Annual Independent Audits and Reporting Requirements, 44293-44297 [05-15109]

Download as PDF 44293 Proposed Rules Federal Register Vol. 70, No. 147 Tuesday, August 2, 2005 This section of the FEDERAL REGISTER contains notices to the public of the proposed issuance of rules and regulations. The purpose of these notices is to give interested persons an opportunity to participate in the rule making prior to the adoption of the final rules. FEDERAL DEPOSIT INSURANCE CORPORATION 12 CFR Part 363 RIN 3064–AC91 Annual Independent Audits and Reporting Requirements Federal Deposit Insurance Corporation (FDIC). AGENCY: ACTION: Notice of proposed rulemaking. SUMMARY: The FDIC is proposing to amend its regulations concerning annual independent audits and reporting requirements, which implement Section 36 of the Federal Deposit Insurance Act (FDI Act). Section 36 and the FDIC’s implementing regulations are generally intended to facilitate early identification of problems in financial management at insured depository institutions with total assets above a certain threshold (currently $500 million) through annual independent audits, assessments of the effectiveness of internal control over financial reporting and compliance with designated laws and regulations, and related reporting requirements. Section 36 also includes requirements for audit committees at these insured depository institutions. The FDIC’s amendments would raise the asset size threshold from $500 million to $1 billion for internal control assessments by management and external auditors and for the members of the audit committee, who must be outside directors, to be independent of management. As required by section 36, the FDIC has consulted with the other Federal banking agencies. These amendments are proposed to take effect December 31, 2005. Comments must be received on or before September 16, 2005. DATES: Interested parties are invited to submit written comments to the FDIC by any of the following methods: ADDRESSES: VerDate jul<14>2003 15:36 Aug 01, 2005 Jkt 205001 • Federal eRulemaking Portal: https:// www.regulations.gov. Follow the instructions for submitting comments. • Agency Web site: https:// www.fdic.gov/regulations/laws/federal/ propose.html. Follow the instructions for submitting comments on the FDIC Web site. • E-mail: Comments@FDIC.gov. Include RIN number in the subject line of the message. • Mail: Robert E. Feldman, Executive Secretary, Attention: Comments, Federal Deposit Insurance Corporation, 550 17th Street, NW., Washington, DC 20429. • Hand Delivery/Courier: Guard station at the rear of the 550 17th Street building (located on F Street) on business days between 7 a.m. and 5 p.m. Instructions: All submissions received must include the agency name and RIN number for this rulemaking. All comments received will be posted without change to https://www.fdic.gov/ regulations/laws/federal/propose.html including any personal information provided. Comments may be inspected and photocopied in the FDIC Public Information Center, Room 100, 801 17th Street, NW., Washington, DC, between 9 a.m. and 4:30 p.m. on business days. FOR FURTHER INFORMATION CONTACT: Harrison E. Greene, Jr., Senior Policy Analyst (Bank Accounting), Division of Supervision and Consumer Protection, at hgreene@fdic.gov or (202) 898–8905; or Michelle Borzillo, Counsel, Supervision and Legislation Section, Legal Division, at mborzillo@fdic.gov or (202) 898–7400. SUPPLEMENTARY INFORMATION: A. Background Section 112 of the Federal Deposit Insurance Corporation Improvement Act of 1991 (FDICIA) added Section 36, ‘‘Early Identification of Needed Improvements in Financial Management,’’ to the FDI Act (12 U.S.C. 1831m). Section 36 is generally intended to facilitate early identification of problems in financial management at insured depository institutions above a certain asset size threshold through annual independent audits, assessments of the effectiveness of internal control over financial reporting and compliance with designated laws and regulations, and related requirements. Section 36 also includes requirements for audit committees at these insured depository institutions. Section 36 grants the FDIC PO 00000 Frm 00001 Fmt 4702 Sfmt 4702 discretion to set the asset size threshold for compliance with these statutory requirements, but it states that the threshold cannot be less than $150 million. Sections 36(d) and (f) also obligate the FDIC to consult with the other Federal banking agencies in implementing these sections of the FDI Act, and the FDIC has performed that consultation requirement. In June 1993, the FDIC published 12 CFR part 363 (58 FR 31332, June 2, 1993) to implement the provisions of section 36 of the FDI Act. Under part 363, the requirements of section 36 apply to each insured depository institution with $500 million or more in total assets at the beginning of its fiscal year (covered institution). Often referred to as the ‘‘FDICIA reporting requirements,’’ part 363 requires each covered institution to submit to the FDIC and other appropriate Federal and state supervisory agencies an annual report that includes audited financial statements, a statement of management’s responsibilities, assessments by management of the effectiveness of internal control over financial reporting and compliance with designated laws and regulations, and an auditor’s attestation report on internal control over financial reporting. In addition, part 363 provides that each covered institution must establish an independent audit committee of its board of directors comprised of outside directors who are independent of management of the institution. Part 363 also includes Guidelines and Interpretations (Appendix A to part 363), which are intended to assist institutions and independent public accountants in understanding and complying with section 36 and part 363. A covered institution may satisfy the audited financial statements requirement of part 363 at the holding company level. Subject to certain conditions, the other requirements of part 363 may be satisfied at the holding company level. Members of the independent audit committee of a holding company may serve as the audit committee of a subsidiary covered institution provided they are otherwise independent of the subsidiary’s management and meet the other criteria set forth in part 363. When it adopted part 363 in 1993, the FDIC stated that it was setting the asset size threshold at $500 million rather E:\FR\FM\02AUP1.SGM 02AUP1 44294 Federal Register / Vol. 70, No. 147 / Tuesday, August 2, 2005 / Proposed Rules than the $150 million specified in section 36 to mitigate the financial burden of compliance with section 36 consistent with safety and soundness. In selecting $500 million in total assets as the size threshold, the FDIC noted that approximately 1,000 of the then nearly 14,000 FDIC-insured institutions would be subject to part 363. These covered institutions held approximately 75 percent of the assets of insured institutions at that time. By imposing the audit, reporting, and audit committee requirements of part 363 on institutions with this percentage of the industry’s assets, the FDIC intended to ensure that the Congress’s objectives for achieving sound financial management at insured institutions when it enacted section 36 would be focused on those institutions posing the greatest risk to the insurance funds administered by the FDIC. Today, due to consolidation in the banking and thrift industry and the effects of inflation, approximately 1,150 of the 8,900 insured institutions have $500 million or more in total assets and are therefore subject to part 363. These covered institutions hold approximately 90 percent of the assets of insured institutions. B. Increasing the Asset Size Threshold for Internal Control Assessments An effective internal control structure is critical to the safety and soundness of each insured institution. Given its importance, internal control is evaluated as part of the supervision of individual institutions and its adequacy is a factor in the management rating assigned to an institution. Furthermore, in the audit of an institution’s financial statements, the external auditor must obtain an understanding of internal control, including assessing control risk, and must report certain matters regarding internal control to the institution’s audit committee. An institution subject to part 363 has the added requirement that its management perform an assessment of the internal control structure and procedures for financial reporting and that its external auditor examine, attest to, and report on management’s assertion concerning the institution’s internal control over financial reporting. For purposes of these internal control provisions of part 363, the FDIC has advised covered institutions that the term ‘‘financial reporting’’ includes both financial statements prepared in accordance with generally accepted accounting principles and those prepared for regulatory reporting VerDate jul<14>2003 15:36 Aug 01, 2005 Jkt 205001 purposes.1 Until year-end 2004, external auditors performed their internal control assessments in accordance with an attestation standard issued by the American Institute of Certified Public Accountants (AICPA) known as ‘‘AT 501.’’ The Sarbanes-Oxley Act was enacted into law on July 30, 2002. Section 404 of this Act imposes a requirement for internal control assessments by the management and external auditors of all public companies that is similar to the FDICIA requirement. The Securities and Exchange Commission’s (SEC) rules implementing these requirements took effect at year-end 2004 for ‘‘accelerated filers,’’ i.e., generally, public companies whose common equity has an aggregate market value of at least $75 million, but they will not take effect until 2006 for ‘‘non-accelerated filers.’’ For the section 404 auditor attestations, the Public Company Accounting Oversight Board’s (PCAOB) Auditing Standard No. 2 (AS 2) applies. AS 2 replaces the AICPA’s AT 501 internal control attestation standard for public companies, but AS 2 does not apply to nonpublic companies. The SEC’s section 404 rules for management and the provisions of AS 2 for section 404 audits of internal control establish more robust documentation and testing requirements than those that have been applied by covered institutions and their auditors to satisfy the internal control reporting requirements in part 363. For internal control attestations of nonpublic companies, the AICPA is currently developing proposed revisions to AT 501 that are expected to bring it closer into line with the provisions of AS 2. The revisions also are likely to have the effect of requiring greater documentation and testing of internal control over financial reporting by an institution’s management in order for the auditor to perform his or her attestation work. As the environment has changed and continues to change since the enactment of the Sarbanes-Oxley Act, the FDIC has observed that compliance with the audit and reporting requirements of part 363 has and will continue to become more burdensome and costly, particularly for smaller nonpublic covered institutions. Thus, the FDIC has reviewed the current asset size threshold for compliance with part 363 in light of the discretion 1 See FDIC Financial Institution Letter (FIL) 86– 94, dated December 23, 1994. FIL–86–94 indicates that financial statements prepared for regulatory reporting purposes encompass the schedules equivalent to the basic financial statements in an institution’s appropriate regulatory report, e.g., the bank Reports of Conditions and Income and the Thrift Financial Report. PO 00000 Frm 00002 Fmt 4702 Sfmt 4702 granted by Section 36 that permits the FDIC to determine the appropriate size threshold (at or above $150 million) at which insured institutions should be subject to the various provisions of section 36. Based on this review, the FDIC is proposing to amend part 363 to increase the asset size threshold for internal control assessments by management and external auditors from $500 million to $1 billion. Raising the threshold to $1 billion would achieve meaningful burden reduction without sacrificing safety and soundness. In reaching this decision, the FDIC concluded that raising the $500 million asset size threshold to $1 billion and exempting all institutions below this higher size level from all of the reporting requirements of part 363 would not be consistent with the objective of the underlying statute, i.e., early identification of needed improvements in financial management. In contrast, the FDIC believes that relieving smaller covered institutions from the burden of internal control assessments, while retaining the financial statement audit and other reporting requirements for all institutions with $500 million or more in total assets, strikes an appropriate balance in accomplishing this objective. If the FDIC were to raise the size threshold for internal control assessments to $1 billion, about 600 of the largest insured institutions with approximately 86 percent of industry assets would continue to be covered by the internal control reporting requirements of part 363. At the same time, the managements of covered institutions would remain responsible for establishing and maintaining an adequate internal control structure and procedures for financial reporting, and all institutions with $500 million or more in total assets would continue to include a statement to that effect in their part 363 annual report. Accordingly, the FDIC is seeking comments on the proposed amendment to part 363 to increase the asset size threshold for internal control assessments by management and external auditors to $1 billion. This amendment is proposed to take effect December 31, 2005. For insured institutions (both public and nonpublic) with calendar year fiscal years that had $500 million or more in total assets, but less than $1 billion in total assets, on January 1, 2005, this proposal would mean that the part 363 annual report for 2005 that they submit to the FDIC and other appropriate Federal and state supervisory agencies would need to include only audited financial statements, statements of management’s E:\FR\FM\02AUP1.SGM 02AUP1 Federal Register / Vol. 70, No. 147 / Tuesday, August 2, 2005 / Proposed Rules responsibilities, management’s assessment of the institution’s compliance with designated laws and regulations, and an auditor’s report on the financial statements. For insured depository institutions that are public companies or subsidiaries of public companies, regardless of size, the FDIC’s proposed amendment to part 363 would not relieve public companies of their obligation to comply with the internal control assessment requirements imposed by section 404 of the SarbanesOxley Act in accordance with the effective dates for compliance set forth in the SEC’s implementing rules. Nevertheless, the FDIC reminds insured institutions with $1 billion or more in total assets that are public companies or subsidiaries of public companies that they have considerable flexibility in determining how best to satisfy the internal control assessment requirements in the SEC’s section 404 rules and the FDIC’s part 363. As indicated in the preamble to the SEC’s section 404 final rule release, the FDIC (and the other Federal banking agencies) agreed with the SEC that insured depository institutions that are subject to both part 363 (as well as holding companies permitted under the holding company exception in part 363 to file an internal control report on behalf of their insured depository institution subsidiaries) and the SEC’s rules implementing section 404 can choose either of the following two options: • They can prepare two separate reports of management on the institution’s or the holding company’s internal control over financial reporting to satisfy the FDIC’s part 363 requirements and the SEC’s section 404 requirements; or • They can prepare a single report of management on internal control over financial reporting that satisfies both the FDIC’s requirements and the SEC’s requirements.2 2 Footnote 117 in the preamble to the SEC’s Section 404 final rule releases states that ‘‘[a]n insured depository institution subject to both the FDIC’s [internal control assessment] requirements and our new requirements [i.e., a public depository institution] choosing to file a single report to satisfy both sets of requirements will file the report with its primary Federal regulator under the Exchange Act and the FDIC, its primary Federal regulator (if other than the FDIC), and any appropriate state depository institution supervisor under part 363 of the FDIC’s regulations. A [public] holding company choosing to prepare a single report to satisfy both sets of requirements will file the report with the [Securities and Exchange] Commission under the Exchange Act and the FDIC, the primary federal regulator of the insured depository institution subsidiary subject to the FDIC’s requirements, and any appropriate state depository institution supervisor under part 363.’’ VerDate jul<14>2003 15:36 Aug 01, 2005 Jkt 205001 For more complete information on these two options, institutions (and holding companies) should refer to Section II.H.4. of the preamble to the SEC’s Section 404 final rule release (68 FR 36648, June 18, 2003). C. Composition of the Audit Committee Currently, part 363 requires each covered institution to establish an independent audit committee of its board of directors, comprised of outside directors who are independent of management of the institution. The duties of the audit committee include reviewing with management and the institutions’ independent public accountant the basis for the reports included in the part 363 annual report submitted to the FDIC and other appropriate Federal and state supervisory agencies. The FDIC’s Guidelines to part 363 provide that, at least annually, the board of directors of a covered institution should determine whether all existing and potential audit committee members are ‘‘independent of management of the institution.’’ The guidelines also describe factors to consider in making this determination.3 Section 36 provides that an appropriate Federal banking agency may grant a hardship exemption to a covered institution that would permit its independent audit committee to be made up of less than all, but no fewer than a majority of, outside directors who are independent of management. To grant the exemption, the agency must find that the institution has encountered hardships in retaining and recruiting a sufficient number of competent outside directors. Notwithstanding this exemption provision of section 36, the FDIC has observed that a number of smaller covered institutions, particularly those with few shareholders that have recently exceeded $500 million in total assets and become subject to part 363, have encountered difficulty in satisfying the independent audit committee requirement. To comply with this requirement, these institutions must identify and attract qualified individuals in their communities who would be willing to become a director and audit committee member and who would be independent of management. To relieve this burden, but also recognizing that the FDIC has long held that individuals who serve as directors of any insured depository institution should be persons of independent judgment, the FDIC is proposing to amend part 363 to increase from $500 3 See Guidelines 27 through 29 of Appendix A to part 363. PO 00000 Frm 00003 Fmt 4702 Sfmt 4702 44295 million to $1 billion the asset size threshold for requiring audit committee members to be independent of management. Conforming changes would be made to Guidelines 27–29 of Appendix A to part 363. Each insured depository institution with total assets of $500 million or more but less than $1 billion would continue to be required to have an audit committee comprised of outside directors. Consistent with Guideline 29 of Appendix A to part 363, an outside director would be defined as an individual who is not, and within the preceding year has not been, an officer or employee of the institution or any affiliate of the institution. This proposed amendment to the audit committee requirements for institutions with between $500 million and $1 billion in total assets would allow an outside director who is, for example, a consultant or legal counsel to the institution, a relative of an officer or employee of the institution or its affiliates, or the owner of 10 percent or more of the stock of the institution to serve as an audit committee member. Nevertheless, the FDIC would encourage each institution with between $500 million and $1 billion in assets to make a reasonable good faith effort to establish an audit committee of outside directors who are independent of management. Accordingly, the FDIC is seeking comments on the proposed amendment to increase from $500 million to $1 billion the asset size threshold at which members of a covered institution’s audit committee must be outside directors who are independent of management. This amendment is proposed to take effect December 31, 2005. D. Technical Changes The FDIC also proposes to make certain technical changes to part 363 to correct outdated titles, terms, and references in the regulation and its appendix. E. Other Revisions The FDIC has identified other aspects of part 363 that may warrant revision in light of changes in the industry and the passage of the Sarbanes-Oxley Act. However, the FDIC believes that finalizing the amendments in this proposal should take priority over other possible revisions to part 363 in order to reduce compliance burdens and expenses for affected institutions in the current year. The FDIC expects to propose further revisions to part 363 as soon as practicable. E:\FR\FM\02AUP1.SGM 02AUP1 44296 Federal Register / Vol. 70, No. 147 / Tuesday, August 2, 2005 / Proposed Rules Request for Comments The FDIC welcomes comments on all aspects of this proposal. Solicitation of Comments on Use of Plain Language Section 722 of the Gramm-LeachBliley Act, Pub. L. 106–102, sec. 722, 113 Stat. 1338, 1471 (Nov. 12, 1999), requires the Federal banking agencies to use plain language in all proposed and final rules published after January 1, 2000. We invite your comments on how to make this proposal easier to understand. For example: • Have we organized the material to suit your needs? If not, how could this material be better organized? • Are the requirements in the proposed regulation clearly stated? If not, how could the regulation be more clearly stated? • Does the proposed regulation contain language or jargon that is not clear? If so, which language requires clarification? • Would a different format (grouping and order of sections, use of headings, paragraphing) make the regulation easier to understand? If so, what changes to the format would make the regulation easier to understand? • What else could we do to make the regulation easier to understand? Solicitation of Comments on Impact on Community Banks The FDIC seeks comments on the impact of this proposal on community banks. The FDIC recognizes that community banks operate with more limited resources than larger institutions and may present a different risk profile. Thus, the FDIC specifically requests comments on the impact of the proposal on community banks’ current resources, including personnel, and whether the goals of the proposed rule could be achieved, for community banks, through an alternative approach. Regulatory Flexibility Act Analysis The Regulatory Flexibility Act (RFA) requires that each Federal Agency either certify that a proposed rule would not, if adopted in final form, have a significant economic impact on a substantial number of small entities or prepare an initial regulatory flexibility analysis (IRFA) of the proposal and publish the analysis for comment. See 5 U.S.C. 603, 605. The Small Business Administration (SBA) defines small banks as those with less than $150 million in assets. Because this rule expressly exempts insured depository institutions having assets of less than $500 million, it is inapplicable to small entities as defined by the SBA. VerDate jul<14>2003 15:36 Aug 01, 2005 Jkt 205001 Therefore, it is certified that this proposed rule would not have a significant economic impact on a substantial number of small entities. Paperwork Reduction Act This proposed rule would revise a collection of information that has been reviewed and approved by the Office of Management and Budget under control number 3064–0113, pursuant to the Paperwork Reduction Act (44 U.S.C. 3501 et seq). The primary revisions increase the asset size threshold for compliance with sections 363.2(b), 363.3(b), and 363.5(a). It is anticipated that these changes will result in a burden reduction for affected insured institutions. Comments are invited on: (a) Whether the collection of information is necessary for the proper performance of the FDIC’s functions, including whether the information has practical utility; (b) the accuracy of the estimates of the burden of the information collection; (c) ways to enhance the quality, utility, and clarity of the information to be collected; and (d) ways to minimize the burden of the information collection on respondents, including through the use of automated collection techniques or other forms of information technology. Comments should be addressed to Steven F. Hanft, Paperwork Clearance Officer, Room MB–3064, Federal Deposit Insurance Corporation, 550 17th Street, NW., Washington, DC 20429, with copies to Desk Officer Mark Menchik, Office of Information and Regulatory Affairs, Office of Management and Budget, NEOB, Washington, DC 20503. The paperwork burden associated with this rule was last reviewed in 2002. At that time, the FDIC estimated the burden to be 42,639 hours for FDICsupervised institutions. Since then, data has become available to the FDIC that indicates the 2002 estimate was too low. Taking that information (including the results of a burden study conducted by a major trade association) into account, the FDIC believes a more accurate estimate for this collection of information is 118,535 hours. If the revisions in this proposed rule are implemented, the resulting estimated reporting burden for the collection of information would be 65,612 hours, a 