I The reinvigorated role played by internal and external gatekeepers

After each wave of corporate upheaval and financial scandals, scrutiny invariably descends on business transactions, on apparent errors in corporate disclosures and on shortcomings in supervisory practices. The 2008 Great Financial Crisis (GFC) pointed out sheer weaknesses in the risk management, control and governance processes of financial institutions, as well as in their statutory audit and financial supervision. Trust in the banking sector and in the role played by gatekeepers faded away, eventually deterring the public from using the financial systemFootnote ¹ and thus undermining the stability and integrity of the economy at large.Footnote ² Lack of public confidence and the urge to regain it have never been so high a priority on the agenda of regulatory agencies worldwide, including the introduction of the “Volcker Rule” in the United States,Footnote ³ the move to a Banking Union in the European Union (EU)Footnote ⁴ and initiatives aimed at establishing an Asia-Pacific financial market.Footnote ⁵ As empirical research shows, in fact, citizens’ acceptance of any economic or social activity is directly correlated with the level of institutional trust, and, therefore, the presence of the public character of regulatory governance as an institution, underpinning the investment economy, is necessary to facilitate acceptance of private investment risks and participation in the investment economy.Footnote ⁶

In the aftermath of the GFC, policy- and law-makers have strived to address and rectify the shortcomings identified during the crisis by taking various sweeping initiatives to reform the financial architecture. Especially in Europe, a regulatory and supervisory overhaul came about. In fact, in just a few years the call for harmonisation, integration and mutualisation of resources came together in the establishment of the Banking Union in the quest to strengthen the banking sector contribution to the overarching goal of creating the single market (Article 3 TEU and Article 26 TFEU).

As appropriate as the EU reaction to the financial crisis is commonly perceived to be, the banking sector ended up being even more complicated than before. In fact, the supervisory architecture was expanded and the layers of complexity stratified, calling for a closer look at interactions and interlinkages between the wide set of regulatory and supervisory actors. This increased complexity in interactions between gatekeepers is but a mirror image of the complexity of interactions in the marketplace, between and within financial users, financial institutions and financial gatekeepers.

The myriad of intricate, constantly evolving and often undetected interconnections that shape modern financial intermediation amounts to one the main triggers of the market and regulatory failures.Footnote ⁷ Complexity of interactions between international standard setters, governments, NGOs, policymakers, supervisors, and financial services users is, in fact, projected to generate significant asymmetries of information within financial markets.Footnote ⁸ Not only do these interconnections between such a broad array of economic actors make it more costly to identify and monitor potential sources of risk within the financial system, but they also entail a great deal of knowledge fragmentation. Each actor or constituency retains some informational power and contributes in de-centering the production of information and knowledge,Footnote ⁹ which exacerbates the transactions costs borne by financial regulators and supervisors engaged in discharging their duties.Footnote ¹⁰

Such fragmentation into multiple centres of knowledge has led to a further prioritisation of governmental and supervisory agendas, relating to closer cooperation between internal and external gatekeepers, namely supervisors, and external and internal auditors, to overcome information asymmetry and to deal with shortcomings in the overall architecture of banking supervision.Footnote ¹¹

This article approaches the trend to reinvigorate the use of both “internal” and “external” gatekeepers in financial regulation, delegating (or co-opting) the compliance functionFootnote ¹² and enlisting external auditorsFootnote ¹³ to serve regulatory objectives respectively. We intend to move the debate forward, to address questions pertaining to the interaction between the “internal” and “external” gatekeepers and the possible implications for the efficient allocation of regulatory resources. In doing so, we adopt a multidisciplinary approach, drawing on research concerning multiple gatekeepers’ liability and elaborating upon the recent legal scholarship that qualifies the contemporary compliance department as the product of a de facto government mandate.

The main objective is thus to engage in a scholarly debate and provide a solid framework for dialogue between policymakers, supervisors and scholars of financial law and corporate governance.

The remainder of this article proceeds as follow. The next section scrutinises the role of gatekeepers and elaborates on the theory of multiple gatekeepers. Section III approaches compliance as a delegated form of external enforcement. External auditors are analysed in section IV. The article moves on in sections V and VI to look closely at the relationship between regulators/supervisors and internal and external gatekeepers. In that respect, the following critical issues will be dealt with: (i) the scope of the additional audit work external auditors would have to do; (ii) what information they would share with regulators/supervisors; (iii) their incentives for sharing information, including any sanctions or liability. The article then closes with a brief conclusion.

II External auditors and the “multiple gatekeepers” framework

At its simplest, gatekeepers are regarded as independent professionals who are interposed between investors and managers in order to play a watchdog role that reduces the agency costs of corporate governance.Footnote ¹⁴ Corporate governance indeed depends upon “gatekeepers” to protect the interests of investors and shareholders, and/or other constituencies, by monitoring the behaviour of corporate “insiders” and by reporting the financial results of corporate performance in an accurate and unbiased fashion that permits objective valuation of the firm. Attorneys, investment bankers, and, most of all, auditors are the paradigmatic examples of “gatekeepers”.Footnote ¹⁵

Auditors, in fact, review the preparation and presentation of financial statements, reviewing not only the work product of companies’ financial officers, but also the manner in which such information is collected and prepared. Credit rating agencies review financial products and provide assessments of creditworthiness.Footnote ¹⁶

In financial institutions, the external auditor has been rightly qualified as a “supervisory gatekeeper”, since it has additional responsibilities and interests to serve.Footnote ¹⁷ Over time, financial regulators have more explicitly stated the degree to which they expect these gatekeepers to serve a public function. Indeed, in some jurisdictions, not only is the external auditor providing a view on the accounts of a bank but also it is required to work with the regulator to oversee the bank and its activities in the supervision process. In the U.S., for instance, section 404 of the Sarbanes-Oxley Act (SOX) expanded the role of auditors, requiring them to certify the effectiveness of companies’ internal controls. Section 404 thus represents an application of a private supervisory strategy to the supervision of public companies. The Securities and Exchange Commission (SEC) enshrined the status of certain credit rating agencies by designating them Nationally Recognized Statistical Rating Organizations (NRSROs) and promulgating an additional regulation, allowing parties to rely on ratings provided by NRSROs.Footnote ¹⁸

However, there have been a number of high-profile examples of gatekeeper failure in recent years, having cast doubt on their ability to fulfil this role. Such failures started from high-profile corporate collapses in the early years of this century, such as Enron, Worldcom and Parmalat, and continued with concerns about their role arising from the global financial crisis, in particular, the role of credit rating agencies (CRAs) in relation to their underestimation of the credit risk of structured credit products.

