Annual Independent Audits and Reporting Requirements, 35726-35761 [E9-17009]

Agencies

• FEDERAL DEPOSIT INSURANCE CORPORATION

[Federal Register Volume 74, Number 137 (Monday, July 20, 2009)]
[Rules and Regulations]
[Pages 35726-35761]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E9-17009]



[[Page 35725]]

-----------------------------------------------------------------------

Part III





Federal Deposit Insurance Corporation





-----------------------------------------------------------------------



12 CFR Parts 308 and 363



Annual Independent Audits and Reporting Requirements; Final Rule

Federal Register / Vol. 74, No. 137 / Monday, July 20, 2009 / Rules 
and Regulations

[[Page 35726]]


-----------------------------------------------------------------------

FEDERAL DEPOSIT INSURANCE CORPORATION

12 CFR Parts 308 and 363

RIN 3064-AD21


Annual Independent Audits and Reporting Requirements

AGENCY: Federal Deposit Insurance Corporation (FDIC).

ACTION: Final rule; correction.

-----------------------------------------------------------------------

SUMMARY: The FDIC is amending part 363 of its regulations concerning 
annual independent audits and reporting requirements for certain 
insured depository institutions, which implements section 36 of the 
Federal Deposit Insurance Act (FDI Act), largely as proposed, but with 
certain modifications made in response to the comments received. The 
amendments are designed to further the objectives of section 36 by 
incorporating certain sound audit, reporting, and audit committee 
practices from the Sarbanes-Oxley Act of 2002 (SOX) into part 363 and 
they also reflect the FDIC's experience in administering part 363. The 
amendments will provide clearer and more complete guidance to 
institutions and independent public accountants concerning compliance 
with the requirements of section 36 and part 363. As required by 
section 36, the FDIC has consulted with the other Federal banking 
agencies. The FDIC is also making a technical amendment to its rules 
and procedures (part 308, subpart U) for the removal, suspension, or 
debarment of accountants and accounting firms.
    The FDIC previously published this final rule in the Federal 
Register on July 7, 2009, however the document is being republished in 
its entirety in order to correct an error in the DATES section which 
caused the applicability date to be incorrect and to correct language 
relating to holding company depository institution subsidiaries.

DATES: Effective Dates: The final rule is effective August 6, 2009. 
Part 363 Annual Reports with a filing deadline on or after the 
effective date of these amendments should be prepared in accordance 
with the final rule.
    The compliance date for the provision of the final rule that 
directs covered institutions' boards of directors to develop and adopt 
an approved set of written criteria for determining whether a director 
who is to serve on the audit committee is an outside director and is 
independent of management (guideline 27) is delayed until December 31, 
2009. The provision of the final rule that requires the total assets of 
a holding company's insured depository institution subsidiaries to 
comprise 75 percent or more of the holding company's consolidated total 
assets in order for an institution to be eligible to comply with part 
363 at the holding company level (Sec.  363.1(b)(1)(ii)) is effective 
for fiscal years ending on or after June 15, 2010.

FOR FURTHER INFORMATION CONTACT: Harrison E. Greene, Jr., Senior Policy 
Analyst (Bank Accounting), Division of Supervision and Consumer 
Protection, at hgreene@fdic.gov or (202) 898-8905; or Michelle 
Borzillo, Senior Counsel, Corporate and Legal Operations Section, Legal 
Division, at mborzillo@fdic.gov or (202) 898-7400.

SUPPLEMENTARY INFORMATION:

I. Executive Summary

    Section 36 of the Federal Deposit Insurance Act (FDI Act) and the 
FDIC's implementing regulations (part 363) are generally intended to 
facilitate early identification of problems in financial management at 
insured depository institutions with total assets above certain 
thresholds through annual independent audits, assessments of the 
effectiveness of internal control over financial reporting and 
compliance with laws and regulations pertaining to insider loans and 
dividend restrictions, the establishment of independent audit 
committees, and related reporting requirements. The asset-size 
threshold for an institution for internal control assessments is $1 
billion and the threshold for the other requirements generally is $500 
million. Given changes in the industry; certain sound audit, reporting, 
and audit committee practices incorporated in the Sarbanes-Oxley Act of 
2002 (SOX); and the FDIC's experience in administering part 363, the 
FDIC is amending part 363 of its regulations. These amendments are 
designed to further the objectives of section 36 by incorporating these 
sound practices into part 363 and to provide clearer and more complete 
guidance to institutions and independent public accountants concerning 
compliance with the requirements of section 36 and part 363.
    After making certain modifications to the proposed amendments to 
part 363 \1\ in response to the comments received, the most significant 
revisions to existing part 363 that are included in the final rule 
will: (1) Extend the time period for a non-public institution to file 
its Part 363 Annual Report by 30 days and replace the 30-day extension 
of the filing deadline that may be granted if an institution (public or 
non-public) is confronted with extraordinary circumstances beyond its 
reasonable control with a late filing notification requirement that 
would have general applicability; (2) provide relief from the annual 
reporting requirements for institutions that are merged out of 
existence before the filing deadline; (3) provide relief from reporting 
on internal control over financial reporting for businesses acquired 
during the fiscal year; (4) require management's assessment of 
compliance with the laws and regulations pertaining to insider loans 
and dividend restrictions to state management's conclusion regarding 
compliance and disclose any noncompliance with such laws and 
regulations; (5) require an institution's management and the 
independent public accountant to identify the internal control 
framework used to evaluate internal control over financial reporting 
and disclose all identified material weaknesses that have not been 
remediated prior to the institution's most recent fiscal year-end; (6) 
clarify the independence standards with which independent public 
accountants must comply and enhance the enforceability of compliance 
with these standards; (7) specify that the duties of the audit 
committee include the appointment, compensation, and oversight of the 
independent public accountant, including ensuring that audit engagement 
letters do not contain unsafe and unsound limitation of liability 
provisions; (8) require certain communications by independent public 
accountants to audit committees; (9) establish retention requirements 
for audit working papers; (10) require boards of directors to adopt 
written criteria for evaluating an audit committee member's 
independence and provide expanded guidance for boards of directors to 
use in determining independence; (11) provide that ownership of 10 
percent or more of any class of voting securities of an institution is 
not an automatic bar for considering an outside director to be 
independent of management; (12) require the total assets of a holding 
company's insured depository institution subsidiaries to comprise 75 
percent or more of the holding company's consolidated total assets in 
order for an institution to be eligible to comply with part 363 at the 
holding company level; and (13) provide illustrative management reports 
to assist institutions in complying with the annual reporting 
requirements.
---------------------------------------------------------------------------

    \1\ 72 FR 62310, November 2, 2007.
---------------------------------------------------------------------------

    The FDIC is also amending its rules and procedures (part 308, 
subpart U) for

[[Page 35727]]

the removal, suspension, or debarment of accountants and accounting 
firms from performing audit services required by section 36 of the FDI 
Act to specify where an accountant or accounting firm should file 
required notices of orders and actions with the FDIC.

