Internal Control Over Financial Reporting, 94615-94619 [2024-27657]

Agencies

• Farm Credit Administration

[Federal Register Volume 89, Number 230 (Friday, November 29, 2024)]
[Proposed Rules]
[Pages 94615-94619]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-27657]


========================================================================
Proposed Rules
                                                Federal Register
________________________________________________________________________

This section of the FEDERAL REGISTER contains notices to the public of 
the proposed issuance of rules and regulations. The purpose of these 
notices is to give interested persons an opportunity to participate in 
the rule making prior to the adoption of the final rules.

========================================================================


Federal Register / Vol. 89, No. 230 / Friday, November 29, 2024 / 
Proposed Rules

[[Page 94615]]



FARM CREDIT ADMINISTRATION

12 CFR Parts 620 and 630

RIN 3052-AD56


Internal Control Over Financial Reporting

AGENCY: Farm Credit Administration.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: The Farm Credit Administration (FCA, we, or Agency) is seeking 
comments on this proposed rule to amend the reporting regulations to 
require Farm Credit System (System) associations that meet certain 
asset thresholds or conditions, as well as all System banks, to obtain 
annual attestation reports from their external auditors that express an 
opinion on the effectiveness of internal control over financial 
reporting (ICFR), are made in accordance with generally accepted 
auditing standards (GAAS) as promulgated by the American Institute for 
Certified Public Accountants (``AICPA'') or the Public Company 
Accounting Oversight Board's (``PCAOB'') auditing standards, and 
accompany management's assessment and be included with the System 
Institution's annual report (these attestation reports are hereinafter 
referred to as ``Attestation Reports''). The proposed rule would also 
require Attestation Reports obtained by the Federal Farm Credit Banks 
Funding Corporation (Funding Corporation) be made in accordance with 
GAAS.

DATES: Comments on this proposed rule must be submitted on or before 
January 28, 2025.

ADDRESSES: For accuracy and efficiency, please submit comments by email 
or through FCA's website. We do not accept comments submitted by fax 
because faxes are difficult to process. Also, please do not submit 
comments multiple times; submit your comment only once, using one of 
the following methods:
     Send an email to [email protected].
     Use the public comment form on our website:
    1. Go to https://www.fca.gov.
    2. Click inside the ``I want to. . .'' field near the top of the 
page.
    3. Select ``comment on a pending regulation'' from the dropdown 
menu.
    4. Click ``Go.'' This takes you to the comment form.
     Send the comment by mail to the following: Autumn R. 
Agans, Deputy Director, Office of Regulatory Policy, Farm Credit 
Administration, 1501 Farm Credit Drive, McLean, VA 22102-5090.
    We post all comments on the FCA website. We will show your comments 
as submitted, including any supporting information; however, for 
technical reasons, we may omit items such as logos and special 
characters. Personal information that you provide, such as phone 
numbers and addresses, will be publicly available. However, we will 
attempt to remove email addresses to help reduce internet spam.
    To review comments on our website, go to https://www.fca.gov and 
follow these steps:
    1. Click inside the ``I want to. . .'' field near the top of the 
page.
    2. Select ``find comments on a pending regulation'' from the 
dropdown menu.
    3. Click ``Go.'' This will take you to a list of regulatory 
projects.
    4. Select the project in which you're interested. If we have 
received comments on that project, you will see a list of links to the 
individual comments.
    You may also review comments at the FCA office in McLean, Virginia. 
Please call us at (703)883-4056 or email us at [email protected] to make 
an appointment.

FOR FURTHER INFORMATION CONTACT: 
    Technical information: Aaron M. Livernois, Senior Policy 
Accountant, Office of Regulatory Policy, Farm Credit Administration, 
McLean, VA 22102-5090, (703) 883-4414, TTY (703) 883-4056.
    Legal information: Andra Grossman, Attorney Advisor, Office of 
General Counsel, Farm Credit Administration, McLean, VA 22102-5090, 
(703) 883-4323, TTY (703) 883-4056.