The recent debate about the failure of credit rating agencies to provide accurate ratings of various subprime mortgage products reflects the degree to which regulators and the public have come to expect these private gatekeepers to serve a supervisory role.Footnote ¹⁹ This debate stems from expectations that customers and investors had in the competence of these credit rating agencies to provide accurate ratings, and regulators encouraged this expectation by relying on the ratings themselves. In short, the regulators deputised the rating agencies in their efforts to supervise the activities of the financial institutions.Footnote ²⁰ Credit rating agencies, in turn, have denied they are part of the regulatory apparatus, arguing that they are merely expressing private opinions. Nevertheless, as shown in the Dodd-Frank Act, Congress and the SEC intend to bind the credit rating agencies even more tightly to the supervisory framework. The Act requires NRSROs to strengthen internal controls, requires NRSROs to disclose rating procedures and methodologies, provides investors with a private right of action against NRSROs, and grants the SEC and its new Office of Credit Ratings greater enforcement and examination tools.

On the other hand, the magnitude of scandals and failures also served as a caveat for the lack of any formal structure to best utilise what the external auditor can offer to the supervisory process. In fact, anecdotal evidence shows that the soft forms of regulations currently in place (such as codes, memorandum of understanding, practices) bring about inconsistencies and bad use of “audit knowledge”.Footnote ²¹

As analysed by Professors Chris Brummer, David Zaring and Pierre-Hugues Verdier,Footnote ²² international standards are various and divergently implemented into national legal systems, opening up a scope for arbitrage in the design of corporate compliance and review by national supervisors, especially when firms operate in a cross-border fashion. This holds particularly true for the interaction between supervisors, external auditors and internal corporate controls, as international practices show.

Literature on gatekeepers up until recently has overlooked the multiple gatekeepers’ phenomenon. The paradigmatic conception is, in fact, a unitary actor. Legal and economic scholarships alike have assumed either that it alone acts on a business transaction or that, where it is one of multiple gatekeepers participating, each gatekeeper’s action is independently capable of deterring corporate wrongdoing.Footnote ²³

However, such a view does not account for the fact that traditional roles and skills among gatekeepers are relentlessly overlapping, and so are the areas of expertise and spheres of influence. Professor Andrew F Tuch conceives of multiple gatekeepers as acting as a unified gatekeeping body, a “gatekeeping web”. Despite such a framework being developed with specific reference to the liability matter, it offers surprisingly much help in explaining how regulators might benefit in enlisting internal and external gatekeepers/auditors to serve regulatory objectives.Footnote ²⁴

The explanatory nature is twofold: first, it contributes in emphasising the interactions between multiple gatekeepers; second, it offers a solid working hypothesis to detect shortcomings that can arise from such interactions, namely, relating to fragmentation and construction of knowledge (information asymmetry).

Let us elaborate further on these two aspects. Not only does the multiple gatekeepers’ framework acknowledge the existence of an interrelation between different watchdogs, but most importantly it also provides a different diagnosis of wrongdoings, scandals and, in general, market failures.

Market failures are indeed based on a different understanding of gatekeepers’ roles, and of the relationship between them. Instead of looking at the failures and deficiencies of the unitary actor, the analysis should be centred on the interactions and the complexity that such interactions bring about. There is an implicit recognition that misuse or ineffective use of gatekeepers’ knowledge is due to the interdependencies between multiple gatekeeping actors. Those interactions are complex and intricate, as actors are diverse in their goals, intentions, purposes, powers and duties.

The second aspect, ie the problem of fragmentation, is beyond the mere information asymmetry between gatekeeper and supervised entity. It is rather based on the premise that no single gatekeeper is likely to gather all the knowledge required to fulfil its duty, and no gatekeeper is likely to have the overview necessary to promptly detect an enforcement problem, employ the instruments needed, and eventually solve it. Such shortcomings call for construing models that formalise interaction and information exchange. Yet, such an argument holds insofar as an overarching common goal, translating into an obligation or duty to cooperate and exchange information, is to be found. In fact, gatekeepers seem to undertake similar functions, while they actually serve different purposes and bear different responsibilities.

In the context of banking regulation, financial regulators/supervisors and external auditors are indeed projected towards different goals. They pursue a public and a private purpose, respectively.Footnote ²⁵ The supervisor is entrusted with the task to protect market confidence and depositor and investor interests, as opposed to the interests of company shareholders, as served by the external auditor.Footnote ²⁶ This, in turn, implies that the banking supervisor is predominantly concerned about future viability, whereas the external auditor looks at the past performance and viability. In serving the primary interests of company shareholders, on the other hand, the external auditorFootnote ²⁷ expresses an opinion as to whether the financial statements provide a “true and fair”Footnote ²⁸ view. The audit is based on a contractual relationship expressed by a letter of engagement between the auditor and the client. The letter indicates the responsibilities of both the auditor and the board of directors, and details the scope of the audit and the nature of the engagement.Footnote ²⁹ The private interests associated with risk capital of shareholders in comparison to the public interests, associated with compliance with prudential regulatory requirements, set the obligation on the regulator/supervisor higher. To fulfil their respective responsibilities, however, both the regulator/supervisor and the external auditor undertake a process of verifying information and representations as to its accuracy and reliability provided by the directors and management of a firm.

Gatekeepers have diverse goals, powers and duties, and yet their actions and activities do intersect; and such intersections, or “informational nodes”, are the places where interdependencies and modes of interaction should be examined.

In other words, enrolling gatekeepers to serve regulatory objectives could be seen as a form of enforcement co-production, enabling the regulator or external auditor to make an accurate assessment and possibly initiate enforcement actions to deal with any corporate failures.

