Standing our ground: auditors and supervisors in the world of geopolitics

Thank you. I feel honored to speak here today at this important gathering of auditors worldwide. I mean, an economist giving a speech at an accountants conference: that sounds like either the beginning of a very funny joke, or a very high bar.

But although I am an economist by training, the world of auditing is not unfamiliar to me. I trained auditors earlier in my life when I was a professor at Maastricht University. I even wrote my PhD on an accounting and auditing topic. It was on the economics of accounting regulation. Also later on, as a financial supervisor, auditing has always kept my interest, so I feel rather at home here. And independence and scepticism are common essential pillars of auditing and financial supervision.

But for now, let me stick to my current field of expertise and talk you through some of the things that keep me busy as prudential supervisor of the financial sector. As we will discover, I think these things are relevant for auditors as well.

As a central bank and prudential supervisor, DNB seeks to ensure that banks, insurers, pension funds and other financial institutions remain healthy, and that the financial system as a whole remains stable. We also want to make sure that the financial sector is conducting its business with integrity, and that institutions avoid becoming involved in financial crime.

There are a lot of things we look at in our day-to-day supervision, and a lot of that is standard practice. But there are a couple of issues that are of particular concern to us at the moment. The first I want to mention is the geopolitical situation. Countries are re-arming, they are protecting strategic parts of their economies, they are imposing trade restrictions and sanctions on each other, and they are restricting access to international finance. Needless to say, over the past few months, the geopolitical situation has changed in ways that only few could have predicted.

Geopolitics affect the financial sector in various ways. First of all, weaker growth and higher inflation make it more likely that banks and other financial institutions will incur losses. And second, restrictions on the flow of capital and investments limit the ability of financial institutions to diversify their portfolios. But perhaps the most acute risk of all is the increased threat of cyberattacks. I will come back to that in a minute.

Next to the rising geopolitical tensions, our focus is on the impact of new digital technologies. The financial industry is one of the sectors in the economy that has fully embraced digitalisation, especially here in the Netherlands. Digitalisation, including AI, has produced more efficient business processes, greater transparency for consumers, and many new financial services, in particular in the area of payments.

At De Nederlandsche Bank, we welcome digitalisation in the financial sector. But we obviously also look at the risks. Take, for example, the outsourcing of digital services to large technology companies. What if these companies are no longer able or willing to fulfil their obligations? Are financial institutions fully aware of what these companies are doing with the data they entrust to them? Another aspect is that many of these tech companies are not located in Europe. With geopolitical tensions rising, there is a desire, particularly among some European politicians, to develop certain critical technologies on European soil.

Geopolitical tensions and digital innovation. Where these two major developments meet, new risks arise. Take, for instance, Amsterdam Trade Bank, or ATB, the Dutch bank that went bankrupt in April 2022. ATB was a subsidiary of the Russian Alpha Bank. Following the sanctions against Russia, software providers stopped servicing the bank’s payment systems. Unable to meet its obligations, ATB was declared bankrupt. It was a unique case. Banks, or for that matter any other company, will usually go bankrupt if they run into financial difficulties. But there was nothing wrong with either the solvency or liquidity of ATB. In this case, the bank could not meet its obligations for purely operational reasons.

As I already mentioned, another area where geopolitics and technology come together is the increased threat of cyberattacks, notably by state actors.

Take the example of Kyivstar, Ukraine's largest telecom provider. On December 12^th 2023, it suffered a Russian cyberattack that disrupted services for millions of users. Approximately half of Kyivstar's network was disabled, leaving millions without mobile and internet connection. But the damage wasn’t limited to the telecom sector. The attack also disrupted banking operations, payment processing, and online banking services. Some ATMs and point-of-sale terminals didn’t work. Financial transactions were in disarray across the country.

Amazingly, the Ukrainians were quickly able to restore services. Over the past three years they have become quite proficient in dealing with large-scale disruption. Many critical processes in Ukraine are equipped with backup measures. Many people even have two sim cards in their phones. That enabled critical processes and people to continue working, while the primary provider was busy recovering from the incident. Services at Kyivstar were gradually restored, with almost full restoration achieved eight days after the attack.

