As a result of recent inquiries, the FDIC's Division of Supervision is restating the agency's long-standing position encouraging insured institutions' use of vacation policy as an effective internal control.

The FDIC endorses the concept of a vacation policy that allows active officers and employees to be absent from their duties for an uninterrupted period of no less than two weeks. During this time, their duties and responsibilities should be assumed by other employees. This basic control has proven to be an effective internal safeguard in preventing fraud. In addition, such a policy is viewed as a benefit to the well-being of the employees and can be a valuable aid to the institution's overall training program.

The FDIC recognizes, however, that exceptions to a two-week policy can occur. In those situations, it is important for the institution to have adequate compensating controls -- such as an effective rotation of personnel -- that are strictly enforced. When the vacation policy does not conform to the recommended two-week absence, the institution's board of directors should review and approve the policy actually followed and the exceptions allowed.

The FDIC views a sound vacation policy as one element of an institution's overall internal control system. In evaluating the adequacy of that system, examiners review the relative importance of an individual control, or lack thereof, in the context of the entire system and whether the institution has other effective compensatory control procedures.

The FDIC's position is consistent with the industry's practices and guidelines on internal control systems, as well as the position of the other regulators. The following paragraph is included as examiner guidance in the Internal Routine and Controls Section of the FDIC's Manual of Examination Policies.

Vacation Policies - It is the FDIC's goal that all banks have a vacation policy which provides that active officers and employees be absent from their duties for an uninterrupted period of not less than two consecutive weeks. Such a policy is considered an important internal safeguard largely because of the fact that perpetration of an embezzlement of any substantial size usually requires the constant presence of the embezzler in order to manipulate records, respond to inquiries from customers or other employees, and otherwise prevent detection. It is important for examiners and bank management to recognize that the benefits of this policy may be substantially, if not totally, eroded if the duties performed by an absent individual are not assumed by someone else. Where the bank's policy does not conform to the two-week recommended absence period, examiners should encourage the board of directors to annually review and approve the policy followed and the exceptions allowed. It is important in such cases that adequate compensating controls be devised and strictly enforced. When it is determined, after thorough consideration of all relevant facts and circumstances, that the bank's vacation policies are deficient, the matter should be discussed with the chief executive officer or directors. Comments and recommendations on the supplemental Internal Routine and Controls schedule may be appropriate.

For more information, contact Examination Specialist Mike Jenkins in Washington (202-898-6896) or your regional office of the FDIC's Division of Supervision.

Nicholas J. Ketcha Jr.

Acting Director

Distribution

FDIC-Supervised Banks & Savings Banks

All Examiners

State Banking Regulators