SUPPLEMENTARY INFORMATION:

I. Summary of Proposed Objectives and Amendments

    The objective of this proposed rule is to strengthen the safety and 
soundness of the System's ICFR by requiring Attestation Reports from 
certain institutions. As further discussed in section II, complexity 
and concentration of System banks and their affiliated associations 
have changed dramatically since 2006 (the fiscal year before Sec.  
630.5 was last amended), leading to an increased risk that an internal 
control weakness or failure, such as an undetected management error, 
negligence, or fraud event at one association could affect the safety 
and soundness of the entire System. By requiring certain associations 
to obtain an Integrated Audit, FCA's proposed rule would help reduce 
undetected and evolving financial reporting risks in the System.
    The amendments in the proposed rule include changes to financial 
reporting requirements set forth in 12 CFR 620.3 and 630.5 that:
     Revise Sec.  620.3 to mandate all System banks obtain an 
Attestation Report from their external auditors.
     Revise Sec.  620.3 to mandate all System associations that 
meet the following thresholds or conditions obtain an Attestation 
Report from their external auditors:
    [cir] The association's total assets were one percent or more of 
total System assets as of December 31 of the previous fiscal year; or
    [cir] The association's direct note payable to its bank was 15 
percent or more of the bank's direct loans to associations as of 
December 31 of the previous fiscal year; or
    [cir] FCA staff determines that a material weakness exists in the 
association's ICFR, or other developments have occurred or are expected 
to occur that could adversely impact, or result in significant changes 
to, the association's ICFR that impacts the safety and soundness of the 
association.
     Revise Sec.  630.5(d)(2), to correspond with the proposed 
language in Sec.  620.3(d)(2) and (3) that an Attestation Report be 
made in accordance with GAAS. Refer to section II for additional 
information.
    FCA believes requiring associations to obtain an Attestation Report 
when their assets equal or exceed one percent of total System assets is 
appropriate because this threshold captures the associations that pose 
a systemic risk to the System. FCA also believes requiring associations 
to obtain an Attestation

[[Page 94616]]

Report when their direct note payable to their bank equals or exceeds 
15 percent of the bank's direct loans to associations is appropriate 
because these associations hold a large concentration of their bank's 
direct loans and may pose a systemic risk to the safety and soundness 
of their bank without meeting the one percent of total System assets. 
This requirement ensures associations that hold a large concentration 
of bank direct loans also obtain an Attestation Report.
    An association would generally have three fiscal years to obtain 
its Attestation Report. Additionally, the proposed rule also details 
how and when merging associations are to obtain Attestation Reports.
    All System banks currently obtain an Integrated Audit, as required 
by the Funding Corporation. FCA now proposes to formalize this 
requirement in this regulation.

II. Background

A. Law and Regulation

    The Farm Credit Amendments Act of 1985 \1\ revised the Farm Credit 
Act of 1971, as amended (Act),\2\ to require FCA regulate the 
disclosure and reporting practices of System institutions and require 
each System institution to prepare and publish annual financial reports 
to shareholders. Section 5.19(b) of the Act requires financial 
statements be prepared in accordance with generally accepted accounting 
principles (GAAP) and be audited by an independent public accountant.
---------------------------------------------------------------------------

    \1\ Public Law 99-205, 99 Stat. 1678, Dec. 23, 1985.
    \2\ Public Law 92-181, 85 Stat. 583, Dec. 10, 1971.
---------------------------------------------------------------------------

    In December 2006, FCA issued a final rule at 12 CFR 630.5(d) (71 FR 
76111) that, in part, requires the Funding Corporation to require its 
external auditor to express an opinion on the Funding Corporation's 
effectiveness of ICFR in preparing disclosures to investors in System-
wide and consolidated bank debt obligations. When proposed, FCA stated 
that a System-wide opinion at the Funding Corporation level on ICFR 
would accomplish many of the same objectives as requiring an opinion on 
ICFR at the bank and association levels.\3\
---------------------------------------------------------------------------