45 percent reduction (52,923 hours). Number of Respondents: 5,243. Total Annual Responses: 15,684. Total Annual Burden Hours: 65,612. List of Subjects in 12 CFR Part 363 Accounting, Administrative practice and procedure, Banks, banking, PO 00000 Frm 00004 Fmt 4702 Sfmt 4702 Reporting and recordkeeping requirements. For the reasons set forth in the preamble, the Board of Directors of the FDIC proposes to amend part 363 of title 12, chapter III, of the Code of Federal Regulations as follows: PART 363—ANNUAL INDEPENDENT AUDITS AND REPORTING REQUIREMENTS 1. The authority citation for part 363 continues to read as follows: Authority: 12 U.S.C 1831m. 2. Section 363.1 is amended by revising paragraph (b)(2)(ii)(B) to read as follows: § 363.1 Scope. * * * * * (b) * * * (2) * * * (ii) * * * (B) Total assets of $5 billion or more and a composite CAMELS rating of 1 or 2. * * * * * 3. Section 363.2 is amended by revising paragraph (b)(2) and adding paragraph (b)(3) to read as follows: § 363.2 Annual reporting requirements. * * * * * (b) * * * (1) * * * (2) An assessment by management of the institution’s compliance with such laws and regulations during such fiscal year; and (3) For an institution with total assets of $1 billion or more at the beginning of such fiscal year, an assessment by management of the effectiveness of such internal control structure and procedures as of the end of such fiscal year. 4. Section 363.3 is amended by revising paragraph (b) to read as follows: § 363.3 Independent public accountant. * * * * * (b) Additional reports. For each insured depository institution with total assets of $1 billion or more at the beginning of the institution’s fiscal year, such independent public accountant shall examine, attest to, and report separately on, the assertion of management concerning the institution’s internal control structure and procedures for financial reporting. The attestation shall be made in accordance with generally accepted standards for attestation engagements. * * * * * 5. Section 363.5 is amended by revising paragraph (a) to read as follows: E:\FR\FM\02AUP1.SGM 02AUP1 Federal Register / Vol. 70, No. 147 / Tuesday, August 2, 2005 / Proposed Rules § 363.5 Audit committees. (a) Composition and duties. Each insured depository institution shall establish an audit committee of its board of directors, the composition of which complies with paragraphs (a)(1), (2), and (3) of this section, and the duties of which shall include reviewing with management and the independent public accountant the basis for the reports issued under this part. (1) Each insured depository institution with total assets of $1 billion or more as of the beginning of its fiscal year shall establish an independent audit committee of its board of directors, the members of which shall be outside directors who are independent of management of the institution. (2) Each insured depository institution with total assets of $500 million or more but less than $1 billion as of the beginning of its fiscal year shall establish an audit committee of its board of directors, the members of which shall be outside directors. (3) An outside director is a director who is not, and within the preceding fiscal year has not been, an officer or employee of the institution or any affiliate of the institution. * * * * * 6. Appendix A to Part 363 is amended as follows: a. Footnote 2 Guideline 10 is amended by adding ‘‘and Consumer Protection Risk Management’’ after ‘‘FDIC’s Division of Supervision’’; b. Guideline 16 is amended by removing ‘‘Registration and Disclosure Section’’ and adding in its place ‘‘Accounting and Securities Disclosure Section’’; c. Guideline 22 is amended by revising the first sentence of paragraph (a) to read as set forth below: d. Guideline 27 is amended by revising the second sentence to read as set forth below; e. Guideline 28 is amended by revising paragraph (a) to read as set forth below; f. Guideline 29 is revised to read as set forth below; and g. The first sentence of Guideline 36 is revised to read as set forth below. The revisions read as follows: Appendix A to Part 363—Guidelines and Interpretations * * * * * Filing and Notice Requirements (§ 363.4) 22. * * * (a) FDIC: Appropriate FDIC Regional or Area Office (Supervision and Consumer Protection), i.e., the FDIC regional or area office in the FDIC region or area that is responsible for monitoring the institution or, in the case of a subsidiary institution of a VerDate jul<14>2003 15:36 Aug 01, 2005 Jkt 205001 holding company, the consolidated company. * * * * * * * * Audit Committees (§ 363.5) 27. * * * At least annually at an institution with $1 billion or more in total assets at the beginning of its fiscal year, the board should determine whether all existing and potential audit committee members are ‘‘independent of management of the institution.’’ * * * 28. * * * (a) Has previously been an officer of the institution or any affiliate of the institution; 29. Lack of Independence. An outside director should not be considered independent of management if such director owns or controls, or has owned or controlled within the preceding fiscal year, assets representing 10 percent or more of any outstanding class of voting securities of the institution. * * * * * Other 36. * * * The FDIC Board of Directors has delegated to the Director of the FDIC’s Division of Supervision and Consumer Protection (DSC) authority to make and publish in the Federal Register minor technical amendments to the Guidelines in this appendix in consultation with the other appropriate Federal banking agencies, to reflect the practical experience gained from implementation of this part. * * * * * * * * By order of the Board of Directors. Federal Deposit Insurance Corporation. Dated at Washington, DC, this 19th day of July, 2005. Robert E. Feldman, Executive Secretary. [FR Doc. 05–15109 Filed 8–1–05; 8:45 am] BILLING CODE 6714–01–P DEPARTMENT OF TRANSPORTATION Federal Aviation Administration 14 CFR Part 39 [Docket No. FAA–2005–21835; Directorate Identifier 2005–CE–35–AD] RIN 2120–AA64 Airworthiness Directives; Pilatus Aircraft Ltd. Models PC–12 and PC–12/ 45 Airplanes Federal Aviation Administration (FAA), DOT. ACTION: Notice of proposed rulemaking (NPRM). AGENCY: SUMMARY: The FAA proposes to adopt a new airworthiness directive (AD) for certain Pilatus Aircraft Ltd. (Pilatus) Models PC–12 and PC–12/45 airplanes. This proposed AD would require you to inspect the left and right main landing PO 00000 Frm 00005 Fmt 4702 Sfmt 4702 44297 gear (MLG) assemblies for any part number (P/N) 532.10.12.077 bolts that do not have white primed and painted heads; and replace any bolt found with new P/N 532.10.12.077F bolts in all MLG assemblies. This proposed AD results from mandatory continuing airworthiness information (MCAI) issued by the airworthiness authority for Switzerland. We are issuing this proposed AD to detect and correct any P/N 532.10.12.077 bolts that do not have white primed and painted heads, which could result in corrosion of the bolt and consequent failure of the bolt. This failure could lead to MLG collapse during airplane landing and take-off operations with consequent loss of airplane control. DATES: We must receive any comments on this proposed AD by August 31, 2005. Use one of the following to submit comments on this proposed AD: • DOT Docket Web site: Go to https://dms.dot.gov and follow the instructions for sending your comments electronically. • Government-wide rulemaking Web site: Go to https://www.regulations.gov and follow the instructions for sending your comments electronically. • Mail: Docket Management Facility; U.S. Department of Transportation, 400 Seventh Street, SW., Nassif Building, Room PL–401, Washington, DC 20590– 001. • Fax: 1–202–493–2251. • Hand Delivery: Room PL–401 on the plaza level of the Nassif Building, 400 Seventh Street, SW., Washington, DC, between 9 a.m. and 5 p.m., Monday through Friday, except Federal holidays. To get the service information identified in this proposed AD, contact Pilatus Aircraft Ltd., Customer Liaison Manager, CH–6371 Stans, Switzerland; telephone: +41 41 619 6208; facsimile: +41 41 619 7311; e-mail: SupportPC12@pilatus-aircraft.com or from Pilatus Business Aircraft Ltd., Product Support Department, 11755 Airport Way, Broomfield, Colorado 80021; telephone: (303) 465–9099; facsimile: (303) 465–6040. To view the comments to this proposed AD, go to https://dms.dot.gov. This is docket number FAA–2005– 21835; Directorate Identifier 2005–CE– 35–AD. FOR FURTHER INFORMATION CONTACT: Doug Rudolph, Aerospace Engineer, FAA, Small Airplane Directorate, 901 Locust, Room 301, Kansas City, Missouri 64106; telephone: (816) 329– 4059; facsimile: (816) 329–4090. SUPPLEMENTARY INFORMATION: ADDRESSES: E:\FR\FM\02AUP1.SGM 02AUP1

