Federal Deposit
Insurance Corporation

=======================================================================
-----------------------------------------------------------------------

FEDERAL DEPOSIT INSURANCE CORPORATION

Rescission of Policy Statement Regarding Independent External
Auditing Programs of State Nonmember Banks, and Adoption of the
Interagency Policy Statement on External Auditing Programs of Banks and
Savings Associations

AGENCY: Federal Deposit Insurance Corporation (FDIC or Corporation).

ACTION: Rescission of a Policy Statement and Adoption of an Interagency
Policy Statement.

-----------------------------------------------------------------------

SUMMARY: In an effort to provide consistent guidance for banks and
savings associations regardless of their primary federal supervisor,
the FDIC is rescinding its Statement of Policy Regarding Independent
External Auditing Programs of State Nonmember Banks (Current Policy
Statement) and concurrently adopting the Interagency Policy Statement
on External Auditing Programs of Banks and Savings Associations
(Interagency Policy Statement). Both policy statements encourage
institutions to adopt an annual external auditing program, preferably
an audit by an independent public accountant, and to establish an audit
committee composed entirely of outside directors, where practicable. In
addition, the Interagency Policy Statement includes two alternatives to
an audit by an independent public accountant for institutions not
subject to the audit requirement in section 36 of the Federal Deposit
Insurance Act (FDI Act). The alternatives consist of (1) An attestation
report on internal control over specified schedules of the
institution's regulatory reports or (2) A report on the institution's
balance sheet. Both must be performed by an independent public
accountant.
The Interagency Policy Statement also includes guidance regarding
the responsibilities of boards of directors, audit committees, and
senior management with respect to external auditing programs; the
attributes and types of external auditing programs; and the review of
external auditing programs by examiners.

DATES: The Current Policy Statement is rescinded and the Interagency
Policy Statement is effective for fiscal years beginning on or after
January 1, 2000.

FOR FURTHER INFORMATION CONTACT: Doris L. Marsh, Examination
Specialist, Division of Supervision, (202) 898-8905, or A. Ann Johnson,
Counsel, Legal Division, (202) 898-3573, FDIC, 550 17th Street, NW,
Washington, DC 20429.

SUPPLEMENTARY INFORMATION:

I. Background

The FDIC first adopted guidance on external auditing programs in
its Policy Statement Regarding Independent External Auditing Programs
of State Nonmember Banks in 1988 (53 FR 47871, November 28, 1988). In
1996, the FDIC reviewed the Current Policy Statement pursuant to
section 303(a) of the Riegle Community Development and Regulatory
Improvement Act of 1994 and adopted several amendments to eliminate
inconsistencies and outdated requirements (61 FR 32438, June 24, 1996).
The Federal Financial Institutions Examination Council (FFIEC), on
behalf of the Board of Governors of the Federal Reserve System (FRB),
the Federal Deposit Insurance Corporation (FDIC), the Office of the
Comptroller of the Currency (OCC), and the Office of Thrift Supervision
(OTS), collectively referred to as the ``banking agencies'' or the
``agencies,'' have each provided guidance on external audits to their
supervised institutions, but a uniform policy did not exist. Under the
auspices of the FFIEC, the agencies sought public comment on a proposed
policy statement on External Auditing Programs of Banks and Savings
Associations in February 1998 (63 FR 7796, February 17, 1998). The
FFIEC received approximately 120 letters commenting on the proposed
policy statement, and it revised the policy statement after considering
the comments. On August 19, 1999, the FFIEC approved the Interagency
Policy Statement on External Auditing Programs of Banks and Savings
Associations (Policy Statement) (64 FR 52319, September 28, 1999) and
recommended that the banking agencies adopt it.<SUP>1</SUP>
---------------------------------------------------------------------------

\1\ The National Credit Union Administration (NCUA), also a
member of the FFIEC, is not adopting the policy.
---------------------------------------------------------------------------

II. Rescission of the Current Policy Statement and Adoption of the
Interagency Policy Statement

In order to minimize burden on institutions and holding companies
and in the spirit of section 303 of the Riegle Community Development
and Regulatory Improvement Act of 1994, the banking agencies seek to
provide consistent and uniform guidance for supervised institutions.
The banking agencies believe that an independent external audit
provides reasonable assurance that an institution's financial
statements are prepared in accordance with generally accepted
accounting principles (GAAP). Accordingly, the banking agencies
recommend that every institution have an external auditing program.
To provide explicit guidance to institutions regarding these
programs, the FFIEC approved a uniform Interagency Policy Statement on
August 19, 1999. The FFIEC recommended to the banking agencies that
they individually adopt the policy. Thus, the FDIC must replace its
Current Policy Statement with the Interagency Policy Statement in order
to achieve uniformity in this area.

