BANK FINANCIAL DISCLOSURES:

Report to the Committee on Financial Services, House of Representatives

September 2026

GAO-26-107719

United States Government Accountability Office

A report to the Committee on Financial Services, House of Representatives

Contact: Michael Clements at ClementsM@gao.gov

What GAO Found

Congress and the Securities and Exchange Commission (SEC) require public companies to disclose information that investors would find important when making investment decisions. Disclosures include an annual audited financial statement and a description of risk factors and financial performance. Accounting firms that audit public companies must register with the nonprofit Public Company Accounting Oversight Board (PCAOB), which Congress created in 2002 to focus on audit quality. Certain auditor responsibilities—such as evaluating a company’s accounting estimates and ability to continue as a going concern—can be particularly challenging in bank audits, according to PCAOB staff, auditors, and others.

SEC is required by law to review public companies’ disclosures. However, 11 public banks—including two with more than $80 billion in assets—are not subject to SEC review because they operate without a corporate parent known as a bank holding company. (Two of the three banks that failed in spring 2023 operated without a holding company. Shareholders lost more than $29 billion in investments in these two banks between the end of 2022 and May 2023.) For those banks, Congress charged banking regulators with certain functions and duties of SEC. However, GAO found that banking regulators’ review processes, unlike SEC’s, do not assess disclosures for investors’ benefit. Reassessing disclosure review authority could help Congress determine whether changes are needed to strengthen investor protection. 

Note: Annual disclosures include details on a company’s business, its risks, and operating and financial results.

GAO reviewed 2021 and 2022 disclosures for the three banks that failed in spring 2023 to analyze the information they provided about interest rate and liquidity risks. GAO and banking regulators previously found that weak management of these risks contributed to the banks’ failures. Although each bank described setting thresholds for interest rate or liquidity risk, they did not disclose when thresholds were breached or how they addressed the breaches. SEC also identified other banks whose disclosures on these risk topics could be improved. However, SEC staff have not provided public guidance on how companies could assess whether breaches of interest rate or liquidity risk tolerances are material to investors. Such guidance could help companies assess the materiality of these details and may provide investors with the information they need to make informed decisions.

Why GAO Did This Study

The Securities Exchange Act of 1934 and federal regulations require public companies to provide investors with periodic disclosures about business risks and financial results. Three of the 30 largest U.S. banks failed in spring 2023, shortly after their financial statement audits were completed. Some observers raised questions about whether auditors had properly fulfilled their roles and whether the banks had clearly disclosed material information.  

GAO was asked to review oversight of bank financial disclosures and external audits. Among other objectives, this report examines auditing standards relevant for bank audits; oversight of audit quality; SEC and banking regulators’ reviews of public companies’ annual disclosures; and the failed banks’ disclosures about selected risks before they failed.

GAO reviewed PCAOB auditing standards, SEC and banking regulators’ disclosure review processes, SEC public comments to bank holding companies, and the failed banks’ annual disclosures. GAO also interviewed staff from SEC, banking regulators, PCAOB, and accounting firms, among others.

What GAO Recommends

GAO recommends that Congress consider reassessing the authority for reviewing annual financial disclosures for public banks without holding companies. GAO also recommends that SEC staff provide guidance to help companies assess the materiality of information related to interest rate and liquidity risks. SEC disagreed with the recommendation, noting that staff provides post-disclosure feedback as warranted. GAO maintains SEC should implement the recommendation.

 

 

 

 

 

Abbreviations
EVE	economic value of equity
FDIC	Federal Deposit Insurance Corporation
Federal Reserve	Board of Governors of the Federal Reserve System
NII	net interest income
OCC	Office of the Comptroller of the Currency
PCAOB	Public Company Accounting Oversight Board
SEC	Securities and Exchange Commission

September 3, 2026

The Honorable French Hill
Chairman
The Honorable Maxine Waters
Ranking Member
Committee on Financial Services
House of Representatives

Public companies must periodically disclose information material to investors.[1] The Securities and Exchange Commission (SEC) sets certain disclosure requirements and enforces laws requiring companies to annually disclose material information on Form 10-K.[2] These disclosures include a company’s annual financial statements.[3] Without public disclosures of material information, securities markets would not function efficiently. SEC requires that an independent public accountant serve as an external auditor to provide an opinion about the fair presentation of annual financial statements. The Public Company Accounting Oversight Board (PCAOB) oversees audits of public companies that are subject to securities laws. SEC approves PCAOB’s budget and oversees its activities.

For banks that are publicly traded (referred to as “public banks” for the purposes of this report), disclosure of material information is also part of the U.S. banking system’s safety-and-soundness framework.[4] These disclosures allow investors in equity and debt securities to impose market discipline by monitoring banks’ risks and financial positions and to influence banks’ risk taking through price discovery.[5] The ability to impose market discipline is an integral component of the rationale for allowing investors to suffer losses.

Three of the 30 largest U.S. banks—First Republic Bank, Signature Bank, and Silicon Valley Bank—failed between March 10 and May 1, 2023. These spring 2023 bank failures raised questions about whether external auditors had properly fulfilled their roles and whether banks’ disclosures of material information were sufficiently transparent.

The March failures of Signature Bank and Silicon Valley Bank prompted federal regulators to take action to protect the safety and soundness of the financial system. For example, the Secretary of the Treasury invoked the systemic risk exception which allowed the Federal Deposit Insurance Corporation (FDIC) to guarantee the two banks’ uninsured deposits. The banks’ failures cost FDIC’s Deposit Insurance Fund an estimated $19 billion as of December 31, 2025, according to FDIC staff, and prompted FDIC to impose a special assessment on certain banks to recover the costs.[6]

You asked us to examine oversight of public banks’ and bank holding companies’ disclosures of material information and the role of their external auditors. This report examines (1) selected external auditing standards that present particular challenges for bank audits, (2) the extent to which SEC oversees PCAOB’s role in monitoring audit quality, (3) the extent to which annual disclosures are reviewed for the protection of investors, (4) bank examiners’ communication with auditors and examination processes for banks’ external audit programs, (5) the extent to which FDIC has obtained civil damages against accounting firms when banks fail, (6) the failed banks’ disclosures for selected risks, and (7) selected investors’ views on public banks’ annual disclosures.

To address our objectives, we reviewed relevant laws, regulations, PCAOB auditing standards, agency policies and procedures, public inspection reports, enforcement materials, bank examination documentation, annual financial disclosures, SEC comment letters, court records, and published literature. We also interviewed staff or officials from PCAOB, SEC, FDIC, the Board of Governors of the Federal Reserve System (Federal Reserve), and the Office of the Comptroller of the Currency (OCC), as well as representatives from the Center for Audit Quality, accounting firms, audit committee members, and selected investor representatives.[7]

For our work on auditing standards and PCAOB oversight, we reviewed PCAOB documentation on standard setting, inspections, and enforcement, including 2024 public inspection reports for annually inspected firms. We selected the six accounting firms with the most audits inspected by PCAOB in 2024; one declined to speak with us. Audit committee members were volunteers who responded to an invitation we developed with the National Association of Corporate Directors.

For our work on disclosure reviews, we reviewed SEC and federal banking regulator documentation on review processes and selected completed reviews.[8] We also reviewed SEC comment letters sent from July 2023 through December 2024 to 10 U.S.-headquartered bank holding companies with assets of $50 billion or more that were not global systemically important banks.[9]

For our work on failed bank disclosures, we reviewed the 2021 and 2022 Form 10-Ks for First Republic Bank, Signature Bank, and Silicon Valley Bank’s holding company (SVB Financial Group) and described disclosures on interest rate and liquidity risks and regulators’ conclusions about the banks’ management of those risks. We also compared the failed banks’ disclosures with those of the holding companies for four operating banks, which we selected at random from 11 banks that met our criteria for asset size, U.S. headquarters, public trading status, and share-price declines during spring 2023.[10] To obtain investor perspectives, we interviewed representatives from the four largest credit rating agencies, four large external money managers selected at random, and three equity analyst firms with the largest number of rated banks.

We assessed agency activities against relevant statutory missions and authorities, including the investor protection focus of the Sarbanes-Oxley Act of 2002 and SEC’s investor protection mission. We also reviewed literature identified through searches of scholarly databases for peer-reviewed articles published from January 2015 through February 2025. For more detailed information on our scope and methodology, see appendix I.