The interdependencies between banking supervisor, external auditor and compliance in financial institutions bring about problems of multiple centres of information gathering and creation, and raise coordination dilemmas. Lack of coordination between external and internal gatekeepers might, in fact, result in market failures, protracted dialogue and inefficiencies leading to ambiguity and inconsistencies. In the next section, we will discuss the increasing role of compliance and internal control as a form of delegated public enforcement.

III Compliance as a delegated form of external enforcement

There is a wide consensus that substantial failures in corporate governance have been a contributing factor to the GFC.Footnote ³⁰ Although some commentators have argued that corporate governance reforms have so far fallen short of what many had expected,Footnote ³¹ further policies and interventions are seen as essential in reducing the risk of a repetition of a major financial crisis. In particular, the GFC has prompted renewed discussions of the importance of board-level procedural safeguards, including the introduction of legally binding rules to promote board-level risk management committees and the requirement that a chief risk officer (CRO) be appointed to improve board expertise regarding risk management issues.Footnote ³²

At the international level, there has been much debate regarding how the corporate governance procedures of financial institutions could be used to improve risk management. This could be done, for instance, by creating a board-level risk management committee; altering board member incentives through varying remuneration schemes; improving oversight; and imposing other substantive rules on compensation with the ultimate goal of promoting financial stability.

The guidelines issued by the Basel Committee on Banking Supervision (BCBS) in 2015 on corporate governance principles for banks emphasise the importance of proper risk management procedures, including, in particular, “an effective independent risk management function, under the direction of a chief risk officer …, with sufficient stature, independence, resources and access to the board”.Footnote ³³ Furthermore, “the sophistication of the bank’s risk management and internal control infrastructure should keep pace with changes to the bank’s risk profile, to the external risk landscape and in industry practice” so as to identify, monitor and control risks on an ongoing bank-wide and individual-entity basis.Footnote ³⁴

The Organisation for Economic Cooperation and Development (OECD) reaches similar conclusions in that such procedures, especially the position of the CRO, are necessary to better manage the particular risks that banks pose to the larger economy, combining a micro- and a macro-prudential approach to supervision. Likewise, the recent Green Paper of the European Commission on corporate governance at financial institutions and remuneration policies outlines the perceived inadequacies of board-level risk management. Such inadequacies include, in particular, “a lack of understanding of risks”, “a lack of authority […] to be able to curb activities of risk takers”, “a lack of expertise […] in risk management” and “a lack of real-time information on risks”.Footnote ³⁵ Consequently, the Green Paper envisages the following recommendations with regard to risk management: (i) delineating board-level responsibilities; (ii) creating a board-level risk supervision committee; (iii) creating a position of chief risk management officer having familiarity with the “organisational complexity” of the relevant firm; and (iv) increasing cooperation, not only between relevant supervisory authorities and boards of directors, but also between the risk supervision committee and other parts of the firm.

It follows from the above that internal control system reforms should accompany corporate governance reforms to ensure that banks enhance the quality of their risk-taking, either through curbing misaligned incentives or otherwise reducing the riskiness of business strategies. From this vantage point, the GFC showed that the weakness or ineffectiveness of such procedural safeguards was indeed significant.

Scholars have argued that the overarching rationale for regulating internal control systems is to maximise the efficiency and effectiveness with which exposure to risk is managed.Footnote ³⁶ Efficiency is thus a central goal of international standard setters and it appears to have been transposed to the agenda of policymakers and regulators worldwide. As far as internal control systems are concerned, efficiency includes, in our view, the way in which work is performed (in terms of qualifications, professionalism and resources), the model/structure underlying the parties involved in the process and the interaction between those parties. This observation holds particularly true for banks.

Legal scholarship on the law of compliance is gathering momentum, as supervisors and regulators are increasingly “delegating” enforcement activities traditionally performed by the state to “internal gatekeepers”. Internal controls and compliance function have been studied as a form of internalised law enforcement, consisting of efforts banks undertake to ensure that the firm, and its employees, do not violate applicable rules, regulations or norms. The greater involvement of internal gatekeepers in supervisory activities has been researched by Sean GriffithFootnote ³⁷ and Geoffrey Miller.Footnote ³⁸

Professor Griffith maintains that compliance policies and activities are not to be conceived as a typical governance matter to be handled at the discretion of the board of directors. They do not fit traditional models of corporate governance – coming from the board of directors, state corporate law, or federal securities law – but rather amount to an internal governance structure imposed upon the firm from the outside, by enforcement agents.

Indeed, compliance developed over time to represent traditional corporate constituencies, such as shareholders, managers, employees, creditors, or customers. Instead, its rationale comes from the government. “Compliance is a de facto government mandate imposed upon firms by means of ex ante incentives, ex post enforcement tactics, and formal signalling efforts”.Footnote ³⁹ The imposition of governance structures aimed at compliance is a novel exercise of government power since through compliance, the government dictates how firms must comply, imposing specific governance structures, expressly designed to change how the firm conducts its business.

On the other hand, Professor Miller advances a novel theory on the boundaries of internal governance, questioning the reliability of the three lines of defence metaphor in describing the internal control system and compliance function. The metaphor turns out to be incomplete and inaccurate, as it omits to mention other important controls that serve to catch and correct problems that get past internal audit: the board of directors (especially the audit committee), the external auditor, and, for regulated firms such as banks, the government supervisor.Footnote ⁴⁰ Even more broadly, the concept of control includes figures such as activist shareholders, proxy advisory firms, takeover bidders, and the financial press, all of whom, to one degree or another, monitor the behaviour of the organisation’s managers. The metaphor of the three lines of defence also fails to capture the ambiguous role of the second and third lines, which are supposed to operate as independent.

This insight has important implications, both practical and theoretical, in terms of the traditional problems of agency costs and information asymmetries.

In fact, the compliance function destabilises the common wisdom that corporate governance arrangements are to be the product of a bargain between shareholders and managers. Departing from the current theory of the firm, as framed in terms of “nexus of contracts”,Footnote ⁴¹ “transaction cost economics”Footnote ⁴² or “property rights”,Footnote ⁴³ compliance amounts to the extra-firm imposition of intra-firm governance. It, therefore, represents a sui generis corporate arrangement that is designed to foster cooperation between the “inside” and the “outside” of the firm.