Agencies

[Federal Register Volume 70, Number 147 (Tuesday, August 2, 2005)]
[Proposed Rules]
[Pages 44293-44297]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 05-15109]


========================================================================
Proposed Rules
                                                Federal Register
________________________________________________________________________

This section of the FEDERAL REGISTER contains notices to the public of 
the proposed issuance of rules and regulations. The purpose of these 
notices is to give interested persons an opportunity to participate in 
the rule making prior to the adoption of the final rules.

========================================================================


Federal Register / Vol. 70, No. 147 / Tuesday, August 2, 2005 / 
Proposed Rules

[[Page 44293]]



FEDERAL DEPOSIT INSURANCE CORPORATION

12 CFR Part 363

RIN 3064-AC91


Annual Independent Audits and Reporting Requirements

AGENCY: Federal Deposit Insurance Corporation (FDIC).

ACTION: Notice of proposed rulemaking.

-----------------------------------------------------------------------

SUMMARY: The FDIC is proposing to amend its regulations concerning 
annual independent audits and reporting requirements, which implement 
Section 36 of the Federal Deposit Insurance Act (FDI Act). Section 36 
and the FDIC's implementing regulations are generally intended to 
facilitate early identification of problems in financial management at 
insured depository institutions with total assets above a certain 
threshold (currently $500 million) through annual independent audits, 
assessments of the effectiveness of internal control over financial 
reporting and compliance with designated laws and regulations, and 
related reporting requirements. Section 36 also includes requirements 
for audit committees at these insured depository institutions. The 
FDIC's amendments would raise the asset size threshold from $500 
million to $1 billion for internal control assessments by management 
and external auditors and for the members of the audit committee, who 
must be outside directors, to be independent of management. As required 
by section 36, the FDIC has consulted with the other Federal banking 
agencies. These amendments are proposed to take effect December 31, 
2005.

DATES: Comments must be received on or before September 16, 2005.

ADDRESSES: Interested parties are invited to submit written comments to 
the FDIC by any of the following methods:
     Federal eRulemaking Portal: https://www.regulations.gov. 
Follow the instructions for submitting comments.
     Agency Web site: https://www.fdic.gov/regulations/laws/
federal/propose.html. Follow the instructions for submitting comments 
on the FDIC Web site.
     E-mail: Comments@FDIC.gov. Include RIN number in the 
subject line of the message.
     Mail: Robert E. Feldman, Executive Secretary, Attention: 
Comments, Federal Deposit Insurance Corporation, 550 17th Street, NW., 
Washington, DC 20429.
     Hand Delivery/Courier: Guard station at the rear of the 
550 17th Street building (located on F Street) on business days between 
7 a.m. and 5 p.m.
    Instructions: All submissions received must include the agency name 
and RIN number for this rulemaking. All comments received will be 
posted without change to https://www.fdic.gov/regulations/laws/federal/
propose.html including any personal information provided. Comments may 
be inspected and photocopied in the FDIC Public Information Center, 
Room 100, 801 17th Street, NW., Washington, DC, between 9 a.m. and 4:30 
p.m. on business days.

FOR FURTHER INFORMATION CONTACT: Harrison E. Greene, Jr., Senior Policy 
Analyst (Bank Accounting), Division of Supervision and Consumer 
Protection, at hgreene@fdic.gov or (202) 898-8905; or Michelle 
Borzillo, Counsel, Supervision and Legislation Section, Legal Division, 
at mborzillo@fdic.gov or (202) 898-7400.

SUPPLEMENTARY INFORMATION:

A. Background

    Section 112 of the Federal Deposit Insurance Corporation 
Improvement Act of 1991 (FDICIA) added Section 36, ``Early 
Identification of Needed Improvements in Financial Management,'' to the 
FDI Act (12 U.S.C. 1831m). Section 36 is generally intended to 
facilitate early identification of problems in financial management at 
insured depository institutions above a certain asset size threshold 
through annual independent audits, assessments of the effectiveness of 
internal control over financial reporting and compliance with 
designated laws and regulations, and related requirements. Section 36 
also includes requirements for audit committees at these insured 
depository institutions. Section 36 grants the FDIC discretion to set 
the asset size threshold for compliance with these statutory 
requirements, but it states that the threshold cannot be less than $150 
million. Sections 36(d) and (f) also obligate the FDIC to consult with 
the other Federal banking agencies in implementing these sections of 
the FDI Act, and the FDIC has performed that consultation requirement.
    In June 1993, the FDIC published 12 CFR part 363 (58 FR 31332, June 
2, 1993) to implement the provisions of section 36 of the FDI Act. 
Under part 363, the requirements of section 36 apply to each insured 
depository institution with $500 million or more in total assets at the 
beginning of its fiscal year (covered institution). Often referred to 
as the ``FDICIA reporting requirements,'' part 363 requires each 
covered institution to submit to the FDIC and other appropriate Federal 
and state supervisory agencies an annual report that includes audited 
financial statements, a statement of management's responsibilities, 
assessments by management of the effectiveness of internal control over 
financial reporting and compliance with designated laws and 
regulations, and an auditor's attestation report on internal control 
over financial reporting. In addition, part 363 provides that each 
covered institution must establish an independent audit committee of 
its board of directors comprised of outside directors who are 
independent of management of the institution. Part 363 also includes 
Guidelines and Interpretations (Appendix A to part 363), which are 
intended to assist institutions and independent public accountants in 
understanding and complying with section 36 and part 363.
    A covered institution may satisfy the audited financial statements 
requirement of part 363 at the holding company level. Subject to 
certain conditions, the other requirements of part 363 may be satisfied 
at the holding company level. Members of the independent audit 
committee of a holding company may serve as the audit committee of a 
subsidiary covered institution provided they are otherwise independent 
of the subsidiary's management and meet the other criteria set forth in 
part 363.
    When it adopted part 363 in 1993, the FDIC stated that it was 
setting the asset size threshold at $500 million rather

[[Page 44294]]

than the $150 million specified in section 36 to mitigate the financial 
burden of compliance with section 36 consistent with safety and 
soundness. In selecting $500 million in total assets as the size 
threshold, the FDIC noted that approximately 1,000 of the then nearly 
14,000 FDIC-insured institutions would be subject to part 363. These 
covered institutions held approximately 75 percent of the assets of 
insured institutions at that time. By imposing the audit, reporting, 
and audit committee requirements of part 363 on institutions with this 
percentage of the industry's assets, the FDIC intended to ensure that 
the Congress's objectives for achieving sound financial management at 
insured institutions when it enacted section 36 would be focused on 
those institutions posing the greatest risk to the insurance funds 
administered by the FDIC. Today, due to consolidation in the banking 
and thrift industry and the effects of inflation, approximately 1,150 
of the 8,900 insured institutions have $500 million or more in total 
assets and are therefore subject to part 363. These covered 
institutions hold approximately 90 percent of the assets of insured 
institutions.