We conducted this performance audit from July 2024 to September 2026 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Background

Financial Statement Audits and External Auditor Responsibilities

An independent public company audit is intended to provide reasonable assurance about whether management has fairly presented a company’s financial statements, in all material respects, in conformity with U.S. generally accepted accounting principles.[11] The auditor must also express an opinion on the effectiveness of the company’s internal control over financial reporting, when required.[12] Accounting firms that perform external audits are hired by and report to a company’s audit committee, which is made up of members of the board of directors unaffiliated with company management.

PCAOB sets auditing and professional practice standards for external auditors of all public companies.[13] For example, auditors must adhere to general principles and responsibilities, including the following:

·       Independence. Auditors must remain independent from the company they are auditing both in fact and appearance.

·       Due professional care. Auditors must perform work with reasonable care and diligence, exercise professional skepticism (i.e., approach work with critical thinking and readiness to challenge information rather than accept it at face value), act with integrity, and comply with applicable professional and legal requirements.

·       Competence. Auditors must have the knowledge, skill, and ability to perform their assigned activities in accordance with professional and legal requirements and firm policies.

·       Professional judgment. Auditors must apply relevant training, knowledge, and experience to make informed decisions and reach well-reasoned conclusions.[14]

As part of a financial statement audit, PCAOB standards require the external auditor to obtain an understanding of the audited company, including matters affecting the industry in which the company operates.[15] In addition, external auditors’ responsibilities go beyond auditing the financial statements. For example, PCAOB standards require the external auditor to read other information that accompanies—but is not part of—the financial statements to consider whether that information is materially inconsistent with the financial statements.[16]

Public Companies’ Required Annual Disclosures

The Securities Exchange Act of 1934 established the requirement for public companies, including public banks and bank holding companies, to periodically report certain financial information through disclosures. SEC’s Regulation S-X sets forth requirements for financial statements to be filed as part of registration statements and annual or other reports under the Securities Act of 1933 and the Securities Exchange Act of 1934. Regulation S-K establishes the specific information that public companies must disclose annually on SEC Form 10-K. These annual disclosures include details on a company’s business, the risks it faces, and the operating and financial results for the fiscal year.

The Form 10-K section on management’s discussion and analysis of financial conditions and results of operations provides the company’s perspective on its business results from the past fiscal year. Specifically, the section presents information about the company’s operations and financial results, including its liquidity and capital resources and any known trends or uncertainties that could materially affect its financial results. If those uncertainties include key business risks and actions it is taking to address them, this section could include those as well. For example, a bank holding company may discuss how management monitors liquidity and ensures adequate capital under various scenarios, such as a rise in interest rates or a credit rating downgrade.

The Sarbanes-Oxley Act of 2002 requires SEC to review the filings of all public bank holding companies and most other public companies at least once every 3 years.[17] However, certain public banks that operate without a bank holding company structure are not subject to SEC’s authority to review annual disclosures and other filings under the Securities Exchange Act of 1934. The law instead charges the federal banking regulators—FDIC, the Federal Reserve, and OCC—with the powers, functions, and duties of SEC to administer and enforce various provisions of the act for FDIC-insured banks and savings and loan associations without holding companies.[18] Two of the banks that failed in spring 2023—First Republic Bank and Signature Bank—operated without holding companies.

Causes Common to the Spring 2023 Bank Failures

We and banking regulators identified several causes of the First Republic Bank, Signature Bank, and Silicon Valley Bank failures that were common across the three banks.[19] We describe these factors in detail below.

Fast growth and reliance on uninsured deposits for growth. Prior to their failures, all three banks grew more rapidly than most of their peers, with their growth relying on high levels of uninsured deposits—which can be an unstable source of funding in times of stress.[20] For each bank, deposit withdrawals, particularly for uninsured deposits, accelerated rapidly before failure.[21] This reduced the banks’ liquidity—the available funding to respond to depositors’ withdrawal demands—to the point where regulators had to close the banks.

Highly concentrated depositor bases or asset mixes. All three failed banks had concentrations in their depositor bases or asset mixes that left them vulnerable to catalysts such as rising interest rates and contributed to their failures. For example, First Republic Bank was not particularly concentrated within its depositor base; its 10 largest depositors made up 3.83 percent of total deposits, according to the FDIC Office of Inspector General. However, its volume of loans and leases was 94 percent of deposits, compared to a peer group average of 62 percent.[22] Both Signature Bank and Silicon Valley Bank had concentrations in their depositor bases and asset mixes that contributed to their failures.

In addition, an April 2023 Federal Reserve report on the failure of Silicon Valley Bank found that a combination of social media, highly networked and concentrated depositor bases, and technology may have fundamentally changed the speed of bank runs.[23] Social media enabled depositors to instantly spread concerns about a bank run, and technology enabled immediate deposit withdrawals.

Weaknesses in management of liquidity or interest rate risks. Federal banking regulators identified a lack of liquidity as a cause of failure at all three banks. Immediately before failure, none of the banks had enough available assets to respond to all depositors seeking to withdraw their deposits. In some cases, management’s failure to anticipate liquidity needs exacerbated this risk. For example, Signature Bank management had not taken steps to position the bank to borrow from the Federal Reserve System.

In addition, rising interest rates throughout 2022 led to declines in the fair value of loans and securities relative to those assets’ book values.[24] At First Republic Bank and Silicon Valley Bank, these losses—although unrealized—negatively impacted investor confidence in the banks and spurred bank runs, according to an FDIC analysis.[25] The Federal Reserve’s report concluded that the underlying issue in Silicon Valley Bank’s failure was solvency, not liquidity issues arising from deposit withdrawals.[26] In addition, as we described in 2023, according to Federal Reserve staff and examination documents, Silicon Valley Bank did not effectively manage the interest rate risk of securities or develop appropriate interest rate risk management tools, models, or metrics.[27]

Accounting Estimates and Going Concern Can Present Particular Challenges for Auditors at Banks

Evaluating accounting estimates and a company’s ability to continue operating as a going concern can present particular challenges for external auditors at banks, according to PCAOB staff, accounting firm representatives, banking regulators, and others we interviewed.

Auditing Accounting Estimates

Bank management must prepare accounting estimates for various financial line items, such as allowances for credit losses and the fair value of certain debt securities. Such estimates are subject to measurement uncertainty. PCAOB standards require auditors to obtain sufficient appropriate evidence to determine whether accounting estimates in significant accounts and disclosures are properly accounted for and disclosed.[28] The standards require auditors to identify estimates in significant accounts and disclosures in financial statements, understand management’s process for preparing the accounting estimates, and identify and assess risks of material misstatement related to the estimates.

PCAOB standards also require auditors to report on matters that involve especially challenging, subjective, or complex auditor judgment, known as critical audit matters.[29] At banks, the allowances for credit losses—accounting estimates for expected uncollectible amounts—are often critical audit matters.[30] KPMG, the accounting firm that audited each of the three failed banks, included a critical audit matter on allowance for credit losses for each company’s 2022 financial statement audit.

For loans, allowances for credit losses act as a reserve that reduces the total loan value to reflect the net amount expected to be collected over the life of the asset. Allowances for credit losses are also recognized for certain debt securities. This area can be challenging to audit, according to PCAOB staff, accounting firm representatives, Center for Audit Quality staff, and audit committee members. PCAOB staff noted that estimating a bank’s allowance for credit losses may involve significant management judgment and complex models.[31]

Auditing a bank’s intent and ability to continue to hold debt securities classified as “held-to-maturity” can also be challenging, according to Center for Audit Quality staff. Management’s classification of debt securities as held-to-maturity or available-for-sale can have important implications for the bank’s income and equity levels because the classification dictates how unrealized gains and losses affect the bank’s balance sheet and regulatory capital. Specifically, the balance sheet recognizes held-to-maturity debt securities at amortized cost (net of an allowance for credit losses), while it recognizes available-for-sale securities at fair value.[32] (Unrealized losses on debt securities classified as held-to-maturity contributed to the failures of First Republic Bank and Silicon Valley Bank.) Hence, auditors may need to use significant judgment when applying audit procedures to determine the reasonableness of banks’ classification of debt securities.

