Each depositor insured to at least $250,000 per insured bank



Home > News & Events > Inactive Financial Institution Letters




Inactive Financial Institution Letters

Annual Audit and Reporting Requirements
Extended Filing Deadline for Management's Internal Control Assessment and the Independent Auditor's Attestation
FIL-137-2004
December 21, 2004


Summary: The FDIC is providing guidance to insured institutions with $500 million or more in total assets that are required to comply with the FDIC's annual audit and reporting requirements about the Securities and Exchange Commission's (SEC) exemptive order postponing the filing date for internal control reports.

Highlights:
  • The annual audit and reporting requirements for insured institutions with $500 million or more in total assets in Part 363 of the FDIC's regulations require assessments of internal control over financial reporting by both management and independent auditors.
  • On November 30, 2004, the SEC issued an exemptive order to grant certain public companies that are accelerated filers additional time to include in their annual reports on Form 10-K the reports on internal control over financial reporting by management and the independent auditor that are required by Section 404 of the Sarbanes-Oxley Act.
  • The FDIC has received questions about the applicability of the SEC's exemptive order to institutions subject to Part 363.
  • Subject to certain conditions, the FDIC is following the SEC's lead and allowing those institutions subject to Part 363 that fall directly or indirectly within the scope of the SEC's exemptive order to take up to 120 days after their fiscal year-end to submit the assessments of internal control by both management and independent auditors that are required in their Part 363 annual reports.
Continuation of FIL-137-2004

Distribution:
FDIC-Insured Institutions With $500 Million or More in Assets

Suggested Routing:
Chief Executive Office
Chief Financial Officer
Audit Committee

Related Topics:
Federal Deposit Insurance Act Section 36
Part 363 of the FDIC's Regulations

Attachment:
Part 363 Annual Report

Contact:
FDIC Regional Accountant or Harrison Greene, Senior Policy Analyst, Division of Supervision and Consumer Protection at hgreene@fdic.gov or 202 898-8905.

Printable Format:
FIL-137-2004 - PDF 65k (PDF Help)

Note:
FDIC Financial Institution Letters (FILs) may be accessed from the FDIC's Web site at www.fdic.gov/news/news/financial/2004/index.html.

To receive FILs electronically, please visit http://www.fdic.gov/about/subscriptions/fil.html.

Paper copies of FDIC FILs may be obtained through the FDIC's Public Information Center, 801 17th Street, NW, Room 100, Washington, DC 20434 (1-877-275-3342 or (703) 562-2200).



Financial Institution Letters
FIL-137-2004
December 21, 2004

Annual Audit and Reporting Requirements-
Extended Filing Deadline for Management's Internal Control Assessment and the Independent Auditor's Attestation

The FDIC is providing guidance to insured institutions with $500 million or more in total assets that are required to comply with the FDIC's annual audit and reporting requirements about the Securities and Exchange Commission's (SEC) exemptive order postponing the filing date for internal control reports.

On November 30, 2004, the Securities and Exchange Commission (SEC) issued an exemptive order to grant certain public companies1 that are accelerated filers up to an additional 45 days to include in their annual reports on Form 10-K management's report on internal control over financial reporting and the related auditor's report on management's assessment of internal control over financial reporting. Both internal control reports are required under the SEC's rules implementing Section 404 of the Sarbanes-Oxley Act of 2002. All other information required in annual reports on Form 10 K, including audited financial statements, must be submitted by the original due date for these annual reports, which for an accelerated filer is 75 days after the end of the fiscal year. Thus, under the exemptive order, an accelerated filer has up to 120 days after its fiscal year-end to file an amendment to its annual report on Form 10-K that includes both management's and the auditor's reports on internal control over financial reporting. For example, an accelerated filer within the scope of the exemptive order that has a December 31 fiscal year-end would have until April 30, 2005, to submit these internal control reports.

The SEC's exemptive order applies to an accelerated filer that has a fiscal year ending between and including November 15, 2004, and February 28, 2005, and that had a "public float"2 of less than $700 million at the end of its second fiscal quarter in 2004. The SEC's rules define an "accelerated filer" as a public company that:

  • Has a public float of at least $75 million;
  • Has been subject to the SEC's periodic reporting requirements for at least 12 months and has filed one annual report; and
  • Is not eligible to use the SEC's small business reporting forms.

