SVB's Collapse: Lessons for Internal Audit

SVB had significant growth in deposits as customers were awash with capital. The Bank decided to invest these deposits in long-dated US government bonds with typical rates yielding 0.5-2.5%. The Bank decided not to increase its loans products using its deposits to obtain a long term rate of return, perhaps as many of its customers were wealthy. Approximately 50% of its assets were in US government bonds.

SVB collapsed in almost two weeks in March 2023. What were some of the reasons why it collapsed so suddenly and what lessons can be learned, especially for internal auditors.

1. Concentration risk – SVB’s customers were based in the northern California region with a customer base as mentioned above. Although regional banks focus on a particular geography, not all focus in a single sector – venture capitalists backing tech and healthcare sectors. These sectors are highly volatile. This can have a profound negative effect on the bank should, or when, these sectors have a downturn.

2. Asset allocation – the sectors mentioned above had a huge boom between 2019 and 2022, which led to substantial increase in deposits held. Most banks would use these deposits to provide loans to customers that would have long term maturities at a decent rate of return. Instead, SVB used most of the deposits to invest in long-dated US government bonds. It perhaps thought this was risk-free investment. These assets were held in its books using the ‘hold-to-maturity’ basis, meaning these bonds would not be sold before their maturity dates and therefore they do not need to be revalued as the market prices for bonds fluctuate. 

As the US central bank, the Federal Reserve, increased its interest rate substantially in a short time frame to battle inflation, this led to the market prices for the US government bonds to decrease. The bonds held by SVB were not revalued as they were held to maturity, but the actual market value of those bonds were significantly down. If there was sound governance with an efficient ALCO (Assets and Liabilities Committee) at SVB, they should have saw the early warning signs from the market and perhaps decided to sell off some of its bonds. Instead, more bonds were bought. 

Word spread fast that SVB’s high levels of bond holdings actual value has significantly decreased. With perhaps customers doubting the level of confidence in SVB’s business model and its management, decided to withdraw its deposits. With the ease of online banking, a substantial amount of deposits were withdrawn. To meet the level of withdrawals, SVB now had to sell the bonds. Consequently, these bonds could not be held to maturity and were revalued to market rates, which resulted in significant write-downs in its value. This sent further jitters and led to further withdrawals of deposits. 

More than 94% of SVB’s depositors had deposited more than $250,000, meaning that not all of the amounts would be insured by the FDIC if it became insolvent. 

Deposits are a key source for many banks’ funds. However, banks mainly use these funds to make loans, such as commercial loans (one year) to mortgages (up to 30 years). The asset and liability mismatch requires careful management and monitoring, which doesn’t appear to have happened at SVB. 

3. High leverage – most banks have a business model that pay depositors a small rate in order to use those funds to operate. Banks lend via loans at rate marginally higher than what they borrow at, thus making a slight spread, which increases as volumes of business increases. Thereby, volumes are key here. They can operate like this on modest equity capital. If the ratio of assets to equity capital is high, this could mean that if there is modest decline in asset prices this can make the banks equity capital insolvent. This is precisely what happened at SVB.

Basel III requires a minimum capital base measured in part by its risk-weighted assets. This measure is based on the credit quality of the bank’s assets. Majority of SVB’s assets were in government bonds, which are considered low credit risk and hence, has a stronger capital base in accordance to the Basel III requirements. The capital base was above the threshold of Basel III’s requirements along with the liquidity coverage. Could the question be asked to the regulator that what good are these measures in preventing an SVB style collapse?

It does seem that the bank’s supervisors were concerned with the level of interest rate risk it carried along with poor risk management. A 10K report showed that unrecognised losses from the asset portfolio were approximately $18 billion (approximately 96% of its capital base). The Chief Risk Officer role was vacant for the majority of the year. All these showed signs of poor risk management and governance at SVB.

4. Adequacy of internal audit – whilst risk management, governance and ALCO were mostly ineffective at SVB, as part of the three lines of defence and the objectivity of the internal audit from the operations management, internal audit should have raised alarm bells. The reason this perhaps did not occur, is that it too had issues of its own.

A letter of concern, written by the Federal Reserve of San Fransisco in December 2022, highlighted that upon its review of internal audit function it was “not fully effective.” The risk assessment process, process to define its audit universe, continuous monitoring process and its audit execution had material weaknesses. An ineffective internal audit function at SVB could be partly blamed for not holding management more accountable and raising early warning flags over its risk management practises. 

Although banks can state they hold high liquid assets, in accordance with Basel III requirements, the level of unrealised losses and its increasing risk of actual losses in a state where they need to be sold, should be given more importance. Whilst many banks lobby governments for reduced regulations, it can be said that an effective regulatory environment that continually improves upon the changing risk environment can keep banks in check to a certain extent. Ultimately, the effectiveness of the board and its risk management processes are key to manage the risks of the bank effectively.