II. Background

    Section 112 of the Federal Deposit Insurance Corporation 
Improvement Act of 1991 (FDICIA) added section 36, ``Early 
Identification of Needed Improvements in Financial Management,'' to the 
FDI Act (12 U.S.C. 1831m). Section 36 is generally intended to 
facilitate early identification of problems in financial management at 
insured depository institutions above a certain asset size threshold 
through annual independent audits, assessments of the effectiveness of 
internal control over financial reporting and compliance with 
designated laws and regulations, and related reporting requirements. 
Section 36 also includes requirements for audit committees at these 
insured depository institutions. Section 36 grants the FDIC discretion 
to set the asset size threshold for compliance with these statutory 
requirements, but it states that the threshold cannot be less than $150 
million. Sections 36(d) and (f) also obligate the FDIC to consult with 
the other Federal banking agencies in implementing these sections of 
the FDI Act, and the FDIC has performed the required consultation.
    Part 363 of the FDIC's regulations (12 CFR part 363), which 
implements section 36 of the FDI Act, was initially adopted by the 
FDIC's Board of Directors in 1993. At present, part 363 requires each 
insured depository institution with $500 million or more in total 
assets (covered institution) to submit to the FDIC and other 
appropriate Federal and State supervisory agencies an annual report 
(Part 363 Annual Report) comprised of audited financial statements, and 
a management report containing a statement of management's 
responsibilities and an assessment by management of compliance with 
laws and regulations pertaining to insider loans and dividend 
restrictions. The management report component of the annual report for 
an institution with $1 billion or more in total assets must also 
include an assessment by management of the effectiveness of internal 
control over financial reporting and an independent public accountant's 
attestation report on internal control over financial reporting. In 
addition, part 363 provides that each covered institution's board of 
directors must establish an independent audit committee comprised of 
outside directors. For an institution with between $500 million and $1 
billion in total assets, part 363 requires a majority of the members of 
the audit committee to be independent of management of the institution. 
For a larger institution, all of the members of the audit committee 
must be independent of management. Part 363 also includes Guidelines 
and Interpretations (Appendix A to part 363), which are intended to 
assist institutions and independent public accountants in understanding 
and complying with section 36 and part 363.

III. Discussion of Proposed Amendments and Comments Received

    On October 16, 2007, the FDIC's Board approved the publication of 
proposed amendments to part 363 and part 308, subpart U, of the FDIC's 
regulations, which were published in the Federal Register on November 
2, 2007, for a 90-day comment period (72 FR 62310). The comment period 
closed on January 31, 2008.
    Given the number and extent of changes to part 363 and its 
Guidelines and Interpretations and to enable readers to more easily 
understand the context of the changes, this notice includes the entire 
text of part 363 as amended, not just the amended text. Also, the 
following ``Table of Changes to Part 363 and Appendices'' is intended 
to assist readers in determining which sections of part 363 are 
affected by the final rule.

                                   Table of Changes to Part 363 and Appendices
----------------------------------------------------------------------------------------------------------------
                                                 Unchanged         Revised            New            Reserved
----------------------------------------------------------------------------------------------------------------
Part 363--Annual Independent Audits and
 Reporting Requirements:
    Table of Contents.......................  ...............               X   ...............  ...............
    OMB Control Number: Sec.   363.0........               X   ...............  ...............  ...............
    Scope and Definitions:
        Sec.   363.1(a).....................  ...............               X   ...............  ...............
        Sec.   363.1(b)(1)..................  ...............               X   ...............  ...............
        Sec.   363.1(b)(2)..................  ...............               X   ...............  ...............
        Sec.   363.1(b)(3)..................               X   ...............  ...............  ...............
        Sec.   363.1(c).....................  ...............  ...............               X   ...............
        Sec.   363.1(d).....................  ...............  ...............               X   ...............
    Annual Reporting Requirements:            ...............  ...............  ...............  ...............
        Sec.   363.2(a).....................  ...............               X   ...............  ...............
        Sec.   363.2(b).....................  ...............               X   ...............  ...............
        Sec.   363.2(b)(1)..................  ...............               X   ...............  ...............
        Sec.   363.2(b)(2)..................  ...............               X   ...............  ...............
        Sec.   363.2(b)(3)..................  ...............               X   ...............  ...............
        Sec.   363.2(c).....................  ...............  ...............               X   ...............
    Independent Public Accountant:
        Sec.   363.3(a).....................               X   ...............  ...............  ...............
        Sec.   363.3(b).....................  ...............               X   ...............  ...............
        Sec.   363.3(c).....................  ...............               X   ...............  ...............
        Sec.   363.3(d).....................  ...............  ...............               X   ...............
        Sec.   363.3(e).....................  ...............  ...............               X   ...............
        Sec.   363.3(f).....................  ...............  ...............               X   ...............
        Sec.   363.3(g).....................  ...............  ...............               X   ...............
    Filing and Notice Requirements:
        Sec.   363.4(a).....................  ...............               X   ...............  ...............
        Sec.   363.4(b).....................  ...............               X   ...............  ...............
        Sec.   363.4(c).....................  ...............               X   ...............  ...............
        Sec.   363.4(d).....................               X   ...............  ...............  ...............
        Sec.   363.4(e).....................  ...............  ...............               X   ...............