Auditing Going Concern

Both auditors and company management must evaluate whether there is substantial doubt about a company’s ability to continue as a going concern. Specifically, for auditors, PCAOB standards require evaluating whether there is substantial doubt about a company’s ability to continue as a going concern for a reasonable period.[33] However, the auditor is not responsible for predicting future conditions or events, including those that lead to a company’s failure to continue as a going concern. Under accounting standards, management is also required to consider conditions and events that raise substantial doubt about a company’s ability to continue as a going concern.[34]

Banks present challenges for an auditor’s evaluation of going concern due to safety and soundness and other unique considerations. Regulators’ actions and requirements to improve safety and soundness can affect going concern assessments, according to OCC officials.[35] A going concern warning—a statement in the public audit report that the auditor has substantial doubt about a bank’s status as a going concern—could undermine depositor and investor confidence, according to Federal Reserve and OCC officials. Two investor representatives told us that such a warning could become a self-fulfilling prophecy if it led many depositors to withdraw their deposits in a compressed time frame. Under such a scenario, even a solvent bank could fail due to a lack of short-term liquidity needed to respond to depositors’ withdrawals. OCC officials added that a going concern warning could also have a contagion effect, affecting safety and soundness at other banks.

Maturity mismatches between banks’ assets and liabilities and exposure to credit risk are among the reasons an external auditor’s going concern assessment for banks differs from that for other companies, according to a 2014 publication by the Bank for International Settlements.[36] For example, banks generally rely on short-term deposits and other short-term liabilities for significant funding, and a loss of confidence by depositors and other creditors in a bank’s solvency can quickly result in a liquidity crisis, the source concluded. Center for Audit Quality staff told us that banks can appear financially sound right up until a liquidity event or loss of depositor confidence occurs, which may be after the audit report date. First Republic Bank, Signature Bank, and Silicon Valley Bank each experienced significant deposit runs and failed within a few months of receiving clean audit opinions from KPMG.[37]

The auditing standard for going concern at public companies in the United States has not undergone significant revision since 1988.[38] PCAOB has made several efforts to revise the standard, starting in 2009. PCAOB staff said competing views among industry and investor stakeholders have made revising the standard challenging. Stakeholder interest is higher for this standard because it requires the auditor to opine on the business itself, PCAOB staff said.[39]

PCAOB announced in 2024 that it intended to publish a new proposal to amend the going concern standard in 2025. However, as of June 2026, PCAOB had not released this proposal. PCAOB staff said in July 2025 they delayed the release because of anticipated leadership changes at PCAOB, which occurred in February 2026.[40] In June 2026, PCAOB issued a request for public comment about the overall PCAOB standard-setting process.[41]

PCAOB Uses Multiple Tools to Promote Audit Quality, and SEC Initiated a New Examination of Its Inspection Process

PCAOB Uses Multiple Means to Establish and Improve Audit Quality

The Sarbanes-Oxley Act of 2002 established PCAOB as a nonprofit corporation to oversee the audits of companies that are subject to securities laws and related matters to protect the interests of investors and further the public interest in the preparation of informative, accurate, and independent audit reports.[42] PCAOB’s oversight of audit quality includes adopting and revising auditing standards and inspecting PCAOB-registered public company accounting firms. PCAOB also has authority to conduct investigations and disciplinary proceedings related to registered public accounting firms and associated persons. PCAOB said that its periodic revisions and updates to auditing and related professional standards are based on the areas prioritized by PCAOB leadership. PCAOB and SEC follow a process that incorporates research and public feedback before revising auditing standards (see fig. 1).

PCAOB staff said the board’s standard-setting process is designed to incorporate public feedback before PCAOB submits a standard to SEC for approval. Staff said this process helps PCAOB anticipate public feedback and facilitate SEC’s review of the proposed standard.

To assess audit quality, PCAOB administers an inspection process that assesses a sample of public company audits from registered accounting firms. PCAOB annually inspects accounting firms that regularly issue audit reports for more than 100 public companies and inspects smaller firms—those that issue audit reports for 100 or fewer public companies—at least every 3 years. During inspections, PCAOB staff review the audit sample for compliance with PCAOB auditing standards and SEC independence rules. In selecting audits for review, PCAOB generally uses both risk-based and random methods of selection. PCAOB staff said reviews generally focus attention on audit areas with more complexity or significance, with increased risk of material misstatement, or with recurring deficiencies. For example, staff said that auditors’ procedures to test the allowance for credit losses are frequently selected as a focus area of PCAOB reviews of bank audits.

Following each inspection, PCAOB publishes a public report that summarizes the results, including the number of audits found to have a single deficiency or multiple deficiencies. Deficiencies can involve insufficient evidence to support conclusions or noncompliance with PCAOB standards or certain SEC or PCAOB rules, such as those relating to auditor independence.[43] Each report includes statistics on the number of deficiencies found during the inspection, such as the number of audits with deficiencies by the audited company’s size or industry, or by the relevant audit standard.

In addition, PCAOB has the authority to pursue sanctions for violations of auditing standards and failures of auditor independence, among other things.[44] Both PCAOB and SEC may seek monetary penalties and remedial measures, including temporary or permanent suspensions. PCAOB regularly coordinates its enforcement efforts with SEC, PCAOB staff said. SEC may refer matters to PCAOB for investigation, or vice versa. PCAOB must report all disciplinary sanctions to SEC, and SEC may review PCAOB’s disciplinary sanctions and modify or cancel them as appropriate.[45]

After the 2023 Bank Failures, PCAOB Assessed Emerging Risks for Bank Holding Company Audits

Shortly after the spring 2023 bank failures, PCAOB assessed potential risks for bank holding company audits. In particular, PCAOB conducted interim inspections of selected audits and surveyed accounting firms to better understand how auditors were responding to emerging risks for banks. PCAOB found that certain audit teams did not revisit risk assessments as interest rates continued to rise during this period.[46] PCAOB also concluded that some auditors did not identify potential financial reporting or internal control over financial reporting considerations associated with rising interest rates. However, some auditors also took steps after the bank failures that improved audit quality, PCAOB found. For example, auditors generally increased communication with bank management and evaluated whether risks that contributed to the bank failures were present at the audited bank.

PCAOB also augmented its annual audit-firm inspection process for 2023 to better address risks in the banking industry. In particular, PCAOB selected additional bank audits for its audit-review sample during regular inspection cycles in 2023 and 2024. In 2024, for the 14 accounting firms that underwent annual inspections, PCAOB reviewed 96 audits of financial companies out of 434 total audits in that sample. This was the most out of any industry, PCAOB staff said.[47] The audit selection process incorporated risks related to interest rates and market volatility.

SEC Recently Initiated Its First Examination of PCAOB’s Audit-Firm Inspections Since 2009

SEC’s mission includes protecting investors, and agency officials said SEC’s PCAOB examinations are one way SEC supports this mission by helping to promote audit quality. SEC’s Division of Examinations is responsible for conducting risk-based examinations of various SEC-regulated entities, including PCAOB.

In September 2025, the division initiated the first examination of PCAOB’s audit-firm inspection process since 2009, according to agency officials and planning documents. This examination was ongoing as of March 2026. Agency officials said the examination is assessing how PCAOB’s procedures and organization promote the uniform application of inspection activities.

SEC officials said they prioritized examining PCAOB’s audit-firm inspection process as part of a broader fiscal year 2026 examination for several reasons: (1) the process is a key PCAOB function for assessing audit quality, (2) a significant period had elapsed since the previous examination of PCAOB’s audit-firm inspections, and (3) officials noted industry concerns about inconsistencies in inspection results.

Although the division initiated an examination of PCAOB’s audit-firm inspection process in September 2025, PCAOB’s analysis of inspection results and other publicly available information indicated that the process and its results presented potential risks for SEC to assess before 2025. Specifically, PCAOB staff and board leadership cited concerns with what they viewed as high or increasing deficiency rates from 2022 through 2024, which led to their conclusions that audit quality was declining.[48] These results would merit closer review by SEC to assess PCAOB’s conclusions. Academic studies also have raised questions related to PCAOB inspections. For example, one peer-reviewed 2021 study found that PCAOB inspection activity led auditors to become more conservative in estimating loan losses and this led to less accurate estimates overall.[49] A separate study summarizing the experiences of a nongeneralizable sample of 20 auditors whose work PCAOB had inspected noted disagreement with PCAOB’s approaches to assessing audit risk and determining thresholds for necessary documentation.[50]

SEC officials cited limitations in resources and relevant staff experience in the Broker-Dealer and Exchange Examination Program, which previously had responsibility for examinations of PCAOB. Officials said these limitations affected the division’s ability to dedicate resources to examining PCAOB. However, SEC has examined other PCAOB activities since 2009. For example, the division examined PCAOB’s inspection program for auditors of broker-dealers in 2023 and its governance and internal policies in 2022.[51]

In January 2026, the division moved responsibility for examining PCAOB from the Broker-Dealers and Exchanges Examination Program to the FINRA and Securities Industry Oversight Examination Program, which reviews certain self-regulatory organizations. Agency officials said this change would allow the division to better examine PCAOB because the FINRA and Securities Industry Oversight Examination Program had more available resources and relevant staff expertise. In addition, officials stated that the program’s focus on self-regulatory organizations was more closely related to PCAOB’s mission.[52]

Initiating a new examination of PCAOB’s inspection process in 2025 affords SEC the opportunity to assess how well PCAOB is using its inspection process to oversee audits of public companies, which supports SEC and PCAOB’s shared investor protection mission. Examination findings can help SEC identify whether PCAOB should take steps to alter or improve its process for inspecting accounting firms and interpreting inspection results.

