Reliance on Third Party Verification in Bank Supervision

Abstract

We examine how third party verification of internal controls over financial reporting (ICFR) affects bank supervision by exploiting a change in size thresholds for required FDICIA-related internal control audits. We document that affected banks have higher reported levels of non-performing loans after the removal of internal control audit requirements compared to unaffected banks. This increase in non-performing loans is not accompanied by increases in past due loans, indicating more forthcoming reporting by management rather than operational deterioration. Furthermore, we find that the effects are concentrated in periods of heightened regulatory scrutiny and in banks with less stringent oversight in the pre-period. Examiners increase the length of targeted examinations and downgrade regulatory ratings, indicating an increase in stringency after the elimination of third-party verification of internal controls over financial reporting. Our findings suggest that third-party verification of internal controls is an imperfect substitute for bank supervision and efforts to rely upon externally generated assurance may heighten bank risk.