Supervisory Committee Audits and Verifications, 53303-53308 [2019-20822]

Download as PDF 53303 Rules and Regulations Federal Register Vol. 84, No. 194 Monday, October 7, 2019 This section of the FEDERAL REGISTER contains regulatory documents having general applicability and legal effect, most of which are keyed to and codified in the Code of Federal Regulations, which is published under 50 titles pursuant to 44 U.S.C. 1510. The Code of Federal Regulations is sold by the Superintendent of Documents. NATIONAL CREDIT UNION ADMINISTRATION 12 CFR Part 715 RIN 3133–AE91 Supervisory Committee Audits and Verifications National Credit Union Administration (NCUA). ACTION: Final rule. AGENCY: The NCUA Board (Board) is amending its regulations governing the responsibilities of a federally insured credit union (FICU) to obtain an annual supervisory committee audit of the credit union. The final rule implements recommendations outlined in the agency’s Regulatory Reform Task Force’s Regulatory Reform Agenda (Agenda) and will provide additional flexibility to FICUs. Specifically, the Board is: Replacing the Supervisory Committee Guide with a simplified appendix to the part; eliminating two audit types that FICUs seldom use; and eliminating a specific deadline for outside, compensated persons to deliver written audit reports to FICUs. DATES: The final rule takes effect January 6, 2020. FOR FURTHER INFORMATION CONTACT: Technical information: Alison Clark, Chief Accountant, Office of Examination and Insurance, at the above address or telephone (703) 518–6611; or Legal information: Marvin Shaw, Staff Attorney, Office of General Counsel, at the above address or telephone (703) 518–6553. SUPPLEMENTARY INFORMATION: SUMMARY: rfrederick on DSKBCBPHB2PROD with RULES I. Background and Legal Authority A. NCUA Regulatory Reform Task Force In August 2017, the Board published and sought comment on the Regulatory Reform Agenda.1 The Agenda identifies those regulations the Board intends to 1 82 FR 39702 (Aug. 22, 2017). VerDate Sep<11>2014 04:48 Oct 05, 2019 Jkt 250001 amend or repeal because they are outdated, ineffective, or excessively burdensome.2 The Agenda addresses the NCUA’s regulations on Supervisory Committee Audits. As discussed more fully below, the Agenda recommends removing from § 715.7 of the NCUA’s regulations the reference to the ‘‘NCUA’s Supervisory Committee Guide’’ and amending the requirement related to the timing for delivery of written audit reports issued by outside, compensated persons in § 715.9 of the NCUA’s regulations. B. Federal Credit Union Act Audit Requirements Sections 115 and 202(a)(6) of the Federal Credit Union Act (FCU Act) set forth provisions addressing auditing and accounting requirements.3 Section 115 of the FCU Act requires a federal credit union’s (FCU’s) supervisory committee to make an annual audit and submit a report of that audit to the FCU’s board of directors and a summary of that report to the FCU’s members at the next annual meeting.4 Further, the supervisory committee is required to make supplemental reports as it deems necessary. Section 202(a)(6)(A) of the FCU Act is a general grant of authority to the Board to prescribe audit standards that require an outside, independent audit by a certified public accountant for any fiscal year for which a FICU has not conducted an annual supervisory committee audit, has not received a complete and satisfactory supervisory committee audit, or during which the FICU has experienced persistent or serious record keeping deficiencies. Section 202(a)(6)(C) of the FCU Act generally requires FICUs having assets of $10 million or more to use accounting principles consistent with generally accepted accounting principles (GAAP) in all reports or statements required to be filed with the Board.5 The Board, and state credit union supervisors under 2 This is consistent with the spirit of President Trump’s regulatory reform agenda and Executive Order 13777. Although the NCUA, as an independent agency, is not required to comply with Executive Order 13777, the Board has chosen to comply with it in spirit and has reviewed all of the NCUA’s regulations to that end. 3 12 U.S.C. 1761d; 12 U.S.C. 1782. 4 12 U.S.C. 1761d. 5 12 U.S.C. 1782(a)(6)(C). In lieu of GAAP, the NCUA Board ‘‘may prescribe an accounting principle . . . that is no less stringent than [GAAP].’’ PO 00000 Frm 00001 Fmt 4700 Sfmt 4700 applicable state law, may require credit unions having less than $10 million in assets to follow GAAP.6 Section 202(a)(6)(D) of the FCU Act imposes audit requirements for larger FICUs. Specifically, a FICU having assets of $500 million or more is required to obtain an annual independent audit of its financial statements performed in accordance with generally accepted auditing standards, hereafter referred to as a ‘‘financial statement audit.’’ That audit must be performed by an independent certified public accountant or public accountant licensed to do so by an appropriate state or jurisdiction.7 Additionally, if an FCU having total assets of less than $500 million but more than $10 million elects to obtain a financial statement audit, the audit must be performed consistent with the accountancy laws of the appropriate state or jurisdiction.8 C. The NCUA’s Supervisory Committee Audit Regulations Currently, §§ 715.5 and 715.6 of the NCUA’s regulations specify: (1) The minimum type of annual audit a FICU is required to obtain according to its charter type and asset size; (2) the licensing requirements of persons performing certain audits; and (3) the auditing principles that apply to certain audits.9 These provisions were last updated in July 1999.10 The July 1999 rulemaking adopted § 715.7 of the NCUA’s regulations, which outlines the options for a FICU to comply with the annual audit requirement, if it has elected not to voluntarily obtain a financial statement audit. The options currently permitted include a FICU obtaining: (1) A Balance Sheet Audit; (2) a Report on Examination of Internal Controls over Call Reporting; or (3) an Audit per the Supervisory Committee Guide. The first two options are analogous to options that the Federal Financial Institutions Examination Council adopted in 1999 for other federally insured financial institutions. Regarding the third option, the NCUA amended the Supervisory Committee Guide in 1999 to detail the minimum scope and procedures for engaging 6 Id. 7 12 U.S.C. 1782(a)(6)(D)(i). U.S.C. 1782(a)(6)(D)(ii). 9 12 CFR part 715. 10 64 FR 41035 (July 29, 1999). 8 12 E:\FR\FM\07OCR1.SGM 07OCR1 53304 Federal Register / Vol. 84, No. 194 / Monday, October 7, 2019 / Rules and Regulations rfrederick on DSKBCBPHB2PROD with RULES outside, compensated professionals in the audit process and to clearly distinguish a Supervisory Committee Guide audit from a financial statement audit. The Supervisory Committee Guide is not included in the NCUA’s regulations and instead is available on the agency’s website. II. Proposed Amendments In February 2019 (84 FR 5957), the Board issued a notice of proposed rulemaking (proposal) amending part 715 to: (1) Eliminate the Report on Examination of Internal Controls over Call Reporting option in § 715.7(b); (2) remove reference to the NCUA’s Supervisory Committee Guide in § 715.7(c) and replace it with minimum requirements set forth in a new appendix A to part 715; (3) eliminate the Balance Sheet Audit option in § 715.7(a); and (4) amend § 715.9(c)(6) applicable to engagement letters with outside auditors to eliminate a specific 120-day timing requirement. The proposal also sought comments on whether to include additional topics in the new proposed appendix A. Specifically, under the proposed appendix A, the supervisory committee, internal auditor, or other qualified person would be required to perform and document the following areas of review: • Test and confirm material asset and liability accounts, including, at a minimum, loans, cash, investments, shares and borrowings; • test material equity, income and expense accounts; • review key internal controls, including, at a minimum, bank reconciliation procedures, cash controls, dormant account controls, wire and ACH transfer controls, loan approval and disbursement procedures, and controls over insider 11 accounts; • test the mathematical accuracy of the allowance for loan and lease loss accounts and ensure the methodology is properly applied; and • test loan delinquency and chargeoffs. As reflected in the text of the proposed appendix A, the supervisory committee or other person conducting the audit would be expected to determine whether to supplement the minimum procedures in light of a particular FICU’s circumstances. In the proposal, the Board noted that in selecting these areas of review for inclusion in appendix A, NCUA staff borrowed substantially from the Supervisory Committee Guide, reviewed 11 ‘‘Insider’’ refers to employees and officials of the credit union. VerDate Sep<11>2014 04:48 Oct 05, 2019 Jkt 250001 and adopted procedures established by the American Institute of Certified Public Accountants, and consulted with accounting professionals. The goal of the proposal was to make the requirements more understandable to FICUs, rather than change the areas of review the Board considers important. Nevertheless, the Board requested comment on whether other areas of review should be included in appendix A, and listed the following examples: Loans to insiders, pay and benefits to employees and board members, regulatory compliance, and compliance with the Bank Secrecy Act. In the proposal, the Board noted its plan to decommission the outdated Supervisory Committee Guide, stating that the NCUA would issue reference materials on how to conduct procedures that would meet the minimum requirements of appendix A. This reference material could be used by supervisory committees and the third parties hired to develop agreed upon procedures. Alternatively, supervisory committees and hired third parties could elect to incorporate other agreed upon procedures, so long as the testing meets the minimum requirements. III. Comments The Board received 22 comments from credit unions, credit union trade associations, credit union leagues, an association of state regulators, and accountants and accounting firms. Commenters generally supported the proposed rule and the Board’s objectives. The consensus was that the proposal would provide FICUs with assets less than $500 million with additional flexibility, reduce compliance burdens, and simplify the Supervisory Committee Audit, while still providing useful information about the financial health and stability of FICUs. Nevertheless, some commenters objected to specific provisions or proposals, while others provided additional suggestions that they believed would improve the proposal and avoid adversely affecting small FICUs. Specifically, a few commenters cautioned that some provisions might increase cost and burden for smaller FICUs and thus run counter to the intent of the proposal. Substantive comments supporting or opposing each specific proposal and advocating alternatives or modifications are discussed below. As discussed in detail below, the Board is adopting the proposal with a few minor modifications. IV. Final Rule As detailed below, in this final rule, the Board is amending part 715, PO 00000 Frm 00002 Fmt 4700 Sfmt 4700 Supervisory Committee Audits and Verifications, by adopting the proposal with a few minor modifications. The final rule updates outdated provisions and provides added flexibility to FICUs with assets less than $500 million while continuing to ensure appropriate financial oversight. The final rule includes the following modifications to part 715: (1) Eliminating the Report on Examination of Internal Controls Over Call Reporting in § 715.7(b); (2) removing the Supervisory Committee Guide Audit Alternative to a Financial Statement Audit in § 715.7 and replacing it with an appendix; 12 (3) eliminating the Balance Sheet Audit option in § 715.7(a); and (4) removing the 120-day report delivery deadline in § 715.9(c)(6) from the required terms for audit engagement letters with outside, compensated persons. The Board is also making conforming amendments to part 715 to reflect the replacement of the Supervisory Committee Guide with the appendix. A. Eliminate Report on Examination of Internal Controls Over Call Reporting in § 715.7(b) The Board proposed eliminating the option for FICUs with assets less than $500 million to obtain a Report on Examination of Internal Controls Over Call Reporting as one of the alternatives to a financial statement audit. The proposal noted that less than one percent of FICUs use this option to fulfill their audit requirement. Commenters generally agreed with the proposal because of this option’s limited use and lack of review of a FICU’s income statement. One commenter favored retaining this option to maintain flexibility for smaller FICUs. As proposed, the Board is eliminating this option because it advances the purpose of eliminating outdated and ineffective regulations. This audit option is seldom used and provides limited insight into a FICU’s financial condition. B. Eliminate the Supervisory Committee Guide Audit Alternative to a Financial Statement Audit in § 715.7 and Replace It With an Appendix The Board proposed removing reference to the NCUA’s Supervisory Committee Guide in § 715.7(c) and replacing it with a new appendix covering minimum supervisory committee audit requirements. The Board described the 350-page Supervisory Committee Guide as 12 In the final rule, the Board will no longer reference the ‘‘appendix’’ as ‘‘appendix A.’’ The reason for this modification is to avoid confusion with appendix A of the Supervisory Committee Guide. E:\FR\FM\07OCR1.SGM 07OCR1 Federal Register / Vol. 84, No. 194 / Monday, October 7, 2019 / Rules and Regulations rfrederick on DSKBCBPHB2PROD with RULES outdated. In lieu of this option, the Board proposed adding an appendix to part 715 to set forth minimum areas of review in a clear, concise manner. Comments on this part of the proposal addressed two areas: (1) Replacing the Supervisory Committee Guide with the appendix generally; and (2) the specific areas of review set forth in the appendix. The Board discusses these areas separately, below. i. General Comments on Replacing the Supervisory Committee Guide Although a few commenters supported retaining the Supervisory Committee Guide, most supported replacing it with the appendix. The commenters supporting the change stated that it would clarify and simplify audits for FICUs with assets less than $500 million, increase flexibility, save time and resources, and replace the outdated Supervisory Committee Guide, among other advantages. These commenters also stated that the appendix would increase flexibility and allow FICUs to focus on major risk areas. The few commenters that opposed adopting the appendix opined that it would create additional costs and unintended consequences, such as increased audit work and associated fees for FICUs that hire outside auditors. These commenters stated that costs would increase significantly, but they did not attempt to quantify the claimed increase in costs. One commenter made several suggested edits to the appendix to alleviate the negative economic impact that the commenter asserted the appendix would cause. After reviewing and analyzing the comments, the Board has determined that it is appropriate to remove the Supervisory Committee Guide alternative to a financial statement audit in § 715.7 and replace it with an appendix. As stated in the proposal, the Board finds the Supervisory Committee Guide outdated and that the minimum areas of review should be incorporated into the regulation. The NCUA will replace the Supervisory Committee Guide with reference materials on audit procedures to aid in performing the areas of review in the appendix. Replacing the Supervisory Committee Guide with new reference materials on audit procedures will provide an up-todate resource and greater flexibility for FICUs. The Board finds that the appendix will provide specific areas of review while covering an appropriate range of financial matters. Adding prescriptive provisions to the appendix would run counter to the Board’s intention to simplify the requirements VerDate Sep<11>2014 04:48 Oct 05, 2019 Jkt 250001 and afford flexibility to FICUs. In recognition of the concerns that a few commenters raised, the agency will monitor the implementation of the appendix and may issue informal guidance to address questions that arise. In addition, as the Board stated in the proposal, the agency will consult with representatives of the accounting profession and publish reference materials on audit procedures to aid FICUs and others in conducting audits under the appendix. The Board believes that these measures will effectively address any initial questions or concerns that may arise during the transition from the Supervisory Committee Guide to the appendix. Separately, despite supporting adoption of the appendix, a few commenters stated that it would be worthwhile to retain the Supervisory Committee Guide as a guidance document on the NCUA website for smaller FICUs. These commenters suggested adding a disclaimer to the document to note that its procedures would no longer satisfy part 715. The Board has determined that it is appropriate to retain the Supervisory Committee Guide for historical reference on the NCUA website, with the appropriate disclaimers. However, because the Supervisory Committee Guide is outdated, FICUs should not rely on the Guide as a means to comply with part 715. ii. Comments Addressing the Appendix The appendix sets forth specific areas of review, as discussed above. The appendix also provides that parties conducting audits may need to perform additional procedures based on the circumstances of a particular FICU, and that the supervisory committee must apply its judgment in determining the procedures necessary to meet audit requirements. The Board requested comments on whether the proposed minimum procedures and topics in the appendix are appropriate, and whether there are any additional topics that should be included. To this end, the Board listed several specific topics that it was considering adding to the appendix. One commenter expressed concern that the objectives of the supervisory audit would not be met by the proposed appendix. This commenter suggested incorporating several procedures into the appendix that the commenter believed would result in assurance that the balance sheet accounts are fairly stated, including reconciliations, verifications, and a review of board minutes. PO 00000 Frm 00003 Fmt 4700 Sfmt 4700 53305 The Board has determined that the minimum areas of review set forth in the proposed appendix are appropriate. These areas of review are intended to reflect common industry practices for auditing accounts and controls over financial institution financial statements. Incorporating extensive additional detail into the appendix would run counter to the Board’s goal of clarifying and simplifying audit procedures for FICUs with assets less than $500 million. The Board further notes that NCUA is considering recommendations received on the audit procedures for incorporation into the reference materials that the agency will make available after this final rule goes into effect, as the Board stated in the proposal. As noted above, the Board also requested comments on whether the topics in the appendix are appropriate and whether there are any additional topics that should be included. The Board specifically requested comment on including the following additional topics in the appendix: loans to insiders; pay and benefits to employees and board members; regulatory compliance; and compliance with the Bank Secrecy Act. Most commenters agreed with the list of topics expressly set forth in the appendix, stating that the proposed areas of review in the appendix sufficiently ensure that a proper audit would be conducted. However, several commenters recommended not including the additional topics on which the Board sought comments. As detailed below, the Board has decided to adopt the text of the appendix as proposed, with the addition of reviewing board minutes and testing for unrecorded liabilities. The Board has decided to not add any other topics. Several commenters objected to including employee and board compensation as an audit topic in the appendix. They stated generally that this topic does not fit the intent of a supervisory committee audit and instead is within the purview of the board of directors. Some commenters also objected because they perceived no clear safety and soundness basis to include this topic. The Board notes that while it is not an express provision in the appendix, the supervisory committee audit must test employee and board compensation when it is a significant component of a FICU’s expenses—as the regulation requires the audit to include a test of ‘‘material equity, income, and expense accounts.’’ However, the Board emphasizes that the purpose of the supervisory committee audit is to reconcile the mathematical E:\FR\FM\07OCR1.SGM 07OCR1 53306 Federal Register / Vol. 84, No. 194 / Monday, October 7, 2019 / Rules and Regulations rfrederick on DSKBCBPHB2PROD with RULES computations related to compensation, and whether they are consistent with authorized compensation plans, but not to judge the appropriateness of the level of compensation. Confirming the accuracy of these figures and flagging any irregularities will serve the goal of ensuring safety and soundness. Several commenters stated that the appendix should not require testing for Bank Secrecy Act and Anti-Money Laundering as part of the audit engagement, noting that it would be redundant of part 748, which requires annual testing in this area.13 The Board agrees with these commenters and has decided not to include this topic in the appendix. Also, several commenters stated that the topics should not include ‘‘regulatory compliance.’’ They noted that regulatory compliance issues are beyond the scope of a supervisory committee audit, which focuses on financial and accounting issues. The Board agrees with commenters that it would likely be duplicative of other legal and regulatory requirements to incorporate regulatory compliance in the appendix. Accordingly, the Board has decided not to add this topic to the appendix. In addition, a few commenters recommended adding to the list of topics. The suggested areas included testing for unrecorded and/or unstated liabilities that would not otherwise be subject to testing based on the materiality definition described in the proposal. Another commenter recommended that the appendix include these topics: disaster recovery and business continuity plans, information security, and vendor management. The Board agrees that the areas of review should include testing for unrecorded liabilities. However, the Board declines to add the other recommended topics because they are not customarily part of a supervisory committee audit and would be covered by separate engagements. Specifically, the Board has determined not to add disaster recovery and business continuity plans, information security, and vendor management. In sum, the Board is adopting the appendix as proposed, with the addition of reviewing board minutes and testing for unrecorded liabilities. C. Eliminate the Balance Sheet Audit Option in § 715.7(a) The proposal sought comments on whether to eliminate the Balance Sheet Audit option for FICUs with assets less than $500 million. This audit does not cover a FICU’s income statement. Several commenters stated that this option provides no benefit because the balance sheet does not reflect the current value of assets. Commenters also noted that the other audit alternatives provide better indicators of a FICU’s financial health. A few commenters favored retaining this option, despite acknowledging its limitations. For example, some commenters suggested that this option may be effective in the limited circumstance when a credit union is transitioning from a supervisory committee audit to a financial statement audit. Another commenter stated that this option provides reasonable assurance that the balance sheet complies with GAAP and is a viable, lower-cost option than a financial statement audit. The Board has determined that the balance sheet audit does not provide sufficient information to allow a FICU’s board of directors to assess the FICU’s financial health. Because a supervisory committee audit provides greater insight at reasonable costs, the Board has decided to eliminate the Balance Sheet Audit as a means to comply with part 715. D. Assistance From Outside, Compensated Person—Timing Requirement The Board also proposed amending § 715.9(c)(6) to eliminate a prescriptive timing requirement for completion of audits by an outside, compensated person. This section, among other things, addresses engagement letters a FICU may use to hire a compensated auditor. The current regulation requires that an engagement letter specify a target date of delivery of written audit reports ‘‘not to exceed 120 days from the date of calendar or fiscal year-end under audit (period covered).’’ 14 The Board proposed to eliminate this requirement and replace it with a flexible standard that would require only that the target delivery date allows the FICU to meet its requirement to obtain an audit each calendar year.15 Most commenters agreed with this proposed amendment because it provides FICUs with additional flexibility. Further, these commenters believed the amendment enhances a FICU’s ability to better negotiate the target date for delivery of written reports. Commenters further stated that the proposal eliminates burden associated with seeking waivers of the 14 12 13 12 CFR 748.2. VerDate Sep<11>2014 04:48 Oct 05, 2019 15 12 Jkt 250001 PO 00000 CFR 715.9(c)(6). CFR 715.4(a). Frm 00004 Fmt 4700 deadline from the NCUA. One commenter opposed the proposal, stating the 120-day requirement may ensure uniformity throughout the industry. The Board has determined that it is appropriate to adopt this change as proposed. The Board believes that this amendment will provide enhanced flexibility and potential cost savings, without any adverse impact to the auditing process. Although audit due dates may now vary across the industry, the regulation will continue to require annual audits, which provides substantial uniformity. E. Applicability of Part 715 A few commenters addressed how part 715 should apply to FICUs, both in terms of asset size and chartering authority. Because the Board did not propose any changes in these areas, it declines to adopt the commenters’ recommendations, as discussed below. The Board received two comments suggesting a lower asset-size threshold for a financial statement audit. Because the FCU Act establishes this threshold, as discussed above, and this matter is beyond the scope of the proposal, the Board will not adopt this change. One commenter stated that the NCUA should clarify part 715’s applicability to federally insured, state chartered credit unions (FISCUs), observing that not all FISCUs have supervisory committees. The commenter suggested re-organizing part 715 or amending Part 741 to more clearly identify which requirements apply to FISCUs generally, and in particular to those without supervisory committees. Because the Board proposed no changes on this subject, it will not amend part 715 or 741 in this manner in this final rule. However, the Board notes that the definition of ‘‘supervisory committee’’ in § 715.2(l) expressly addresses this issue as follows: ‘‘Supervisory committee refers to a supervisory committee as defined by section 111(b) of the Federal Credit Union Act, 12 U.S.C. 1761(b). For some FISCUs, the ‘audit committee’ designated by state statute or regulation is the equivalent of a supervisory committee.’’ 