[[Page 35728]]

 
        Sec.   363.4(f).....................  ...............  ...............               X   ...............
    Audit Committees:
        Sec.   363.5(a).....................  ...............               X   ...............  ...............
        Sec.   363.5(b).....................  ...............               X   ...............  ...............
        Sec.   363.5(c).....................  ...............  ...............               X   ...............
Appendix A to Part 363--Guidelines and
 Interpretations:
    Table of Contents.......................  ...............               X   ...............  ...............
    Introduction............................               X   ...............  ...............  ...............
    Scope (Sec.   363.1):
        Guideline 1.........................               X   ...............  ...............  ...............
        Guideline 2.........................               X   ...............  ...............  ...............
        Guideline 3.........................  ...............               X   ...............  ...............
        Guideline 4.........................  ...............               X   ...............  ...............
        Guideline 4A........................  ...............  ...............               X   ...............
    Annual Reporting Requirements (Sec.
     363.2):
        Guideline 5.........................  ...............               X   ...............  ...............
        Guideline 5A........................  ...............  ...............               X   ...............
        Guideline 6.........................  ...............               X   ...............  ...............
        Guideline 7.........................  ...............               X   ...............  ...............
        Guideline 7A........................  ...............  ...............               X   ...............
        Guideline 8.........................  ...............               X   ...............  ...............
        Guideline 8A........................  ...............  ...............               X   ...............
        Guideline 8B........................  ...............  ...............               X   ...............
        Guideline 8C........................  ...............  ...............               X   ...............
        Guideline 9.........................  ...............               X   ...............  ...............
        Guideline 10........................  ...............               X   ...............  ...............
        Guideline 11........................  ...............               X   ...............  ...............
        Guideline 12........................  ...............  ...............  ...............               X
    Role of Independent Public Accountant
     (Sec.   363.3):
        Guideline 13........................  ...............               X   ...............  ...............
        Guideline 14........................  ...............  ...............  ...............               X
        Guideline 15........................  ...............               X   ...............  ...............
        Guideline 16........................  ...............  ...............  ...............               X
        Guideline 17........................               X   ...............  ...............  ...............
        Guideline 18........................  ...............               X   ...............  ...............
        Guideline 18A.......................  ...............  ...............               X   ...............
        Guideline 19........................               X   ...............  ...............  ...............
        Guideline 20........................  ...............               X   ...............  ...............
        Guideline 21........................               X   ...............  ...............  ...............
    Filing and Notice Requirements (Sec.
     363.4):
        Guideline 22........................  ...............  ...............  ...............               X
        Guideline 23........................  ...............               X   ...............  ...............
        Guideline 24........................               X   ...............  ...............  ...............
        Guideline 25........................  ...............  ...............  ...............               X
        Guideline 26........................  ...............               X   ...............  ...............
    Audit Committees (Sec.   363.5):
        Guideline 27........................  ...............               X   ...............  ...............
        Guideline 28........................  ...............               X   ...............  ...............
        Guideline 29........................  ...............  ...............  ...............               X
        Guideline 30........................  ...............               X   ...............  ...............
        Guideline 31........................  ...............               X   ...............  ...............
        Guideline 32........................  ...............               X   ...............  ...............
        Guideline 33........................               X   ...............  ...............  ...............
        Guideline 34........................               X   ...............  ...............  ...............
        Guideline 35........................  ...............               X   ...............  ...............
    Other: Guideline 36                       ...............               X   ...............  ...............
Table 1 to Appendix A--Designated Federal     ...............               X   ...............  ...............
 Laws and Regulations.......................
Appendix B--Illustrative Management Reports.  ...............  ...............               X   ...............
----------------------------------------------------------------------------------------------------------------

    In response to its request for comments, the FDIC received 23 
comment letters that addressed the proposed amendments to part 363. 
These commenters represented 12 financial institutions; 3 bankers' 
trade organizations; 4 accounting firms; 1 accountants' trade 
organization; 1 State regulatory organization; and 2 law firms.
    Regarding the technical amendment to part 308, Subpart U, the FDIC 
did not receive any comments on its proposal to specify the location 
where an accountant or accounting firm should file required notices of 
orders and actions regarding removal, suspension, or debarment.
    With respect to the comments received on the proposed amendments to 
part 363, eight commenters expressed general support for the proposal, 
seven commenters were generally not supportive, and eight commenters 
did not express an overall view on the proposal. While comments were 
received on almost every aspect of the proposed amendments, no 
commenter specifically commented on each aspect.

[[Page 35729]]

However, eleven commenters expressed concerns regarding the regulatory 
burden associated with various aspects of the proposal. In addition, 
commenters expressed concerns about the following aspects of the 
proposed amendments:
     Disclosure of noncompliance with the designated laws and 
regulations,
     Insured depository institution percentage-of-consolidated-
total-assets threshold for eligibility to comply with part 363 at a 
holding company level,
     Management's report on internal control over financial 
reporting,
     Independent public accountant's report on internal control 
over financial reporting,
     Independent public accountant's communications with audit 
committees,
     Time period for the retention of the independent public 
accountant's working papers,
     Independence standards applicable to independent public 
accountants,
     Filing requirement for and public availability of AICPA 
peer review reports and PCAOB inspection reports on independent public 
accountants,
     Filing requirement for and public availability of audit 
engagement letters, and
     Audit committee member independence.

The following sections discuss the proposed amendments and the comments 
and concerns raised by the commenters, including the responses received 
on two specific aspects of the proposed amendments for which the FDIC 
specifically requested comments: (1) Disclosure of noncompliance with 
the designated safety and soundness laws and regulations pertaining to 
insider loans and dividend restrictions, and (2) the 75 percent of 
total assets threshold for eligibility to comply with the requirements 
of part 363 at the holding company level.