B. Increasing the Asset Size Threshold for Internal Control Assessments

    An effective internal control structure is critical to the safety 
and soundness of each insured institution. Given its importance, 
internal control is evaluated as part of the supervision of individual 
institutions and its adequacy is a factor in the management rating 
assigned to an institution. Furthermore, in the audit of an 
institution's financial statements, the external auditor must obtain an 
understanding of internal control, including assessing control risk, 
and must report certain matters regarding internal control to the 
institution's audit committee.
    An institution subject to part 363 has the added requirement that 
its management perform an assessment of the internal control structure 
and procedures for financial reporting and that its external auditor 
examine, attest to, and report on management's assertion concerning the 
institution's internal control over financial reporting. For purposes 
of these internal control provisions of part 363, the FDIC has advised 
covered institutions that the term ``financial reporting'' includes 
both financial statements prepared in accordance with generally 
accepted accounting principles and those prepared for regulatory 
reporting purposes.\1\ Until year-end 2004, external auditors performed 
their internal control assessments in accordance with an attestation 
standard issued by the American Institute of Certified Public 
Accountants (AICPA) known as ``AT 501.''
---------------------------------------------------------------------------

    \1\ See FDIC Financial Institution Letter (FIL) 86-94, dated 
December 23, 1994. FIL-86-94 indicates that financial statements 
prepared for regulatory reporting purposes encompass the schedules 
equivalent to the basic financial statements in an institution's 
appropriate regulatory report, e.g., the bank Reports of Conditions 
and Income and the Thrift Financial Report.
---------------------------------------------------------------------------

    The Sarbanes-Oxley Act was enacted into law on July 30, 2002. 
Section 404 of this Act imposes a requirement for internal control 
assessments by the management and external auditors of all public 
companies that is similar to the FDICIA requirement. The Securities and 
Exchange Commission's (SEC) rules implementing these requirements took 
effect at year-end 2004 for ``accelerated filers,'' i.e., generally, 
public companies whose common equity has an aggregate market value of 
at least $75 million, but they will not take effect until 2006 for 
``non-accelerated filers.'' For the section 404 auditor attestations, 
the Public Company Accounting Oversight Board's (PCAOB) Auditing 
Standard No. 2 (AS 2) applies. AS 2 replaces the AICPA's AT 501 
internal control attestation standard for public companies, but AS 2 
does not apply to nonpublic companies. The SEC's section 404 rules for 
management and the provisions of AS 2 for section 404 audits of 
internal control establish more robust documentation and testing 
requirements than those that have been applied by covered institutions 
and their auditors to satisfy the internal control reporting 
requirements in part 363.
    For internal control attestations of nonpublic companies, the AICPA 
is currently developing proposed revisions to AT 501 that are expected 
to bring it closer into line with the provisions of AS 2. The revisions 
also are likely to have the effect of requiring greater documentation 
and testing of internal control over financial reporting by an 
institution's management in order for the auditor to perform his or her 
attestation work.
    As the environment has changed and continues to change since the 
enactment of the Sarbanes-Oxley Act, the FDIC has observed that 
compliance with the audit and reporting requirements of part 363 has 
and will continue to become more burdensome and costly, particularly 
for smaller nonpublic covered institutions. Thus, the FDIC has reviewed 
the current asset size threshold for compliance with part 363 in light 
of the discretion granted by Section 36 that permits the FDIC to 
determine the appropriate size threshold (at or above $150 million) at 
which insured institutions should be subject to the various provisions 
of section 36. Based on this review, the FDIC is proposing to amend 
part 363 to increase the asset size threshold for internal control 
assessments by management and external auditors from $500 million to $1 
billion. Raising the threshold to $1 billion would achieve meaningful 
burden reduction without sacrificing safety and soundness.
    In reaching this decision, the FDIC concluded that raising the $500 
million asset size threshold to $1 billion and exempting all 
institutions below this higher size level from all of the reporting 
requirements of part 363 would not be consistent with the objective of 
the underlying statute, i.e., early identification of needed 
improvements in financial management. In contrast, the FDIC believes 
that relieving smaller covered institutions from the burden of internal 
control assessments, while retaining the financial statement audit and 
other reporting requirements for all institutions with $500 million or 
more in total assets, strikes an appropriate balance in accomplishing 
this objective. If the FDIC were to raise the size threshold for 
internal control assessments to $1 billion, about 600 of the largest 
insured institutions with approximately 86 percent of industry assets 
would continue to be covered by the internal control reporting 
requirements of part 363. At the same time, the managements of covered 
institutions would remain responsible for establishing and maintaining 
an adequate internal control structure and procedures for financial 
reporting, and all institutions with $500 million or more in total 
assets would continue to include a statement to that effect in their 
part 363 annual report.
    Accordingly, the FDIC is seeking comments on the proposed amendment 
to part 363 to increase the asset size threshold for internal control 
assessments by management and external auditors to $1 billion. This 
amendment is proposed to take effect December 31, 2005. For insured 
institutions (both public and non-public) with calendar year fiscal 
years that had $500 million or more in total assets, but less than $1 
billion in total assets, on January 1, 2005, this proposal would mean 
that the part 363 annual report for 2005 that they submit to the FDIC 
and other appropriate Federal and state supervisory agencies would need 
to include only audited financial statements, statements of 
management's

[[Page 44295]]

responsibilities, management's assessment of the institution's 
compliance with designated laws and regulations, and an auditor's 
report on the financial statements.
    For insured depository institutions that are public companies or 
subsidiaries of public companies, regardless of size, the FDIC's 
proposed amendment to part 363 would not relieve public companies of 
their obligation to comply with the internal control assessment 
requirements imposed by section 404 of the Sarbanes-Oxley Act in 
accordance with the effective dates for compliance set forth in the 
SEC's implementing rules.
    Nevertheless, the FDIC reminds insured institutions with $1 billion 
or more in total assets that are public companies or subsidiaries of 
public companies that they have considerable flexibility in determining 
how best to satisfy the internal control assessment requirements in the 
SEC's section 404 rules and the FDIC's part 363. As indicated in the 
preamble to the SEC's section 404 final rule release, the FDIC (and the 
other Federal banking agencies) agreed with the SEC that insured 
depository institutions that are subject to both part 363 (as well as 
holding companies permitted under the holding company exception in part 
363 to file an internal control report on behalf of their insured 
depository institution subsidiaries) and the SEC's rules implementing 
section 404 can choose either of the following two options:
     They can prepare two separate reports of management on the 
institution's or the holding company's internal control over financial 
reporting to satisfy the FDIC's part 363 requirements and the SEC's 
section 404 requirements; or
     They can prepare a single report of management on internal 
control over financial reporting that satisfies both the FDIC's 
requirements and the SEC's requirements.\2\
---------------------------------------------------------------------------