16 If state law or regulation does not require FISCUs chartered in the state to have a supervisory committee or an audit committee, then the credit union’s board of directors is responsible for the requirements attributed to the supervisory committee in this regulation. 16 12 Sfmt 4700 E:\FR\FM\07OCR1.SGM CFR 715.2(l). 07OCR1 53307 Federal Register / Vol. 84, No. 194 / Monday, October 7, 2019 / Rules and Regulations F. Conforming Amendments As proposed, the Board is amending § 715.9(c)(3), (d), and (e) to replace references to the Supervisory Committee Guide with references to the appendix. V. Regulatory Procedures A. Regulatory Flexibility Act The Regulatory Flexibility Act requires NCUA to prepare an analysis of any significant economic impact a regulation may have on a substantial number of small entities (those with less than $100 million in assets).17 This rule will provide relief to small credit unions by clarifying and simplifying requirements related to supervisory committee audits. Accordingly, NCUA certifies the rule will not have a significant economic impact on a substantial number of small credit unions. B. Paperwork Reduction Act The Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501 et seq.) requires that the Office of Management and Budget (OMB) approve of all collections of information by a Federal agency from the public before they can be implemented. Respondents are not required to respond to any collection of information unless it displays a current, valid OMB control number. The information collection burden previously associated with the internal controls and balance sheet audit options are now collected as a single information collection associated with amended § 715.7. This change will be reflected in an upcoming renewal. The information collection requirements under the current rule are covered under OMB #3133–0059. This final rule does not contain any additional information collection requirements under the Paperwork Reduction Act.18 C. Executive Order 13132 Executive Order 13132 encourages independent regulatory agencies to consider the impact of their actions on state and local interests. NCUA, an independent regulatory agency as defined in 44 U.S.C. 3502(5), voluntarily complies with the executive order to adhere to fundamental federalism principles. The final rule does not have substantial direct effects on the states, on the relationship between the national government and the states, or on the distribution of power and responsibilities among the various levels of government. NCUA has, therefore, determined that this rule does not constitute a policy that has federalism implications for purposes of the executive order. D. Assessment of Federal Regulations and Policies on Families NCUA has determined that this rule will not affect family well-being within the meaning of § 654 of the Treasury and General Government Appropriations Act, 1999, Public Law 105–277, 112 Stat. 2681 (1998). E. Small Business Regulatory Enforcement Fairness Act The Small Business Regulatory Enforcement Fairness Act of 1996 (Pub. L. 104–121) (SBREFA) generally provides for congressional review of agency rules.19 A reporting requirement is triggered in instances where the NCUA issues a final rule as defined by Section 551 of the Administrative Procedure Act.20 An agency rule, in addition to being subject to congressional oversight, may also be subject to a delayed effective date if the rule is a ‘‘major rule.’’ 21 The NCUA does not believe this rule is a ‘‘major rule’’ within the meaning of the relevant sections of SBREFA. As required by SBREFA, the NCUA submitted this final rule to OMB for it to determine if the final rule is a ‘‘major rule’’ for purposes of SBREFA. OMB determined that the final rule is not major. The NCUA also will file appropriate reports with Congress and the Government Accountability Office so this rule may be reviewed. List of Subjects in 12 CFR Part 715 Credit unions, Reporting and recordkeeping requirements. By the National Credit Union Administration Board on September 19, 2019. Gerard Poliquin, Secretary of the Board. For the reasons discussed above, the National Credit Union Administration Board amends 12 CFR part 715 as follows: PART 715—SUPERVISORY COMMITTEE AUDITS AND VERIFICATIONS 1. The authority citation for part 715 continues to read as follows: ■ Authority: 12 U.S.C. 1761(b), 1761d, and 1782(a)(6). § 715.2 [Amended] 2. Amend § 715.2 by removing and reserving paragraph (a) and (j). ■ 3. Amend § 715.4 by revising paragraph (b) and the table and footnote 1 following paragraph (c) to read as follows: ■ § 715.4 Audit responsibility of the Supervisory Committee. * * * * * (b) Financial statement audit option. Any federally-insured credit union, whether Federal or State chartered and regardless of asset size, may choose to fulfill its Supervisory Committee audit responsibility by obtaining an annual audit of its financial statements performed in accordance with GAAS by an independent person who is licensed to do so by the State or jurisdiction in which the credit union is principally located. (A ‘‘financial statement audit’’ is distinct from a ‘‘supervisory committee audit,’’ although a financial statement audit is included among the options for fulfilling the supervisory committee audit requirement in this section. Compare § 715.2(c).) * * * * * rfrederick on DSKBCBPHB2PROD with RULES TABLE 1 TO § 715.4 Type of charter Asset size Minimum audit required to fulfill supervisory committee audit responsibility 1 Federal Charter ....................... $500 Million or more ............... State Charter ........................... Less than $500 Million but greater than $10 Million. $10 Million or less ................... $500 Million or more ............... Financial statement audit per GAAS by independent, State-licensed person. Either financial statement audit or other supervisory committee audit. Supervisory committee audit. Financial statement audit per GAAS by independent, State licensed person. 17 5 U.S.C. 603(a). U.S.C. 3501. 19 5 18 44 VerDate Sep<11>2014 04:48 Oct 05, 2019 20 5 Jkt 250001 PO 00000 U.S.C. 801–804. U.S.C. 551. Frm 00005 Fmt 4700 21 5 Sfmt 4700 E:\FR\FM\07OCR1.SGM U.S.C. 804(2). 07OCR1 Part 715 section 715.5 715.6 53308 Federal Register / Vol. 84, No. 194 / Monday, October 7, 2019 / Rules and Regulations TABLE 1 TO § 715.4—Continued Asset size Minimum audit required to fulfill supervisory committee audit responsibility 1 Less than $500 Million ............ Supervisory committee audit unless audit prescribed by State law is more stringent. Type of charter Part 715 section 1 The Supervisory Committee audit responsibility under this part can always be fulfilled by obtaining a financial statement audit. See paragraph (b) of this section. ■ 4. Revise § 715.7 to read as follows: § 715.7 Supervisory Committee audit alternatives to a financial statement audit. A credit union which is not required to obtain a financial statement audit may fulfill its supervisory committee responsibility by obtaining an Other Supervisory Committee Audit. Such an audit is one that is performed by the supervisory committee, its internal auditor, or any other qualified person (such as a certified public accountant, public accountant, league auditor, credit union auditor consultant, retired financial institutions examiner, etc.) that satisfies the minimum requirements in appendix A of this part. Qualified persons who are not State-licensed cannot provide assurance services under this section. ■ 5. Revise § 715.9(c)(3) and (6), (d), and (e) to read as follows: § 715.9 Assistance from outside, compensated person. rfrederick on DSKBCBPHB2PROD with RULES * * * * * (c) * * * (3) If an Other Supervisory Committee Audit, include an appendix setting forth the procedures to be performed; * * * * * (6) Specify a target date of delivery of the written reports, so that such target date will enable the credit union to meet its annual audit requirements in this part; * * * * * (d) Complete scope. If the engagement is to perform an Other Supervisory Committee Audit intended to fully meet the requirements of § 715.7, the engagement letter shall certify that the audit will address at least the minimum requirements in appendix A of this part. (e) Exclusions from scope. If the engagement is to perform an Other Supervisory Committee Audit which will exclude any of the minimum requirements in appendix A of this part, the engagement letter shall: (1) Identify the excluded items; (2) State that, because of the exclusion(s), the resulting audit will VerDate Sep<11>2014 04:48 Oct 05, 2019 Jkt 250001 not, by itself, fulfill the scope of a supervisory committee audit; and (3) Caution that the supervisory committee will remain responsible for fulfilling the scope of a supervisory committee audit with respect to the excluded items. ■ 6. Add appendix A to part 715 to read as follows: Appendix A to Part 715—Supervisory Committee Audit—Minimum Procedures This appendix presents minimum procedures which a supervisory committee, its internal auditor, or other qualified person must complete when a credit union chooses the Other Supervisory Committee Audit option for completing its annual audit requirements under § 715.7. This option may not be adequate for all credit unions as it is designed for smaller, less complex credit unions. The supervisory committee, internal auditor, or other qualified person may also need to perform additional procedures to supplement these minimum procedures if the specific circumstances of a particular credit union so dictate. The supervisory committee must apply its judgment in determining the procedures necessary to meet audit requirements in this part. The supervisory committee remains responsible to ensure that a complete set of test procedures is performed. All test procedures will be done using balances and samples for the applicable audit period under review. Any time the test or confirmation procedures include making a sample or selection, the supervisory committee’s report, its internal auditor’s report, or other qualified person’s report on minimum procedures should describe the method of selection and the number of selected items. For purposes of this appendix, the following definitions will apply: • Confirm or confirmation refers to a written verification with a third-party (person or organization) pertaining to an account balance or condition. Examples of confirmation letters are bank/corporate credit union account confirmation, investment account confirmation, borrowing or line of credit confirmation, attorney letter confirmation, and member share/loan account confirmation. • Materiality refers to a statement, fact or item, which, giving full consideration to the surrounding circumstances as they exist at PO 00000 Frm 00006 Fmt 4700 Sfmt 4700 the time, it is of such a nature that its disclosure, or the method of treating it, would be likely to influence or to make a difference in the judgment and conduct of a reasonable person. Materiality should take into account ending balances as well as the volume of transactions in an account. Typically, balances or transaction volume greater than 5 percent of the credit union’s net worth should be considered material for purposes of this appendix. • Review refers to the examination of Board minutes, policies and procedures, and a review of a sample portion of activities, rather than all of the activities. • Test refers to procedures applied to the individual items that compose an account balance or class of transactions. The tests involve confirmation, inspection, or observation procedures to provide evidence about the recorded amount. The supervisory committee, internal auditor, or other qualified person must perform and document the following minimum procedures: • Review Board of Director minutes to determine whether there are any material changes to the credit union’s activities or condition that are relevant to the areas to be reviewed in the audit • Test and confirm material asset and liability accounts including, at a minimum: Æ Loans Æ Cash on deposit Æ Investments Æ Shares Æ Borrowings • Test material equity, income, and expense accounts • Test for unrecorded liabilities • Review key internal controls including, at a minimum: Æ Bank reconciliation procedures Æ Cash controls Æ Dormant account controls Æ Wire and ACH transfer controls Æ Loan approval and disbursement procedures Æ Controls over accounts of employees and officials Æ Other real estate owned Æ Foreclosed and repossessed assets • Test the mathematical accuracy of the allowance for loan and lease loss account and ensure the methodology is properly applied • Test loan delinquency and charge-offs [FR Doc. 2019–20822 Filed 10–4–19; 8:45 am] BILLING CODE 7535–01–P E:\FR\FM\07OCR1.SGM 07OCR1