In fact, traditionally, the board retains primary authority over the firm. In that respect, it exerts the power to alter the firm’s governance at will insofar as it complies with the corporate law and the limits contained in the charter and bylaws.Footnote ⁴⁴ By contrast, compliance does not arise from the delegation of the board, nor is the compliance function wholly subordinated to the board. Despite compliance being required to report to the board, the board does not have ultimate authority over the compliance function. Indeed, as Sean J Griffith maintains,

The imposition of a compliance function for financial institutions is but a governmental acknowledgment of the need for a line of defence before a firm’s irregularities may become externalised. In that sense, internal control procedures might be seen as an ex ante strategy to secure regulatory objectives. In fact, internal control functions are better placed to monitor the firm from the inside, and support the regulatory supervision and enforcement.

Most importantly for the purposes of this analysis, the compliance function thus represents a legal response – as gatekeeper’s role is legally mandated – to the problem of information asymmetry.

Compliance provides a measure of assurance to supervisors as to the accuracy of corporate information and disclosures, reducing information costs. As a matter of fact, along these lines, the recent update of the European Banking Authority (EBA) Guidelines on internal governance requires banking supervisors to “establish effective and reliable mechanisms to enable institutions’ staff to report to competent authorities relevant potential or actual breaches of regulatory requirements”, thus acknowledging the relevance of the internal control functions (most importantly, compliance and risk management) as a centre of knowledge construction.Footnote ⁴⁶

What makes compliance unique within the constellation of functions and procedures forming the internal control system is its position in the firm.Footnote ⁴⁷ It is, in fact, strategically positioned to gather information, monitor risk, and report to those who are running the business. The compliance function is directly connected to the management body, to advise on measures to be taken to ensure compliance with applicable laws, rules, regulations and standards.Footnote ⁴⁸ This connection to the management board is essential. Indeed, the “influence”, ie advice, is directed at the functional level of the firm where the business actually operates.

Monitoring and overseeing the internal affairs of the organisation from this standpoint makes the compliance function a special centre of knowledge creation. The information collected by means of this strategic position and peculiar task, in fact, is essential from a regulatory perspective.

The enlisting trend, to our mind, is but the mirror-image of the new regulatory strategy characterised by the introduction of more ex ante pre-emptive regulatory measures. The need to ensure an adequate supply of “financial stability” as a public good, led to a resurgence in public regulatory power.Footnote ⁴⁹ However, the financial sector still resides in a “decentred” regulatory space, whereby public and private actors both contribute to and influence governance and law-making.Footnote ⁵⁰ In fact, no amount of re-regulation can elevate the state to a position of substitute for the variety of actors in governance that have arisen, nor is that an ideal position from either a practical or normative point of view.Footnote ⁵¹ Pagliari qualifies the post-crisis financial regulation reforms as a resurgence of public regulatory power, but opines that the substance of the reforms continues to leave much reflexive implementation to the “private” realm (ie the financial sector and markets).Footnote ⁵²

In the decentred regulatory space, financial institutions themselves have been regarded as key in producing internal governance and controls to connect the private justice of the internal system to the public justice of accountability. In the EU, for instance, the Markets in Financial Instruments Directive (MiFID II, Directive 2014/65/EU) provides for broad principles of organisational soundness, the establishment of internal controls such as a compliance function, risk management systems, internal audits and the responsibility of senior management for internal control generally. Parker uses “meta-regulation” to refer to such capacity to self-regulate, which may be enhanced by value orientation, management commitment, the acquisition of skills and knowledge, and the design of internal processes and systems. “Meta-regulation” refers to a regulatory approach that empowers and enhances the capacity of corporations to self-regulate, but connects “the private justice of the internal management system” to the “public justice of accountability”.Footnote ⁵³ Andenas and H-Y Chiu specify that these broad frameworks are proxies for achieving the outcomes of prudential soundness and robust conduct of business. Firms have, in fact, the responsibility and discretion to implement the broad frameworks into firm-based systems and procedures. On the one hand, organisational structures and arrangements cannot be excessively prescribed, as regulators are not in a position to micromanage firms, but on the other hand, financial institutions are relied upon to design a proportionate and appropriate form of compliance that meets regulatory objectives.Footnote ⁵⁴

Meta-regulation is, therefore, a form of cooperation and interaction between internal and external, private and public, actors by co-opting firms into designing solutions that may be more appropriate for both of them. Now, the critical characteristic of meta-regulation lies in firms’ conflicting objectives in designing risk management systems and the inability of regulators to critically evaluate these systems.Footnote ⁵⁵ Coglianese and Mendelson qualify this difficulty as one of “complementarity” between firm goals and regulatory goals, and the lack of complementarity may affect the effectiveness of the meta-regulatory regime in achieving public regulatory goals. Regulators and supervisors would need to evaluate firm-designed solutions against the public good of financial stability, but it is not easy to make the connection between what is observed at the micro-level and what such micro-level behaviour may portend at the macro-level.Footnote ⁵⁶

In enlisting internal control functions, regulators and supervisors are calling for a form of cooperation to counter information asymmetries. In fact, supervisors continue to face limitations in resources and in knowledge creation and are likely to rely on the financial sector to supply expertise and material information. Internal controls and compliance involve using expertise, interests and resources of private actors in the regulatory space as “surrogate” regulators, thus providing a range of policy instruments and instrument mixes for addressing any governance issue.

From internal to external, the same considerations hold true mutatis mutandis for the role played by the external auditor, which will be discussed in the next section.

IV Enlisting external auditors in financial regulation

In many countries, supervisors have traditionally relied on the work performed by external auditors, for instance, by using them for on-site inspection functions.Footnote ⁵⁷ In most jurisdictions, auditors have a duty to report or alert banking supervisors regarding certain matters. In the EU, Article 12(2) of Regulation (EU) No 537/2014 on specific requirements regarding the statutory audit of public-interest entities,Footnote ⁵⁸ includes the requirement that an “effective dialogue shall be established between the competent authorities supervising credit institutions, on the one hand, and the statutory auditor(s) and the audit firm(s) carrying out the statutory audit of those institutions, on the other hand”.

