The recent events surrounding Silicon Valley Bank have been both shocking and eye-opening. From the depositors who faced near death experiences, the shareholders who lost all their money, and the taxpayers who supported the bailout, it’s clear that there were multiple levels of oversight that failed to stop this disaster from happening. In this week’s episode of Compliance into the Weeds, Matt Kelly and myself explored the roles of KPMG, the Board of Directors and management, institutional investors, and the regulators, to uncover the lessons the compliance professional can take away from this debacle.
There were three key areas that SBV and those who advised it failed in. They included:
- Failures in identifying the poor risk management practices and the lack of assurance around the bank’s ability to access emergency cash.
- Failures by the Board of Directors and senior in responding to the red flags raised by the BlackRock consultants.
- Failures by SVB who was not prepared with a plan to resolve the crisis when it occurred.
Poor Risk Management Practices
The first step in understanding the lack of assurance around the bank’s ability to access emergency cash is to identify its poor risk management practices. KPMG, the banks’s auditors, may have given an anodyne report that stated there was no material risk of misstatement, but they could not have predicted the strategic risks that SVB was taking. SVB got into trouble around its financial assets, namely low-interest rate loans that SVB issued in the late 2010s. When the Federal Reserve started jacking interest rates to cool down inflation, the value of those loans fell. It put the bank in a precarious position. It is not clear what the bank’s management did but whatever it was, it was clearly insufficient.
Board and Senior Management Failure to Address Red Flags
Both the Board and senior management failed to respond adequately to the red flags raised by the BlackRock consultants, who SVB hired in late 2020, to look at their risk management practices. According to the report, SVB failed 11 of 11 criteria for risk management, indicating that there were serious issues present. This assessment should have been a red flag for management and the board’s risk committee, which met 18 times in 2022. It is not clear whether they discussed the BlackRock consultants’ report, but it is clear that the risk of rising interest rates and the lack of hedging to offset these risks was ignored. Despite this, the bank declined to pursue the opportunity for improvements.
Moreover by this time, the San Francisco Fed had already given Silicon Valley Bank at least six citations for poor risk management practices and not doing enough to assure easy access to emergency cash. This should have been a warning sign to both regulators and investors, yet it seems that no one was prepared for the eventual collapse of the bank. This oversight deficit points to a lack of communication and assurance from the board and management to the public, which is a key compliance lesson for other organizations.
Lack of a Plan
Clearly, SVB was not prepared with a plan to resolve the crisis when it occurred. There was a clear lack of communication between the board and management of Silicon Valley Bank, it’s audit firm, and the regulators. The board and management of Silicon Valley Bank were aware of the risks that their strategies posed, as evidenced by their hiring of BlackRock consultants to assess their risk management processes. However, they failed to take the necessary steps to address the issues identified by the consultants, leaving the bank exposed to the risk posed by rising interest rates. The auditors also failed to point out the strategic risk of the bank’s holdings, instead offering an anodyne report that did not indicate any risk of material misstatement or substantial doubt about the bank’s ability to continue as a going concern. Finally, the regulators, such as the San Francisco Fed, had raised multiple red flags about Silicon Valley Bank’s risk management practices and potential lack of access to emergency funding, yet they failed to create a plan to address these issues before the crisis occurred. As a result, the public, investors, and depositors were left in the dark, without a plan to respond to the crisis.
The collapse of Silicon Valley Bank is a stark reminder that organizations need to take effective steps to ensure proper oversight and risk management. This includes both board and management members being aware of the risks posed by their strategies, engaging with auditors to assess the risks, and having a plan in place to deal with potential crises. The Silicon Valley Bank case serves as an example of what can happen when these steps are not taken and the consequences of such a failure. It is up to organizations to learn from this case and take the necessary steps to ensure that a similar disaster does not occur again. Despite the gravity of the situation, there is still hope that organizations can achieve the same level of compliance and oversight by following the lessons from this case.
Check out the full episode of Compliance into the Weeds, here.