Agencies

[Federal Register Volume 84, Number 194 (Monday, October 7, 2019)]
[Rules and Regulations]
[Pages 53303-53308]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-20822]



========================================================================
Rules and Regulations
                                                Federal Register
________________________________________________________________________

This section of the FEDERAL REGISTER contains regulatory documents 
having general applicability and legal effect, most of which are keyed 
to and codified in the Code of Federal Regulations, which is published 
under 50 titles pursuant to 44 U.S.C. 1510.

The Code of Federal Regulations is sold by the Superintendent of Documents. 

========================================================================


Federal Register / Vol. 84, No. 194 / Monday, October 7, 2019 / Rules 
and Regulations

[[Page 53303]]



NATIONAL CREDIT UNION ADMINISTRATION

12 CFR Part 715

RIN 3133-AE91


Supervisory Committee Audits and Verifications

AGENCY: National Credit Union Administration (NCUA).

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The NCUA Board (Board) is amending its regulations governing 
the responsibilities of a federally insured credit union (FICU) to 
obtain an annual supervisory committee audit of the credit union. The 
final rule implements recommendations outlined in the agency's 
Regulatory Reform Task Force's Regulatory Reform Agenda (Agenda) and 
will provide additional flexibility to FICUs. Specifically, the Board 
is: Replacing the Supervisory Committee Guide with a simplified 
appendix to the part; eliminating two audit types that FICUs seldom 
use; and eliminating a specific deadline for outside, compensated 
persons to deliver written audit reports to FICUs.