Not only was the absence of a dialogue and relationship between the auditors and prudential supervisors in the pre-crisis period identified as a significant weakness, the lack of harmonised rules and practices across countries was also identified as a weakness.Footnote ⁵⁹ In fact, despite some supervisory authorities being empowered to ask external auditors to perform certain types of tasks outside the scope of the audit, this varies depending on the jurisdiction. This creates a great deal of confusion regarding where the responsibilities of external auditors start and where they end, blurring the line between what is legally required as part of the audit mandate and what is just a common practice. For instance, verifying that items with a particular supervisory interest are registered correctly in the financial statements and/or in the corresponding supervisory returns (ie correct breakdown of credit risk items, impaired assets, expected losses in the context of a business combination) is an additional task performed as a common practice and not as a legal requirement.Footnote ⁶⁰

A number of cases over the past decade have shown that, even when dialogue had been established, supervisors and external auditors were not incentivised to contribute to each other’s tasks.Footnote ⁶¹ A survey conducted by the Bank of England shows that although 70% of supervisors have access to audit information, either directly or through the bank being supervised, only 50% review this information as part of their regular inspection of banks.Footnote ⁶² On top of that, only a few supervisors request a Long Form Audit Report (LFAR) along with an annex to the financial statements.Footnote ⁶³ That said, empirical evidence brings to the fore the question of whether the work performed by external auditors should be relied upon. Indeed, recurring deficiencies have been detected in the external audit of SIFIs relating to judgemental elements of balance sheet items or processes.

The cross-cutting issues involving supervisors and external auditors lend this area a high mark of interest from a practical standpoint. In that respect, several initiatives have been undertaken to improve the interaction between supervisors and external auditors. In particular, the BCBS explored such issues and found a positive correlation between an enhanced relationship, on the one hand, and an improved audit quality of banks’ financial statements and effective banking supervision, on the other.Footnote ⁶⁴ Similar conclusions and recommendations were formulated by other standard setters, regulators and supervisory agencies, such as the EBA,Footnote ⁶⁵ the Bank of England and the World Bank.Footnote ⁶⁶

The external auditor could indeed be a valuable ally for the supervisory authority, particularly in areas where skills and resources are scarce.Footnote ⁶⁷ The GFC underscored the importance of closer cooperation between external auditors and banking supervisors – who possess distinct skills and knowledge – in improving the oversight of banks’ activities and overcoming weaknesses in the risk management, valuation, control and governance processes of banks as well as in their statutory audit and financial supervision.Footnote ⁶⁸

The PRA put forward strong arguments supporting the valuable ancillary benefits of auditor‑supervisor dialogue, and, particularly, the discussions that take place around accounting and auditing issues. Such discussions help to improve the quality of external audits, especially in situations where auditors are notified of key areas of regulatory interest in advance. Dialogue ahead of an audit engagement provides the auditor with a better understanding of how regulators use financial statements in their decision-making process. This focus on issues of regulatory interest may also allow the auditors to challenge firm management at a greater level of granularity than would otherwise be the case, to the benefit of the overall risk management system.

Supervisors and external auditors are important contributors to an effective control system and are endowed with the power to challenge the system itself. Better communication and closer interaction between supervisors and external auditors can add to the efficiency of the control system by capturing deficiencies and weaknesses in the first and second line of defence, thanks to information that would not be available otherwise. Besides, such an interaction has the potential to foster the creation of an environment that supports the independence, objectivity and integrity of internal and external audit work. In that respect, the reliability of external auditors’ performance and output could be enhanced by the supervisor ensuring that the process for external auditor appointment was fair, objective, transparent and independent of the bank’s management, and well documented.

In that respect, in aiming at reinforcing the overall consistency of controls, the scope of information, the form of communication and the timing/frequency of communication are important elements to be dealt with: (a) regularity of information provided: (i) definition of the terms and scope of the interaction; and (ii) exchange of information before and during the audit engagement, allowing flexibility (eg ad hoc meetings whenever necessary); (b) quality of interactions: (i) ex post feedback on quality of interactions and information-sharing; and (ii) regular assessment of independence and objectivityFootnote ⁶⁹ of each party involved (eg the conditions of an external auditor’s appointment); (c) clear definition of authority and scope: (i) supervisors should have the power to request access to any type of information retained by external/internal audit; (ii) all three parties should jointly set the audit scope of the subject matter to be reviewed (eg joint discussion of financial statements); and (iii) all three parties should share their audit methodology and discuss critical action plans. The next section will approach the main elements of communication.

V Main elements of communication

For a long time, international standard setters did not require a close relationship between supervisors, internal bodies and functions.Footnote ⁷⁰ More recently, however, they have called for a stronger interaction, particularly with respect to enhancing dialogue with the board and senior management on the governance of risk, including the development of an institution’s risk appetite framework and an assessment of its risk culture. In that respect, the Federal Reserve has recently addressed the issue and, building upon the 2003 Policy statement on the internal audit function, issued a new section entitled Enhanced internal audit practices. That section encourages examiners to “rely on the work performed by internal auditors” and to “supplement their examination procedures through continuous monitoring and an assessment of key elements of internal audit”.Footnote ⁷¹ The BCBS paper on the internal audit function in banks reaches similar conclusions when describing the relationship between internal audit and supervisors.Footnote ⁷² It not only provides an overview of supervisory expectations relevant to the internal audit function (including quality assessment) but also explicitly underlines the benefits of enhanced communication between supervisors and internal audit functions.

As the business of banking has grown in complexity over time, the tasks of banking supervisors and external auditors are actually becoming increasingly demanding. This holds true particularly in regulatory regimes where competencies are shared between a centralised supervisory authority and national supervisory authorities, as in the EU.Footnote ⁷³ The growing complexity of transactions and markets is making supervisory agencies less able to reduce information asymmetries. As a consequence, supplementary approaches should be sought to reduce such asymmetries. In fact, internal auditors, banking supervisors and external auditors face similar challenges and their roles should be seen increasingly as complementary.