    \2\ Footnote 117 in the preamble to the SEC's Section 404 final 
rule releases states that ``[a]n insured depository institution 
subject to both the FDIC's [internal control assessment] 
requirements and our new requirements [i.e., a public depository 
institution] choosing to file a single report to satisfy both sets 
of requirements will file the report with its primary Federal 
regulator under the Exchange Act and the FDIC, its primary Federal 
regulator (if other than the FDIC), and any appropriate state 
depository institution supervisor under part 363 of the FDIC's 
regulations. A [public] holding company choosing to prepare a single 
report to satisfy both sets of requirements will file the report 
with the [Securities and Exchange] Commission under the Exchange Act 
and the FDIC, the primary federal regulator of the insured 
depository institution subsidiary subject to the FDIC's 
requirements, and any appropriate state depository institution 
supervisor under part 363.''
---------------------------------------------------------------------------

    For more complete information on these two options, institutions 
(and holding companies) should refer to Section II.H.4. of the preamble 
to the SEC's Section 404 final rule release (68 FR 36648, June 18, 
2003).

C. Composition of the Audit Committee

    Currently, part 363 requires each covered institution to establish 
an independent audit committee of its board of directors, comprised of 
outside directors who are independent of management of the institution. 
The duties of the audit committee include reviewing with management and 
the institutions' independent public accountant the basis for the 
reports included in the part 363 annual report submitted to the FDIC 
and other appropriate Federal and state supervisory agencies. The 
FDIC's Guidelines to part 363 provide that, at least annually, the 
board of directors of a covered institution should determine whether 
all existing and potential audit committee members are ``independent of 
management of the institution.'' The guidelines also describe factors 
to consider in making this determination.\3\
---------------------------------------------------------------------------

    \3\ See Guidelines 27 through 29 of Appendix A to part 363.
---------------------------------------------------------------------------

    Section 36 provides that an appropriate Federal banking agency may 
grant a hardship exemption to a covered institution that would permit 
its independent audit committee to be made up of less than all, but no 
fewer than a majority of, outside directors who are independent of 
management. To grant the exemption, the agency must find that the 
institution has encountered hardships in retaining and recruiting a 
sufficient number of competent outside directors.
    Notwithstanding this exemption provision of section 36, the FDIC 
has observed that a number of smaller covered institutions, 
particularly those with few shareholders that have recently exceeded 
$500 million in total assets and become subject to part 363, have 
encountered difficulty in satisfying the independent audit committee 
requirement. To comply with this requirement, these institutions must 
identify and attract qualified individuals in their communities who 
would be willing to become a director and audit committee member and 
who would be independent of management.
    To relieve this burden, but also recognizing that the FDIC has long 
held that individuals who serve as directors of any insured depository 
institution should be persons of independent judgment, the FDIC is 
proposing to amend part 363 to increase from $500 million to $1 billion 
the asset size threshold for requiring audit committee members to be 
independent of management. Conforming changes would be made to 
Guidelines 27-29 of Appendix A to part 363. Each insured depository 
institution with total assets of $500 million or more but less than $1 
billion would continue to be required to have an audit committee 
comprised of outside directors. Consistent with Guideline 29 of 
Appendix A to part 363, an outside director would be defined as an 
individual who is not, and within the preceding year has not been, an 
officer or employee of the institution or any affiliate of the 
institution.
    This proposed amendment to the audit committee requirements for 
institutions with between $500 million and $1 billion in total assets 
would allow an outside director who is, for example, a consultant or 
legal counsel to the institution, a relative of an officer or employee 
of the institution or its affiliates, or the owner of 10 percent or 
more of the stock of the institution to serve as an audit committee 
member. Nevertheless, the FDIC would encourage each institution with 
between $500 million and $1 billion in assets to make a reasonable good 
faith effort to establish an audit committee of outside directors who 
are independent of management.
    Accordingly, the FDIC is seeking comments on the proposed amendment 
to increase from $500 million to $1 billion the asset size threshold at 
which members of a covered institution's audit committee must be 
outside directors who are independent of management. This amendment is 
proposed to take effect December 31, 2005.

D. Technical Changes

    The FDIC also proposes to make certain technical changes to part 
363 to correct outdated titles, terms, and references in the regulation 
and its appendix.

E. Other Revisions

    The FDIC has identified other aspects of part 363 that may warrant 
revision in light of changes in the industry and the passage of the 
Sarbanes-Oxley Act. However, the FDIC believes that finalizing the 
amendments in this proposal should take priority over other possible 
revisions to part 363 in order to reduce compliance burdens and 
expenses for affected institutions in the current year. The FDIC 
expects to propose further revisions to part 363 as soon as 
practicable.

[[Page 44296]]

Request for Comments

    The FDIC welcomes comments on all aspects of this proposal.

Solicitation of Comments on Use of Plain Language

    Section 722 of the Gramm-Leach-Bliley Act, Pub. L. 106-102, sec. 
722, 113 Stat. 1338, 1471 (Nov. 12, 1999), requires the Federal banking 
agencies to use plain language in all proposed and final rules 
published after January 1, 2000. We invite your comments on how to make 
this proposal easier to understand. For example:
     Have we organized the material to suit your needs? If not, 
how could this material be better organized?
     Are the requirements in the proposed regulation clearly 
stated? If not, how could the regulation be more clearly stated?
     Does the proposed regulation contain language or jargon 
that is not clear? If so, which language requires clarification?
     Would a different format (grouping and order of sections, 
use of headings, paragraphing) make the regulation easier to 
understand? If so, what changes to the format would make the regulation 
easier to understand?
     What else could we do to make the regulation easier to 
understand?

Solicitation of Comments on Impact on Community Banks

    The FDIC seeks comments on the impact of this proposal on community 
banks. The FDIC recognizes that community banks operate with more 
limited resources than larger institutions and may present a different 
risk profile. Thus, the FDIC specifically requests comments on the 
impact of the proposal on community banks' current resources, including 
personnel, and whether the goals of the proposed rule could be 
achieved, for community banks, through an alternative approach.

Regulatory Flexibility Act Analysis

    The Regulatory Flexibility Act (RFA) requires that each Federal 
Agency either certify that a proposed rule would not, if adopted in 
final form, have a significant economic impact on a substantial number 
of small entities or prepare an initial regulatory flexibility analysis 
(IRFA) of the proposal and publish the analysis for comment. See 5 
U.S.C. 603, 605. The Small Business Administration (SBA) defines small 
banks as those with less than $150 million in assets. Because this rule 
expressly exempts insured depository institutions having assets of less 
than $500 million, it is inapplicable to small entities as defined by 
the SBA. Therefore, it is certified that this proposed rule would not 
have a significant economic impact on a substantial number of small 
entities.

