Through the Lens of Litigation

KPMG's audit of Silicon Valley Bank illustrates how auditors assess going concern risk—whether a client can continue operations for at least one year. The case shows the gap between standard audit procedures and the judgment calls required in volatile industries.

Read article

Teaching notes are auto-generated. Worth a fact-check before class.

Why this matters

An audit is an independent review of a company's financial statements and internal controls by a licensed firm, performed to give investors and regulators confidence that the numbers are accurate and fairly presented. One of the auditor's most critical judgments is assessing "going concern"—the question of whether the company will stay in business long enough to fulfill its obligations, typically assumed to be at least one year ahead. In the case of Silicon Valley Bank (SVB), a major bank that serves tech startups and venture capital firms, KPMG (a Big Four audit firm) was responsible for examining SVB's internal controls, cash, and financial health. When SVB collapsed in March 2023, questions arose: Did KPMG's audit adequately evaluate the risks that led to failure? This litigation case is instructive because it shows how auditors balance standard procedures with judgment, particularly in industries—like banking—where market conditions can shift rapidly.

Key points

KPMG documented going concern procedures at SVB, but auditors must judge whether standard tests caught actual collapse risk → going concern assessment relies on auditor judgment, not just checklists.
SVB's deposits came largely from volatile tech/VC clients who could withdraw funds en masse, creating liquidity risk not visible in year-end balance sheets → auditors must evaluate industry-specific threats beyond historical financials.
Bank regulators and auditors use similar but different toolkits to assess solvency; auditors focus on fair financial reporting, regulators focus on systemic risk → auditor role is distinct from regulatory oversight.
Audit failures are not determined solely by whether a client later fails; courts examine whether the auditor followed professional standards and applied reasonable judgment → audit quality is measured against standards in place at audit date, not hindsight.

Key terms

Going concern: An auditor's assessment of whether a company has enough cash and financial stability to continue operating for at least the next 12 months.
Internal controls: Policies and procedures a company puts in place to prevent errors, fraud, and unauthorized transactions in its accounting and operations.
Audit opinion: The auditor's conclusion, included in their report, about whether the financial statements are fairly presented and prepared according to accounting standards.
Audit procedures: Specific tests and reviews (such as inspecting documents, interviewing management, and analyzing account balances) that auditors perform to gather evidence about financial statement accuracy.
Liquidity risk: The risk that a company cannot quickly convert assets to cash or raise cash to pay its obligations when due.
Professional standards: Rules and guidelines (such as GAAS—Generally Accepted Auditing Standards) that all auditors must follow to conduct audits fairly and thoroughly.
Big Four audit firms: The four largest accounting and audit firms in the world: Deloitte, PwC, EY, and KPMG; they audit most large public companies.

Discussion prompts

01
What is the auditor's responsibility when evaluating whether a company can survive the next 12 months, and how does this affect the audit opinion?
Answer: Students should recognize that auditors must assess going concern as part of evaluating whether the financial statements make sense as a whole. If going concern is questionable, the auditor must either require management to disclose it prominently in the footnotes or qualify (modify) the audit opinion. The goal is to alert investors and stakeholders to survival risks.
02
Why might standard audit procedures for banks differ from those for retail companies, and what additional risks should an auditor watch for?
Answer: Banks have unique risks: they hold customer deposits (liabilities that can be withdrawn on demand), they invest in loans and securities (which may lose value quickly), and they are tightly regulated. Auditors must test deposit stability, the quality of loan portfolios, and liquidity—how fast the bank can raise cash. Retail companies don't face deposit runs or asset-liability maturity mismatches.
03
If an auditor documents going concern procedures but a client fails weeks later, does that mean the audit was wrong?
Answer: Not automatically. Auditors are required to follow professional standards (GAAS) and exercise reasonable judgment based on information available at the time of the audit. If an auditor performed adequate procedures and reached reasonable conclusions, but the client failed for reasons not yet evident, the audit may still have met standards. However, if the auditor ignored red flags or skipped required procedures, negligence may apply. Courts evaluate this by hindsight and professional standards.
04
SVB's deposits came from volatile tech firms; how should an auditor have assessed this concentration risk differently from a bank with stable consumer deposits?
Answer: The key point to draw out is that concentrated, volatile customer bases increase liquidity risk—the risk that deposits could flee en masse. An auditor should have inquired: How likely is a deposit withdrawal? How fast can the bank raise cash if it happens? With tech/VC clients, market sentiment can shift overnight. Standard procedures for stable customer bases may underestimate this tail risk.
05
What is the difference between an auditor's role and a bank regulator's role in protecting depositors?
Answer: Auditors examine the accuracy of financial statements and the adequacy of internal controls; their opinion goes to investors and creditors. Regulators (like the Federal Reserve and FDIC) supervise banks directly to protect the banking system and depositors. Both can spot problems, but auditors and regulators have different legal duties, different timing, and different tools. The KPMG case shows that an audit passing does not guarantee regulatory approval.

Bringing it to class

Open by drawing a simple balance sheet for SVB on the board: assets (loans, securities) and liabilities (customer deposits). Ask: "If every depositor tries to withdraw cash on the same day, what happens?" This makes liquidity real. Then define going concern as the auditor's judgment about whether this situation will resolve within 12 months. Show the tension: standard audit tests look at year-end balances and historical trends, but don't always predict sudden shifts in customer confidence or market conditions. Use the SVB case to illustrate why auditors must dig deeper in volatile industries—not just follow a checklist. End with the key distinction: an audit failing to prevent a collapse is not the same as an audit that violated professional standards.