A. Scope and Definitions (Sec.  363.1 and Guidelines 1-4A)

1. Applicability
    The FDIC proposed to amend Sec.  363.1(a) to more clearly state 
that part 363 applies to any insured depository institution that has 
consolidated total assets of $500 million or more at the beginning of 
its fiscal year.
    One commenter that represents over 30 community banks recommended 
that the FDIC raise the asset size threshold from $500 million to $1 
billion for requiring compliance with part 363. In November 2005, when 
the FDIC increased the asset size threshold for assessments of internal 
control over financial reporting from $500 million to $1 billion, it 
concluded that exempting all institutions below this higher size level 
from all of the requirements of part 363 would not be consistent with 
the objective of the underlying statute, i.e., early identification of 
needed improvements in financial management. The Federal banking 
agencies rely upon financial information to evaluate the condition of 
insured depository institutions and to determine the adequacy of 
regulatory capital. Accurate and reliable measurement of an 
institution's loans, other assets, and earnings has a direct bearing on 
the determination of regulatory capital. The agencies are able to place 
greater reliance on measurements contained in financial statements that 
have been subject to an independent audit. Independent audits help to 
identify weaknesses in internal control over financial reporting and 
risk management at institutions and reinforce corrective measures, thus 
complementing supervisory efforts in contributing to the safety and 
soundness of insured depository institutions. Therefore, after 
considering this comment, the FDIC has determined that, except where a 
$1 billion or higher asset threshold already applies, the $500 million 
asset size threshold continues to be the appropriate level for 
requiring compliance with part 363.
2. Compliance by Subsidiaries of Holding Companies
    At present, an insured depository institution that is a subsidiary 
of a holding company may use consolidated holding company financial 
statements to satisfy the audited financial statements requirement of 
part 363 regardless of whether the assets of the insured depository 
institution subsidiary or subsidiaries of the holding company represent 
substantially all or only a minor portion of the holding company's 
consolidated total assets. When the assets of insured depository 
institution subsidiaries do not comprise a substantial portion of a 
holding company's consolidated total assets, the FDIC staff has found 
that the holding company's consolidated financial statements, including 
the accompanying notes to the financial statements, do not tend to 
provide sufficient information that is indicative of the financial 
position and results of operations of these institutions. Also, when 
the insured depository institution subsidiaries do not contribute 
significantly to the holding company's financial position and results 
of operations, the extent of audit coverage given to these institutions 
in the audit of the consolidated holding company may be limited. Such 
limited audit coverage would not be consistent with the purpose and 
intent of section 36 of the FDI Act, which focuses on insured 
depository institutions rather than holding companies. In this 
situation, the assurance that would be provided by an independent audit 
performed substantially at the level of the insured depository 
institution subsidiaries is not otherwise available.
    Therefore, given the differing characteristics of the holding 
companies that own insured depository institutions as well as the 
relationship of an insured depository institution's total assets to the 
consolidated total assets of its parent holding company, and in keeping 
with the intent and purpose of section 36 of the FDI Act, the FDIC 
proposed to amend Sec. Sec.  363.1(b)(1) and (2) by revising the 
criteria for determining whether the audited financial statements 
requirement and the other requirements of part 363 may be satisfied at 
a holding company level. More specifically, in order for a covered 
institution to be eligible to comply with the requirements of part 363 
at the top-tier or any other mid-tier holding company level, the FDIC 
proposed that the consolidated total assets of the insured depository 
institution (or the consolidated total assets of all of the holding 
company's insured depository institution subsidiaries, regardless of 
size, if the top-tier or mid-tier holding company owns or controls more 
than one insured depository institution) must comprise 75 percent or 
more of the consolidated total assets of the top-tier or mid-tier 
holding company. The FDIC believes that this percentage-of-assets 
threshold should ensure that the extent of independent audit work 
performed at the insured depository institution level is sufficient to 
satisfy the intent of section 36 of the FDI Act, that is, the early 
identification of needed improvements in financial management at 
insured institutions. The FDIC also believes that this threshold will 
continue to provide flexibility to the vast majority of covered 
institutions that are part of a holding company structure with respect 
to the level at which they may comply with part 363.
    When determining an appropriate percentage-of-assets threshold for 
compliance with part 363 at a holding company level, the FDIC 
considered the range of percentage-of-assets ratios for covered 
institutions that are part of a holding company structure. The vast 
majority of insured institutions subject to part 363 that are in a 
holding company structure are subsidiaries of organizations where the 
assets of the insured depository institution

[[Page 35730]]

subsidiaries of the holding company comprise 90 percent or more of the 
holding company's consolidated total assets. Of the remaining 
institutions subject to part 363 that are in a holding company 
structure, most are subsidiaries of organizations where the assets of 
the insured institutions comprise either from 75 to 90 percent or less 
than 25 percent of the top-tier parent company's consolidated total 
assets. Smaller numbers of institutions are subsidiaries of 
organizations where the assets of the insured institutions comprise 
from 25 to 50 percent or from 50 to 75 percent of the top-tier parent 
company's consolidated total assets. However, in a number of cases 
where the insured institution subsidiaries comprise less than 75 
percent of the top-tier holding company's consolidated total assets, 
the insured institution subsidiaries that are subject to part 363 
currently comply with the regulation at a mid-tier holding company 
level where the assets of the insured institution subsidiaries comprise 
90 percent or more of the mid-tier holding company's consolidated total 
assets. Thus, these institutions would not need to change how they 
comply with part 363 in response to the establishment of the proposed 
75 percent threshold, provided they continue to comply at the same mid-
tier holding company level and this holding company continues to meet 
the 75 percent threshold.
    To assist it in considering the costs and benefits of a threshold, 
the FDIC specifically requested comment as to whether 75 percent or 
more of consolidated total assets is an appropriate threshold. Six 
commenters expressed views that the 75 percent threshold is reasonable, 
is in the public's best interest, and provides ease of application 
while obtaining appropriate audit coverage of the insured depository 
institutions.
    Three commenters were opposed to the proposed 75 percent threshold. 
These commenters expressed the following concerns:
     The goal is reasonable but the proposed 75 percent 
threshold may not be appropriate. Instead, lower the threshold and 
require institutions that are below the threshold to consult with the 
FDIC prior to reporting at the holding company level.
     Compliance at the holding company level should not be 
dependent on the aggregate size of the subsidiary insured depository 
institutions relative to the holding company.
     Institutions should have until the end of their first full 
fiscal year after the FDIC promulgates the final rule to comply with 
the proposed change.
     The 75 percent threshold is arbitrary and may result in 
treating very similar institutions differently. An objectives-based 
approach should be used.