Federal Banking Regulators’ Disclosure Reviews Are Less Investor Focused than SEC’s Reviews

SEC Reviews Bank Holding Company Disclosures and Requests Changes to Improve Information for Investors

SEC’s Division of Corporation Finance is responsible for reviewing annual disclosures. According to Corporation Finance procedures, the review process does not guarantee that a company’s disclosure is complete and accurate; responsibility for complete and accurate disclosure lies with company management. However, the review process can help companies improve their disclosures, thereby enhancing investors’ understanding of the company’s business. This improved understanding allows investors to help fulfill their market discipline function, which can help discourage companies from taking excessive risks.

Review Process and Staff Responsibilities

The division developed policies and procedures for reviewing disclosures for all public companies, including bank holding companies. To review disclosures that companies include in Form 10-K, staff assess whether the filing includes certain required disclosure elements, as discussed below.[53] Staff also assess whether, in light of the circumstances under which the disclosures are made, the disclosures are sufficient to make required statements not materially misleading.

SEC instructs its Corporation Finance staff to consider what information would be material to investors and to tailor the review to the specific company’s business. Materiality depends on the facts and circumstances of each company. Examiners collect information about the company’s background to assess materiality, SEC officials said. A bank holding company’s business strategy may also affect how Corporation Finance staff review annual disclosures, according to Corporation Finance staff. For example, if a bank holding company’s business line is concentrated in traditional banking services, such as deposit taking and lending to businesses, the complexity of the business may affect the extent to which the review focuses on credit quality of loans and the composition of deposits, as opposed to other aspects of the review.

Corporation Finance primarily employs accountants and attorneys to review disclosures. For bank holding companies, an accountant examiner assesses a company’s annual disclosures, after which an accountant reviewer performs a second review of both the disclosures and the examiner’s initial analysis. An attorney examiner and reviewer may also be assigned to conduct a legal review, when warranted. Corporation Finance instructs review teams to apply their industry knowledge and professional judgment in assessing disclosures. For example, review teams are expected to draw on their prior experience in evaluating disclosures by key competitors and companies in the same industry.

Comments on Bank Holding Companies’ Disclosures

Corporation Finance staff review Form 10-K filings for the specific information Regulations S-K and S-X require for all public companies, as well as for bank-specific information. Specifically, Regulation S-K contains six additional reporting requirements applicable to bank holding companies. These disclosure requirements relate to the distribution of assets, liabilities, and stockholders’ equity; interest rates and interest differential; investments in debt securities; loan portfolio; allowance for credit losses; and deposits. After the spring 2023 bank failures, Corporation Finance staff reviewed relevant bank holding company disclosures more extensively, according to remarks from an SEC official.[54] These disclosures included those on interest rate risk, liquidity risk, and lending, such as commercial real estate loan portfolios.

After reviewing the disclosures, Corporation Finance staff may issue written comments to the company requesting additional information or clarifications for investors. These comments are public and posted on SEC’s website. We analyzed 10 letters in which Corporation Finance staff requested changes to bank holding companies’ disclosures.[55] The comments requested additional information on topics including the following:

Liquidity and deposits. Corporation Finance staff reviewed disclosures related to deposits and focused on the composition of deposits and the percentage of brokered or uninsured deposits.[56] Specifically, in three comment letters, staff asked the bank holding companies to include additional discussion of the effect that brokered deposits and the concentrations of brokered deposits or uninsured deposits had on the companies. SEC’s comments included requests to consider adding details where additional clarity could be material, such as details about factors that could materially increase or decrease liquidity.

Lending portfolios. In four letters, Corporation Finance staff asked bank holding companies to consider including additional disaggregated information about their commercial real estate loan portfolios, such as details on geographical location, industry type, and loan-to-value ratio. Staff said these details would have provided more meaningful information to investors. In two letters, Corporation Finance staff asked companies to provide the extent of their loan exposure by borrower type, such as office, retail, hotel, and multifamily. In another letter, staff asked the company to explain the underlying reasons for nonperforming loans in its loan portfolio by loan category.

Other topics. Corporation Finance staff also requested that some of these companies revise future disclosures in areas including allowance for credit losses, internal control over financial reporting, and use of measures that do not conform with U.S. generally accepted accounting principles.

Unlike SEC’s Process, Banking Regulators’ Reviews Do Not Require Assessing Disclosures for Investor Protection Purposes

We analyzed the banking regulators’ annual disclosure review processes for banks without holding companies and found that, unlike SEC’s process, none require staff to qualitatively assess the content of annual disclosures. Such assessments would include evaluating whether required statements are not materially misleading and whether disclosures contained sufficient detail about the banks’ financial condition for investors.

Banking regulators were responsible for reviewing annual disclosures for 11 publicly held banks without holding companies as of December 31, 2025. FDIC supervised nine of these banks, whose assets ranged from less than $1 billion to almost $41 billion as of December 31, 2025. OCC supervised the other two, whose assets were between $87 billion and $89 billion as of that date.

Below, we discuss each banking regulator’s disclosure review process, and, for FDIC and OCC, describe the content of review documentation for selected banks.

·       FDIC. FDIC officials told us that the agency fulfills its disclosure review responsibility through what staff referred to as 335 reviews. FDIC implements its authority under Section 12(i) of the Securities Exchange Act of 1934 through the Code of Federal Regulations.[57] We reviewed FDIC documentation for the most recent reviews of three of the nine public banks that FDIC currently supervises and for Signature Bank and First Republic Bank.

The documentation for the five banks showed that staff reviewed the submitted information but did not conduct qualitative analysis of the banks’ disclosures. For each bank, FDIC documentation consisted of spreadsheets that listed each designated section of the Form 10-K and notations about whether the designated sections were included in the submission to FDIC. However, generally the spreadsheets did not indicate any evaluative or qualitative analysis of the companies’ financial statements or disclosures related to management’s discussion of results.[58]

·       OCC. OCC officials told us in August 2025 that the agency was in the process of updating disclosure review procedures, which remained under development as of February 2026. OCC officials said that for public national banks without holding companies, OCC takes on SEC’s role.[59] According to OCC, the agency’s reviews of periodic filings encompass financial statements and related disclosures for compliance with applicable disclosure requirements and accounting standards. We reviewed OCC’s documentation for one bank’s fiscal year 2024 annual disclosure and found that it noted whether the disclosure included required information related to the bank’s audited financial statement. However, the documentation did not include evaluative or qualitative analysis of the bank’s disclosures in Form 10-K.[60]

·       Federal Reserve. In February 2025, the Federal Reserve revised its procedures for reviewing the annual disclosures of public banks without holding companies. The procedures focus on administrative actions, such as verifying whether a bank submitted its required filings and identifying incomplete reporting items. They do not include reviewing a bank’s disclosures for whether the information is sufficient for investors. The Federal Reserve did not perform any disclosure reviews for banks without holding companies after February 2025, when staff revised review procedures. The Federal Reserve was the primary federal regulator for one public bank without a holding company in 2025, but that bank was acquired by a bank with a holding company in February 2026.

Officials at the banking regulators expressed varying perspectives about why their annual disclosure reviews do not include elements related to the quality of information for investors:

·       FDIC staff said that although the agency has a statutory duty to administer various provisions of the Securities Exchange Act of 1934 and the Sarbanes-Oxley Act of 2002, FDIC’s primary statutory mission is to focus on the safety and soundness of the banking system and to resolve failed banks. Its statutory mission does not expressly prioritize investor protection, staff said.

