RESTRICTED FR // EXTERNAL 

CALIFORNIA DEPARTMENT OF 

FINANCIAL PROTECTION AND INNOVATION 

FEDERAL RESERVE BANK OF 

SAN FRANCISCO 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

BOG-FRS - Public Release, April 2023

2101 ARENA BOULEVARD 

SACRAMENTO, CALIFORNIA 95834 

(916) 576-4941 

101 MARKET STREET 

SAN FRANCISCO, CALIFORNIA 94108 

(415) 974-2000 

December 27, 2022 

BY SECURE EMAIL 

Board of Directors 

SVB Financial Group/Silicon Valley Bank 

3003 Tasman Drive 

Santa Clara, California 95054 

Dear Board Members: 

The Federal Reserve Bank of San Francisco (FR) and California Department of Financial 

Protection and Innovation (CDFPI) recently completed a joint target examination of Silicon 

Valley Bank Financial Group (SVBFG or the Firm) and Silicon Valley Bank’s (SVB or the Bank) 

Internal Audit Program. This examination used the supervisory expectations defined in 

Supervisory Letter 13-1, Supplementary Policy Statement on the Internal Audit Function and Its 

Outsourcing and Supervisory Letter 03-5, Interagency Policy Statement on the Internal Audit 

Function and its Outsourcing, as a basis for our assessment. The review started on 

October 3, 2022 and concluded on October 28, 2022. This letter serves to formalize the 

supervisory findings and recommendations discussed with Chief Auditor John Peters on 

December 19, 2022 and Audit Committee Chair Mary Miller on December 21, 2022. 

The scope of the exam covered key elements important to the overall effectiveness of the 

Internal Audit (IA) Program. These key elements include: the IA risk assessment; the process 

for defining the audit universe; audit committee reporting and oversight; the independence, 

professional competence, and quality of the IA function; the quality assurance function; 

continuous monitoring; audit execution; and issues tracking and validation. 

Executive Summary 

SVBFG/SVB’s Internal Audit (IA) is not fully effective. The overall assessment was driven by 

material weaknesses in the risk assessment process, the process to define the IA audit 

universe, IA’s continuous monitoring, and audit execution. While no new supervisory findings 

are being cited from this review, the Appendix provides details on the additional matters that 

the management must address in the Self-assessment and Remediation Plan submitted in 

response to MRIA #3 issued as part of the Governance and Risk Management Supervisory 

Letter, dated May 31, 2022. 

Page 1 of 6 
BOG-FRS - Public Release, April 2023

Summary of Results 

Objective Current examination assessment 

1 - Internal audit risk assessment Below supervisory expectations 

2 - Audit universe Below supervisory expectations 

3 - Audit committee reporting and oversight Partially consistent with supervisory 

expectations 

4 - Independence, professional competence, 

and quality of the IA function 

Partially consistent with supervisory 

expectations 

5 - Quality assurance function Generally consistent with supervisory 

expectations 

6 - Continuous monitoring Below supervisory expectations 

7 - Audit execution Below supervisory expectations 

8 - Issues tracking and validation Generally consistent with supervisory 

expectations 

Additional comments are provided below for those areas assessed as "below supervisory 

expectations:" 

Internal Audit Risk Assessment 

The IA risk assessment process does not effectively analyze the Firm's key risks and risk 

management functions. While there is quantitative methodology that drives the risk 

assessment, the analysis supporting the numerical scores is limited, lacks transparency, and is 

often informal. The FR and CDFPI noted several risk indicators that were incorrectly scored 

with insufficient support and no evidence of effective challenge by IA leadership. For 

example, market risk, credit risk, and model risk were incorrectly designated as not applicable 

for SVB Capital without further rationale or challenge. 

Audit Universe 

IA does not effectively identify all auditable entities within the audit universe. IA's Audit 

Manual does not sufficiently address how auditable entities are captured at the department 

level, the process/activity level or at another aggregated organizational level. IA also has not 

developed a formal methodology to check the completeness of the Firm's Audit Universe. 

