Year after year, the auditor-general’s certificate on Tabung Haji’s accounts carried an important caveat about the scope of its audit: “Not every company beneath the pilgrims' fund had been audited by the auditor-general.”

Tabung Haji sat at the top of a sprawling corporate family spanning plantations, property, hotels, construction, marine businesses, and investments overseas.

Those companies’ accounts fed into the group’s financial statements, but an audit of the group did not necessarily mean the auditor-general examined every company beneath it.

A royal commission of inquiry into Tabung Haji's operations from 2014 to 2020 identified problems involving investments, accounting, and companies within the fund’s wider ecosystem, and recommended forensic audits into 14 investments.