Bank Financial Disclosures: Actions Needed to Improve Oversight of Information Provided to Investors

What GAO Found

Congress and the Securities and Exchange Commission (SEC) require public companies to disclose information that investors would find important when making investment decisions. Disclosures include an annual audited financial statement and a description of risk factors and financial performance. Accounting firms that audit public companies must register with the nonprofit Public Company Accounting Oversight Board (PCAOB), which Congress created in 2002 to focus on audit quality. Certain auditor responsibilities—such as evaluating a company’s accounting estimates and ability to continue as a going concern—can be particularly challenging in bank audits, according to PCAOB staff, auditors, and others.

SEC is required by law to review public companies’ disclosures. However, 11 public banks—including two with more than $80 billion in assets—are not subject to SEC review because they operate without a corporate parent known as a bank holding company. (Two of the three banks that failed in spring 2023 operated without a holding company. Shareholders lost more than $29 billion in investments in these two banks between the end of 2022 and May 2023.) For those banks, Congress charged banking regulators with certain functions and duties of SEC. However, GAO found that banking regulators’ review processes, unlike SEC’s, do not assess disclosures for investors’ benefit. Reassessing disclosure review authority could help Congress determine whether changes are needed to strengthen investor protection.

Comparison of Federal Regulators’ Processes for Annual Disclosure Reviews

Note: Annual disclosures include details on a company’s business, its risks, and operating and financial results.

GAO reviewed 2021 and 2022 disclosures for the three banks that failed in spring 2023 to analyze the information they provided about interest rate and liquidity risks. GAO and banking regulators previously found that weak management of these risks contributed to the banks’ failures. Although each bank described setting thresholds for interest rate or liquidity risk, they did not disclose when thresholds were breached or how they addressed the breaches. SEC also identified other banks whose disclosures on these risk topics could be improved. However, SEC staff have not provided public guidance on how companies could assess whether breaches of interest rate or liquidity risk tolerances are material to investors. Such guidance could help companies assess the materiality of these details and may provide investors with the information they need to make informed decisions.

Why GAO Did This Study

The Securities Exchange Act of 1934 and federal regulations require public companies to provide investors with periodic disclosures about business risks and financial results. Three of the 30 largest U.S. banks failed in spring 2023, shortly after their financial statement audits were completed. Some observers raised questions about whether auditors had properly fulfilled their roles and whether the banks had clearly disclosed material information.

GAO was asked to review oversight of bank financial disclosures and external audits. Among other objectives, this report examines auditing standards relevant for bank audits; oversight of audit quality; SEC and banking regulators’ reviews of public companies’ annual disclosures; and the failed banks’ disclosures about selected risks before they failed.

GAO reviewed PCAOB auditing standards, SEC and banking regulators’ disclosure review processes, SEC public comments to bank holding companies, and the failed banks’ annual disclosures. GAO also interviewed staff from SEC, banking regulators, PCAOB, and accounting firms, among others.