Current practices are largely guided by IA leadership; however, without mechanisms to check 

how the audit universe has been identified, the Firm has the risk of coverage gaps that 

negatively impact IA's effectiveness. Examples of possible coverage gaps include: 

• IA does not leverage the new product approval process for timely updates to the Audit Universe 

• IA does not map/reconcile auditable entities to the General Ledger 

• IA's process to account for vendors, applications, and models within an Audit Universe 

context is informal and relies heavily on business owners 

• IA has not effectively effectively considered the impact of key organizational changes, 

such as acquisitions, when updating its audit universe 
 

 

 

 

 

 

 

 

 

BOG-FRS - Public Release, April 2023

RESTRICTED FR // EXTERNAL 

Continuous Monitoring 

IA’s continuous monitoring processes are ineffective. IA has not established processes for 

updating the Audit Plan or Staffing as emerging risks or significant organizational changes are 

occurring. Continuous monitoring processes do not effectively escalate emerging internal 

controls issues, nor does it adequately cover cross-business line processes or shared services. 

IA’s continuous monitoring processes makes limited use of data analytics – this hinders the 

timely identification of factors that should prompt updates to the Audit Plan or IA staffing. 

Audit Execution 

IA’s audit plan execution is not effective. As noted above, IA’s Risk Assessment process and 

approach to identify its Audit Universe lack key elements that have a negative impact on the 

foundational goal of sufficient audit coverage. Additionally, weaknesses related to audit 

execution include: 

•	 IA’s planning and scoping processes do not provide sufficient oversight. Based on the 

sample of workpapers reviewed, the FR and CDPFI noted examples where the Risk 

and Control Matrices were not approved by an IA Director or Manager; end-to-end 

walkthroughs of the auditable entity were not performed; internal controls maps or 

process narratives were not developed; and ineffective mechanisms to check the 

completeness of the audit scope prior to fieldwork. 

•	 IA’s testing practices are inconsistent and lacks clarity when relying on other control 

functions. While the IA Policy allows leveraging off first and second line control 

testing, there are no defined criteria to determine when to leverage versus when to retest. Also, the examination noted examples where the testing sample sizes were not 

aligned with industry standards. 

After reviewing this supervisory letter1

, and within 45 calendar days, management is required 

to submit in writing a revised gap assessment and action plans that detail how the elements 

above will be fully remediated. The plan should include specific action steps and deliverables, 

individuals responsible for addressing each action item, and clear deadlines for completing 

the necessary corrective actions. Please send all supervisory correspondence from your 

institution in electronic format only, copying our centralized mailbox as a recipient at 

Redacted

@sf.frb.org. 

1 Any institution about which the Federal Reserve makes a written material supervisory determination is eligible to utilize the 

appeals process as described in the Appeals Process and Board Ombudsman (Ombuds) Policy Statement (See also 85 Fed. Reg. 

15,175 (March 17, 2020)). The Ombuds can provide assistance regarding questions related to the appeals process and claims of 

retaliation as well as assist in facilitating the informal resolution of a supervised institution’s concerns prior to the filing of a 

formal appeal. For more information about the Ombuds, please visit the Federal Reserve Board’s public website. 

Page 3 of 6 
 

 

 

 

 

 

 

 

 

 

BOG-FRS - Public Release, April 2023

RESTRICTED FR // EXTERNAL
 

Please note that this letter contains confidential material and should be treated accordingly 

by your organization.2 As such, the contents of this letter are subject to the rules of the Board 

of Governors of the Federal Reserve System regarding disclosure of confidential supervisory 

information. Should you have any comments or questions regarding this letter, please feel 

free to contact

Redacted

with the FRBSF at 

Redacted

and 

Redacted

with the 

CDFPI at 

Redacted. 

