KPMG has built up a large business auditing U.S. banks and had long audited Long Island-based New York Community. The bank's stock is down nearly 70% this year after a series of disclosures that have troubled investors. Last week, it replaced its CEO, filled leadership vacancies in its internal risk and audit departments and disclosed weaknesses in internal controls over its financial reports. 

The latter disclosure seemingly conflicts with an audit KPMG performed in 2022, when KPMG said the bank's internal controls were effective.

The facts over KPMG's audits aren't public, making it hard to gauge whether auditors rightfully pushed back as New York Community quickly grew in 2023. But the bank's disclosures of weaknesses are the latest headache for KPMG, which audited all three of the regional banks that failed last year: Silicon Valley Bank, Signature Bank and First Republic Bank. 

"There's no excuse for it," said Francine McKenna, a former KPMG consultant whose The Dig newsletter focuses on accounting issues. 

Debates over KPMG's audits of those three banks — and now, the struggling New York Community — center around whether auditors are to blame for poor decision-making by the banks, or whether the blame lies solely on CEOs. A full answer on that question is not yet clear, but all four cases highlight the perils of rapid growth.

When growing quickly, banks' risk management and financial reporting effectiveness must "keep pace with their growth in assets," said Kiridaran Kanagaretnam, a professor at York University in Canada who researches bank accounting.

KPMG did not comment on the issues at New York Community. In a statement, KPMG spokesman Russ Grote said the firm has "long had a substantial and dynamic audit practice in the financial services industry." 

"We conduct our audits in accordance with professional standards, maintaining auditor independence. Due to client confidentiality, we have no specific comment," the KPMG spokesman said.

Spokespeople at New York Community did not respond to requests for comment.

The three regional banks that failed last year were all darlings of bank investors who preferred high-growth banks. New York Community long took a more old-fashioned approach, having bulked up mostly through a series of smaller mergers in the 2000s. 

Then came December 2022, when in an effort to diversify away from rent-controlled New York City apartment buildings, the bank bought Troy, Michigan-based Flagstar Bank. Fresh off that acquisition, regulators allowed New York Community to buy large chunks of Signature Bank once its crypto-friendly strategy led to its failure in March of last year.

In a securities filing last week, New York Community said that it had "identified material weaknesses" in its internal controls for loan reviews, citing "ineffective oversight, risk assessment and monitoring activities."

The company also delayed the release of its annual report, saying it's "been working diligently to finalize" it but must first complete its review of the issue. The company said it expects its annual report to state that its internal controls over financial reporting "were not effective" at the end of 2023 and lay out a "remediation plan" to fix those weaknesses.

The bank's issues highlight the need for the "strictest controls and auditing" for retail-focused banks since they handle everyday depositors' money, said Atul Shah, a professor at City University of London. Shah wrote a book about auditors' shortcomings before the 2008 financial crisis and has argued for a stronger government role in auditing.

"Aggressive CEOs who wish to grow the numbers very fast will despise controls and favour risky assets," Shah said in an email. "This has to be checked in time and regulated."

One potential explanation for New York Community's problems in 2023 is the difficulty of integrating Flagstar Bank and the chunks of Signature Bank all within one system, said Jack Castonguay, an accounting professor at Hofstra University. 

In 2022, New York Community's loan portfolio was entirely its own, but last year the company absorbed two other sets of loan books that "may not be structured" the same. 

"It's kind of like if all your devices have lightning chargers, and then you have a USB-C phone," Castonguay said.

KPMG may also have found the same weaknesses as it looked at the bank's books from last year, though that information is not public yet, Castonguay noted. 

Last year, Castonguay wrote an op-ed arguing that while scrutiny of auditing processes is warranted, the failures of Silicon Valley, First Republic and Signature banks may have been solely due to "poor management" rather than anything within an auditors' control.

Others, such as McKenna, have been far more critical and argued the failures reflect auditors failing to take a hard look at all the assumptions that make up a bank's financial statements. McKenna also criticized the "revolving door" between KPMG and bank leadership, noting the CEOs of both First Republic and Signature both held top roles at KPMG. 

"It seems like we've got a little cottage industry in audit partners thinking they can run banks," McKenna said. "And clearly, they're not doing a very good job."

New York Community recently replaced CEO Tom Cangemi, who worked at KPMG for a few years after college but did not become a partner there — since he instead took on chief financial officer roles at banks.

Cangemi, who was the architect of the bank's recent growth, did not respond to a request for comment.