·       OCC staff said that developing a review process had not been a priority until 2025 because OCC’s portfolio of banks without holding companies had previously consisted of only one bank.[61] In addition, they said the agency had focused on revising other processes in response to the COVID-19 pandemic. However, OCC staff viewed their role as similar to SEC’s for the banks without holding companies that OCC supervised.

·       Federal Reserve staff said the Federal Reserve does not have any legal authority or statutory responsibility for investor protection.

Protecting investors is central to the purpose of the Sarbanes-Oxley Act of 2002, which requires SEC to regularly and systematically conduct reviews of public companies’ annual disclosures.[62] However, 11 banks whose disclosures are overseen by banking regulators are exempted from SEC’s disclosure review authority. Without regular and systematic reviews of these banks’ annual disclosures—of the type SEC performs—investors may have insufficient detail about potential risks associated with their investments to aid investment decisions.

Two of the three failed banks were outside SEC’s disclosure review authority. Investors in the three failed banks—including pension funds and general retail investors—saw the value of their investments fall from about $43 billion at the end of 2022 to less than $100 million by May 2023.[63] We previously recommended that Congress consider whether changes to the financial regulatory structure are needed to reduce or better manage fragmentation and overlap.[64] The assignment of disclosure review authority for public banks without holding companies is another aspect of that structure that Congress could reassess. By doing so, Congress could help ensure that annual disclosure reviews for these banks better protect investors by addressing the quality of information available to them.

Examiners Discussed Concerns with Failed Banks’ Auditors and Review External Audit Programs When Certain Risks Arise

Bank Examiners Met with KPMG Auditors and Discussed Areas of Concern for the Three Failed Banks

Examiners generally meet quarterly with external auditors for large banks subject to continuous supervision, according to officials at FDIC, the Federal Reserve, and OCC.[65] An interagency policy encourages communication and coordination between examiners in connection with safety and soundness examinations.[66] Bank size and complexity are factors in how often examiners meet with external auditors, officials at the three banking regulators told us.

We reviewed examiners’ meeting minute summaries at the failed banks from early 2022 until the banks failed and found that examiners and external auditors (KPMG in all three cases) met at least quarterly during that period. They discussed deficiencies and other areas of concern for the three banks. For example:

·       In 2022, FDIC examiners for Signature Bank informed KPMG about the less than satisfactory results from its review of the bank’s liquidity risk management.[67] This type of information can be relevant to auditors as they consider a bank’s liquidity management—for example, when assessing a bank’s intent and ability to hold debt securities to maturity.

·       In 2023, Federal Reserve examiners for Silicon Valley Bank informed KPMG that they had identified deficiencies related to the bank’s internal audit effectiveness. The examiners sought to understand how KPMG was using information produced by the bank’s internal audit function. Use of unreliable information could trigger examiners to evaluate a bank’s external audit function more closely. KPMG auditors responded that the firm had stopped relying on work from the bank’s internal audit function 3 to 4 years earlier and instead relied on work from a different department.

·       In April 2023, KPMG informed FDIC examiners that it would start assessing First Republic Bank’s ability to continue as a going concern quarterly by performing the type of detailed analysis it generally would perform at year end. KPMG did so because of the bank’s recent loss of depositors, significant decline in liquidity, and increase in high-cost borrowings, according to meeting minutes. In general, examiners want to be aware of any public disclosure of going concern issues raised by a bank’s auditor because the bank could lose deposits and face other safety-and-soundness effects as a result.

Examiners Conduct Targeted Reviews of Banks’ External Audit Programs When Certain Risks Are Present

As part of their supervisory process, examiners assess whether a bank’s management and board of directors have an effective external audit program. This assessment is part of the examination of a bank’s management function and does not primarily evaluate external audit quality. Examiners consider the policies, processes, and personnel surrounding an institution’s external audit program. Federal Reserve, FDIC, and OCC examiners use a risk-based process to tailor their examinations of banks—including their external audit programs—as outlined in the regulators’ respective guidance.

Examiners routinely complete a basic review of external audit programs as part of the examination. As a baseline, regulators’ examination guidance directs examiners to assess external audit program components, such as the external auditor’s independence, whether an audit committee has been established and how it operates, or whether management was responsive to issues identified by the external auditor. Additionally, as part of every examination, FDIC examiners must request that bank management provide all correspondence between external auditors and the bank, according to FDIC guidance. FDIC’s guidance indicates that this information can help alert examiners to internal control weaknesses identified by auditors and to bank management’s actions to correct such weaknesses.

Examiners use their risk-based framework to conduct a more detailed review when warranted. The guidance outlines more extensive steps—such as reviewing external auditor workpapers—that examiners should take under certain conditions. For example, examiners might perform expanded procedures when there is a sudden change in external auditor, significant issues are identified in examiners’ review of a bank’s internal audit function, or concerns exist about matters within the scope of the external audit program. Based on our review of FDIC and Federal Reserve examination planning documents, examiners did not identify the need for targeted reviews of the external audit programs for the 2022 or 2023 examinations of First Republic Bank, Signature Bank, or Silicon Valley Bank.

FDIC May Pursue Civil Damages from Accounting Firms When Banks Fail

As the agency responsible for resolving failed banks, FDIC may pursue civil damages against accounting firms that were the external auditors for banks and bank holding companies.[68] FDIC’s Professional Liability Program allows it to recover funds by pursuing claims against directors, officers, and professionals who caused losses to insured banks, including malpractice claims against accounting firms. FDIC investigates the possibility of making professional liability claims each time a bank fails, but it pursues claims only if they are expected to be cost-effective and meritorious, agency officials said.[69]

The Federal Deposit Insurance Corporation Improvement Act of 1991 requires FDIC to maximize recoveries to the Deposit Insurance Fund.[70] In doing so, FDIC uses dispute resolution tools—such as litigation, negotiation, or arbitration—to the extent they are available and deemed effective. FDIC considers the facts and circumstances of each case when considering options to pursue civil damages.

FDIC recovered around $437 million in civil damages from January 2010 through June 2026 from accounting firms that were external auditors, according to our analysis of FDIC’s Professional Liability Program annual reports and other related materials.[71] The recoveries were associated with 14 bank failures, although the majority of recoveries were related to one failure. FDIC recovered $335 million from the accounting firm that was the external auditor for Colonial Bank, which failed in 2009 and caused a loss of $2.96 billion to the Deposit Insurance Fund.

FDIC’s most recent recovery occurred in May 2026, when it recovered about $36 million from the accounting firm for First NBC Bank Holding Company.[72] In that case, a federal district court ordered FDIC as receiver to use arbitration if it wanted to pursue civil damages against the accounting firm for First NBC Bank Holding Company. The court found that FDIC, as receiver for the failed First NBC Bank, was bound by an arbitration agreement between the bank’s holding company and its accounting firm.[73] FDIC officials told us that, based on records dating back to 2010, FDIC had not previously been compelled to arbitration in accounting malpractice lawsuits.[74] Agency officials noted that the decision to compel arbitration overall did not have a negative impact on the Professional Liability Program.

2023 Failed Banks Did Not Disclose Risk-Limit Breaches in Prior Annual Disclosures

Banks Exceeded Interest Rate and Liquidity Risk Tolerances but Did Not Disclose Those Details

Each bank disclosed in its 2021 and 2022 annual disclosures that it had a set of processes to manage interest rate and liquidity risks, including setting risk-tolerance levels that could serve as warning indicators of elevated risks. Specifically, each bank set internal tolerances for losses predicted by its internal forecasting models above which management or the board would need to consider options to reduce risks. In 2021 or 2022, each bank exceeded those tolerances in at least one area but did not disclose that fact or management’s actions to address it.

Interest Rate Risk

According to the banks’ disclosures, all three banks assessed interest rate risk using a measure known as net interest income (NII), and two of the three (Signature Bank and Silicon Valley Bank) also disclosed having prepared another measure known as economic value of equity (EVE).[75] SEC requires financial institutions to provide disclosures related to interest rate risk, and public bank holding companies typically comply by providing an NII sensitivity analysis, according to SEC staff. Staff also noted that SEC rules do not require disclosures about EVE sensitivity. NII measures interest income minus interest-related expenses. EVE measures the present value of expected net future cash flows on assets minus the present value of the expected cash flows on liabilities. For example, the economic value of a bond or other debt security that pays a fixed interest rate generally would fall when prevailing interest rates increase.