Generally speaking, the role of the external auditor is primarily to review financial statements to ensure that they are free from material misstatement and prepared in accordance with an appropriate financial reporting framework.Footnote ⁷⁴ Thus, the external auditor primarily serves the interests of company shareholders by expressing an opinion as to whether the financial statements provide the “true and fair” view.

However, as already stressed above, the scope of activity of external auditors in financial institutions differs. Not only is the external auditor attesting that financial statements provide a fair reflection of the financial position and performance of the company in all material respects,Footnote ⁷⁵ it also serves additional regulatory purposes.Footnote ⁷⁶ In fact, the external auditor is often given a responsibility to share information with supervisors, with the ultimate aim of protecting market confidence and depositor and investor interests.

In some jurisdictions, external auditors have a duty to report matters of material significanceFootnote ⁷⁷ to the supervisor,Footnote ⁷⁸ which begs the question as to whether this technically entails a hierarchical relationship between supervisors and external auditors, since the former bear an obligation to assess the adequacy of work performed by the latter, by exerting the power of appraising and establishing the scope of external audits, and determining the standards to be followed in performing such audits.Footnote ⁷⁹ In any case, recent developments in a number of countries (the UK,Footnote ⁸⁰ Switzerland,Footnote ⁸¹ United States,Footnote ⁸² ChinaFootnote ⁸³ ) confirm the importance of increased cooperation between bank supervisors and external auditors.

Supervisors might indeed be interested in the results of a review of the internal control framework performed by the external auditor, as supervisors are often not able to conduct reviews themselves due to resource and budget constraints. If the supervisor were to receive such information, it would improve the effectiveness of supervision. Supervisors also collect information and focus their reviews on an assessment of the organisation’s ability to comply with financial regulations pertaining to the jurisdiction in question. This information, in turn, may have an impact on the financial statements and prove interesting to external auditors who – by the nature of their duties – might not have access to detailed information. Information provided by the supervisor may enable the external auditor to form a better opinion of the soundness of financial statements.Footnote ⁸⁴

Communication between these parties could take the form of written reports or oral exchanges such as periodic or ad-hoc, informal or formal meetings. Meetings could be of a bilateral (ie between external auditor and supervisor) or trilateral nature (ie between the external auditor, supervisor and the chair of the audit committee). Systemically important banks have been encouraged to implement trilateral meetings.Footnote ⁸⁵ Supervisors have been encouraged to prepare written reports on important issues and exchange these with the management, the board and the external auditors.Footnote ⁸⁶ Written documents could include extended reports on the audited financial statements, which are submitted to the supervisor but are not available to the general public.Footnote ⁸⁷

However, such a trend in enhancing the relationship between supervisors and external auditors brings up some critical considerations. Firstly, the growing complexity and internationalisation of financial institutions has meant that a single institution is rarely subject to a single regulatory authority. Institutions may be subject to more than one regulator for the following specific reasons: (i) cross-border banking and insurance groups;Footnote ⁸⁸ (ii) country- or region-specific structures;Footnote ⁸⁹ (iii) various regulatory bodies in the same jurisdiction.Footnote ⁹⁰

These additional layers of complexity call for a formal structure to best utilise what the external auditor can offer, while avoiding overlaps and/or the uncertainty associated with multi-layering of parties to supervision. An interacting network of gatekeepers brings about transaction costs advantages. Transaction costs are the costs of searching for, elaborating and processing the material information needed to discharge the gatekeeper’s duty. In that respect, the cost advantages arise from economies of scale, scope, and experience. Economies of experience – the cost advantages resulting from the accumulated experience over an extended period of time, also known as “learning by doing” – can be substantial in industries, such as banking, involving complex labour-intensive activities. Economies of scale may also be realised, since gatekeepers will build up a greater reservoir of knowledge of transaction structures and standard forms of interaction. In other words, a key feature of an interacting network of gatekeepers is its role in economising on the information costs that exist due to information asymmetry between the gatekeeper and the supervised entity (the bank).

Second, the scope of supervisory activities has been broadened to include additional responsibilities such as a review of the operational risk management framework, an assessment of internal control frameworks and of the adequacy of the internal and external audit. Yet, effective banking supervision rests upon the operational independence of the supervisor together with a sound governance framework within the supervisory authority.Footnote ⁹¹ Therefore, whatever the scope of cooperation and exchange of information is, the autonomy of the various parties should not be impaired and each party should be in a position to independently perform work within its respective statutory scope and responsibilities. Clear boundaries of responsibilities should exist, and all parties should ensure that confidentiality regimes are complied with, as well as standardisation of practices relating to the functions performed by external auditors.

Regulatory capital ratios, and other indicators of financial strength, such as liquidity and leverage ratios, are produced alongside banks’ standard financial reports but are not audited in the same way. This may create an expectations gap for society: what may be a bank’s most looked-at indicator is not audited. External auditors could perform assurance tasks related to such regulatory requirements (including capital ratios and risk-weighted assets, and leverage and liquidity ratios). Requirements for the independent scrutiny of regulatory capital information have evolved piecemeal across the world; some countries mandate publically available assurance reports, some only require financial institutions to inform regulators, while others have no reporting requirement whatsoever. Given the size and importance of the banking sector – and the systemic risk posed to global financial markets – credibility and reliability are crucial.

VI Comparing gatekeepers’ duties: incentives for information sharing and transfer of knowledge

The interaction between different centres of knowledge creation is one of the cardinal issues of our time, particularly in the financial sector. Not only do bank supervisors benefit from the result of the compliance work but they also turn to external auditors for certain additional tasks or for the collection of supplementary information when this contributes to their supervisory work.

Partly, the problem of knowledge construction is one of knowledge transfer. Whilst clearly financial technical knowledge is a collective construction between different centres (ie internal and external gatekeepers), the main concern relates to the interfaces between such centres and the transfer of knowledge. In other words, the problem of multiple centres of knowledge creation is two-fold. On the one hand, it is a matter of access to relevant information and possession of expertise and resources; on the other hand, it pertains the ability to exchange information between all the centres. The latter is to be qualified as an issue of constraints, obstacles and incentives. As has been emphasised, in fact, regulatory practices relating to cooperation between gatekeepers are fragmented. Most of the obstacles for sharing information thus relate to legal barriers. The possibility of disclosures opening up legal liability is real, as different are the responsibilities and the tasks of the internal and external gatekeepers. Each gatekeeper responds to different mechanics, logics and obligations. Compliance works as a form of delegated public power and enforcement, whereas external audit performs a private task.