    \3\ 71 FR 13040, 13043 (March 14, 2006).
---------------------------------------------------------------------------

    Additionally, 12 CFR 620.3(d) of FCA regulations requires all 
System institutions with over $1 billion in total assets at the end of 
the prior fiscal year include in their annual reports a report by 
management assessing the effectiveness of ICFR. These institutions must 
also report to their board of directors and disclose in their quarterly 
and annual reports any material changes in ICFR during the reporting 
period. Associations with assets of less than $1 billion in total 
assets do not have reporting requirements.
    As discussed below, the complexity and concentration of System 
banks and associations have changed dramatically, leading to an 
increased risk that an internal control weakness or failure at one 
institution could affect the safety and soundness of the entire System, 
due to the System's cooperative structure. This proposed rule, if 
adopted, would decrease risks related to the detection and reporting of 
internal control weakness or failure. FCA believes an Integrated Audit 
will strengthen the safety and soundness of the System.

B. Definitions Used in the Preamble

    Internal Control over Financial Reporting. ICFR is a process 
consisting of policies and procedures designed to assess financial 
statement risk and provide reasonable assurance that an institution 
prepares reliable financial statements.\4\
---------------------------------------------------------------------------

    \4\ AICPA Standard AU-C 940.05, An Audit of Internal Control 
over Financial Reporting that is Integrated with an Audit of the 
Financial Statements, section .05.
---------------------------------------------------------------------------

    Audit of ICFR. An audit of ICFR is an audit of the design and 
operating effectiveness of an entity's ICFR.\5\
---------------------------------------------------------------------------

    \5\ Id.
---------------------------------------------------------------------------

    Integrated Audit. An Integrated Audit is an audit of ICFR that is 
integrated with an audit of financial statements.\6\ An Integrated 
Audit also considers financial reporting systems related to ICFR. The 
auditor provides an opinion, known as an Attestation Report, on both 
the financial statements and ICFR in the annual financial statements. 
Attestation Report and Integrated Audit are used interchangeably in 
this preamble.
---------------------------------------------------------------------------

    \6\ Id, section .01.
---------------------------------------------------------------------------

C. Risks in the System Structure and Related ICFR Considerations

    The cooperative structure of the System creates a unique 
environment in which an adverse event at one institution could impact 
the entire System and affect the Funding Corporation's ability to issue 
System-wide disclosures on a timely, well-controlled basis as required 
in Sec.  630.3. Moreover, debt securities are the joint and several 
obligations of the System banks and are not obligations of or 
guaranteed by the United States government. As such, any material 
weakness or other development, such as an undetected management error, 
negligence, fraud event, or failure, that have occurred, or are 
expected to occur, could adversely impact, or result in significant 
changes to ICFR at a bank or one or more of the associations that could 
impact investor confidence and public trust in the entire System.
    While the System has implemented standards, created workgroups, and 
employed other practices mentioned below, risks arise from 
inconsistencies in the design and implementation of ICFR at different 
institutions. Only the Funding Corporation, System banks, and one 
association (as a condition of merger) \7\ obtain Integrated Audits, 
which exacerbates this risk of inconsistency.
---------------------------------------------------------------------------

    \7\ Two additional associations (as conditions of merger) will 
obtain Integrated Audits beginning in 2026.
---------------------------------------------------------------------------

D. Risks Have Increased With Farm Credit System Growth and 
Consolidation

    When FCA issued 12 CFR 630.5(d) in December 2006, there were five 
System banks and 95 associations with $162.9 billion in total System 
assets \8\ with associations holding $100.7 billion.\9\ Since then, as 
of December 31, 2023, there are four System Banks (20 percent decrease) 
and 56 associations (41 percent decrease). System assets totaled $507.8 
billion (212 percent increase) and association assets totaled $308.4 
billion (206 percent increase).
---------------------------------------------------------------------------