DATES: The final rule takes effect January 6, 2020.

FOR FURTHER INFORMATION CONTACT: Technical information: Alison Clark, 
Chief Accountant, Office of Examination and Insurance, at the above 
address or telephone (703) 518-6611; or Legal information: Marvin Shaw, 
Staff Attorney, Office of General Counsel, at the above address or 
telephone (703) 518-6553.

SUPPLEMENTARY INFORMATION:

I. Background and Legal Authority

A. NCUA Regulatory Reform Task Force

    In August 2017, the Board published and sought comment on the 
Regulatory Reform Agenda.\1\ The Agenda identifies those regulations 
the Board intends to amend or repeal because they are outdated, 
ineffective, or excessively burdensome.\2\
---------------------------------------------------------------------------

    \1\ 82 FR 39702 (Aug. 22, 2017).
    \2\ This is consistent with the spirit of President Trump's 
regulatory reform agenda and Executive Order 13777. Although the 
NCUA, as an independent agency, is not required to comply with 
Executive Order 13777, the Board has chosen to comply with it in 
spirit and has reviewed all of the NCUA's regulations to that end.
---------------------------------------------------------------------------

    The Agenda addresses the NCUA's regulations on Supervisory 
Committee Audits. As discussed more fully below, the Agenda recommends 
removing from Sec.  715.7 of the NCUA's regulations the reference to 
the ``NCUA's Supervisory Committee Guide'' and amending the requirement 
related to the timing for delivery of written audit reports issued by 
outside, compensated persons in Sec.  715.9 of the NCUA's regulations.

B. Federal Credit Union Act Audit Requirements

    Sections 115 and 202(a)(6) of the Federal Credit Union Act (FCU 
Act) set forth provisions addressing auditing and accounting 
requirements.\3\ Section 115 of the FCU Act requires a federal credit 
union's (FCU's) supervisory committee to make an annual audit and 
submit a report of that audit to the FCU's board of directors and a 
summary of that report to the FCU's members at the next annual 
meeting.\4\ Further, the supervisory committee is required to make 
supplemental reports as it deems necessary.
---------------------------------------------------------------------------

    \3\ 12 U.S.C. 1761d; 12 U.S.C. 1782.
    \4\ 12 U.S.C. 1761d.
---------------------------------------------------------------------------

    Section 202(a)(6)(A) of the FCU Act is a general grant of authority 
to the Board to prescribe audit standards that require an outside, 
independent audit by a certified public accountant for any fiscal year 
for which a FICU has not conducted an annual supervisory committee 
audit, has not received a complete and satisfactory supervisory 
committee audit, or during which the FICU has experienced persistent or 
serious record keeping deficiencies.
    Section 202(a)(6)(C) of the FCU Act generally requires FICUs having 
assets of $10 million or more to use accounting principles consistent 
with generally accepted accounting principles (GAAP) in all reports or 
statements required to be filed with the Board.\5\ The Board, and state 
credit union supervisors under applicable state law, may require credit 
unions having less than $10 million in assets to follow GAAP.\6\
---------------------------------------------------------------------------

    \5\ 12 U.S.C. 1782(a)(6)(C). In lieu of GAAP, the NCUA Board 
``may prescribe an accounting principle . . . that is no less 
stringent than [GAAP].''
    \6\ Id.
---------------------------------------------------------------------------

    Section 202(a)(6)(D) of the FCU Act imposes audit requirements for 
larger FICUs. Specifically, a FICU having assets of $500 million or 
more is required to obtain an annual independent audit of its financial 
statements performed in accordance with generally accepted auditing 
standards, hereafter referred to as a ``financial statement audit.'' 
That audit must be performed by an independent certified public 
accountant or public accountant licensed to do so by an appropriate 
state or jurisdiction.\7\
---------------------------------------------------------------------------

    \7\ 12 U.S.C. 1782(a)(6)(D)(i).
---------------------------------------------------------------------------

    Additionally, if an FCU having total assets of less than $500 
million but more than $10 million elects to obtain a financial 
statement audit, the audit must be performed consistent with the 
accountancy laws of the appropriate state or jurisdiction.\8\
---------------------------------------------------------------------------

    \8\ 12 U.S.C. 1782(a)(6)(D)(ii).
---------------------------------------------------------------------------

C. The NCUA's Supervisory Committee Audit Regulations

    Currently, Sec. Sec.  715.5 and 715.6 of the NCUA's regulations 
specify: (1) The minimum type of annual audit a FICU is required to 
obtain according to its charter type and asset size; (2) the licensing 
requirements of persons performing certain audits; and (3) the auditing 
principles that apply to certain audits.\9\ These provisions were last 
updated in July 1999.\10\ The July 1999 rulemaking adopted Sec.  715.7 
of the NCUA's regulations, which outlines the options for a FICU to 
comply with the annual audit requirement, if it has elected not to 
voluntarily obtain a financial statement audit. The options currently 
permitted include a FICU obtaining: (1) A Balance Sheet Audit; (2) a 
Report on Examination of Internal Controls over Call Reporting; or (3) 
an Audit per the Supervisory Committee Guide. The first two options are 
analogous to options that the Federal Financial Institutions 
Examination Council adopted in 1999 for other federally insured 
financial institutions. Regarding the third option, the NCUA amended 
the Supervisory Committee Guide in 1999 to detail the minimum scope and 
procedures for engaging

[[Page 53304]]

outside, compensated professionals in the audit process and to clearly 
distinguish a Supervisory Committee Guide audit from a financial 
statement audit. The Supervisory Committee Guide is not included in the 
NCUA's regulations and instead is available on the agency's website.
---------------------------------------------------------------------------

    \9\ 12 CFR part 715.
    \10\ 64 FR 41035 (July 29, 1999).
---------------------------------------------------------------------------

II. Proposed Amendments

    In February 2019 (84 FR 5957), the Board issued a notice of 
proposed rulemaking (proposal) amending part 715 to: (1) Eliminate the 
Report on Examination of Internal Controls over Call Reporting option 
in Sec.  715.7(b); (2) remove reference to the NCUA's Supervisory 
Committee Guide in Sec.  715.7(c) and replace it with minimum 
requirements set forth in a new appendix A to part 715; (3) eliminate 
the Balance Sheet Audit option in Sec.  715.7(a); and (4) amend Sec.  
715.9(c)(6) applicable to engagement letters with outside auditors to 
eliminate a specific 120-day timing requirement.
    The proposal also sought comments on whether to include additional 
topics in the new proposed appendix A. Specifically, under the proposed 
appendix A, the supervisory committee, internal auditor, or other 
qualified person would be required to perform and document the 
following areas of review:
     Test and confirm material asset and liability accounts, 
including, at a minimum, loans, cash, investments, shares and 
borrowings;
     test material equity, income and expense accounts;
     review key internal controls, including, at a minimum, 
bank reconciliation procedures, cash controls, dormant account 
controls, wire and ACH transfer controls, loan approval and 
disbursement procedures, and controls over insider \11\ accounts;
---------------------------------------------------------------------------

    \11\ ``Insider'' refers to employees and officials of the credit 
union.
---------------------------------------------------------------------------

     test the mathematical accuracy of the allowance for loan 
and lease loss accounts and ensure the methodology is properly applied; 
and
     test loan delinquency and charge-offs.
    As reflected in the text of the proposed appendix A, the 
supervisory committee or other person conducting the audit would be 
expected to determine whether to supplement the minimum procedures in 
light of a particular FICU's circumstances.
    In the proposal, the Board noted that in selecting these areas of 
review for inclusion in appendix A, NCUA staff borrowed substantially 
from the Supervisory Committee Guide, reviewed and adopted procedures 
established by the American Institute of Certified Public Accountants, 
and consulted with accounting professionals. The goal of the proposal 
was to make the requirements more understandable to FICUs, rather than 
change the areas of review the Board considers important. Nevertheless, 
the Board requested comment on whether other areas of review should be 
included in appendix A, and listed the following examples: Loans to 
insiders, pay and benefits to employees and board members, regulatory 
compliance, and compliance with the Bank Secrecy Act.
    In the proposal, the Board noted its plan to decommission the 
outdated Supervisory Committee Guide, stating that the NCUA would issue 
reference materials on how to conduct procedures that would meet the 
minimum requirements of appendix A. This reference material could be 
used by supervisory committees and the third parties hired to develop 
agreed upon procedures. Alternatively, supervisory committees and hired 
third parties could elect to incorporate other agreed upon procedures, 
so long as the testing meets the minimum requirements.