The FDIC continues to recognize that those institutions currently 
complying with part 363 at the holding company level that will not meet 
the proposed 75-percent-of-consolidated-total-assets threshold will 
incur additional costs from having to comply with the regulation at the 
institution level or at a suitable mid-tier holding company level. 
Requiring institutions that do meet the 75 percent threshold, or a 
lower percentage threshold, to consult with the FDIC prior to reporting 
at a holding company level would add a new element of regulatory burden 
and would not provide certainty nor contribute to the ease of 
application of the 75 percent threshold. The FDIC has concluded that 
the 75-percent-of-assets threshold strikes an appropriate balance 
between insured institution financial data and audit coverage and the 
cost of compliance with part 363.
    The FDIC agrees with the comment that institutions that currently 
report at the holding company level, but do not meet the 75-percent-of-
consolidated-total-assets threshold, should be afforded sufficient time 
to comply with this new requirement. Accordingly, the FDIC has decided 
to delay the effective date for implementing this threshold until 
fiscal years ending on or after June 15, 2010. Thus, for fiscal years 
ending on or before June 14, 2010, all insured depository institutions 
may continue to satisfy the audited financial statements requirement of 
part 363 at a holding company level whether or not the institution's 
consolidated total assets (or the consolidated total assets of all of 
its parent holding company's insured institutions) comprise 75 percent 
or more of the holding company's consolidated total assets at the 
beginning of the fiscal year.
    Guideline 3 to part 363, Compliance by Holding Company 
Subsidiaries, states that when a holding company submits audited 
consolidated financial statements and other reports or notices required 
by part 363 on behalf of any subsidiary institution, an accompanying 
cover letter should identify all subsidiary institutions to which the 
statements, reports, or other notices pertain. Because many cover 
letters received by the FDIC have not sufficiently identified these 
subsidiary institutions, the FDIC proposed to amend guideline 3 to 
clarify what information should be included in the cover letter. No 
comments were received on this aspect of the proposal.
3. Financial Reporting
    The FDIC proposed to add a new Sec.  363.1(c) and a new guideline 
4A, Financial Reporting, to specify that ``financial reporting'' 
includes both financial statements prepared in accordance with 
generally accepted accounting principles and those prepared for 
regulatory reporting purposes. Also, as proposed, guideline 4A 
clarifies that financial statements prepared for regulatory reporting 
purposes consist of the schedules equivalent to the basic financial 
statements that are included in an institution's appropriate regulatory 
report and that financial statements prepared for regulatory reporting 
purposes do not include regulatory reports prepared by a non-bank 
subsidiary of a holding company or an institution.
    One commenter recommended that the FDIC further clarify the 
definition of financial reporting for purposes of part 363 to more 
clearly align it with current reporting practices. This commenter also 
stated that, when reporting at a holding company level, ``regulatory 
reporting'' would not extend to assertions about internal control over 
financial reporting at the subsidiary institution level. Another 
commenter, an accountants' trade organization, stated that the proposed 
amendment seems to imply that institutions' regulatory reports may not 
be prepared in conformity with generally accepted accounting principles 
(GAAP). This commenter recommended that the FDIC clarify the definition 
of financial reporting to state that both financial statements and the 
regulatory reports be prepared in accordance with GAAP to make it 
consistent with current practice.
    While the FDIC believes that the proposed amendments are consistent 
with explanatory guidance it issued on this subject in December 
1994,\2\ the FDIC has decided to modify the proposed definition of 
financial reporting set forth in Sec.  363.1(c) and guideline 4A, 
Financial Reporting, to state more clearly that, when reporting at a 
holding company level, it includes the financial statements and 
regulatory reports of an institution's holding company. The modified 
definition would also state that, for recognition and measurement 
purposes, regulatory reporting requirements shall conform to GAAP.
---------------------------------------------------------------------------

    \2\ See FDIC Financial Institution Letter (FIL) 86-94, dated 
December 23, 1994.

---------------------------------------------------------------------------

[[Page 35731]]

4. Definitions
    The FDIC proposed to add Sec.  363.1(d), Definitions, to define 
several common terms used in part 363 and the guidelines and received 
no comments on these definitions.