    \8\ These figures do not include the Federal Agricultural 
Mortgage Association (Farmer Mac), although it is a System 
institution for purposes of the Farm Credit Act and FCA oversight.
    \9\ Aside from total system assets, all information presented in 
the following paragraphs relating to 2006 and 2023 data come from 
FCA's Call Reporting System. Total system assets information is 
sourced from the Farm Credit Funding Corporation's 2006 and 2023 
Annual Information Statements.
---------------------------------------------------------------------------

    The average and median total asset size for associations has also 
increased markedly. As of December 31, 2006, associations averaged $1.1 
billion in total assets and the median total asset size was $462 
million. As of December 31, 2023, associations averaged $5.5 billion in 
total assets (420 percent increase), and the median total asset size 
was $1.8 billion (285 percent increase).
    When comparing associations as of December 31, 2006, to 
associations as of December 31, 2023, asset sizes and concentrations 
for the associations that held either one percent of total System 
assets or 15 percent of their bank's direct loans have also increased.
    As of December 31, 2006, 14 associations held one percent or more 
of total System assets, with these associations holding a combined 
$57.6 billion in total assets. As of December 31, 2023, 12 associations 
held one percent or more of total System assets, with these 
associations holding a

[[Page 94617]]

combined $236.1 billion in total assets (310 percent increase). As of 
December 31, 2006, the 14 associations cited above held 35 percent of 
total System assets. As of December 31, 2023, the 12 associations cited 
above held 46 percent of total System assets (31 percent increase).
    System bank direct loans to associations have also become more 
concentrated. As of December 31, 2006, eight associations held 15 
percent or more of their bank's direct loans to associations (eight 
percent of associations). As of December 31, 2023, seven associations 
held 15 percent or more of their bank's direct note. While the number 
of associations holding 15 percent or more of their bank's direct note 
decreased, the percentage of associations holding 15 percent or more of 
their bank's direct loans increased (13 percent of associations). As of 
December 31, 2006, those eight associations held approximately 42 
percent of all System bank direct notes to associations. As of December 
31, 2023, the seven associations held approximately 60 percent of all 
System bank direct notes to associations (42 percent increase).
    As associations become more complex, and the System has fewer 
overall associations, an ICFR weakness at one association can become 
significant to the association's bank and the entire System. As 
associations become more complex, the effectiveness of ICFR becomes 
more important to the association, as well as to its bank and the 
System, more broadly.
    Additionally, the Farm Credit System Insurance Corporation (FCSIC), 
views concentration risk as an increasing concern. The association 
concentration mentioned above has significantly increased direct loan 
concentration for System banks, which in turn has impacted FCSIC's 
risks of insuring System banks. Concentrated associations pose 
significant inherent risks to their banks and FCSIC's Insurance Fund. 
FCA consulted with FCSIC on the proposed rule and FCSIC stated that it 
believes that an Integrated Audit requirement would provide further 
assurances on the integrity of financial and accounting information at 
the affected associations, as well as help mitigate large losses to the 
Insurance Fund that could result from undetected management errors, 
negligence, a fraud event, or failure.

E. FCA Regulations Should Require Certain System Associations To Obtain 
an Attestation Report To Reduce Systemic Risk

    FCA regulatory requirements for ICFR audits are limited. As 
required by Sec.  630.5(d)(2), the Funding Corporation must obtain an 
Integrated Audit of the combined System-wide financial statements. 
However, there is no equivalent regulation at the association or Bank 
level.
    FCA believes requiring associations to obtain an Attestation Report 
when their assets equal or exceed one percent of total System assets is 
appropriate because this threshold captures the associations that pose 
a systemic risk to the System. FCA also believes requiring associations 
to obtain an Attestation Report when their direct note payable to their 
bank equals or exceeds 15 percent of the bank's direct loans to 
associations is appropriate because these associations hold a large 
concentration of their bank's direct loans and may pose a systemic risk 
to the safety and soundness of their bank without meeting the one 
percent of total System assets. This requirement ensures associations 
that hold a large concentration of bank direct loans also obtain an 
Attestation Report.