This episode raises some inconvenient questions. What if this would happen to us? What if a large-scale Russian cyberattack is launched on the telecoms sector of an EU Member State? Could this happen? How much damage would such an attack cause? Would it affect financial services? And would we be able to recover as quickly as the Ukrainians did?

It's not that financial institutions haven’t prepared. Speaking for the Netherlands, many of them have taken big steps in recent years to boost their cyber resilience. I think it is fair to say the financial industry is one of the better digitally defended sectors in the economy. As it should be. But given the size and urgency of the threat, we need to do even more to keep financial services safe. This is why cyber resilience will absolutely be a key focus area in our supervision of the financial industry in the coming years. This goes both for De Nederlandsche Bank, and for the European Central Bank.

Geopolitics, new digital technologies, cyberthreats. These are issues that keep me quite busy as a financial supervisor. But how about you? How are these developments relevant for you as auditors? Well, I believe they could have a bearing on how you approach concepts such as the going concern risk. When thinking about going concern risk, most of you probably also think in terms of liquidity or solvency risk, like financial supervisors usually do. However, the case of Amsterdam Trade Bank demonstrates that going concern issues can also arise from operational problems, in this case sparked by a combination of geopolitics and technology. As geo-economic fragmentation and cyber risk have become more prominent, operational threats to going concern may occur more often in the future.

For me, as a financial supervisor, the work that you do on the going concern assumption is very important. Failure to notify that the going concern of a financial company is in jeopardy can have big consequences for the financial system and society. So I hope I am one of the first names in your phone book in case you detect a potential going concern issue. During the financial crisis of 2007-2009, our experience was that auditors could have been more proactive in this regard.

Since then, standard-setters, regulators and the audit industry have taken various steps to improve the audit work on going concern. That’s really good news. Recently, for example, the International Audit and Assurance Standards Board has been working on a revised standard on going concern. I am particularly fond of the paragraph that states that the auditor needs to determine whether reporting to an appropriate authority outside the entity is needed. What also helps is the requirement in Dutch mandatory guidance for auditors to communicate proactively with the supervisors when they detect going concern issues. Obviously, the sooner we, as prudential supervisors, know there is an issue, the more effectively we can respond. But, as you come from a world where everybody counts, I am sure I can count on you. (I promise your this is my only accountants joke today).

Another way in which geopolitics may impact your work as auditors is by threatening to undermine the effectiveness of international cooperation. Especially with respect to standard setting. This impacts the work of both auditors and supervisors.

The power of international standard setting is that it brings together the knowledge of experts in their field and creates a common ground for policy making worldwide. This approach has proven to be very effective in financial supervision and financial reporting, areas that have become increasingly complex and global in nature.

In recent decades a lot of energy has been invested in good working relationships within the global standard setting bodies such as the International Assurance and Audit Standards Board, the International Accounting Standards Board and the Basel Committee on Banking Supervision. This goes both for the relationships within these groups, and between them. Both are very valuable, because it is important that supervisors and auditors understand each other’s language.

Harmonised rules based on international standards create a stable international environment and level playing field. A place where companies compete on innovation and efficiency, delivering high-quality, low-cost services to their customers. Unfortunately, this multilateral rules-based system is increasingly under pressure. Both because relationships between countries are becoming more strained, and because in some countries political pressure to deregulate is mounting.

When politicians start to drift, independent experts, like in the IAASB, IASB and the Basel Committee, must stand firm. Our job is to continue working on common, high quality standards. And we need to continue explaining the advantages for countries to play by the rules, even if others don’t. We must continue to take up that role. Especially now.

For me that means pleading for the full and timely implementation of Basel III, the package of strengthened prudential regulation for banks. The capital buffers required by Basel III are not a burden. They are a shield, allowing banks to absorb losses while maintaining operations, and maintaining lending to households and firms in times of economic stress. I think you, as a community of auditors, know best what you need to do at this juncture.

And last but not least, supervisors and auditors must continue to work together. We must continue to invest in good working relationships. In understanding each other’s language. In order to make sure that the pieces of the supervisory and auditing puzzles fit together. And we must continue to share experiences on how geopolitics and new technologies are changing the financial industry. In order to stand our ground, we need each other. Especially now, in this time of great consequence.