In considering knowledge transfer as a process of translation and transformation of knowledge by actors, the knowledge-sharing issue could be addressed through a “communal resource” perspective.Footnote ⁹² According to such perspective, individuals share overarching objectives and become motivated to cooperate and share knowledge. This might approximate the course of action by dismantling the legal barriers attached to “silo” thinking. Goals, such as the soundness of the firm or financial stability, are potentially capable of creating the legal basis to overcome such barriers and the fragmentation that comes with them.

Interactions between gatekeepers therefore play a central role in collecting and diffusing information, and translating the knowledge from one gatekeeper to another.

This relationship must be looked at in recognition that no gatekeeper is realistically capable of gathering all the information required to discharge their duty. Instead, each of them possesses – or might possess – material pieces of information for the tasks to be performed by others.

Regulators’ increasing need to enrol gatekeepers is largely due to the perceived expert and professional capacities of such gatekeepers. The formation of law and policy in contemporary societies is indeed often influenced by experts. An expert-driven law is justified by the fact that experts are endowed with specialised knowledge necessary to design effective policies in technically complex domains. Arcuri and Dari-Mattiacci empirically approached some of the questions raised by the nature of expert-decision-making, and, specifically, how the level of governance (centralised versus decentralised) affects the decisions made.Footnote ⁹³ They drew some implications for social welfare, based on the choice between centralisation and decentralisation. They considered a clean set of cases in which scientific uncertainty plagues the decision-making process concerning balanced issues, where it is important to make the right decision but errors on either side have the same impact. This is surely the case with decision-making in the banking and finance sector.

When the available expertise is advanced – the analysis goes – centralisation is to be preferred, as it yields more accurate and less risky decisions. With poor expertise, decisions under centralisation, although more accurate, are also more risky than under decentralisation.

There seems to be a sheer advantage in pooling expertise. When experts gather together, each of them brings in some information, thus adopting deliberation that is more desirable.Footnote ⁹⁴

This situation recalls what Charles Goodhart referred to as “relational paradigm”. The relational paradigm emphasises the interaction between different actors in the regulatory space. The key feature is the changing role of regulators and supervisors not as platforms of authority but as participants in a relational paradigm with the industry in providing governance over the financial services landscape. This public-private governance could be defined as a sharing and morphing together of competence between actors of a public and private nature, in addressing regulatory concerns and problems.

As the comparison goes, such thinking, the relational paradigm, sustains enhanced modes of interaction between gatekeepers – external auditors, compliance and supervisors – by virtue of improved communication channels, supervisors might be provided with useful and reliable information to support their judgments and enable them to be more forward-looking in their assessments of risk.

Better informed supervisors, equipped with accurate information, help in ensuring that market stability is being maintained and might lead to improving the tools and methods that could be used for regulatory purposes, going some way to deliver pre-emptive, rather than reactive and outcome-based supervision.

Now, in making the supervisor/financial regulator the “gathering point” where information should converge, two types of the relational paradigm are to exist:

• (a) the relational distance between the supervisor and the compliance, which amounts to a delegation of power to the regulated financial institution;

• (b) the relational distance between the supervisor and the external auditor, which is a horizontal – inter pares – distance.

As far as the relational distance (a) is concerned, compliance is the product of supervisors’ needs rather than a delegation of board authority. In fact, public authority dictates how banks must comply, imposing specific governance processes and structures expressly designed to change how the firm conducts its business. In other words, compliance remains an exogenous imposition, not an endogenous element of firm governance. The government authority to intervene in the firm through compliance stems from public policy reasons, ie the soundness of the bank and eventually the stability of the market. The compliance function has indeed a mandate that encompasses risks relating to the regulatory objective of supervision, such as “strategic risk,” “regulatory quality,” “business continuity,” and “consumer protection”.Footnote ⁹⁵

This, in turn, implies that compliance responds to a transaction cost of the government,Footnote ⁹⁶ as it is a means of outsourcing enforcement costs.Footnote ⁹⁷ By requiring financial institutions to install a compliance function to detect and report violations of law, in fact, supervisors and public authorities can externalise a portion of their budget. Most importantly, the compliance function creates a critical centre of knowledge construction by bridging the gap between the “inside” and the “outside” of the bank. The compliance function indeed attends the flow of information within the organisation. In monitoring the information flowing up and down, it is best placed as to critically engage in reporting. Through the reporting function, in fact, compliance ensures that lower-level employees can safely report to their managers and that information concerning potential violations is quickly related to the appropriate level of authority in the bank. In carrying out such a function, not only does compliance ensure adherence to the firms’ policies and procedures but is also eventually pursues regulatory objectives and interests. In the quest to minimise downside risk associated with misconduct, compliance serves as a regulatory enforcement actor first. Wealth maximisation comes second, and the fact that shareholders benefit from compliance function is but a positive consequence of imposing efficient governance structure on firms.

As far as the relational distance (b) is concerned, the distance between the supervisor and the external auditor is to be regarded as a horizontal, inter pares, one. In fact, the external auditor is not an imposition of an intrafirm governance to pursue financial regulatory objectives. External auditing, as the name indicates, rests outside the firm. Financial regulators/supervisors and external auditors are indeed projected towards different goals. They pursue a public and a private purpose, respectively.Footnote ⁹⁸ The banking supervisor is predominantly concerned about future viability, whereas the external auditor looks at the past performance and viability.

Gatekeepers have diverse goals, powers and duties, and yet their actions and activities do intersect. To fulfil their respective responsibilities, however, both the regulator/supervisor and external auditor undertake a process of verifying information and representations as to its accuracy and reliability provided by the directors and management of a firm.