The Public Company Accounting Oversight Board (PCAOB) also adopted a temporary transitional rule regarding auditors' internal control reports that is consistent with the SEC's exemptive order. On December 3, 2004, the SEC approved the PCAOB's temporary rule on an accelerated basis. The full texts of the SEC's exemptive order and the PCAOB's temporary rules are posted on their respective Web sites at http://www.sec.gov/rules/exorders/34-50754.htm and http://www.pcaobus.org/Rules/Docket_016/index.aspx.

Section 36 of the Federal Deposit Insurance Act and Part 363 of the FDIC's regulations impose annual audit and reporting requirements on insured depository institutions with $500 million or more in total assets. An institution's Part 363 annual report must include an assessment by management of the effectiveness of internal control over financial reporting and a report by the institution's independent auditor on management's assertion concerning internal control. For purposes of Part 363, financial reporting encompasses both financial statements prepared in accordance with generally accepted accounting principles and those prepared for regulatory reporting purposes. The Part 363 annual report must be submitted within 90 days after the end of an institution's fiscal year. However, notwithstanding this 90-day filing period, each audit and attestation report issued by its independent auditor is to be filed within 15 days of receipt. In addition, with certain exceptions, the Part 363 annual reporting requirements may be satisfied by an institution's holding company if services and functions comparable to those required of the institution are provided at the holding company level.

Since the SEC issued the exemptive order for internal control reports, the FDIC has considered its applicability and effect on institutions subject to the similar internal control reporting requirements of Part 363. We understand that some institutions subject to Part 363 that are accelerated filers or subsidiaries of holding companies that are accelerated filers had planned to file combined internal control reports to satisfy both the Section 404 and Part 363 requirements, as permitted by the SEC and the federal banking agencies. Other institutions planned to file separate internal control reports, but the work to be performed by management and auditors as the basis for these separate reports would take place at the same time. Therefore, we believe it would be beneficial to follow the SEC's lead and provide relief, comparable to that provided in the SEC's exemptive order, to those institutions subject to Part 363 that directly or indirectly fall within the scope of the exemptive order.

Accordingly, an institution subject to Part 363 that has a fiscal year ending between and including November 15, 2004, and February 28, 2005, and satisfies the following additional conditions may take up to 120 days after the end of its fiscal year (i.e., until April 30, 2005, for an institution with a December 31 fiscal year-end) to submit to the FDIC and other federal and state supervisors, as appropriate, the assessment by management of the effectiveness of internal control over financial reporting and the related auditor's attestation report concerning internal control that are required by Part 363.

  1. The institution is:
    1. A public company that is an accelerated filer, as that term is defined by the SEC's rules, with a public float of less than $700 million at the end of its second fiscal quarter in 2004, or
    2. A subsidiary of a public holding company that is an accelerated filer with a public float of less than $700 million at the end of its second fiscal quarter in 2004;
  2. The institution files all of the other parts of its Part 363 annual report (i.e., items 1, 2, 3.a.i-iii, and 3.b.ii on the list of the required parts of the Part 363 annual report in the Attachment) within 90 days after the end of its fiscal year;
  3. The institution includes in the management report section of the Part 363 annual report a statement that management's assessment of the effectiveness of the internal control structure over financial reporting as of the end of the fiscal year and the related auditor's attestation report on management's assertion concerning internal control (i.e., items 3.b.i and 4 on the list of the required parts of the Part 363 annual report in the Attachment) will be filed not later than 120 days after the end of the institution's fiscal year; and
  4. The institution discloses information in the management report section of the Part 363 annual report about:
    1. Any material weaknesses in internal control over financial reporting that it (or its parent holding company) has identified before the Part 363 annual report is filed; and
    2. Any material weaknesses in internal control over financial reporting that its auditor has identified and communicated to the institution (or its parent holding company) before the Part 363 annual report is filed.

All other institutions subject to Part 363 must file their complete Part 363 annual report, including both management's and the auditor's internal control reports, within 90 days after the end of their fiscal year.

Questions about the FDIC's annual audit and reporting requirements, including the extension of the deadline for certain institutions to file management's internal control assessment and the independent auditor's attestation, may be addressed to your FDIC Regional Accountant or Senior Policy Analyst Harrison E. Greene, Jr., Division of Supervision and Consumer Protection, at (202) 898-8905 or hgreene@fdic.gov.

Michael J. Zamorski
Director
Division of Supervision and Consumer Protection



1 Public companies are companies subject to the reporting requirements of the Securities Exchange Act of 1934.

2 “Public float” is the aggregate market value of a public company’s voting and non-voting common equity held by investors other than affiliates of the public company.


Last Updated 12/21/2004 communications@fdic.gov