F. Attestation Report Opinion for Individual Associations

    FCA acknowledges that System associations have an ICFR review 
performed by their System bank. System banks may impose monetary 
penalties, i.e., increased funding costs due to increased risks, if 
associations do not maintain adequate ICFR. Additionally, the external 
auditor of all significant associations (one percent or more of total 
System assets) performs additional ICFR reviews yearly and at all other 
associations on a three-year rotation.
    The System has also implemented practices related to ICFR. In order 
to express an opinion on ICFR at the Funding Corporation, all 
associations must establish a system of internal controls. System 
associations must make quarterly assertions related to ICFR to the 
Funding Corporation. The System has also established an ICFR workgroup. 
This workgroup provides tools and training to System institutions on 
how to establish and maintain their ICFR environment.
    However, these additional ICFR reviews and practices are designed 
to support the ICFR opinion at the Funding Corporation and System Bank 
level and not the individual association level. FCA believes that the 
scope of such work is not adequate for an external auditor to express 
an opinion on the effectiveness of the individual association's ICFR. 
Thus, FCA believes a regulation requiring an Attestation Report will 
provide an independent review of an association's ICFR environment and 
reduce the probability and magnitude of an internal control weakness or 
failure. Additionally, an Attestation Report would examine different 
controls and in different detail than current requirements for 
management assessments.

G. Benefits of Integrated Audits and Reduction of System Risks Justify 
Cost

    Integrated Audits are more robust than financial statement audits. 
The objective of a financial statement audit is to determine if the 
financial statements are presented fairly, in all material respects. As 
part of a financial statement audit, auditors obtain an understanding 
of a System Institution's ICFR. Although a financial statement audit 
assesses factors that affect the risks of material misstatement on 
ICFR, the scope of work and level of testing is less than an Integrated 
Audit. An Integrated Audit is structured to achieve the same objectives 
as a financial statement audit and additionally tests the design and 
operating effectiveness of all ICFR controls that can have a material 
effect on the financial statements and provides an opinion on the 
controls.
    The Securities and Exchange Commission (SEC), has considered 
various studies when promulgating audit requirements for regulated 
entities that show Integrated Audits offer two benefits compared to 
financial statement audits:
     Integrated Audits have been found to provide information 
to investors about the reliability of the financial statements. For 
example, a 2011 SEC Staff Study \10\ highlighted evidence that 
Attestation Reports generally resulted in the identification and 
disclosure of material weaknesses that were not previously identified 
or whose severity was misclassified when identified by management in 
its assessment of ICFR.
---------------------------------------------------------------------------

    \10\ SEC Study: Study and Recommendations on section 404(b) of 
the Sarbanes-Oxley Act of 2002 for Issuers With Public Float Between 
$75 and $250 Million.
---------------------------------------------------------------------------

     The reliability of the financial statements can be 
enhanced through the execution of Integrated Audits. Studies considered 
in SEC Release No. 34-88365, Amendments to the Accelerated and Large 
Accelerated Filer Definitions, documented a significant correlation 
between audits of ICFR and the maintenance of better internal controls, 
thereby improving reliability of financial statements. The SEC also 
found that a failure to maintain effective ICFR has been associated 
with a higher rate of future restatements and lower earnings quality 
and a higher rate of future fraud revelations (among other things).

[[Page 94618]]

    The SEC Release No. 34-88365 noted the following:
     Risks of fraud and financial statement restatements or 
misstatements were found to be greater for registrants that would not 
be subject to a requirement to obtain Attestation Reports. From 2003 to 
2020, non-accelerated U.S. filers (which did not obtain Attestation 
Reports) accounted for 62 percent of the total U.S. financial statement 
restatements.
     Registrants not subject to a requirement to obtain 
Attestation Reports were found to have higher levels of ineffective 
ICFR compared with issuers subject to that requirement. Over 40 percent 
of non-accelerated filers (not required to obtain Auditor Attestations) 
had ineffective ICFR, compared to less than approximately nine and five 
percent of accelerated and large accelerated filers, respectively 
(accelerated filers were subject to Integrated Audit requirements).
    While the referenced SEC insights pertain to public companies, FCA 
believes that this information provides meaningful insights into 
reporting risks and their reduction at System institutions. Although 
there are costs in obtaining an Integrated Audit for each institution, 
there are safety and soundness benefits to the entire System. 
Consequently, FCA believes requiring certain System institutions to 
obtain Attestation Reports will reduce financial reporting risks 
described above that stem from significant changes in the complexity 
and concentration of System banks and associations justifying the cost 
to require certain associations obtain Integrated Audits.