III. Comments

    The Board received 22 comments from credit unions, credit union 
trade associations, credit union leagues, an association of state 
regulators, and accountants and accounting firms. Commenters generally 
supported the proposed rule and the Board's objectives. The consensus 
was that the proposal would provide FICUs with assets less than $500 
million with additional flexibility, reduce compliance burdens, and 
simplify the Supervisory Committee Audit, while still providing useful 
information about the financial health and stability of FICUs. 
Nevertheless, some commenters objected to specific provisions or 
proposals, while others provided additional suggestions that they 
believed would improve the proposal and avoid adversely affecting small 
FICUs. Specifically, a few commenters cautioned that some provisions 
might increase cost and burden for smaller FICUs and thus run counter 
to the intent of the proposal. Substantive comments supporting or 
opposing each specific proposal and advocating alternatives or 
modifications are discussed below. As discussed in detail below, the 
Board is adopting the proposal with a few minor modifications.

IV. Final Rule

    As detailed below, in this final rule, the Board is amending part 
715, Supervisory Committee Audits and Verifications, by adopting the 
proposal with a few minor modifications. The final rule updates 
outdated provisions and provides added flexibility to FICUs with assets 
less than $500 million while continuing to ensure appropriate financial 
oversight. The final rule includes the following modifications to part 
715: (1) Eliminating the Report on Examination of Internal Controls 
Over Call Reporting in Sec.  715.7(b); (2) removing the Supervisory 
Committee Guide Audit Alternative to a Financial Statement Audit in 
Sec.  715.7 and replacing it with an appendix; \12\ (3) eliminating the 
Balance Sheet Audit option in Sec.  715.7(a); and (4) removing the 120-
day report delivery deadline in Sec.  715.9(c)(6) from the required 
terms for audit engagement letters with outside, compensated persons. 
The Board is also making conforming amendments to part 715 to reflect 
the replacement of the Supervisory Committee Guide with the appendix.
---------------------------------------------------------------------------

    \12\ In the final rule, the Board will no longer reference the 
``appendix'' as ``appendix A.'' The reason for this modification is 
to avoid confusion with appendix A of the Supervisory Committee 
Guide.
---------------------------------------------------------------------------

A. Eliminate Report on Examination of Internal Controls Over Call 
Reporting in Sec.  715.7(b)

    The Board proposed eliminating the option for FICUs with assets 
less than $500 million to obtain a Report on Examination of Internal 
Controls Over Call Reporting as one of the alternatives to a financial 
statement audit. The proposal noted that less than one percent of FICUs 
use this option to fulfill their audit requirement.
    Commenters generally agreed with the proposal because of this 
option's limited use and lack of review of a FICU's income statement. 
One commenter favored retaining this option to maintain flexibility for 
smaller FICUs. As proposed, the Board is eliminating this option 
because it advances the purpose of eliminating outdated and ineffective 
regulations. This audit option is seldom used and provides limited 
insight into a FICU's financial condition.

B. Eliminate the Supervisory Committee Guide Audit Alternative to a 
Financial Statement Audit in Sec.  715.7 and Replace It With an 
Appendix

    The Board proposed removing reference to the NCUA's Supervisory 
Committee Guide in Sec.  715.7(c) and replacing it with a new appendix 
covering minimum supervisory committee audit requirements. The Board 
described the 350-page Supervisory Committee Guide as

[[Page 53305]]

outdated. In lieu of this option, the Board proposed adding an appendix 
to part 715 to set forth minimum areas of review in a clear, concise 
manner.
    Comments on this part of the proposal addressed two areas: (1) 
Replacing the Supervisory Committee Guide with the appendix generally; 
and (2) the specific areas of review set forth in the appendix. The 
Board discusses these areas separately, below.
i. General Comments on Replacing the Supervisory Committee Guide
    Although a few commenters supported retaining the Supervisory 
Committee Guide, most supported replacing it with the appendix. The 
commenters supporting the change stated that it would clarify and 
simplify audits for FICUs with assets less than $500 million, increase 
flexibility, save time and resources, and replace the outdated 
Supervisory Committee Guide, among other advantages. These commenters 
also stated that the appendix would increase flexibility and allow 
FICUs to focus on major risk areas.
    The few commenters that opposed adopting the appendix opined that 
it would create additional costs and unintended consequences, such as 
increased audit work and associated fees for FICUs that hire outside 
auditors. These commenters stated that costs would increase 
significantly, but they did not attempt to quantify the claimed 
increase in costs. One commenter made several suggested edits to the 
appendix to alleviate the negative economic impact that the commenter 
asserted the appendix would cause.
    After reviewing and analyzing the comments, the Board has 
determined that it is appropriate to remove the Supervisory Committee 
Guide alternative to a financial statement audit in Sec.  715.7 and 
replace it with an appendix. As stated in the proposal, the Board finds 
the Supervisory Committee Guide outdated and that the minimum areas of 
review should be incorporated into the regulation. The NCUA will 
replace the Supervisory Committee Guide with reference materials on 
audit procedures to aid in performing the areas of review in the 
appendix. Replacing the Supervisory Committee Guide with new reference 
materials on audit procedures will provide an up-to-date resource and 
greater flexibility for FICUs. The Board finds that the appendix will 
provide specific areas of review while covering an appropriate range of 
financial matters. Adding prescriptive provisions to the appendix would 
run counter to the Board's intention to simplify the requirements and 
afford flexibility to FICUs. In recognition of the concerns that a few 
commenters raised, the agency will monitor the implementation of the 
appendix and may issue informal guidance to address questions that 
arise. In addition, as the Board stated in the proposal, the agency 
will consult with representatives of the accounting profession and 
publish reference materials on audit procedures to aid FICUs and others 
in conducting audits under the appendix. The Board believes that these 
measures will effectively address any initial questions or concerns 
that may arise during the transition from the Supervisory Committee 
Guide to the appendix.
    Separately, despite supporting adoption of the appendix, a few 
commenters stated that it would be worthwhile to retain the Supervisory 
Committee Guide as a guidance document on the NCUA website for smaller 
FICUs. These commenters suggested adding a disclaimer to the document 
to note that its procedures would no longer satisfy part 715.
    The Board has determined that it is appropriate to retain the 
Supervisory Committee Guide for historical reference on the NCUA 
website, with the appropriate disclaimers. However, because the 
Supervisory Committee Guide is outdated, FICUs should not rely on the 
Guide as a means to comply with part 715.
ii. Comments Addressing the Appendix
    The appendix sets forth specific areas of review, as discussed 
above. The appendix also provides that parties conducting audits may 
need to perform additional procedures based on the circumstances of a 
particular FICU, and that the supervisory committee must apply its 
judgment in determining the procedures necessary to meet audit 
requirements.
    The Board requested comments on whether the proposed minimum 
procedures and topics in the appendix are appropriate, and whether 
there are any additional topics that should be included. To this end, 
the Board listed several specific topics that it was considering adding 
to the appendix.
    One commenter expressed concern that the objectives of the 
supervisory audit would not be met by the proposed appendix. This 
commenter suggested incorporating several procedures into the appendix 
that the commenter believed would result in assurance that the balance 
sheet accounts are fairly stated, including reconciliations, 
verifications, and a review of board minutes.
    The Board has determined that the minimum areas of review set forth 
in the proposed appendix are appropriate. These areas of review are 
intended to reflect common industry practices for auditing accounts and 
controls over financial institution financial statements. Incorporating 
extensive additional detail into the appendix would run counter to the 
Board's goal of clarifying and simplifying audit procedures for FICUs 
with assets less than $500 million. The Board further notes that NCUA 
is considering recommendations received on the audit procedures for 
incorporation into the reference materials that the agency will make 
available after this final rule goes into effect, as the Board stated 
in the proposal.
    As noted above, the Board also requested comments on whether the 
topics in the appendix are appropriate and whether there are any 
additional topics that should be included. The Board specifically 
requested comment on including the following additional topics in the 
appendix: loans to insiders; pay and benefits to employees and board 
members; regulatory compliance; and compliance with the Bank Secrecy 
Act.
    Most commenters agreed with the list of topics expressly set forth 
in the appendix, stating that the proposed areas of review in the 
appendix sufficiently ensure that a proper audit would be conducted. 
However, several commenters recommended not including the additional 
topics on which the Board sought comments. As detailed below, the Board 
has decided to adopt the text of the appendix as proposed, with the 
addition of reviewing board minutes and testing for unrecorded 
liabilities. The Board has decided to not add any other topics.
    Several commenters objected to including employee and board 
compensation as an audit topic in the appendix. They stated generally 
that this topic does not fit the intent of a supervisory committee 
audit and instead is within the purview of the board of directors. Some 
commenters also objected because they perceived no clear safety and 
soundness basis to include this topic. The Board notes that while it is 
not an express provision in the appendix, the supervisory committee 
audit must test employee and board compensation when it is a 
significant component of a FICU's expenses--as the regulation requires 
the audit to include a test of ``material equity, income, and expense 
accounts.'' However, the Board emphasizes that the purpose of the 
supervisory committee audit is to reconcile the mathematical