B. Annual Reporting Requirements (Sec.  363.2 and Guidelines 5-12)

1. Audited Financial Statements
    Consistent with sound management practices and the objective of 
internal control over financial reporting, the FDIC proposed to amend 
Sec.  363.2(a) to require that the annual financial statements reflect 
all material correcting adjustments identified by the independent 
public accountant. Financial statements issued by insured depository 
institutions that are public companies or by their parent holding 
companies that are public companies are already subject to such a 
requirement pursuant to section 401 of SOX. The FDIC believes this 
requirement should also apply to institutions subject to part 363 that 
are not public companies.
    In response to a commenter's recommendation, the FDIC revised this 
proposed requirement to provide additional context regarding the phrase 
``material correcting adjustments identified by the independent public 
accountant'' by explaining that these adjustments should be those that 
are necessary for the financial statements to conform with GAAP.
2. Part 363 Management Report Contents
    The FDIC has noted differences in the content of the management 
reports included in Part 363 Annual Reports and the adequacy of the 
information in these management reports regarding the results of 
management's assessments of the effectiveness of internal control over 
financial reporting and compliance with the laws and regulations 
pertaining to insider loans and dividend restrictions. Identified 
material weaknesses in internal control over financial reporting and 
instances of noncompliance with insider lending requirements and 
dividend restrictions have not always been disclosed.
    In addition, management's assessment of internal control over 
financial reporting has often failed to disclose the internal control 
framework used to perform the assessment of the effectiveness of these 
controls and to clearly state whether controls over the preparation of 
the regulatory financial statements have been included within the scope 
of management's assessment. The omission of this information from an 
institution's management report reduces the usefulness of the report as 
a means of identifying needed improvements in financial management, 
which is the objective of section 36 of the FDI Act. The regulations 
adopted by the Securities and Exchange Commission (SEC) in 2003 
implementing the requirement in section 404 of SOX for a management 
report on internal control over financial reporting requires management 
to identify the internal control framework it used to evaluate the 
effectiveness of these controls and to disclose any identified material 
weakness.
    To provide clearer guidance on the information that should be 
included in the management report, the FDIC proposed to expand Sec.  
363.2(b) to require management's assessment of compliance with the laws 
and regulations pertaining to insider loans and dividend restrictions 
to include a clear statement as to management's conclusion regarding 
compliance and to disclose any noncompliance with such laws and 
regulations. In addition, the proposed amendment to Sec.  363.2(b) 
would require management's assessment of internal control over 
financial reporting to identify the internal control framework that 
management used to make its evaluation, include a statement that the 
evaluation included controls over the preparation of regulatory 
financial statements, include a clear statement as to management's 
conclusion regarding the effectiveness of internal control over 
financial reporting, disclose all material weaknesses identified by 
management, and preclude management from concluding that internal 
control over financial reporting is effective if there are any material 
weaknesses.
    The FDIC specifically requested comment as to whether the 
disclosure in the management report of instances of noncompliance with 
the laws and regulations pertaining to insider loans and dividend 
restrictions should be made available for public inspection or be 
designated as privileged and confidential and not be made available to 
the public by the FDIC. Three commenters supported public availability 
only for disclosures of ``material'' noncompliance and twelve 
commenters were not supportive of public availability of disclosures of 
noncompliance. These commenters were concerned that minor errors may be 
mistaken for a systemic compliance failure and stated that 
noncompliance should be addressed through the examination process.
    The FDIC has considered these comments and notes that all insured 
depository institutions, regardless of size, are required to comply 
with the designated safety and soundness laws and regulations that deal 
with insider loans and dividend restrictions. Moreover, these laws and 
regulations have not substantially changed since part 363 was first 
implemented in 1993. Thus, well before an insured depository 
institution reaches $500 million in total assets and becomes subject to 
part 363, it should already have appropriate policies, procedures, 
controls, and systems in place to monitor insider lending activities 
and assess its dividend-paying capacity and thereby ensure compliance 
with the safety and soundness laws and regulations in these two 
designated areas. Public availability of disclosures of instances of 
noncompliance with these designated laws and regulations should act as 
a further stimulus to management's efforts to ensure that its policies, 
procedures, controls, and systems are sound and operating effectively. 
Therefore, the FDIC has concluded that, to reinforce the importance of 
management's responsibility for complying with the laws and regulations 
pertaining to insider loans and dividend restrictions, instances of 
noncompliance with these laws and regulations should be disclosed in 
management's assessment (that is included in the management report) and 
made available to the public.
    Nevertheless, based on the comments it received on this issue, the 
FDIC believes it would be useful to provide further guidance regarding 
disclosure of noncompliance with the designated safety and soundness 
laws and regulations. Accordingly, the FDIC is adding guideline 8C, 
Management's Disclosure of Noncompliance with Designated Laws and 
Regulations, to Appendix A to part 363. This guideline states that 
management is not required to specifically identify the individual or 
individuals (e.g., officers or directors) who were responsible for or 
were the subject of any such noncompliance and provides general 
parameters for making the disclosure. For example, the disclosure 
should include appropriate qualitative and quantitative information to 
describe the nature, type, and severity of the noncompliance. Also, 
similar instances of noncompliance may be aggregated.
    While the majority of commenters did not comment on the proposed 
revisions applicable to management's report on internal control over 
financial reporting, four commenters expressed concerns or made 
recommendations as follows:
     The report is not necessary, its costs exceed the benefits 
derived, and it is difficult for small community banks to

[[Page 35732]]