III. Comparison of the Current and Interagency Policy Statements

For the most part, both the Current Policy Statement and the
Interagency Policy Statement provide similar guidance. Both encourage
each institution to have an annual audit of its financial statements
performed by an independent public accountant. The Interagency Policy
Statement also describes two alternatives to an audit that an
institution may elect to have performed annually in order to have an
acceptable external auditing program. These alternatives, which must be
performed by an independent public accountant, are an attestation on
internal control over financial reporting on certain schedules of the
Reports of Condition and Income (Call Report) and an audit of the
institution's balance sheet. The Interagency Policy Statement further
indicates that for a smaller institution with less complex operations,
the attestation on internal control may be less costly than an audit of
its financial statements or its balance sheet and provide more useful
information to management. Neither policy precludes the use of agreed-
upon procedures/state-required examinations as an external auditing
program.
Both policy statements include sections discussing their
applicability to institutions that are part of a holding company, newly
chartered institutions, and institutions presenting supervisory
concern. In addition, both policies recommend that each institution
have an audit committee consisting entirely of outside directors,
unless impracticable.
Banks and savings associations (institutions) with $500 million or
more in total assets must have an annual audit performed by an
independent public accountant under section 36 of

[[Page 57095]]

the Federal Deposit Insurance Act (FDI Act), as implemented by 12 CFR
part 363. Thus, both policy statements are directed toward institutions
below that threshold that are not otherwise subject to audit
requirements.
The two policies differ in the extent of guidance provided rather
than the content of the guidance. Accordingly, the Interagency Policy
Statement includes some guidance regarding independent external
auditing programs that is lacking in the Current Policy Statement. For
example, it discusses the responsibilities of boards of directors,
audit committees, and senior management in more detail than the Current
Policy Statement. It also describes the attributes and types of
external auditing programs available and includes a short description
of each. Guidance on what examiners will be evaluating in their review
of external auditing programs is also included in the Interagency
Policy Statement. This policy statement also recommends that examiners
have access to the auditor's workpapers concerning the auditing
engagement.
The following table shows the number and section title of each of
the paragraphs in the Current Policy Statement and the section title of
the corresponding provision in the Interagency Policy Statement:

Paragraph Conversion Table
------------------------------------------------------------------------
Current policy Interagency policy
Current policy statement: section statement: section
paragaraph No. title title
------------------------------------------------------------------------
1-3..................... Introduction.......... Introduction.
4....................... State Nonmember Banks Introduction.
Not Subject to Part
363.
5....................... ...................... Overview of the
External Auditing
Program Audit
Committee.
6....................... ...................... Examiner Guidance
Review of the
External Auditing
Program.
7....................... Audit by an External Auditing
Independent Public Programs Types of
Accountant. External Auditing
Programs.
8....................... ...................... External Auditing
Programs Other
Considerations--Timin
g.
9-10.................... Alternatives to a External Auditing
Financial Statement Programs External
Audit. Auditing Programs.
11...................... Newly Insured Banks... Special Situations
Newly Insured
Institutions.
12-13................... Notification and Examiner Guidance
Submission of Reports. Access to Reports.
14...................... Holding Company Special Situations
Subsidiaries. Holding Company
Subsidiaries.
15...................... Troubled Banks........ Special Situations
Institutions
Presenting
Supervisory Concerns.
Appendix A.............. Definitions........... Appendix A--
Definitions.
------------------------------------------------------------------------

The Interagency Policy Statement instructs institutions to provide
copies of reports pertaining to the external auditing program,
including any management letters, to the agencies and any state
authority in accordance with their appropriate supervisory office's
guidance. The FDIC requests that each state nonmember bank furnish a
copy of any reports by the independent public accountant pertaining to
the bank's external auditing program (regardless of the scope) to the
appropriate FDIC regional office as soon as possible after the report
is received by the bank. In addition, the FDIC requests each bank to
promptly notify the appropriate FDIC regional office when any
independent public accountant is initially engaged to perform external
auditing work and when a change in, or termination of, its independent
public accountant occurs.

IV. Paperwork Reduction Act

In accordance with the Paperwork Reduction Act of 1995 (PRA), the
FDIC may not conduct or sponsor, and the respondent is not required to
respond to, an information collection that does not display a currently
valid Office of Management and Budget (OMB) control number. The FDIC
submitted to OMB a request for approval of the information collection
requested by this policy statement (64 FR 55926, October 15, 1999).

V. Rescission and Adoption of Policy Statements

For the reasons set forth in the preamble, the Board of Directors
of the FDIC hereby rescinds the FDIC's Policy Statement Regarding
Independent External Auditing Programs of State Nonmember Banks and
adopts the Interagency Policy Statement on External Auditing Programs
of Banks and Savings Associations.
The text of the Interagency Policy Statement follows:

Interagency Policy Statement On External Auditing Programs of Banks
and Savings Associations

Introduction

The board of directors and senior managers of a banking institution
or savings association (institution) are responsible for ensuring that
the institution operates in a safe and sound manner. To achieve this
goal and meet the safety and soundness guidelines implementing section
39 of the Federal Deposit Insurance Act (FDI Act) (12 U.S.C. 1831p-
1),<SUP>1</SUP> the institution should maintain effective systems and
internal control <SUP>2</SUP> to produce reliable and accurate
financial reports.
---------------------------------------------------------------------------