First Republic Bank and Silicon Valley Bank disclosed certain details about management of interest rate risk but did not disclose breaches of the banks’ respective internal risk tolerances. We discuss below the annual disclosure information describing model results and management and board activities.

First Republic Bank. The bank’s 2021 and 2022 annual disclosures included details showing that its board set limits on interest rate risk. Specifically, management said the board approved policies and limits governing the management of interest rate risk at least annually. In addition, management committees set risk management guidelines and procedures within the board’s limits.

In those annual disclosures, First Republic Bank reported results of interest rate simulation models on NII but did not disclose any information about EVE models. The 2021 disclosures forecast that in 2022 increasing interest rates would lead to higher NII—that is, higher profit from NII.

Bank management also prepared an EVE model, which forecasted that rising interest rates would lead to declining EVE.[76] However, the bank did not disclose this in its Form 10-K for fiscal years 2021 or 2022.[77] FDIC reported that during the second quarter of 2022, the bank’s EVE projections breached its risk limits under several model scenarios of interest rate increases. A board committee and the overall board discussed these breaches in the second half of 2022, and the full board agreed with the decision to take no action to address them. EVE modeling showed risk breaches increasing in the third and fourth quarters of 2022. According to an FDIC analysis, under some model scenarios, the bank would have had negative equity.[78]

SVB Financial Group. The bank’s 2021 and 2022 annual disclosures for SVB Financial Group, Silicon Valley Bank’s holding company, noted that a committee from the company’s board had approved the interest rate risk metrics. The disclosures said the bank used simulation models for NII and EVE to manage risk and monitored those risks on an ongoing basis.

In its 2021 annual disclosure, SVB Financial Group reported model results for both NII and EVE under various scenarios of rising and falling interest rates. The 2021 disclosure showed generally rising NII and falling EVE if interest rates increased. However, in its 2022 annual disclosure, bank management reported model results for NII but did not disclose model results for EVE.

After Silicon Valley Bank failed, we and the Federal Reserve reported that examiners had identified weaknesses in the bank’s management of interest rate risk. A Federal Reserve report found that examiners identified EVE risk-tolerance breaches in 2020, 2021, and 2022. The report concluded that, in April 2022, the company changed model assumptions about the duration of deposits, which gave the appearance of reduced interest rate risk even though the company had not reduced risk on its balance sheet.[79] In November 2022, examiners found that the bank’s interest rate risk simulations were unreliable and instructed management to address the issue within a reasonable period. The company did not include details in its 2021 or 2022 annual disclosures about breaches of its interest rate risk guidelines or choices made by management or the board to address those breaches.

Disclosures at other banks. Among four comparison bank holding companies we reviewed, three described model outcomes in terms of how they complied with internal risk tolerance levels in their 2022 disclosures, and two discussed model results for the EVE measure for which First Republic Bank and Silicon Valley Bank incurred threshold breaches.[80] Specifically:

·       One company that discussed EVE model thresholds disclosed that one of its six management-prepared EVE model scenarios had exceeded risk tolerances and that the modeled breach was less than 1 percentage point above the tolerance. The company said that, in consultation with the board, it opted not to act because it believed its focus on increasing deposits would reduce future EVE exposure.

·       A second company that discussed EVE model thresholds provided NII and EVE model results and stated that the results had not breached risk tolerances for any of the interest rate scenarios that were modeled.

·       A third company described its risk-tolerance thresholds for NII and NII model results, which showed that a threshold from one NII model had not been breached.[81] While this company said it used EVE modeling to manage interest rate risk, it did not discuss EVE thresholds or whether its EVE models breached those thresholds.

The final comparison bank generally described interest rate risk management activities but did not disclose details about tolerances or whether tolerance breaches had occurred.

Liquidity Risk

Signature Bank. The bank’s 2021 and 2022 disclosures noted that it had established board-approved liquidity management policies overseen by a designated management committee consisting of senior officers such as the bank’s chairman, chief executive officer, and chief financial officer. The policies were based on the view that core deposit growth was the bank’s primary source of liquidity. Management said the policies accounted for the source and stability of deposits, the amount of loan commitments, and other factors.

According to examination documents that we reviewed, bank management did not have an effective process for measuring the stability of deposits. Examiners found that the bank’s liquidity contingency policy needed improvement, in part because it did not have supporting rationale for its liquidity stress test modeling. Signature Bank management hired a third party to conduct a study of depositor behavior in 2021 and planned to use the study to revise model assumptions, but the study results were not expected until August 2022.

In addition, Signature Bank management did not provide details in its 2021 annual disclosure that liquidity tolerances had been breached. Examination documents show that breaches occurred between the fourth quarter of 2020 and the third quarter of 2021 for the level of liquid assets necessary to cover potential deposit outflows. Management raised those tolerance thresholds in December 2021, although examiners concluded that management’s rationale for this change was unclear. Signature Bank filed its 2021 annual disclosures in March 2022, after the thresholds were raised. However, the bank used the same language from its 2020 annual disclosure, released in March 2021, describing liquidity management policies that considered the source and stability of deposits.[82]

Disclosures at other banks. None of the four comparison bank holding companies disclosed details about overall liquidity risk relative to internally established tolerances. However, three of the four companies provided some context about overall liquidity risk. Specifically, one company said its liquidity risk tolerances for wholesale funding and brokered deposits—two parts of its overall liquidity risk management activities—had remained within risk tolerances. That company and two others also described relative liquidity risk. Three companies said their sources of liquidity were adequate.

SEC Guidance Does Not Directly Address How Companies Should Assess the Materiality of Risk-Tolerance Breaches

SEC’s Regulation S-K requires all companies to discuss financial condition, changes in financial condition, and results of operations with specific detail about liquidity and operational issues. These disclosures must include “trends or uncertainties that have had or that are reasonably likely to have a material favorable or unfavorable impact on net sales or revenues.”[83] Companies also must report favorable or unfavorable trends in capital resources, including changes in equity. SEC staff said that whether a public company’s breaches of an internal risk-tolerance metric are material information depends on individual facts and circumstances. They added that companies typically consult with attorneys when determining whether the information should be disclosed.

As part of the agency’s mission to protect investors, SEC staff provide guidance on the agency’s website about issues related to fulfilling agency rules and regulations. This guidance includes discussions of specific disclosure topics called Corporation Finance Interpretations that address certain issues that may apply only to a subset of public companies.[84] According to the Division of Corporation Finance, Corporation Finance Interpretations reflect the views of the division’s staff. They are not rules, regulations, or statements of the commission, and the commission has neither approved nor disapproved them. However, this guidance does not directly provide interpretive advice on how to assess whether breaches of internally set risk tolerances would be material information for investors. SEC staff noted that SEC also provides sample comment letters related to disclosure of certain topics such as loan loss and fair value measurements. These sample comment letters, however, also have not addressed evaluating risk tolerance breaches.

After the spring 2023 bank failures, SEC staff provided written public comments to several banks requesting improved disclosures related to interest rate or liquidity risk. Specifically, between July 2023 and December 2024, SEC staff issued comments to bank holding companies that included the following:[85]

·       SEC staff requested that one company provide a materially complete description of how the company managed risks related to changes in interest rates and include the board-approved limits on interest rate risk. SEC staff also asked the company to advise SEC staff about the extent to which the board or relevant management subcommittee approved risk profiles that did not conform to the risk tolerances set by bank management and the board of directors.

·       SEC staff requested that a second company enhance its risk management disclosures, such as by describing specific risk management policies, including established limits for NII sensitivity.

·       SEC staff requested that a third company (1) provide specific metrics used to manage liquidity, including compliance with internal guidelines and limits; (2) disclose more detail about outcomes from interest rate sensitivity models; and (3) expand disclosures to include discussion of EVE metrics or other metrics used by management to manage interest rate risk.

These comments, along with the failed banks’ disclosures, show that breaches of interest rate or liquidity risk tolerances can raise disclosure questions for public banks or their holding companies. Additional SEC staff guidance on how companies should assess the materiality of this information, particularly during periods of rising interest rates, could enhance the consistency of disclosures about liquidity and interest rate risk management, including how model results relate to internally set risk tolerances.

Information about risk-tolerance breaches and related management or board responses could be relevant to investors’ evaluation of how banks are responding to elevated interest rate or liquidity risk. Without such information, investors may have less ability to assess companies’ risk management and provide market discipline through their investment decisions.