[[Page 53306]]

computations related to compensation, and whether they are consistent 
with authorized compensation plans, but not to judge the 
appropriateness of the level of compensation. Confirming the accuracy 
of these figures and flagging any irregularities will serve the goal of 
ensuring safety and soundness.
    Several commenters stated that the appendix should not require 
testing for Bank Secrecy Act and Anti-Money Laundering as part of the 
audit engagement, noting that it would be redundant of part 748, which 
requires annual testing in this area.\13\ The Board agrees with these 
commenters and has decided not to include this topic in the appendix.
---------------------------------------------------------------------------

    \13\ 12 CFR 748.2.
---------------------------------------------------------------------------

    Also, several commenters stated that the topics should not include 
``regulatory compliance.'' They noted that regulatory compliance issues 
are beyond the scope of a supervisory committee audit, which focuses on 
financial and accounting issues. The Board agrees with commenters that 
it would likely be duplicative of other legal and regulatory 
requirements to incorporate regulatory compliance in the appendix. 
Accordingly, the Board has decided not to add this topic to the 
appendix.
    In addition, a few commenters recommended adding to the list of 
topics. The suggested areas included testing for unrecorded and/or 
unstated liabilities that would not otherwise be subject to testing 
based on the materiality definition described in the proposal. Another 
commenter recommended that the appendix include these topics: disaster 
recovery and business continuity plans, information security, and 
vendor management.
    The Board agrees that the areas of review should include testing 
for unrecorded liabilities. However, the Board declines to add the 
other recommended topics because they are not customarily part of a 
supervisory committee audit and would be covered by separate 
engagements. Specifically, the Board has determined not to add disaster 
recovery and business continuity plans, information security, and 
vendor management.
    In sum, the Board is adopting the appendix as proposed, with the 
addition of reviewing board minutes and testing for unrecorded 
liabilities.

C. Eliminate the Balance Sheet Audit Option in Sec.  715.7(a)

    The proposal sought comments on whether to eliminate the Balance 
Sheet Audit option for FICUs with assets less than $500 million. This 
audit does not cover a FICU's income statement.
    Several commenters stated that this option provides no benefit 
because the balance sheet does not reflect the current value of assets. 
Commenters also noted that the other audit alternatives provide better 
indicators of a FICU's financial health.
    A few commenters favored retaining this option, despite 
acknowledging its limitations. For example, some commenters suggested 
that this option may be effective in the limited circumstance when a 
credit union is transitioning from a supervisory committee audit to a 
financial statement audit. Another commenter stated that this option 
provides reasonable assurance that the balance sheet complies with GAAP 
and is a viable, lower-cost option than a financial statement audit.
    The Board has determined that the balance sheet audit does not 
provide sufficient information to allow a FICU's board of directors to 
assess the FICU's financial health. Because a supervisory committee 
audit provides greater insight at reasonable costs, the Board has 
decided to eliminate the Balance Sheet Audit as a means to comply with 
part 715.

D. Assistance From Outside, Compensated Person--Timing Requirement

    The Board also proposed amending Sec.  715.9(c)(6) to eliminate a 
prescriptive timing requirement for completion of audits by an outside, 
compensated person. This section, among other things, addresses 
engagement letters a FICU may use to hire a compensated auditor. The 
current regulation requires that an engagement letter specify a target 
date of delivery of written audit reports ``not to exceed 120 days from 
the date of calendar or fiscal year-end under audit (period covered).'' 
\14\ The Board proposed to eliminate this requirement and replace it 
with a flexible standard that would require only that the target 
delivery date allows the FICU to meet its requirement to obtain an 
audit each calendar year.\15\
---------------------------------------------------------------------------

    \14\ 12 CFR 715.9(c)(6).
    \15\ 12 CFR 715.4(a).
---------------------------------------------------------------------------

    Most commenters agreed with this proposed amendment because it 
provides FICUs with additional flexibility. Further, these commenters 
believed the amendment enhances a FICU's ability to better negotiate 
the target date for delivery of written reports. Commenters further 
stated that the proposal eliminates burden associated with seeking 
waivers of the deadline from the NCUA. One commenter opposed the 
proposal, stating the 120-day requirement may ensure uniformity 
throughout the industry.
    The Board has determined that it is appropriate to adopt this 
change as proposed. The Board believes that this amendment will provide 
enhanced flexibility and potential cost savings, without any adverse 
impact to the auditing process. Although audit due dates may now vary 
across the industry, the regulation will continue to require annual 
audits, which provides substantial uniformity.

E. Applicability of Part 715

    A few commenters addressed how part 715 should apply to FICUs, both 
in terms of asset size and chartering authority. Because the Board did 
not propose any changes in these areas, it declines to adopt the 
commenters' recommendations, as discussed below.
    The Board received two comments suggesting a lower asset-size 
threshold for a financial statement audit. Because the FCU Act 
establishes this threshold, as discussed above, and this matter is 
beyond the scope of the proposal, the Board will not adopt this change.
    One commenter stated that the NCUA should clarify part 715's 
applicability to federally insured, state chartered credit unions 
(FISCUs), observing that not all FISCUs have supervisory committees. 
The commenter suggested re-organizing part 715 or amending Part 741 to 
more clearly identify which requirements apply to FISCUs generally, and 
in particular to those without supervisory committees. Because the 
Board proposed no changes on this subject, it will not amend part 715 
or 741 in this manner in this final rule. However, the Board notes that 
the definition of ``supervisory committee'' in Sec.  715.2(l) expressly 
addresses this issue as follows: ``Supervisory committee refers to a 
supervisory committee as defined by section 111(b) of the Federal 
Credit Union Act, 12 U.S.C. 1761(b). For some FISCUs, the `audit 
committee' designated by state statute or regulation is the equivalent 
of a supervisory committee.'' \16\ If state law or regulation does not 
require FISCUs chartered in the state to have a supervisory committee 
or an audit committee, then the credit union's board of directors is 
responsible for the requirements attributed to the supervisory 
committee in this regulation.
---------------------------------------------------------------------------

    \16\ 12 CFR 715.2(l).

---------------------------------------------------------------------------

[[Page 53307]]

F. Conforming Amendments

    As proposed, the Board is amending Sec.  715.9(c)(3), (d), and (e) 
to replace references to the Supervisory Committee Guide with 
references to the appendix.

V. Regulatory Procedures

A. Regulatory Flexibility Act

    The Regulatory Flexibility Act requires NCUA to prepare an analysis 
of any significant economic impact a regulation may have on a 
substantial number of small entities (those with less than $100 million 
in assets).\17\ This rule will provide relief to small credit unions by 
clarifying and simplifying requirements related to supervisory 
committee audits. Accordingly, NCUA certifies the rule will not have a 
significant economic impact on a substantial number of small credit 
unions.
---------------------------------------------------------------------------

    \17\ 5 U.S.C. 603(a).
---------------------------------------------------------------------------

B. Paperwork Reduction Act

    The Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501 et seq.) 
requires that the Office of Management and Budget (OMB) approve of all 
collections of information by a Federal agency from the public before 
they can be implemented. Respondents are not required to respond to any 
collection of information unless it displays a current, valid OMB 
control number.
    The information collection burden previously associated with the 
internal controls and balance sheet audit options are now collected as 
a single information collection associated with amended Sec.  715.7. 
This change will be reflected in an upcoming renewal.
    The information collection requirements under the current rule are 
covered under OMB #3133-0059. This final rule does not contain any 
additional information collection requirements under the Paperwork 
Reduction Act.\18\
---------------------------------------------------------------------------

    \18\ 44 U.S.C. 3501.
---------------------------------------------------------------------------

C. Executive Order 13132

    Executive Order 13132 encourages independent regulatory agencies to 
consider the impact of their actions on state and local interests. 
NCUA, an independent regulatory agency as defined in 44 U.S.C. 3502(5), 
voluntarily complies with the executive order to adhere to fundamental 
federalism principles. The final rule does not have substantial direct 
effects on the states, on the relationship between the national 
government and the states, or on the distribution of power and 
responsibilities among the various levels of government. NCUA has, 
therefore, determined that this rule does not constitute a policy that 
has federalism implications for purposes of the executive order.

D. Assessment of Federal Regulations and Policies on Families

    NCUA has determined that this rule will not affect family well-
being within the meaning of Sec.  654 of the Treasury and General 
Government Appropriations Act, 1999, Public Law 105-277, 112 Stat. 2681 
(1998).

