only a third party's confirmation.

Much has happened since. The German parliament set up a committee of inquiry, the Financial Market Integrity Strengthening Act (FISG) tightened the rules for auditors and supervision in 2021, and the 2017 and 2018 financial statements were declared void by a court in 2022. In April 2023, the audit oversight body APAS imposed a fine of 500,000 euros on the audit firm and a two-year ban on new mandates at public-interest entities. The criminal trial of former CEO Markus Braun and two other defendants has been running since December 2022. Markus Braun denies all charges.

The thinking model: a chain of agency relationships

Principal-agent theory describes what happens when someone acts on behalf of someone else. A principal, such as an owner, engages an agent, such as management, to act in the principal's interest. Because the agent knows more and has goals of its own, the principal needs oversight. This need not lead to misconduct, but it opens up the possibility.

In a corporation there is not one such relationship but a chain. Shareholders engage the supervisory board to oversee the management board. The supervisory board engages the auditor. The regulator is meant to protect the market. Each link is itself an agent with its own incentives, and each knows less than the link it controls. I call this the control chain.

An analogy makes the situation tangible. Imagine a bucket brigade fighting a fire. Everyone passes the bucket on and trusts that the person before them filled it with water. If the first bucket is empty, it stays empty, no matter how many hands pass it along. A control that only passes on what it received adds no assurance.

A control chain is no stronger than the link that last looked for itself.

Where the individual links gave way

The following points are based on official findings, reports from the special investigation, and the professional literature. They describe weak points of control, not the guilt of individuals.

1. Management board and internal control

   According to the case study by Bloch, Hunter, and Kleinman (2025), a consulting firm engaged by the company found after the first newspaper reports that internal controls for the business with third-party partners were practically non-existent. According to the authors, almost half of the transaction volume ran through such partners in 2018.

2. Supervisory board

   In October 2019, the supervisory board commissioned KPMG to carry out a special investigation. The report of April 2020 stated that material revenues from the third-party partner business for 2016 to 2018 could not be verified. Until then, the board had worked mainly with information from the management board.

3. Auditor

   EY audited the financial statements from 2009 to 2018 and issued unqualified opinions. Since then the debate has been whether balance confirmations were obtained directly from the banks or came via the trustee. According to the account by Bloch, Hunter, and Kleinman (2025), which draws on the KPMG report, the auditor communicated with the trustee rather than with the banks. APAS sanctioned the audit firm in 2023. EY stated that there were clear indications of an elaborate fraud involving multiple parties around the world.

4. Financial regulator

   BaFin supervised only the group's own bank, not the group itself. In February 2019 it banned new short positions in the share for two months, and in April 2019 it filed a criminal complaint against journalists. That investigation was dropped in September 2020.

What stands out is how similar the weak points are. Each link relied on information that passed through the audited company or its partners. And criticism from outside was long fended off rather than examined. How auditors and audited companies manage their public image after such cases is studied by Dunne, Brennan, and Kirwan (2021) under the term impression management, the deliberate shaping of the impression others form. Recurring messages are: we are not to blame, our hands were tied, our work was good. Deny, justify, deflect covers this in more detail.

Two readings: deception nobody could stop, or controls that did not look?

Both readings have documented elements, and they do not exclude each other. One principle applies to the assessment: negligence is not intent. A civil judgment by the Munich Regional Court of September 2024 shows what this distinction looks like in practice. The court ordered Markus Braun and two other former board members to pay damages of 140 million euros to the company because a loan of 100 million euros had been granted without collateral and an investment made without thorough review. It found at least negligence. The judgment is not final.

I consider the second reading the more instructive one, without playing down the first. Who deceived is for the criminal court to decide. For an owner, the question that matters is the one they can influence: would my controls still work if someone were deliberately deceiving me? A control that only works when everyone involved is honest is a habit, not a control.

Why the damage was so much larger than the missing amount

The missing amount was large, the total damage a multiple of it. Claims of 15.4 billion euros were registered in the insolvency proceedings, of which around 8.5 billion euros were damages claims by shareholders. They are set against an estate of around 650 million euros.

The reason is simple: with one figure, trust in all the others disappeared. Banks called in loans, partners left, the market value dissolved. These mechanics apply on a small scale just the same. If a bank discovers a false item at a mid-sized business, it will examine every other item with suspicion afterward. Why trust weighs so much as an economic factor is described in Trust as an economic factor.

Five rules a small business can adopt

From the control chain and the findings I derive five rules. They cost little and address exactly where the case was vulnerable.

1. Obtain evidence at the source. You read account balances with your own access directly at the bank, confirm receivables directly with the customer, and have someone count stock in person. The confirmation test from Chronicle of an Accounting Scandal asks about source, route, and cross-check.
2. Separate roles. Whoever prepares a figure does not confirm it. Whoever orders does not pay alone. How this works without corporate machinery is described in Corporate governance for small businesses.
3. Treat criticism as information. Judge a warning by its content, not by the motive of whoever gives it. A protected reporting channel helps, as Whistleblower protection shows.
4. Examine incentives. Wherever pay, reputation, or financing depends on a figure, that very figure needs a second view.
5. Do not tie control to trust. Do not only check those you distrust, but everyone on a fixed schedule, including yourself and long-standing partners.

What carries over and what does not

The case has changed rules: auditor independence has been regulated more strictly since the FISG, as How independent are auditors? shows, and BaFin has more powers. The basic lesson is older than any law, though: where a control only passes on what the audited party supplies, it does not control. The same pattern appears in other major cases, as Patterns of accounting scandals describes.

The limits of this assessment are clear. Many details come from special reports, the press, and case studies, not from final judgments. The case study by Bloch, Hunter, and Kleinman (2025) was written for teaching and draws on press reports. Applying it to small businesses is an assessment: a trade business has no trust accounts in Asia, but it does have figures it believes only because someone else confirms them.

Conclusion: what the case teaches a small business

To the guiding question: above all, a small business can learn from the case how control fails when it relies on evidence that passes through the party being checked. Principal-agent theory explains why every link in a control chain has its own incentives and less knowledge. Whether anyone deceived, and who, is a matter for the courts; the presumption of innocence applies to everyone involved until a final judgment.

For your business, the lesson comes down to a habit that costs little: obtain important evidence yourself at the source, separate roles, and treat uncomfortable questions as information. Trust remains the foundation of every business. It should simply not replace control but rest on it.

• Note the five largest items on your latest balance sheet and record for each who confirms it and by what route.
• Make sure you have your own read access to all business accounts.
• Obtain a balance confirmation directly from the customer for the three largest receivables.
• Check whether one person prepares, confirms, and passes on figures, and separate the roles.
• Set up a channel through which employees can raise concerns without disadvantage.