Bank Regulation/Supervision and Bank Auditing

Abstract

We investigate how bank regulation and supervision influence banks’ internal control quality, banks’ financial statement reliability, and the effort expended by bank auditors. Using material weaknesses in internal controls disclosed under Section 404 of the Sarbanes-Oxley Act as the proxy for internal control quality, we find that banks exhibit significantly higher internal control quality than comparable nonbank financial firms. Using restatements of financial statements as the proxy for financial statement reliability, we find that banks’ financial reports are more reliable than those of comparable nonbanks. Using audit fees as the proxy for audit effort, we find that auditors expend less effort in audits of banks than in audits of comparable nonbanks. Collectively, our findings suggest that the combination of bank audits and banking regulation/supervision significantly improves banks’ internal control quality and financial statement reliability, despite auditors expending less effort in bank audits compared to nonbanks.

Keywords:

• Audit quality
• Banks
• Financial statement reliability
• Internal control quality
• Nonbanks

JEL codes:

• G21
• G23
• G28
• M41
• M42

Acknowledgements

We thank the participants of the accounting research seminars at the Copenhagen Business School, University of Groningen, Hanken School of Economics, University of Jyväskylä, Norwegian School of Economics, Pennsylvania State University, Indian School of Business in Hyderabad, and University of Vaasa, as well as the participants of the law, accounting, and business workshop at the University of California, Berkeley. We also extend our gratitude to Beatriz Garcia Osma (the editor), two anonymous referees, Ray Ball, Doug Carmichael, Marie Herly, Chris Hogan, Clive Lennox, Gilad Livne, Gerald Lobo, Arpine Maghakyan, Emma-Riikka Myllymäki, Lasse Niemi, Thomas Ray, Nemit Shroff, and Dan Simunic for their useful comments.

Disclosure statement

No potential conflict of interest was reported by the author(s).

Notes

1 When the auditor assesses higher audit risk, it designs more substantive audit procedures, such as tests of details and substantive analytical procedures, to reduce audit risk to an acceptable level (PCAOB 2024b, 2024c).

2 The primary report for BHCs is the Consolidated Financial Statements for Bank Holding Companies (FR Y-9C). The Federal Reserve indicates it uses an automated system to estimate an organization’s CAMELS rating based on its prior examination results and current quarterly Call report or FR Y-9C filings (FRB, 2017).

3 For example, we do not discuss the National Credit Union Administration (NCUA) and the Farm Credit Administration (FCA). The NCUA is responsible for regulating, supervising, and insuring deposits at federal credit unions. The FCA is responsible for regulating and supervising agricultural lenders in the Farm Credit System and the Federal Agricultural Mortgage Corporation (Farmer Mac). We expect that both the NCUA and the FCA to have little influence on our sample banks and nonbanks.

4 For example, see https://www.occ.treas.gov/topics/supervision-and-examination/bank-operations/financial-crime/identity-theft/index-identity-theft.html.

5 https://www.federalreserve.gov/publications/supervision_bhc.htm

6 https://www.federalreserve.gov/supervisionreg/topics/mgmt_n_internal_control.htm

7 The PCAOB defines inherent and control risks as follows (PCAOB, 2024a): ‘Inherent risk, which refers to the susceptibility of an assertion to a misstatement, due to error or fraud, that could be material, individually or in combination with other misstatements, before consideration of any related controls. Control risk, which is the risk that a misstatement due to error or fraud that could occur in an assertion and that could be material, individually or in combination with other misstatements, will not be prevented or detected on a timely basis by the company's internal control. Control risk is a function of the effectiveness of the design and operation of internal control.’ Auditing standards require that, in assessing inherent risk, auditors must consider external factors including industry conditions, regulatory environment and government policies, how the client addresses those external factors, and the client’s financial performance including key ratios and operating statistics (AICPA, 2021).

8 When estimating equation (1) with LogFEE as the dependent variable, we also control for MW404, because prior studies conclude that auditors charge more for testing internal control over financial reporting for clients that disclose material weaknesses in financial reporting.

9 We include observations with fiscal year-ends after November 15, 2004, because Section 404 became effective for U.S. accelerated filers on that date. The requirement of fic = USA removes subsidiary banks owned by large international banks (e.g., Deutsche Bank).

10 The Federal Bank of New York researchers created the CRSP-FRB Link file to facilitate academic research. The data set links regulatory identification numbers (RSSD ID) from the National Information Center (NIC) to the permanent company number (PERMCO) used by CRSP. The Compustat Bank database sometimes fails to include a firm that previously was a nonbank but that has transitioned to a BHC. We identify 14 such cases using the CRSP-FRB Link file and exclude these firms from the control (nonbank) sample. For example, American Express received Federal Reserve approval to become a BHC in November 2008 during the financial crisis. Despite its change in status from a nonbank to a BHC, American Express does not subsequently appear in the Compustat Bank dataset. The link file is available at https://www.newyorkfed.org/research/banking_research/crsp-frb.

11 We construct entropy balancing weights for banks rather than nonbanks because there are significantly more bank observations.

12 We obtain the odds ratio by exponentiating the coefficient estimate. Alternatively, maintaining the control variables at their mean levels, we calculate the expected probability of material weaknesses in internal controls. This approach suggests that the probability of a bank reporting a material weakness in internal controls is approximately half that of a comparable nonbank.

13 Specifically, FDICIA requires institutions meeting the $500 million asset threshold to have an audit committee consisting primarily of outside directors and to submit an annual report that includes the independent auditor’s report to the audit committee and management reports that state management’s responsibility for establishing and maintaining adequate internal controls over financial reporting. Institutions meeting the $1 billion asset threshold must also have a completely independent audit committee, adhere to expanded management reporting requirements, document and test key information technology (IT) controls, especially those that relate to or impact the financial reporting process, and include a report from the external auditor on the effectiveness of the banks’ internal controls.

14 Similarly, the BANK indicator variable in audit fee (deflated by the square root of total assets) regressions in Simunic (1980, Table 8) is negative. His estimates suggest that deflated audit fees for banks are only one-fourth (≈(13.61-9.79)/13.61) of the deflated audit fees for nonbanks.

15 Agarwal et al. (2014) estimate BRL using proprietary data from the ‘alternating examination program.’ Their BRL measure is based on data from 1996 to 2010, while our study is based on the sample period from 2004 to 2020. Consequently, there is some temporal measurement mismatch.