However, certain jurisdictions impose on external auditors a duty to report matters of material significance the supervisor and allow bank supervisors to request external audit firms to review areas beyond the statutory requirements of external auditors, if deemed appropriate.Footnote ⁹⁹

One needs to critically assess this obligation, as this is only possible in jurisdictions where external auditors are protected from litigation or legal proceedings when disclosing confidential information to third parties (safe harbour).Footnote ¹⁰⁰ If such safe harbour protection does not exist, external auditors may need to resort to alternative measures. They may, for instance, decide to report confidential issues indirectly to the supervisors through the bank’s management. Alternatively, external auditors may also consider obtaining explicit approval from the board and management permitting them to disclose confidential information to supervisors.Footnote ¹⁰¹ However, there are instances where external auditors voluntarily decide to report, formally or informally, on issues that are outside the scope of their duties but may nevertheless be of interest to bank supervisors. This might be the case if the external auditor detects significant deficiencies in internal control processes or opaque business structures intended to circumvent financial regulations.Footnote ¹⁰²

Greater reliance placed upon the external audit’s submission of information, data and reporting for regulatory purposes raises questions as to whether it may result in downsides pertaining to, for instance: (i) decreased trust between client and audit firm, which might make company officials less likely to share information with external auditors; (ii) whether enhanced responsibilities will dilute the effectiveness of auditors at performing their original role in the integrity of financial/securities disclosure; (iii) the sheer economic costs of conducting more of an audit and who will bear that cost; (iv) whether the steps needed to make external auditors and regulators more independent of company management will dampen the information flow to, and expertise of, auditors and regulators.

To our mind, despite opening up new venues for further research, most of the discussion boils down to incentives. We believe that incentives for information sharing should be reputational, in order to economise on information costs and create value of each of the gatekeeper involved.Footnote ¹⁰³ Deterrence measures, ie the disciplining effect of reputation on gatekeeper behaviour, are sufficient. The effectiveness of reputation is based on the informational content of reputation and its sensitivity to gatekeeper failure in past performances.Footnote ¹⁰⁴ Given the nature of the gatekeeping role and the fact that information about past gatekeeper conduct is widely disseminated, the relevant bank reputation reflects its performance as a gatekeeper, and so its reputation.

Gatekeepers are, in fact, to be regarded as renting their reputations to each other, preserving a reputation for diligence, transparency and honesty. Each gatekeeper has particular areas of expertise and spheres of influence in transactions. Each is expected to vary in terms of the information it holds, and its means of gathering information. Accordingly, a gatekeeper may need to rely on the information or advice of another gatekeeper in order to perform its role. Thus, in expecting to be engaged in the future exchange of information and performing a complementary role to other gatekeepers’ duties, each will have strong reasons to build on strong, long-term, effective interaction.

An interacting gatekeeper network – as a ramification of multiple centres of knowledge creation – is, in fact, to be seen as a response to the problem of information asymmetry. In that perspective, the specific modes of interactions should be accounted for. Gatekeepers are more accurately envisioned as an interlocking and interacting web of protection against asymmetric information than as a single guardian or even a series of guardians acting in isolation from one another. At the same time, however, it should be kept in mind that each centre of knowledge construction responds to different mechanics, logics and obligations. Compliance works as a form of delegated public power and enforcement, whereas external audit performs a private task.

Complexity of modern financial intermediation calls for an integrated and holistic approach to overcome the fragmentation of material knowledge and incorporate expertise and information that each gatekeeper can gather and then provide to the other, in line with overarching financial regulatory objectives.

Technology is also playing a central role. On the one hand, technology frames interactions between economic actors, regulators and society. Technological advancement is re-setting the rules of the game and compounding (relational) complexity. In fact, regulatory engagement with financial innovation should take into account that the industry itself – as a nexus of parties – has been faced with technological change. New technologies and actors have caused a rapid expansion of the “governance” or “architecture” – the code, protocols, platforms and structures that determine how firms, consumers, policy-makers and legislators interact – which raises a number of legal and societal issues. Some of the recent inventions in information technology such as distributed ledger technology (DLT) do indeed have the potential to significantly affect the basic infrastructure for financial services and to change the way consumers and financial institutions interact when buying or selling financial products. Innovation lies in the manner in which these technologies could potentially affect ‘money’, ‘ledgers’, ‘risk and time allocation’, ‘information’ and all the basic infrastructures for financial activities in ways that are still to be explored.Footnote ¹⁰⁵ Such a complex network of participants, who perform a variety of functions, is developing in a legal environment that is still highly fragmented and based on an institutional framework where entities are regulated, supervised and overseen by a diverse group of competent authorities.

As Julia Black maintains, the “dynamic interactions between actors and/or systems, and to the operations of forces which produce a constant tension between stability and change within a system. Those interactions are themselves complex and intricate, and actors are diverse in their goals, intentions, purposes, norms, and powers”.Footnote ¹⁰⁶ Re-connecting to the topic of supervision and information exchange between multiple centres of knowledge creation, this entails analysing structural changes in the way market participants interact, especially focusing on the patterns between financial users and financial providers. Regulators and supervisors should, in fact, evaluate: (a) if new channels for meeting financial needs are being created (new forms of interfaces); and (b) if such new channels and changes are “structural” (structural impact).

On the other hand, however, technological innovation can definitely be adopted as to better operationalise the collection of data and, most importantly, the transfer of knowledge between gatekeepers. The application of technology can improve the monitoring, auditing, and testing function, and the next step will come from applying “big data” tools to existing surveillance technologies.Footnote ¹⁰⁷

VII Concluding remarks

The interdependencies between external and internal gatekeepers in financial institutions bring about problems of multiple centres of information gathering and creation, raising coordination dilemmas. The magnitude of complexity, characterising financial markets, calls for resource sharing between banking supervisor, external auditor and compliance in a structured fashion. Lack of coordination between gatekeepers might result in market failures and protracted dialogue and inefficiencies, leading to ambiguity and inconsistencies. In order to overcome such information gaps, we build upon the scholarship relating to multiple gatekeepers’ liability and compliance. Such literature provides the theoretical basis to advocate for construing models that proceduralise communication, shared problem-solving and synergy between gatekeepers. In designing such models, attention ought to be paid to: (i) the scope of the additional audit work that external auditors would have to do; (ii) what information they would share with regulators/supervisors; (iii) their incentives for sharing information.