COLONIAL BANK
Case Analysis
PricewaterhouseCoopers | Audit Negligence | $2.3 Billion Fraud
$25B
$2.3B
$5B
Total Assets
Fraud Amount
FDIC Est. Loss
2009
Justice · Banking · Accountability
Bank Failure
Case Overview — What Happened?
The Fraud
The Failure
The Lawsuit
Colonial Bank and Taylor, Bean & Whitaker
(TBW) executed a $2.3B scheme using
phantom mortgage securitizations. TBW chair
Lee Farkas skimmed millions for personal
luxuries.
Colonial's $25B bank collapsed in 2009 — the
largest U.S. bank failure that year. FDIC
estimated the ultimate cost to its insurance
fund at $5 billion.
First auditor malpractice suit post-financial
crisis. FDIC sued PwC for negligently failing to
uncover the fraud, seeking up to $2.1B in
damages.
Sources: [1] [2] [3]
Q1 — Post-January 2018 Ruling: Key Updates
LIABILITY
Jan 2018
Judge Rothstein ruled PwC negligently failed to detect the $2.3B fraud. Case advanced to damages phase. FDIC seeking
up to $2.1B.
SETTLEMENT
Pre-2018
PwC had already settled related claims from TBW's bankruptcy trustee for an undisclosed amount in 2016.
DAMAGES
FDIC pursued the damages phase post-ruling to recover taxpayer funds. Marked the first auditor held liable for fraud in
many years.
IMPACT
Legal community divided: some called it 'an aggressive interpretation' likely to be reversed; others said it signals greater
auditor accountability going forward.
Ongoing
Industry
Sources: [1] [9] [10]
Q2 — AICPA Code of Professional Conduct Violations
Sources: [4]
Due Care (ET §0.300.060)
Objectivity (ET §0.300.020)
PwC assigned an intern to evaluate a $600M asset after a senior
auditor gave up. A 'truly astonishing' departure from professional
standards.
PwC relied on Farkas — the fraud's architect — to verify collateral.
Akin to asking 'the fox to report on the hen house.'
Professional Skepticism (ET §0.300.040)
Compliance with Standards (ET §0.300.050)
PwC ignored illogical dates and never verified whether a near-20%
loan class existed, accepting management representations uncritically.
PwC's own partner admitted 'our audit procedures were not designed
to detect fraud' — a direct self-indictment of standards noncompliance.
Supervision (ET §1200)
ICFR — Reliance on Crowe (AS 2201)
After a partner declared transactions 'above his pay grade,' PwC
delegated the review to an unqualified intern with no adequate
oversight.
PwC concluded Treasury controls were effective without any evidence
Crowe Horwath tested controls for the credit facility specifically.
Q3 — PCAOB Auditing Standard Violations
Violation Severity
AS 2401
Fraud in an Audit
Procedures explicitly 'not designed to detect fraud' — direct admission.
AS 2305
Analytical Procedures
7
AS 2301
AS 2101
Audit Planning
Fraud Risk Procs
Relied on fraud architect Farkas; never inspected underlying loan documents.
7
AS 2201
AS 2110
Risk Assessment
8
AS 2201
ICFR Audit
8
ICFR Audit
Concluded controls effective with zero evidence of credit facility testing.
AS 2110
Risk Assessment
Ignored 20% portfolio concentration and signs of asset non-existence.
AS 2301
Fraud Risk Procedures
AS 2101
9
Audit Planning
Excluded the credit facility from key controls despite being flagged 'Significant.'
AS 2401
Fraud Detection
10
0
Sources: [5] [6]
2
4
6
8
10
AS 2305
12
Analytical Procs
Failed to follow up on illogical dates or verify existence of loan class.
Q3 (Continued) — Should PwC Be Held Responsible?
YES — PwC Should Be Held Responsible (Our Analysis)
Sources: [1] [5]
Active Failures — Not Passive Deception
Standards Mandate Fraud Detection Design
PwC made affirmative negligent choices: assigning an intern, skipping
walkthroughs, relying on Farkas. These were not caused by client
interference.
PCAOB AS 2401 explicitly requires auditors to design procedures for
fraud. PwC's admission its procedures were 'not designed to detect
fraud' is a direct violation.
Client Fraud ≠ Excusal of Auditor Negligence
Public Interest Demands Accountability
While Colonial employees participated in fraud, PwC's independent
failures were distinct acts of negligence that existed regardless of
client behavior.
PwC's clean opinion gave false confidence to investors, depositors, and
regulators. Accountability reinforces the auditor's critical gatekeeping
function.
Q4 — Would the Ruling Make Auditors Insurers for Client Wrongdoing?
Dell's Argument
Our Analysis: The Ruling Is Narrowly Targeted
Audit firms would become 'effective insurers' for client wrongdoing
Rothstein held PwC liable for its OWN negligence, not the fraud
itself
Firms held liable even when clients actively deceive their auditors
The failures (intern, no walkthrough, Farkas reliance) were
independent of client deception
Would fundamentally change the nature and cost of auditing
VS. ▶
Holding auditors to professional standards ≠ guaranteeing against
all fraud
In most cases, firms are protected when client employees
participated in fraud
The FDIC (third-party) plaintiff avoids in pari delicto — a legitimate
policy choice
Lawyers called it 'an aggressive interpretation' and 'extremely
disturbing'
Accountability preserves the integrity of the auditing function in
capital markets
Sources: [1] [9] [10]
Q5 — In Pari Delicto: Is It in the Public Interest?
In pari delicto ("in equal fault") — bars a party from claiming breach against another when both share roughly equal blame for the harm.