recruit personnel with the level of training and experience necessary 
to implement the accounting and reporting rules.
     Consider a ``delayed phase-in'' of the requirements for 
assessing internal control over financial reporting similar to the 
phase-in utilized by the SEC in its rules implementing section 404 of 
SOX.
     Raise the asset size threshold for this requirement from 
$1 billion to $3 billion to ease regulatory burden.
     The requirement to disclose all identified material 
weaknesses in internal control over financial reporting in management's 
report should be clarified as to whether the disclosure covers all 
identified material weaknesses, regardless of their status as of the 
institution's fiscal year-end, or only those in existence as of the end 
of the fiscal year that have not been remediated prior to that date.
    Management has been required to assess and report on the 
effectiveness of an institution's internal control over financial 
reporting since part 363 was first implemented in 1993. In November 
2005, when the FDIC increased the asset size threshold for internal 
control assessments from $500 million to $1 billion, it concluded, and 
continues to believe, that the $1 billion asset size threshold is 
appropriate for requiring assessments and reports on internal control 
over financial reporting. Therefore, the FDIC has decided to retain the 
$1 billion asset size threshold for requiring assessments and reports 
on internal control over financial reporting. Also, for the reasons 
previously stated, the FDIC does not believe that a ``delayed phase-
in'' of the requirement for assessing and reporting on internal control 
over financial reporting is necessary or appropriate. Moreover, a 
phase-in of the requirement for management to assess and report on 
internal control over financial reporting in effect already exists 
because this requirement takes effect only when an institution's total 
assets exceed $1 billion, not when the institution first becomes 
subject to the other audit and reporting requirements of section 36 and 
part 363 when its assets reach $500 million.
    With respect to management's reporting on the material weaknesses 
it has identified in the management report component of its Part 363 
Annual Report, the FDIC notes that section 36 of the FDI Act requires 
management to perform an assessment of internal control over financial 
reporting as of year-end. Therefore, to clarify management's reporting 
responsibility, the FDIC has revised Sec.  363.2(b)(3)(iii) to explain 
that management must disclose all material weaknesses in internal 
control over financial reporting that it has identified and that have 
not been remediated prior to the end of the institution's fiscal year.
    Because part 363 and its guidelines provide only limited guidance 
concerning the contents of the management report and the related 
signature requirements for this report, institutions and auditors have 
expressed interest in examples of acceptable reports. Therefore, to 
assist managements of insured depository institutions in complying with 
the annual reporting requirements of Sec.  363.2, the FDIC proposed to 
add Appendix B to Part 363--Illustrative Management Reports. Appendix B 
provides guidance regarding reporting scenarios that satisfy the annual 
reporting requirements of part 363, illustrative management reports, 
and an illustrative cover letter for use when an institution complies 
with the annual reporting requirements at the holding company level. 
The FDIC also states in Appendix B that the use of the illustrative 
management reports and cover letter is not required. The FDIC 
encourages the managements of insured depository institutions to tailor 
the wording of their management reports to fit their particular 
circumstances, especially when reporting on material weaknesses in 
internal control over financial reporting or noncompliance with 
designated laws and regulations.
    Two commenters stated that the illustrative management reports are 
helpful and will mitigate regulatory burden. Another commenter 
suggested that the illustrative management reports would be better 
suited in an accounting and auditing guide that could be updated 
regularly to reflect changes in professional standards or other 
requirements that would affect these reports and that the accounting 
and auditing guide could illustrate the differences in reporting under 
AICPA and PCAOB standards. This commenter also stated that the 
illustrative management report on internal control over financial 
reporting at the holding company level is inconsistent with current 
practice and that it does not clearly and appropriately describe the 
scope of the internal control assessments by management or the 
independent public accountant. This commenter added that the language 
in the illustrative management report on internal control at the 
holding company level does not make it clear to a reader whether 
management has separately assessed the effectiveness of internal 
control over financial reporting at each subsidiary institution listed 
in the report.
    The FDIC has considered this commenter's suggestion that the 
illustrative management reports would be better suited in an accounting 
and auditing guide. In this regard, the FDIC notes that auditing and 
attestation standards require auditors to evaluate the elements that 
management is required to present in its report on its assessment of 
internal control over financial reporting, but these standards do not 
fully address the requirements of part 363 for management reports on 
internal control nor do they provide guidance to management regarding 
the preparation of management reports for part 363 purposes. Given the 
varying degrees of familiarity of institution management with 
professional auditing and attestation standards as well as the lack of 
availability of illustrative management reports that satisfy the 
requirements of part 363, the FDIC has determined that the illustrative 
management reports should be provided in Appendix B to part 363. 
However, in response to this commenter's statements concerning the 
illustrative management reports on internal control over financial 
reporting at the holding company level, the FDIC has revised the text 
of these illustrative management reports, which are presented in 
sections 5(c) and (d) and 6(b) of Appendix B. More specifically, the 
sample text in these illustrative reports that identifies the 
subsidiary institutions that are subject to part 363 has been revised 
by removing the language stating that these institutions are included 
in the scope of management's assessment of internal control over 
financial reporting. The FDIC believes that the revised illustrative 
management reports on internal control over financial reporting at the 
holding company level are consistent with current practices and 
professional auditing and attestation standards.
    Regarding management's responsibility for assessing compliance with 
the laws and regulations pertaining to insider loans and dividend 
restrictions, the FDIC proposed to revise and update Table 1 to 
Appendix A of part 363 to reflect changes in these laws and regulations 
that have occurred since this table was last revised in 1997. The FDIC 
received no comments on the revised and updated Table 1.
3. Management Report Signatures
    Section 36(b)(2) of the FDI Act requires an institution's 
management report to be signed by the chief executive officer and the 
chief accounting officer or chief financial

[[Page 35733]]

officer. In its reviews of management reports, the FDIC has noted that 
these reports are often not signed by the officers at the appropriate 
corporate level when the audited financial statements requirement is 
satisfied at the holding company level or when one or more of the 
components of the management report is satisfied at the holding company 
level and the remaining components of the management report are 
satisfied at the insured depository institution level. Therefore, the 
FDIC proposed to add Sec.  363.2(c) to specify which corporate officers 
must sign the management report and also the level of the corporate 
signers (i.e., insured depository institution level or the holding 
company level). No comments were received on this aspect of the 
proposal.
4. Institutions Merged Out of Existence
    To reduce regulatory burden and provide certainty for merging 
institutions, the FDIC proposed to add guideline 5A, Institutions 
Merged Out of Existence, to explicitly provide relief from filing a 
Part 363 Annual Report for an institution that is merged out of 
existence after the end of its fiscal year, but before the deadline for 
filing its Part 363 Annual Report. However, a covered institution that 
is acquired after the end of its fiscal year, but retains its separate 
corporate existence rather than being merged out of existence, would 
continue to be required to file a Part 363 Annual Report for that 
fiscal year. Three commenters commented in support of this aspect of 
the proposal, one of whom stated that the proposed amendment will 
reduce both regulatory burden and uncertainty.
5. Management's Assessment of the Effectiveness of Internal Control 
Over Financial Reporting
    The FDIC has publicly advised institutions with $1 billion or more 
in total assets that are public companies or subsidiaries of public 
companies that they have considerable flexibility in determining how 
best to satisfy the SEC's requirements for management's assessment of 
internal control over financial reporting which implement section 404 
of SOX, and the FDIC's requirements in part 363.\3\ The reporting 
flexibility available to institutions subject to both the section 404 
and the part 363 requirements was initially described in the preamble 
to the SEC's section 404 final rule release (68 FR 36642, June 18, 
2003). This final rule release explained that the flexible reporting 
approach described in the preamble had been developed by the SEC staff 
in consultation with the staff of the Federal banking agencies. To 
codify this reporting flexibility in part 363, the FDIC proposed to add 
guideline 8A, Management's Assessment of the Effectiveness of Internal 
Control Over Financial Reporting. For an institution with $1 billion or 
more in total assets that is subject to both part 363 and the SEC's 
rules implementing section 404 of SOX (or whose parent holding company 
is subject to section 404 and the condition in Sec.  363.1(b)(2) is 
met), the proposed guideline describes two options for complying with 
the filing requirements regarding management's report on internal 
control over financial reporting. These options are to prepare (1) two 
separate reports, one to satisfy the FDIC's part 363 requirements and 
another to satisfy the SEC's section 404 requirements, or (2) a single 
report that satisfies all of the FDIC's part 363 requirements and all 
of the SEC's section 404 requirements. No comments were received on 
proposed new guideline 8A.
---------------------------------------------------------------------------

    \3\ 70 FR 71231, November 28, 2005; 70 FR 44295, August 2, 2005; 
FDIC Financial Institution Letter (FIL) 137-2004, December 21, 2004.
---------------------------------------------------------------------------