Paperwork Reduction Act

    This proposed rule would revise a collection of information that 
has been reviewed and approved by the Office of Management and Budget 
under control number 3064-0113, pursuant to the Paperwork Reduction Act 
(44 U.S.C. 3501 et seq). The primary revisions increase the asset size 
threshold for compliance with sections 363.2(b), 363.3(b), and 
363.5(a). It is anticipated that these changes will result in a burden 
reduction for affected insured institutions. Comments are invited on: 
(a) Whether the collection of information is necessary for the proper 
performance of the FDIC's functions, including whether the information 
has practical utility; (b) the accuracy of the estimates of the burden 
of the information collection; (c) ways to enhance the quality, 
utility, and clarity of the information to be collected; and (d) ways 
to minimize the burden of the information collection on respondents, 
including through the use of automated collection techniques or other 
forms of information technology.
    Comments should be addressed to Steven F. Hanft, Paperwork 
Clearance Officer, Room MB-3064, Federal Deposit Insurance Corporation, 
550 17th Street, NW., Washington, DC 20429, with copies to Desk Officer 
Mark Menchik, Office of Information and Regulatory Affairs, Office of 
Management and Budget, NEOB, Washington, DC 20503.
    The paperwork burden associated with this rule was last reviewed in 
2002. At that time, the FDIC estimated the burden to be 42,639 hours 
for FDIC-supervised institutions. Since then, data has become available 
to the FDIC that indicates the 2002 estimate was too low. Taking that 
information (including the results of a burden study conducted by a 
major trade association) into account, the FDIC believes a more 
accurate estimate for this collection of information is 118,535 hours. 
If the revisions in this proposed rule are implemented, the resulting 
estimated reporting burden for the collection of information would be 
65,612 hours, a 45 percent reduction (52,923 hours).
    Number of Respondents: 5,243.
    Total Annual Responses: 15,684.
    Total Annual Burden Hours: 65,612.

List of Subjects in 12 CFR Part 363

    Accounting, Administrative practice and procedure, Banks, banking, 
Reporting and recordkeeping requirements.

    For the reasons set forth in the preamble, the Board of Directors 
of the FDIC proposes to amend part 363 of title 12, chapter III, of the 
Code of Federal Regulations as follows:

PART 363--ANNUAL INDEPENDENT AUDITS AND REPORTING REQUIREMENTS

    1. The authority citation for part 363 continues to read as 
follows:

    Authority: 12 U.S.C 1831m.

    2. Section 363.1 is amended by revising paragraph (b)(2)(ii)(B) to 
read as follows:


Sec.  363.1  Scope.

* * * * *
    (b) * * *
    (2) * * *
    (ii) * * *
    (B) Total assets of $5 billion or more and a composite CAMELS 
rating of 1 or 2.
* * * * *
    3. Section 363.2 is amended by revising paragraph (b)(2) and adding 
paragraph (b)(3) to read as follows:


Sec.  363.2  Annual reporting requirements.

* * * * *
    (b) * * *
    (1) * * *
    (2) An assessment by management of the institution's compliance 
with such laws and regulations during such fiscal year; and
    (3) For an institution with total assets of $1 billion or more at 
the beginning of such fiscal year, an assessment by management of the 
effectiveness of such internal control structure and procedures as of 
the end of such fiscal year.
    4. Section 363.3 is amended by revising paragraph (b) to read as 
follows:


Sec.  363.3  Independent public accountant.

* * * * *
    (b) Additional reports. For each insured depository institution 
with total assets of $1 billion or more at the beginning of the 
institution's fiscal year, such independent public accountant shall 
examine, attest to, and report separately on, the assertion of 
management concerning the institution's internal control structure and 
procedures for financial reporting. The attestation shall be made in 
accordance with generally accepted standards for attestation 
engagements.
* * * * *
    5. Section 363.5 is amended by revising paragraph (a) to read as 
follows:

[[Page 44297]]

Sec.  363.5  Audit committees.

    (a) Composition and duties. Each insured depository institution 
shall establish an audit committee of its board of directors, the 
composition of which complies with paragraphs (a)(1), (2), and (3) of 
this section, and the duties of which shall include reviewing with 
management and the independent public accountant the basis for the 
reports issued under this part.
    (1) Each insured depository institution with total assets of $1 
billion or more as of the beginning of its fiscal year shall establish 
an independent audit committee of its board of directors, the members 
of which shall be outside directors who are independent of management 
of the institution.
    (2) Each insured depository institution with total assets of $500 
million or more but less than $1 billion as of the beginning of its 
fiscal year shall establish an audit committee of its board of 
directors, the members of which shall be outside directors.
    (3) An outside director is a director who is not, and within the 
preceding fiscal year has not been, an officer or employee of the 
institution or any affiliate of the institution.
* * * * *
    6. Appendix A to Part 363 is amended as follows:
    a. Footnote 2 Guideline 10 is amended by adding ``and Consumer 
Protection Risk Management'' after ``FDIC's Division of Supervision'';
    b. Guideline 16 is amended by removing ``Registration and 
Disclosure Section'' and adding in its place ``Accounting and 
Securities Disclosure Section'';
    c. Guideline 22 is amended by revising the first sentence of 
paragraph (a) to read as set forth below:
    d. Guideline 27 is amended by revising the second sentence to read 
as set forth below;
    e. Guideline 28 is amended by revising paragraph (a) to read as set 
forth below;
    f. Guideline 29 is revised to read as set forth below; and
    g. The first sentence of Guideline 36 is revised to read as set 
forth below.
    The revisions read as follows:

Appendix A to Part 363--Guidelines and Interpretations

* * * * *

Filing and Notice Requirements (Sec.  363.4)

    22. * * *
    (a) FDIC: Appropriate FDIC Regional or Area Office (Supervision 
and Consumer Protection), i.e., the FDIC regional or area office in 
the FDIC region or area that is responsible for monitoring the 
institution or, in the case of a subsidiary institution of a holding 
company, the consolidated company. * * *
* * * * *

Audit Committees (Sec.  363.5)

    27. * * * At least annually at an institution with $1 billion or 
more in total assets at the beginning of its fiscal year, the board 
should determine whether all existing and potential audit committee 
members are ``independent of management of the institution.'' * * *
    28. * * *
    (a) Has previously been an officer of the institution or any 
affiliate of the institution;
    29. Lack of Independence. An outside director should not be 
considered independent of management if such director owns or 
controls, or has owned or controlled within the preceding fiscal 
year, assets representing 10 percent or more of any outstanding 
class of voting securities of the institution.
* * * * *

Other

    36. * * * The FDIC Board of Directors has delegated to the 
Director of the FDIC's Division of Supervision and Consumer 
Protection (DSC) authority to make and publish in the Federal 
Register minor technical amendments to the Guidelines in this 
appendix in consultation with the other appropriate Federal banking 
agencies, to reflect the practical experience gained from 
implementation of this part. * * *
* * * * *

    By order of the Board of Directors.

Federal Deposit Insurance Corporation.

    Dated at Washington, DC, this 19th day of July, 2005.
Robert E. Feldman,
 Executive Secretary.

[FR Doc. 05-15109 Filed 8-1-05; 8:45 am]
BILLING CODE 6714-01-P
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.