Sincerely, 

Redacted

Redacted

Redacted

Department of Financial Protection and Innovation LFBO Dedicated Supervisory Team Lead 

Federal Reserve Bank of San Francisco 

By: 

Senior Financial Institutions Examiner 

Redacted Redacted

Greg Becker, Chief Executive Officer 

John Peters, Chief Auditor

 CDFPI

cc: 

 FDIC 

Redacted Redacted

2 THIS DOCUMENT IS STRICTLY CONFIDENTIAL: This document has been prepared by an examiner selected or approved by the 

Board of Governors of the Federal Reserve System. The document is the property of the Board of Governors and is furnished to 

directors and management for their confidential use. The document is strictly privileged and confidential under applicable law, 

and the Board of Governors has forbidden its disclosure in any manner without its permission, except in limited circumstances 

specified in the law (12 U.S.C 1817(a) and 1831m) and in the regulations of the Board of Governors (12 C.F.R. 261.20). Under no 

circumstances should the directors, officers, employees, trustees or independent auditors disclose or make public this document 

or any portion thereof except in accordance with applicable law and the regulations of the Board of Governors. Any 

unauthorized disclosure of the document may subject the person or persons disclosing or receiving such information to the 

penalties of Section 641 of the U.S. Criminal Code (18 U.S.C. 641). Each director or trustee, in keeping with his or her responsibilities, 

should become fully informed regarding the contents of this document. In making this review, it should be noted that this 

document is not an audit and should not be considered as such. 

Page 4 of 6 
 

 

 

 

 

 

 

 

 

BOG-FRS - Public Release, April 2023

RESTRICTED FR // EXTERNAL
 

APPENDIX: 

Assessment of Response and Remediation Plan –
 

May 2022 Governance Exam MRIA #3 Finding Related to IA Effectiveness
 

As part of this target exam, the FR and CDPFI assessed management’s response to MRIA #3 on 

IA Effectiveness from the 2022 Governance and Risk Management supervisory letter issued on 

May 31, 2022. The MRIA required the Firm to complete a Gap Self-Assessment and 

Remediation Plan. 

We noted that the Firm’s Gap Self-Assessment did not sufficiently address the following: 

• Audit universe completeness 

• Reliance of IA on other control functions 

• Individual audit scoping requirements 

• Outsourcing oversight 

We also noted that the Firm’s Remediation Plan needs further development to: 

•	 define clear actions for each gap to be remediated, 

•	 allocate sufficient resources to execute the action steps, and 

•	 set timelines to establish accountability 

While no new MRIAs or MRAs are proposed at this time, management is required to revise the 

remediation plans and incorporate the following: 

• Interim controls, additional details on resources, and specific time frames required to 

update legacy risk assessments. 

• Criteria to determine a complete audit universe and a sub-processes inventory for 

each auditable entity, to consider risks indicated by the general ledger, the inventory 

of vendors, the inventory of models and applications, and the new product approval 

processes. 

• Mechanisms for timely assessment of significant organizational changes such as 

merger and acquisitions’ impacts on the audit universe. 

• Specific timeline for integration of SVB Securities into the overall audit universe. 

• Enhanced reporting specific to outsourced audits and IA staffing. 

• Multi-year staffing analysis of IA’s resource and training needs that considers the 

function’s core responsibilities in addition to its future state needs. 

• Resourcing strategy, with input from staffing analysis, that considers co-sourcing 

leverage, skills and competencies, and transformation needs. 

• Coverage of all business lines, supporting functions, and legal entities for continuous 

monitoring purposes. 

• Individual audit scoping criteria and requirements, including walkthrough, reviewed 

and approved risk and controls matrix prior to starting fieldwork and tracking of 

scoped out sub-processes. 

Page 5 of 6 
BOG-FRS - Public Release, April 2023

RESTRICTED FR // EXTERNAL
 

• Formal internal senior management review and approval of the audit scope prior to 

audit execution. 

• Formal criteria and approval requirements as to when testing performed by other 

control functions may be used in lieu of independent IA testing. 

Page 6 of 6