Legal Community Split
For the Doctrine
45%
Against the Doctrine
Prevents windfalls for fraudulent entities
Auditors serve the PUBLIC, not just their
client
Courts shouldn't reward parties in equal
fault
FDIC (third-party) should not be barred by
client's misconduct
Colonial BancGroup claim was correctly
barred
Creates perverse incentive for auditors to
be less careful
Avoids moral hazard — clients must also
bear consequences
Courts split — public interest argument is
compelling
55%
Supports Doctrine
(protects auditors)
Against Doctrine
(protects public)
Conclusion: In pari delicto appropriately bars the FRAUDULENT CLIENT from suing, but should NOT shield auditors from third-party suits by the FDIC acting in the
public interest.
Sources: [8] [1]
Q6 — Critical Audit Matters (CAMs): When & What Should PwC Have Disclosed?
When Are CAMs Required?
•
Matters communicated to the audit
committee
•
Related to material accounts or disclosures
•
Require especially challenging, subjective,
or complex auditor judgment
•
Required under AS 3101 (PCAOB
amendment)
•
Effective for large accelerated filers after
June 30, 2019
•
Must describe the CAM, why it's a CAM,
and how it was addressed
CAM 1
CAM 2
TBW Credit Facility — Existence &
Valuation
Mortgage Securitization Accounting
Treatment
The ~$600M facility was nearly 20% of the mortgage
warehouse. PwC should have disclosed its procedures
(or lack thereof) to verify asset existence.
CAM 3
CAM 4
Reliance on Crowe Horwath (Internal
Auditor)
Fraud Risk Indicators in Treasury
Operations
Reducing substantive tests based on Crowe's untested
work — without Crowe ever testing credit facility
controls — required CAM disclosure.
Sources: [7]
Classifying TBW mortgages as sales vs. secured loans
required highly judgmental assumptions with material
P&L and balance sheet impact.
Recycled mortgage data, fake wire transfers, and
management override were red flags. PwC should have
disclosed how it addressed heightened fraud risk.
Key Takeaways
Auditor Independence Is Non-Negotiable Relying on the fraud architect for verification violated core AICPA independence and objectivity rules.
Competence Requires Appropriate Staffing Assigning a $600M complex asset to an intern without supervision is professional negligence, not a minor
oversight.
In Pari Delicto Has Limits It correctly bars fraudulent client entities but must not shield auditors from legitimate third-party (FDIC) suits.
CAM Disclosures Protect the Public Specific CAM disclosures on the credit facility and fraud risk would have warned investors and regulators in time.
Audit Liability ≠ Automatic Insurance The ruling targets PwC's own independent negligence — not the client's fraud. A vital and defensible distinction.
Sources: [1] [4] [5] [7]
References
[1]
FDIC v. PricewaterhouseCoopers LLP (M.D. Ala. Dec. 28, 2017 & July 2, 2018). FDIC Settlement
Announcement, PR-19-2019.
[6]
https://www.fdic.gov/news/press-releases/2019/pr19019.html
[2]
U.S. Dept. of Justice. (June 30, 2011). Former Chairman of Taylor, Bean & Whitaker Sentenced to
30 Years in Prison.
https://pcaobus.org/oversight/standards/auditing-standards/details/AS2201
[7]
https://www.justice.gov/archives/opa/pr/former-chairman-taylor-bean-whitaker-sentenced-30-years-prisonand-ordered-forfeit-385
[3]
FDIC. (Aug. 14, 2009). Failed Bank Information — Colonial Bank, Montgomery, AL. Federal Deposit
Insurance Corporation.
AICPA. Code of Professional Conduct. ET §§0.300.020, 0.300.040, 0.300.050, 0.300.060 (Principles
of Professional Conduct). Full PDF available at pub.aicpa.org.
[8]
PCAOB. Auditing Standard No. 2401: Consideration of Fraud in a Financial Statement Audit. Public
Company Accounting Oversight Board.
https://pcaobus.org/oversight/standards/auditing-standards/details/AS2401
All URLs verified May 2026. Click any blue link to open the source. Full FDIC case records: fdic.gov/news/press-releases/2019/pr19019.html
Bateman Eichler, Hill Richards, Inc. v. Berner, 472 U.S. 299 (1985). U.S. Supreme Court — in pari
delicto doctrine in securities fraud context.
https://supreme.justia.com/cases/federal/us/472/299/
[9]
Rapoport, M. (Jan. 3, 2018). Judge Rules PricewaterhouseCoopers Was Negligent in Colonial Bank
Audit. The Wall Street Journal.
https://www.wsj.com/articles/judge-rules-pricewaterhousecoopers-was-negligent-in-colonial-bank-audit1514999490
https://pub.aicpa.org/codeofconduct/ethicsresources/et-cod.pdf
[5]
PCAOB. Auditing Standard No. 3101: The Auditor Report on an Audit of Financial Statements —
Critical Audit Matters. Eff. June 30, 2019.
https://pcaobus.org/oversight/standards/auditing-standards/details/AS3101
https://www.fdic.gov/resources/resolutions/bank-failures/failed-bank-list/colonial-al.html
[4]
PCAOB. Auditing Standard No. 2201: An Audit of Internal Control Over Financial Reporting That Is
Integrated with an Audit of Financial Statements.
[10]
Stempel, J. (Mar. 15, 2019). PwC settles with FDIC for $335M over Colonial Bank audits. Reuters /
Accounting Today.
https://www.accountingtoday.com/news/pwc-settles-with-fdic-for-335m-over-colonial-bank-audits