H. Integrated Audit Requirements of Similar Federal Financial 
Regulators

    When drafting the proposed rule, FCA reviewed the audit 
requirements that govern publicly traded financial institutions, 
institutions regulated by the Federal Deposit Insurance Corporation 
(FDIC),\11\ and other Federal financial institution regulatory 
agencies.\12\ In general, other regulators have established 
requirements that mandate a regulated entity engage an external auditor 
to conduct an annual audit of its financial statements as well as, 
under certain circumstances, an Integrated Audit. We reviewed other 
regulators thresholds and determined the compliance tailored and 
focused requirements in this proposal are more appropriate for the Farm 
Credit System than the asset minimums imposed by other regulators.
---------------------------------------------------------------------------

    \11\ 12 U.S.C. 363.2 requires FDIC-insured institutions with $1 
billion or more in total assets to obtain an Integrated Audit, among 
other requirements.
    \12\ 12 U.S.C. 704.15(b)(2) requires NCUA corporate credit 
unions to obtain an Integrated Audit, among other requirements.
---------------------------------------------------------------------------

I. An Integrated Audit Is Necessary at Certain Institutions, Including 
Certain Associations, To Strengthen the Safety and Soundness of the 
Entire System

    As discussed, the complexity and concentration of System banks and 
associations have changed dramatically leading to an increased risk 
that an internal control weakness or failure at one institution could 
affect the safety and soundness of the entire System, due to the 
System's cooperative structure. An Integrated Audit will strengthen 
shareholder and investor confidence in the System's ICFR. By requiring 
certain associations to obtain an Integrated Audit, FCA's proposed rule 
would help reduce undetected and evolving financial reporting risks in 
the System.

J. Transitional Considerations

    FCA acknowledges the effort and cost an association would bear to 
obtain and prepare for its first Integrated Audit. Therefore, FCA 
believes that the first Integrated Audit for associations should begin 
in the third full fiscal year after the effective date of this 
regulation, unless FCA determines it is appropriate to require an 
association to obtain an Attestation Report sooner because, as 
considered in Sec.  620.3(d)(3)(i)(C), as proposed, material weaknesses 
in ICFR are identified or FCA has assessed that other developments have 
occurred, or are expected to occur, that could adversely impact, or 
result in significant changes to the association's ICFR that impacts 
the safety and soundness of the association. FCA believes that three 
years should provide an adequate period of time to allow affected 
associations to prepare for their first Integrated Audit.
    All System banks currently obtain an Integrated Audit, as required 
by the Funding Corporation. Therefore, an Integrated Audit would be 
formally required for System banks upon the effective date of this 
regulation given that no transition period would be deemed necessary.

III. Proposed Rule

A. Amendments to Sec.  620.3

    FCA proposes an amendment to Sec.  620.3 that would require an 
Integrated Audit:
     By all Farm Credit System banks;
     By associations with one percent or more of total System 
assets;
     By an association when the direct note payable to its 
System bank is 15 percent or more of the System bank's direct loans to 
associations; or
     when FCA's Office of Examination (referred to as FCA staff 
in the regulatory text) determines that a material weakness in an 
association's ICFR exists such that an Integrated Audit is warranted. 
This could be based on material weaknesses in ICFR controls or other 
developments which occurred, or are expected to occur, that could 
adversely impact, or result in significant changes to an association's 
ICFR that impacts the safety and soundness of the association.
    An association would generally have three fiscal years to obtain 
its Attestation Report. Additionally, the proposed rule also details 
how and when merging associations will obtain Attestation Reports.\13\
---------------------------------------------------------------------------

    \13\ No changes are being proposed to the existing Sec.  
620.3(d). The existing regulatory language is simply being restyled 
as proposed Sec.  620.3(d)(1).
---------------------------------------------------------------------------

B. Amendment to 12 CFR 630.5(d)(2)

    With respect to the Funding Corporation, the proposed rule would 
amend Sec.  630.5(d)(2) to require that an Attestation Report be made 
in accordance with GAAS to correspond to proposed language in Sec.  
620.3(d)(2) and (3).