Selected Investors Reported Useful Attributes and Continuing Shortcomings in Bank Disclosures

SEC regulations require annual financial disclosures to include certain information, but companies have latitude about the level of detail they provide beyond required information. Banks often adjust the level of detail in their annual financial disclosures in response to investor interest in certain topics, according to most of the 11 investor representatives we interviewed.[86] Banks that do not keep pace with investors’ disclosure expectations risk negative public opinion in the marketplace, some investors said. One investor added that banks may feel greater responsibility than other types of companies to address investor interests because their business relies heavily on consumer confidence.

Overall, bank and bank holding company disclosures contain useful information for investors, most investor representatives reported. For example, certain investor representatives cited the disclosures’ usefulness in providing information to analyze available capital and profitability. Certain investor representatives also highlighted that disclosures for banks were easier to analyze than those for other types of companies.

Some investor representatives also reported that disclosures about concentration risk were particularly important for their analysis of banks because of the risks they can present to bank health. Representatives cited the importance of information on concentrations in assets or liabilities; within certain sectors, such as commercial real-estate lending; and among a certain borrower or set of borrowers. Additionally, one investor expressed concern about disclosures related to lending to nonbank financial institutions, noting that this activity had been increasing but the detail in the disclosures was sometimes not useful.[87]

Most investors also said they reviewed annual disclosures along with regulatory data and corporate presentations for the most complete picture of a bank’s condition because each source has distinct strengths. For example, representatives from one credit rating agency said certain regulatory data can be easier to use than banks’ disclosures for cross-company comparisons because data categories are more clearly defined. Information that companies prepare to accompany investor presentations also can be useful to understand the aspects of results that management is seeking to emphasize, some investors said.

Investors also identified what they saw as shortcomings in the quality of bank and bank holding company disclosures. Investors addressed the following issues:

Allowances for credit losses. Most investors we interviewed highlighted allowances for credit losses—accounting estimates for expected uncollectible amounts—as an area where banks did not provide enough detail. Two investors said banks’ disclosures about these allowances have evolved since accounting standards first required banks to adopt a new reserving methodology called current expected credit losses.[88]

Most investors we interviewed said they generally could not make accurate comparisons across banks’ allowances for credit losses. For example, some investors cited variations in bank management’s level of conservatism or differing methodologies for estimating loan-loss allowances as barriers to bank-to-bank comparisons. Undisclosed model inputs also created uncertainty about the comparability of results, some investors said.

Interest rate-risk models. Some investors said that because risk models are not standardized, it is difficult to compare results across banks. For example, the models are sensitive to assumptions, and banks vary the magnitude of interest rate changes for which they model results. Some banks report model results for potential interest rate adjustments of 100 or 200 basis points, while others report model results for more substantial changes.

One investor identified another shortcoming related to reporting for economic value of equity. Although SEC regulations require bank holding companies to provide disclosures related to interest rate risk—and this typically leads banks to report NII model results, SEC staff said—companies are not required to report results for economic value of equity. This can lead banks either to report EVE inconsistently or not at all, the investor said.

Liquidity. Some investors also highlighted potential improvements in how banks disclose liquidity information. For example, two investors cited the need for more detail about deposits, such as better distinguishing deposits potentially subject to a bank run from those more likely to remain at the bank in times of stress. Another investor identified a lack of detail about banks’ calculations of their liquidity coverage ratio, which measures a bank’s ability to meet short-term obligations to depositors and others in the event of a crisis.

Conclusions

Independent audits of financial statements and management disclosures of material information are critical to efficient functioning of public markets because they help investors make informed decisions. Federal oversight of these audits and disclosures provides additional assurance that companies and auditors are meeting their obligations to investors.

However, public banks without holding companies are subject to a different disclosure review framework than public companies reviewed by SEC. Banking regulators review these banks’ disclosures, but their processes do not require the type of investor-focused qualitative assessment that SEC performs. As a result, investors may have less information available for evaluating risk. The Sarbanes-Oxley Act of 2002 emphasized protecting investors through enhanced oversight of public company disclosures. Reassessing the authority for reviewing these banks’ disclosures would allow Congress to consider whether the current framework meets that purpose.

Our findings also indicate that breaches of interest rate and liquidity risk tolerances can raise disclosure questions for banks and bank holding companies, particularly during periods of rising interest rates. Although SEC staff requested improved disclosures from certain banks on these topics after the spring 2023 bank failures, existing SEC staff guidance does not directly address how companies should assess the materiality of such breaches. Additional guidance could help companies more consistently consider whether these breaches are material information for investors and improve the information available for evaluating banks’ risk management.

Matter for Congressional Consideration

Congress should consider reassessing the authority for reviewing annual financial disclosures of public banks without holding companies for investor protection purposes. (Matter for Consideration 1)

Recommendation for Executive Action

The Chairman of the Securities and Exchange Commission should ensure that the Director of the Division of Corporation Finance provides informal staff guidance, such as through Corporation Finance Interpretations or another public source, on how companies should assess whether breaches of interest rate risk and liquidity risk tolerance levels are material information for investors, particularly during periods of rising interest rates. (Recommendation 1)

Agency Comments and Our Evaluation

We provided a draft of this report to FDIC, the Federal Reserve, OCC, and SEC for review and comment. We also provided relevant excerpts of the draft to PCAOB. In its written comments, reproduced in appendix II, SEC disagreed with our recommendation. FDIC, the Federal Reserve, OCC, SEC, and PCAOB provided technical comments, which we incorporated as appropriate.

In response to our recommendation, SEC said internal risk-tolerance metrics are management tools that can vary significantly across institutions in methodology, calibration, and supervisory context. Therefore, the metrics are not appropriate bases for uniform disclosure standards, SEC concluded.

We agree that bank holding companies’ internal risk-tolerance metrics are management tools that can vary across institutions. Our recommendation, however, does not intend for SEC to create a uniform disclosure standard. In our report, we provide examples of SEC staff’s feedback to certain bank holding companies about potential disclosure improvements related to managing interest rate and liquidity risks. These examples demonstrate that SEC staff believe guidance can be useful even in the absence of a uniform disclosure standard. The recommendation also is not intended to create a finding of de facto materiality when a company breaches a threshold. Rather, it would provide guidance to help companies weigh whether—given economic and market conditions and company-specific factors—disclosure would be appropriate. We modified our recommendation to indicate that such guidance would be informal.

Our recommendation to provide additional guidance has two advantages over the company-specific post-disclosure feedback that SEC noted in its comments. First, SEC does not review all companies’ annual disclosures each year, and therefore SEC staff may not identify all opportunities to provide feedback about improving disclosures on this topic. Second, SEC staff feedback occurs after the annual disclosures are released and investors have digested the information. General guidance that helps companies prepare better disclosures can improve the quality of disclosures at the time of release to investors, rather than after the fact. We maintain that SEC should implement our recommendation.

We are sending copies of this report to the appropriate congressional committees, the Chairman of the Securities and Exchange Commission, the Chairman of the Federal Deposit Insurance Corporation, the Chairman of the Board of Governors of the Federal Reserve System, the Comptroller of the Currency, and the General Counsel of the Public Company Accounting Oversight Board. In addition, the report is available at no charge on the GAO website at https://www.gao.gov.

If you or your staff have any questions about this report, please contact me at ClementsM@gao.gov. Contact points for our Offices of Congressional Relations and Media Relations may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III.

Michael E. Clements, Director
Financial Markets and Community Investment

This report examines (1) selected external auditing standards that present particular challenges for bank audits, (2) the extent to which the Securities and Exchange Commission (SEC) oversees the Public Company Accounting Oversight Board’s (PCAOB) role in monitoring audit quality, (3) the extent to which annual disclosures are reviewed for the protection of investors, (4) bank examiners’ communication with auditors and examination processes for banks’ external audit programs, (5) the extent to which the Federal Deposit Insurance Corporation (FDIC) has obtained civil damages against accounting firms when banks fail, (6) the disclosures of three banks that failed in spring 2023 on selected risks, and (7) selected investors’ views on public banks’ annual disclosures.

To describe selected external auditing standards that present particular challenges for bank audits, we reviewed relevant PCAOB auditing standards, a PCAOB staff summary describing focus areas for audit quality oversight, and an international banking organization’s analysis of challenges in assessing going concern at banks.[89] We also interviewed PCAOB staff and representatives from the Center for Audit Quality, which represents U.S. accounting firms that perform public company audits. In addition, we conducted semi-structured interviews with a nongeneralizable sample of four former or current audit committee members and representatives from five accounting firms.