6. Internal Control Reports for Acquired Businesses
    Currently, under the reporting requirements of part 363, both 
management's and the independent public accountant's evaluation of an 
institution's internal control over financial reporting must include 
controls at an institution in its entirety, including all of its 
consolidated businesses, including businesses that were recently 
acquired. However, like the SEC staff, the FDIC recognizes that it may 
not always be possible for management to conduct an evaluation of the 
internal control over financial reporting of an acquired business in 
the period between the consummation date of the acquisition and the due 
date of management's internal control evaluation. The SEC staff has 
provided guidance to public companies stating that the staff would not 
object to the exclusion of the acquired business from management's 
evaluation of internal control over financial reporting, provided 
certain disclosures are made and other conditions are met.\4\ The FDIC 
has received and granted several written requests from institutions 
subject to the internal control reporting requirements of part 363 to 
exclude recently acquired businesses from the scope of management's 
internal control evaluation.
---------------------------------------------------------------------------

    \4\ See Question 3 in the SEC staff's Frequently Asked Questions 
on Management's Report on Internal Control Over Financial Reporting 
and Certification of Disclosure in Exchange Act Periodic Reports at 
https://www.sec.gov/info/accountants/controlfaq1004.htm.
---------------------------------------------------------------------------

    To reduce regulatory burden, including the burden of submitting 
written requests to the FDIC, and provide certainty to institutions, 
the FDIC proposed to add guideline 8B, Internal Control Reports for 
Acquired Businesses, to explicitly provide relief from the reporting 
requirements regarding internal control over financial reporting 
related to business acquisitions made by an institution during its 
fiscal year. As proposed and consistent with the SEC staff's guidance, 
guideline 8B would permit management's evaluation of internal control 
over financial reporting to exclude internal control over financial 
reporting for the acquired business, provided management's report 
identifies the acquired business, states that the acquired business is 
excluded from management's evaluation of internal control over 
financial reporting, and indicates the significance of the acquired 
business to the institution's consolidated financial statements. Also, 
proposed guideline 8B would clarify that if the acquired business is an 
insured depository institution that is subject to part 363 and it is 
not merged out of existence before the deadline for filing its Part 363 
Annual Report, the acquired business (institution) must continue to 
comply with all of the applicable requirements of part 363. One 
commenter commented on this aspect of the proposal and supported the 
amendment as proposed, stating that it will reduce both regulatory 
burden and uncertainty.
7. Standards for Internal Control
    At present, guideline 10, Standards for Internal Control, provides 
that each institution should determine its own standards for 
establishing, maintaining, and assessing the effectiveness of its 
internal control over financial reporting, but it does not describe the 
characteristics of a suitable internal control framework. The FDIC 
proposed to amend guideline 10 to provide guidance regarding the 
attributes of a suitable internal control framework. The proposed 
attributes are consistent with the attributes the SEC described in the 
preamble to the SEC's section 404 final rule release (68 FR 36648, June 
18, 2003). The FDIC believes that a framework with these attributes is 
appropriate for all institutions whether or not they are public 
companies. No comments were received on this aspect of the proposal.

[[Page 35734]]

C. Independent Public Accountant (Sec.  363.3 and Guidelines 13-21)

1. Internal Control Over Financial Reporting
    As with its experience in reviewing the portion of the management 
report in which management provides its assessment of the effectiveness 
of the institution's internal control over financial reporting, the 
FDIC has found some independent public accountants' internal control 
attestation reports to be less than sufficiently informative. Such 
attestation reports are, therefore, inconsistent with the objectives of 
section 36 of the FDI Act. As a consequence, the FDIC proposed to amend 
Sec.  363.3(b), which governs the independent public accountant's 
report on internal control over financial reporting, to specify that, 
consistent with generally accepted standards for attestation 
engagements, the Public Company Accounting Oversight Board's (PCAOB) 
auditing standards, and related PCAOB staff implementation guidance, 
the accountant's report must:
     Not be dated prior to the date of management's report on 
its assessment of the effectiveness of internal control over financial 
reporting;
     Identify the internal control framework that the 
accountant used to make the evaluation (which must be the same as the 
internal control framework used by management);
     Include a statement that the accountant's evaluation 
included controls over the preparation of regulatory financial 
statements;
     Include a clear statement as to the accountant's 
conclusion regarding the effectiveness of internal control over 
financial reporting;
     Disclose all material weaknesses identified by the 
accountant; and
     Conclude that internal control is ineffective if there are 
any material weaknesses.
    The FDIC also proposed to amend guideline 18, Attestation Report, 
to be consistent with Sec.  363.3(b)(2) by reiterating that the 
attestation report on internal control over financial reporting should 
include a statement as to regulatory reporting.
    The majority of commenters did not comment on the independent 
public accountant's report on internal control over financial 
reporting. However, four commenters expressed concerns or made 
recommendations as follows:
     Since the AICPA Auditing Standards Board's proposed 
revisions to the attestation standards for nonpublic companies will 
likely be similar to the requirements for public companies, and based 
upon the experiences of public companies complying with SOX 404, the 
requirement for the independent public accountant to examine, attest 
to, and report on management's assertion concerning internal control 
over financial reporting for both GAAP and regulatory reporting 
purposes will be too costly. Instead of having the accountant examine 
internal control, banking regulators should assess the adequacy of 
internal control over financial reporting as part of the examination 
process.
     The requirements that the independent public accountant's 
report on internal control over financial reporting identify the 
internal control framework used, state that the evaluation included 
controls over the preparation of regulatory financial statements, 
express the accountant's conclusion as to whether internal control is 
effective, and disclose all material weaknesses can be deleted because 
they are already addressed by the AICPA and PCAOB standards. The rule 
should instead refer to the professional auditing and attestation 
standards.
     The FDIC should consider a delayed phase-in of the 
requirement for the independent public accountant to assess internal 
control over financial reporting similar to the phase-in set forth in 
the SEC's rules implementing SOX 404.
     The requirement to disclose material weaknesses in 
internal control over financial reporting in the independent public 
accountant's report should be clarified as to whether the disclosure 
covers all id