IV. Regulatory Flexibility Act

    Pursuant to section 605(b) of the Regulatory Flexibility Act (5 
U.S.C. 601 et seq.), FCA hereby certifies that the proposed rule will 
not have a significant economic impact on a substantial number of small 
entities. Each of the banks in the Farm Credit System, considered 
together with its affiliated associations, has assets and annual income 
in excess of the amounts that would qualify them as small entities. 
Therefore, Farm Credit System institutions are not ``small entities'' 
as defined in the Regulatory Flexibility Act.

List of Subjects

12 CFR Part 620

    Accounting, Agriculture, Banks, banking, Reporting and 
recordkeeping requirements, Rural areas.

12 CFR Part 630

    Accounting, Agriculture, Banks, banking, Organization and functions 
(Government agencies), Reporting and recordkeeping requirements, Rural 
areas.

    For the reasons stated in the preamble, the Farm Credit 
Administration proposes to amend 12 CFR parts 620 and 630 as follows:

[[Page 94619]]

PART 620--DISCLOSURES TO SHAREHOLDERS

0
1. The authority citation for part 620 continues to read as follows:

    Authority: Secs. 4.3, 4.3A, 4.19, 5.9, 5.17, 5.19 of the Farm 
Credit Act (12 U.S.C. 2154, 2154a, 2207, 2243, 2252, 2254); sec. 
424, Pub. L. 100-233, 101 Stat. 1568, 1656 (12 U.S.C. 2252 note); 
sec. 514, Pub. L. 102-552, 106 Stat. 4102, 4134.

0
2. Amend Sec.  620.3 by revising paragraph (d) to read as follows:


Sec.  620.3  Accuracy of reports and assessment of internal control 
over financial reporting.