The audit committee members we interviewed were volunteers who responded to an invitation we developed in collaboration with the National Association of Corporate Directors, a trade association. We selected six accounting firms with the most audits inspected by PCAOB in 2024. (One firm declined to speak with us.) We analyzed responses from all interviews to identify auditing standards that had potential to be particularly challenging to apply in bank audits.

To describe PCAOB’s role in monitoring audit quality, we reviewed documentation related to PCAOB’s standard-setting, accounting firm inspection, and processes for bringing enforcement actions against auditors or associated persons. The materials on PCAOB’s accounting firm inspection process included three staff reports that described the inspection process—one of which described actions taken in response to the spring 2023 bank failures—and 2024 public inspection reports for 14 firms for which PCAOB conducted annual inspections. We analyzed those public inspection reports to calculate the proportion of all inspected audits that were audits of financial companies. We also reviewed documentation describing enforcement activities, including applicable laws, SEC regulations, and SEC and PCAOB enforcement procedures.

To assess the extent to which SEC oversees PCAOB’s role in monitoring audit quality, specifically the Division of Examinations’ role in examining PCAOB, we reviewed internal SEC documentation related to prior and ongoing examination planning and prior PCAOB examination results. We also analyzed two research studies identified from our literature search, discussed below, that addressed outcomes from PCAOB’s accounting firm inspection process. In addition, we interviewed staff from PCAOB, SEC, and the Center for Audit Quality. We assessed SEC’s examination planning activity against its statutory investor protection mission.

To assess the extent to which annual disclosures are reviewed for the protection of investors, we collected and analyzed descriptions of disclosure review processes and documentation of reviews from SEC and the federal banking regulators—FDIC, the Board of Governors of the Federal Reserve System (Federal Reserve), and the Office of the Comptroller of the Currency (OCC). We did not analyze a disclosure review from the Federal Reserve because it did not complete any reviews for 2023 or 2024 annual disclosures.

To understand SEC’s disclosure review process, we reviewed internal policies and procedures from SEC’s Division of Corporation Finance. We also analyzed comment letters that Corporation Finance staff sent to bank holding companies from July 2023 through December 2024. During this period, 10 companies received a letter and met our selection criteria. Specifically, they were bank holding companies that

·       had assets of $50 billion or more;

·       were headquartered in the United States (because foreign companies are required to submit their disclosures on a different form from Form 10-K); and

·       were not global systemically important banks.[90]

To understand the disclosure review processes of FDIC, the Federal Reserve, and OCC, we reviewed documentation describing each federal banking regulator’s disclosure review process for public banks. In addition, we reviewed FDIC documentation on its disclosure review process for the two banks that failed in spring 2023 that FDIC had supervised—First Republic Bank and Signature Bank—and for three of the nine public banks FDIC supervised and for which it reviewed disclosures as of December 31, 2025. From the nine public banks, we selected the two from the largest asset size range and one from the middle asset size range. The nine banks’ assets ranged from less than $1 billion to $41 billion. For OCC, we also analyzed documentation for the one bank disclosure review that OCC performed for fiscal year 2024 annual disclosures.

We also interviewed staff from SEC’s Division of Corporation Finance and the federal banking regulators about their review processes. We compared the agencies’ disclosure review processes to the investor protection focus of the Sarbanes-Oxley Act of 2002. We also referred to our previous work on financial regulatory fragmentation to inform our analysis of how disclosure review authority is assigned across regulators.[91]

To describe communication between examiners and auditors and examiners’ review of external audit programs, we reviewed relevant FDIC and Federal Reserve documentation, including meeting minutes prepared by examiners of the three failed banks from January 2022 through the dates of the banks’ failures. We also reviewed relevant portions of bank examination manuals from all three federal banking regulators to describe the regulators’ policies for evaluating banks’ external audit programs. In addition, we interviewed officials from FDIC, the Federal Reserve, and OCC.

To assess the extent to which FDIC has obtained civil damages against accounting firms when banks fail, we reviewed FDIC documentation on its professional liability program annual reports and other related materials. We also reviewed FDIC’s policy on the use of arbitration. In addition, we reviewed federal district court records from FDIC’s case against the accounting firm that audited First NBC Holding Company—which operated a bank that failed in 2017—and interviewed FDIC officials.

To analyze the failed banks’ disclosures for selected risks and financial results, we reviewed the 2021 and 2022 Form 10-Ks for First Republic Bank, Signature Bank, and Silicon Valley Bank’s holding company (SVB Financial Group). We documented disclosures related to management of interest rate and liquidity risks, since those risks contributed to the banks’ failures. We described the disclosures on these risk management topics and regulators’ conclusions about the companies’ effectiveness at managing interest rate and liquidity risks.[92]

We compared our summary of these disclosures with disclosures from the holding companies for four other operating banks. We selected these banks from among the 39 largest U.S.-based publicly traded banks using data from Bloomberg LP. We then screened them to identify banks whose holding company share price declined at least 10 percent from January 3, 2023, (the first trading day of 2023) to March 10, 2023 (the day Silicon Valley Bank closed) and declined at least 15 percent from January 3, 2023, to May 1, 2023 (the day First Republic Bank closed).[93] Of the 11 bank holding companies that met the criteria, we chose four at random.

In addition, we analyzed the same set of SEC comment letters from 10 bank holding companies described earlier to obtain details about SEC’s public feedback on disclosures related to interest rate and liquidity risks. We assessed the failed bank and comparison bank disclosures and comment letters against SEC’s mission to protect investors.

To describe selected investors’ views on public banks’ annual disclosures, we interviewed 11 investor representatives about the usefulness of annual financial disclosures for understanding banks and making investment decisions or recommendations. These representatives were from the four largest global credit rating agencies, four external money managers that used active investing strategies, and three equity analyst firms.

We selected the external money managers randomly from among U.S.-headquartered firms with at least $250 billion in assets under management as of December 31, 2023, using data published by Pensions & Investments.[94] We selected the equity analyst firms with the largest number of rated banks using data from Bloomberg LP obtained in June 2025.[95] Some external money management firms and equity analyst firms did not respond to our request for an interview. In such cases, we used the same methodology to select the next firm on our list.

To provide context for all of the objectives, we reviewed laws and regulations related to public company disclosures and banking and identified relevant published literature. Relevant laws and regulations that guided all of our objectives included the Securities Exchange Act of 1934, which imposes registration and reporting requirements for public companies, among other matters; the Sarbanes-Oxley Act of 2002, which established PCAOB and its authority over public accounting firms; and SEC Regulations S-K and S-X, which describe public company disclosure requirements.

We identified relevant literature by searching scholarly journals using databases including ProQuest, EBSCO, and Scopus, for peer-reviewed articles published from January 2015 through February 2025, when we conducted our search. We used several variations of keywords focusing on bank audits, bank runs, bank financial statements, and other related topics. From the initial list of articles, we examined summary-level information about each article and more fully reviewed articles that we determined were potentially relevant to the scope of our report. In addition, we obtained and reviewed certain additional literature that we identified through ongoing research.

We conducted this performance audit from July 2024 to September 2026 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

GAO Contact

Michael E. Clements, clementsm@gao.gov

Staff Acknowledgments

In addition to the contact named above, Lisa Reynolds (Assistant Director), Steve Robblee (Analyst in Charge), Noelle Du Bois, Nancy Eibeck, Mac Emery, Daniel Horowitz, Alberto Lopez, Marc Molino, Bryan Prince, and Mary Stack made key contributions to this report.

GAO’s Mission

The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost is through our website. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. You can also subscribe to GAO’s email updates to receive notification of newly posted products.

Order by Phone

The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, https://www.gao.gov/ordering.htm.

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO

Connect with GAO on X, LinkedIn, Instagram, and YouTube.
Subscribe to our Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.

To Report Fraud, Waste, and Abuse in Federal Programs

Contact FraudNet:

Website: https://www.gao.gov/about/what-gao-does/fraudnet

Automated answering system: (800) 424-5454

Media Relations

Sarah Kaczmarek, Managing Director, Media@gao.gov

Congressional Relations

David A. Powner, Acting Managing Director, CongRel@gao.gov

General Inquiries

https://www.gao.gov/about/contact-us