On Feb. 14, 2008, the Office of the Comptroller of the Currency sent a seven-page letter to Citigroup Inc.’s chief executive, Vikram Pandit, summarizing the results of a special supervisory review its bank examiners had recently concluded.
The gist of the regulator’s findings: Citigroup’s internal controls were a mess. So were its valuation methods for subprime mortgage bonds, which had spawned record losses at the bank. Among other things, “weaknesses were noted with model documentation, validation and control group oversight,” the letter said. The main valuation model Citigroup was using “is not in a controlled environment.” In other words, the model wasn’t reliable.
Here’s where the timeline gets curious. Eight days later, on Feb. 22, Citigroup filed its annual report to shareholders, in which it said “management believes that, as of Dec. 31, 2007, the company’s internal control over financial reporting is effective.” Pandit certified the report personally, including the part about Citigroup’s internal controls. So did Citigroup’s chief financial officer at the time, Gary Crittenden.
The annual report also included a Feb. 22 letter from KPMG LLP, Citigroup’s outside auditor, vouching for the effectiveness of the company’s financial-reporting controls. Nowhere did Citigroup or KPMG mention any of the problems cited by the OCC. KPMG, which earned $88.1 million in fees from Citigroup for 2007, should have been aware of them, too. The lead partner on KPMG’s Citigroup audit, William O’Mara, was listed on the “cc” line of the OCC’s Feb. 14 letter.
So, what did Citigroup and KPMG know, and when did they know it? Those are questions the Financial Crisis Inquiry Commission should have answered, but didn’t.
The OCC’s letter to Pandit was one of hundreds of newly released documents the FCIC posted to its website before it closed shop this month. As far as I can tell, there’s no indication the commission asked anyone at Citigroup or KPMG to explain how they justified their assurances about Citigroup’s internal controls in the face of the OCC’s criticisms. KPMG’s name doesn’t even appear anywhere in the FCIC’s 545-page report.
The key players aren’t talking now, either. Pandit, Crittenden and O’Mara didn’t return phone calls. A KPMG spokesman, George Ledwith, declined to comment, as did an OCC spokesman, Kevin Mukri. A Citigroup spokeswoman, Shannon Bell, declined to discuss the OCC’s findings, though in an e-mail she said the certifications by Pandit and Crittenden were “entirely appropriate.”
The OCC began its special review after Citigroup on Nov. 4, 2007, disclosed that the value of its subprime-related assets had fallen by anywhere from $8 billion to $11 billion since Sept. 30, which the bank blamed on downgrades by credit-rating companies that “occurred after the end of the third quarter.”
As I wrote in a column at the time, the idea that all these losses occurred after September 2007 wasn’t credible. Merrill Lynch & Co. had already written down its own subprime-related holdings by $8.4 billion during the third quarter, while Citigroup’s writedowns as of Sept. 30 had been small by comparison.
Now we have further confirmation. In a Jan. 17, 2008, internal memo to John Lyons, the examiner in charge of the OCC’s review, two OCC staff members, Michael Sullivan and Ron Frake, put it simply: “Model control processes did not work.”
Citigroup’s valuation model for collateralized debt obligations, they said, “was built in a short time and largely circumvented typical control policies and procedures. Developers were not aware of their responsibilities under corporate policies, having typically built trader tools rather than official valuation models. Control groups did not enforce them at the time and are now firmly on the sidelines.”
About the only kind comment the OCC staff had for Citigroup’s valuation method was that it “is broadly within the range of current market practice.” That was hardly a compliment, considering the whole financial world was blowing up. One big problem they found was that Citigroup was using a sketchy discounted cash flow model to value its CDOs, rather than using the value of the collateral as a starting point.
The Feb. 14 letter to Pandit, signed by Lyons, echoed those conclusions. It said “several months after the first use of the DCF model there are several deficiencies that need to be addressed.” Additionally, “over-reliance was placed on credit rating agency ratings without considering the appropriateness of these ratings to specific products or the true risk of the underlying collateral.”
Skewed Balance Sheet
Yet somehow KPMG and Citigroup’s management decided they didn’t need to mention any of those weaknesses or deficiencies. Maybe in their minds it was all just a difference of opinion. Whatever their rationale, nine months later Citigroup had taken a $45 billion taxpayer bailout, still sporting a balance sheet that made it seem healthy.
“As I look at the deficiencies cited in the letter, taken as a whole, it appears that Citigroup had a material weakness with respect to valuing these financial instruments,” said Ed Ketz, an accounting professor at Pennsylvania State University, who reviewed the OCC’s letter to Pandit at my request. “It just is overwhelming by the time you get to the end of it.”
One company that did get a cautionary note from its auditor that same quarter was American International Group Inc. In February 2008, PricewaterhouseCoopers LLP warned of a material weakness related to AIG’s valuations for credit-default swaps. So at least investors were told AIG’s numbers might be off. That turned out to be a gross understatement.
At Citigroup, there was no such warning. The public deserves to know why.
(Jonathan Weil is a Bloomberg News columnist. The opinions expressed are his own.)
To contact the editor responsible for this column: James Greiff at firstname.lastname@example.org