* * * * *
    (d) Assessment of internal control over financial reporting. (1) 
Annual reports of those institutions with over $1 billion in total 
assets (as of the end of the prior fiscal year) must include a report 
by management assessing the effectiveness of the institution's internal 
control over financial reporting. The assessment must be conducted 
during the reporting period and be reported to the institution's board 
of directors. Quarterly and annual reports for those institutions with 
over $1 billion in total assets (as of the end of the prior fiscal 
year) must disclose any material change(s) in the internal control over 
financial reporting occurring during the reporting period.
    (2) All System banks must require their external auditor to issue 
an annual attestation report, which must express an opinion on the 
effectiveness of internal control over financial reporting. The 
attestation report must be made in accordance with generally accepted 
auditing standards, as promulgated by the American Institute for 
Certified Public Accountants or the Public Company Accounting Oversight 
Board's auditing standards, if applicable. The resulting attestation 
report must accompany management's assessment of internal control over 
financial reporting (as required by paragraph (d)(1) of this section) 
and be included in the bank's annual report.
    (3) Any System association that meets the criteria in paragraphs 
(d)(3)(i)(A) through (C) of this section must engage its external 
auditor to issue an annual attestation report, which must express an 
opinion on the effectiveness of internal control over financial 
reporting. The attestation report must be made in accordance with 
generally accepted auditing standards, as promulgated by the American 
Institute for Certified Public Accountants or the Public Company 
Accounting Oversight Board's auditing standards, if applicable. The 
resulting attestation report must accompany management's assessment of 
internal control over financial reporting (as required by paragraph 
(d)(1) of this section), if applicable, and be included in the 
association's annual report.
    (i)The requirements of this section apply to associations if:
    (A) The association's total assets equaled one percent or more of 
total System assets as of the prior fiscal year;
    (B) The total direct note payable to the association's funding bank 
was 15 percent or more of the funding bank's total direct loans to 
associations as of the prior fiscal year; or
    (C) FCA staff determines that a material weakness exists in the 
association's internal control over financial reporting, or other 
developments have occurred or are expected to occur that could 
adversely impact, or result in significant changes to the association's 
internal control over financial reporting that impacts the safety and 
soundness of the association.
    (4) An association shall comply with paragraph (d)(3) of this 
section at the end of the third full fiscal year after the effective 
date of this rule, or the date on which the association meets the 
criteria in paragraphs (d)(3)(i)(A) through (C) of this section, 
whichever is later, unless FCA staff determines it appropriate to 
require an earlier compliance date. Associations that merge during the 
fiscal year shall determine the compliance date as follows:
    (i) If, on the effective date of the merger, one or more of the 
merging associations must comply with paragraph (d) of this section, 
the merged association shall be required to comply with paragraph 
(d)(3) of this section.
    (ii) If, on the effective date of the merger, paragraph (d)(4)(i) 
of this section does not apply, and one or more of the merging 
associations is within the timeframe prescribed in paragraph (d)(4) of 
this section, the merged association shall be required to comply with 
paragraph (d)(3) of this section on the earliest compliance date of the 
merging associations as of the day immediately preceding the effective 
date of the merger.
    (iii) If, on the effective date of the merger, paragraphs (d)(4)(i) 
through (ii) of this section do not apply, but the merged association 
meets the criteria in paragraphs (d)(3)(i)(A) through (C) of this 
section, the merged association shall comply with paragraph (d)(3) of 
this section at the end of the third full fiscal year after the 
effective date of the merger.
    (5) If an association no longer meets the criteria in paragraph 
(d)(3)(i)(A) or (B) of this section, an attestation report under 
paragraph (d)(3) of this section is not required.
    (6) An attestation report shall no longer be required under 
paragraph (d)(3)(i)(C) of this section if FCA staff determines that:
    (i) The association has no material weaknesses in internal control 
over financial reporting; or
    (ii) No material event exists or is expected to exist that impacts 
the reliability of the association's financial disclosures; and
    (iii) No other indication of material risk exists in the 
association's internal control over financial reporting that impacts 
the safety and soundness of the association.

PART 630--DISCLOSURE TO INVESTORS IN SYSTEMWIDE AND CONSOLIDATED 
BANK DEBT OBLIGATIONS OF THE FARM CREDIT SYSTEM

0
3. The authority citation for part 630 continues to read as follows:

    Authority: Secs. 4.2, 4.9, 5.9, 5.17, 5.19 of the Farm Credit 
Act (12 U.S.C. 2153, 2160, 2243, 2252, 2254); sec. 424, Pub. L. 100-
233, 101 Stat. 1568, 1656 (12 U.S.C. 2252 note); sec. 514, Pub. L. 
102-552, 106 Stat. 4102, 4134.

0
4. Amend Sec.  630.5 by revising the heading to paragraph (d) and 
paragraph (d)(2) to read as follows:
* * * * *
    (d) Assessment of internal control over financial reporting.
* * * * *
    (2) The Funding Corporation must require its external auditor to 
issue an attestation report, which must express an opinion on the 
effectiveness of internal control over financial reporting. The 
attestation report must be made in accordance with generally accepted 
auditing standards, as promulgated by the American Institute for 
Certified Public Accountants or the Public Company Accounting Oversight 
Board's auditing standards, if applicable. The resulting attestation 
report must accompany management's assessment of internal control over 
financial reporting (as required by paragraph (d)(1) of this section) 
and be included in the annual report.

    Dated: November 21, 2024.
Ashley Waldron,
Secretary to the Board, Farm Credit Administration.
[FR Doc. 2024-27657 Filed 11-27-24; 8:45 am]
BILLING CODE 6705-01-P