E. Small Business Regulatory Enforcement Fairness Act

    The Small Business Regulatory Enforcement Fairness Act of 1996 
(Pub. L. 104-121) (SBREFA) generally provides for congressional review 
of agency rules.\19\ A reporting requirement is triggered in instances 
where the NCUA issues a final rule as defined by Section 551 of the 
Administrative Procedure Act.\20\ An agency rule, in addition to being 
subject to congressional oversight, may also be subject to a delayed 
effective date if the rule is a ``major rule.'' \21\ The NCUA does not 
believe this rule is a ``major rule'' within the meaning of the 
relevant sections of SBREFA. As required by SBREFA, the NCUA submitted 
this final rule to OMB for it to determine if the final rule is a 
``major rule'' for purposes of SBREFA. OMB determined that the final 
rule is not major. The NCUA also will file appropriate reports with 
Congress and the Government Accountability Office so this rule may be 
reviewed.
---------------------------------------------------------------------------

    \19\ 5 U.S.C. 801-804.
    \20\ 5 U.S.C. 551.
    \21\ 5 U.S.C. 804(2).
---------------------------------------------------------------------------

List of Subjects in 12 CFR Part 715

    Credit unions, Reporting and recordkeeping requirements.

    By the National Credit Union Administration Board on September 
19, 2019.
Gerard Poliquin,
Secretary of the Board.

    For the reasons discussed above, the National Credit Union 
Administration Board amends 12 CFR part 715 as follows:

PART 715--SUPERVISORY COMMITTEE AUDITS AND VERIFICATIONS

0
1. The authority citation for part 715 continues to read as follows:

    Authority: 12 U.S.C. 1761(b), 1761d, and 1782(a)(6).


Sec.  715.2   [Amended]

0
2. Amend Sec.  715.2 by removing and reserving paragraph (a) and (j).

0
3. Amend Sec.  715.4 by revising paragraph (b) and the table and 
footnote 1 following paragraph (c) to read as follows:


Sec.  715.4   Audit responsibility of the Supervisory Committee.

* * * * *
    (b) Financial statement audit option. Any federally-insured credit 
union, whether Federal or State chartered and regardless of asset size, 
may choose to fulfill its Supervisory Committee audit responsibility by 
obtaining an annual audit of its financial statements performed in 
accordance with GAAS by an independent person who is licensed to do so 
by the State or jurisdiction in which the credit union is principally 
located. (A ``financial statement audit'' is distinct from a 
``supervisory committee audit,'' although a financial statement audit 
is included among the options for fulfilling the supervisory committee 
audit requirement in this section. Compare Sec.  715.2(c).)
* * * * *

                                             Table 1 to Sec.   715.4
----------------------------------------------------------------------------------------------------------------
                                                                     Minimum audit required to
            Type of charter                     Asset size         fulfill supervisory committee     Part 715
                                                                      audit responsibility \1\        section
----------------------------------------------------------------------------------------------------------------
Federal Charter.......................  $500 Million or more.....  Financial statement audit per           715.5
                                                                    GAAS by independent, State-
                                                                    licensed person.
                                        Less than $500 Million     Either financial statement
                                         but greater than $10       audit or other supervisory
                                         Million.                   committee audit.
                                        $10 Million or less......  Supervisory committee audit.
State Charter.........................  $500 Million or more.....  Financial statement audit per           715.6
                                                                    GAAS by independent, State
                                                                    licensed person.

[[Page 53308]]

 
                                        Less than $500 Million...  Supervisory committee audit
                                                                    unless audit prescribed by
                                                                    State law is more stringent.
----------------------------------------------------------------------------------------------------------------
\1\ The Supervisory Committee audit responsibility under this part can always be fulfilled by obtaining a
  financial statement audit. See paragraph (b) of this section.


0
4. Revise Sec.  715.7 to read as follows:


Sec.  715.7   Supervisory Committee audit alternatives to a financial 
statement audit.

    A credit union which is not required to obtain a financial 
statement audit may fulfill its supervisory committee responsibility by 
obtaining an Other Supervisory Committee Audit. Such an audit is one 
that is performed by the supervisory committee, its internal auditor, 
or any other qualified person (such as a certified public accountant, 
public accountant, league auditor, credit union auditor consultant, 
retired financial institutions examiner, etc.) that satisfies the 
minimum requirements in appendix A of this part. Qualified persons who 
are not State-licensed cannot provide assurance services under this 
section.

0
5. Revise Sec.  715.9(c)(3) and (6), (d), and (e) to read as follows:


Sec.  715.9  Assistance from outside, compensated person.

* * * * *
    (c) * * *
    (3) If an Other Supervisory Committee Audit, include an appendix 
setting forth the procedures to be performed;
* * * * *
    (6) Specify a target date of delivery of the written reports, so 
that such target date will enable the credit union to meet its annual 
audit requirements in this part;
* * * * *
    (d) Complete scope. If the engagement is to perform an Other 
Supervisory Committee Audit intended to fully meet the requirements of 
Sec.  715.7, the engagement letter shall certify that the audit will 
address at least the minimum requirements in appendix A of this part.
    (e) Exclusions from scope. If the engagement is to perform an Other 
Supervisory Committee Audit which will exclude any of the minimum 
requirements in appendix A of this part, the engagement letter shall:
    (1) Identify the excluded items;
    (2) State that, because of the exclusion(s), the resulting audit 
will not, by itself, fulfill the scope of a supervisory committee 
audit; and
    (3) Caution that the supervisory committee will remain responsible 
for fulfilling the scope of a supervisory committee audit with respect 
to the excluded items.

0
6. Add appendix A to part 715 to read as follows:

Appendix A to Part 715--Supervisory Committee Audit--Minimum Procedures

    This appendix presents minimum procedures which a supervisory 
committee, its internal auditor, or other qualified person must 
complete when a credit union chooses the Other Supervisory Committee 
Audit option for completing its annual audit requirements under 
Sec.  715.7.
    This option may not be adequate for all credit unions as it is 
designed for smaller, less complex credit unions. The supervisory 
committee, internal auditor, or other qualified person may also need 
to perform additional procedures to supplement these minimum 
procedures if the specific circumstances of a particular credit 
union so dictate. The supervisory committee must apply its judgment 
in determining the procedures necessary to meet audit requirements 
in this part. The supervisory committee remains responsible to 
ensure that a complete set of test procedures is performed. All test 
procedures will be done using balances and samples for the 
applicable audit period under review.
    Any time the test or confirmation procedures include making a 
sample or selection, the supervisory committee's report, its 
internal auditor's report, or other qualified person's report on 
minimum procedures should describe the method of selection and the 
number of selected items.
    For purposes of this appendix, the following definitions will 
apply:
     Confirm or confirmation refers to a written 
verification with a third-party (person or organization) pertaining 
to an account balance or condition. Examples of confirmation letters 
are bank/corporate credit union account confirmation, investment 
account confirmation, borrowing or line of credit confirmation, 
attorney letter confirmation, and member share/loan account 
confirmation.
     Materiality refers to a statement, fact or item, which, 
giving full consideration to the surrounding circumstances as they 
exist at the time, it is of such a nature that its disclosure, or 
the method of treating it, would be likely to influence or to make a 
difference in the judgment and conduct of a reasonable person. 
Materiality should take into account ending balances as well as the 
volume of transactions in an account. Typically, balances or 
transaction volume greater than 5 percent of the credit union's net 
worth should be considered material for purposes of this appendix.
     Review refers to the examination of Board minutes, 
policies and procedures, and a review of a sample portion of 
activities, rather than all of the activities.
     Test refers to procedures applied to the individual 
items that compose an account balance or class of transactions. The 
tests involve confirmation, inspection, or observation procedures to 
provide evidence about the recorded amount.
    The supervisory committee, internal auditor, or other qualified 
person must perform and document the following minimum procedures:

 Review Board of Director minutes to determine whether there 
are any material changes to the credit union's activities or 
condition that are relevant to the areas to be reviewed in the audit
 Test and confirm material asset and liability accounts 
including, at a minimum:
    [cir] Loans
    [cir] Cash on deposit
    [cir] Investments
    [cir] Shares
    [cir] Borrowings
 Test material equity, income, and expense accounts
 Test for unrecorded liabilities
 Review key internal controls including, at a minimum:
    [cir] Bank reconciliation procedures
    [cir] Cash controls
    [cir] Dormant account controls
    [cir] Wire and ACH transfer controls
    [cir] Loan approval and disbursement procedures
    [cir] Controls over accounts of employees and officials
    [cir] Other real estate owned
    [cir] Foreclosed and repossessed assets
 Test the mathematical accuracy of the allowance for loan 
and lease loss account and ensure the methodology is properly 
applied
 Test loan delinquency and charge-offs

[FR Doc. 2019-20822 Filed 10-4-19; 8:45 am]
 BILLING CODE 7535-01-P