\1\ See 12 CFR part 30 for national banks; 12 CFR part 364 for
state nonmember banks; 12 CFR part 208 for state member banks; and
12 CFR part 510 for savings associations.
\2\ This Policy Statement provides guidance consistent with the
guidance established in the ``Interagency Policy Statement on the
Internal Audit Function and its Outsourcing.''
---------------------------------------------------------------------------

Accurate financial reporting is essential to an institution's
safety and soundness for numerous reasons. First, accurate financial
information enables management to effectively manage the institution's
risks and make sound business decisions. In addition, institutions are
required by law <SUP>3</SUP> to provide accurate and timely financial
reports (e.g., Reports of Condition and Income [Call Reports] and
Thrift Financial Reports) to their appropriate regulatory agency. These
reports serve an important role in the agencies' <SUP>4</SUP> risk-
focused supervision programs by contributing to their pre-examination
planning, off-site monitoring programs, and assessments of an
institution's capital adequacy and financial strength. Further,
reliable financial reports are necessary for the institution to raise
capital. They provide data to stockholders, depositors and other

[[Page 57096]]

funds providers, borrowers, and potential investors on the company's
financial position and results of operations. Such information is
critical to effective market discipline of the institution.
---------------------------------------------------------------------------

\3\ See 12 U.S.C. 161 for national banks; 12 U.S.C. 1817a for
state nonmember banks; 12 U.S.C. 324 for state member banks; and 12
U.S.C. 1464(v) for savings associations.
\4\ Terms defined in appendix A are italicized the first time
they appear in this policy statement.
---------------------------------------------------------------------------

To help ensure accurate and reliable financial reporting, the
agencies recommend that the board of directors of each institution
establish and maintain an external auditing program. An external
auditing program should be an important component of an institution's
overall risk management process. For example, an external auditing
program complements the internal auditing function of an institution by
providing management and the board of directors with an independent and
objective view of the reliability of the institution's financial
statements and the adequacy of its financial reporting internal
controls. Additionally, an effective external auditing program
contributes to the efficiency of the agencies' risk-focused examination
process. By considering the significant risk areas of an institution,
an effective external auditing program may reduce the examination time
the agencies spend in such areas. Moreover, it can improve the safety
and soundness of an institution substantially and lessen the risk the
institution poses to the insurance funds administered by the FDIC.
This policy statement outlines the characteristics of an effective
external auditing program and provides examples of how an institution
can use an external auditor to help ensure the reliability of its
financial reports. It also provides guidance on how an examiner may
assess an institution's external auditing program. In addition, this
policy statement provides specific guidance on external auditing
programs for institutions that are holding company subsidiaries, newly
insured institutions, and institutions presenting supervisory concerns.
The adoption of a financial statement audit or other specified type
of external auditing program is generally only required in specific
circumstances. For example, insured depository institutions covered by
section 36 of the FDI Act (12 U.S.C. 1831m), as implemented by part 363
of the FDIC's regulations (12 CFR part 363), are required to have an
external audit and an audit committee. Therefore, this policy statement
is directed toward banks and savings associations which are exempt from
part 363 (i.e., institutions with less than $500 million in total
assets at the beginning of their fiscal year) or are not otherwise
subject to audit requirements by order, agreement, statute, or agency
regulations.

Overview of External Auditing Programs

Responsibilities of the Board of Directors

The board of directors of an institution is responsible for
determining how to best obtain reasonable assurance that the
institution's financial statements and regulatory reports are reliably
prepared. In this regard, the board is also responsible for ensuring
that its external auditing program is appropriate for the institution
and adequately addresses the financial reporting aspects of the
significant risk areas and any other areas of concern of the
institution's business.
To help ensure the adequacy of its internal and external auditing
programs, the agencies encourage the board of directors of each
institution that is not otherwise required to do so to establish an
audit committee consisting entirely of outside directors.<SUP>5</SUP>
However, if this is impracticable, the board should organize the audit
committee so that outside directors constitute a majority of the
membership.
---------------------------------------------------------------------------

\5\ Institutions with $500 million or more in total assets must
establish an independent audit committee made up of outside
directors who are independent of management. See 12 U.S.C.
1831m(g)(1) and 12 CFR 363.5.
---------------------------------------------------------------------------

Audit Committee

The audit committee or board of directors is responsible for
identifying at least annually the risk areas of the institution's
activities and assessing the extent of external auditing involvement
needed over each area. The audit committee or board is then responsible
for determining what type of external auditing program will best meet
the institution's needs (refer to the descriptions under ``Types of
External Auditing Programs'').
When evaluating the institution's external auditing needs, the
board or audit committee should consider the size of the institution
and the nature, scope, and complexity of its operations. It should also
consider the potential benefits of an audit of the institution's
financial statements or an examination of the institution's internal
control structure over financial reporting, or both. In addition, the
board or audit committee may determine that additional or specific
external auditing procedures are warranted for a particular year or
several years to cover areas of particularly high risk or special
concern. The reasons supporting these decisions should be recorded in
the committee's or board's minutes.
If, in its annual consideration of the institution's external
auditing program, the board or audit committee determines, after
considering its inherent limitations, that an agreed-upon procedures/
state-required examination is sufficient, they should also consider
whether an independent public accountant should perform the work. When
an independent public accountant performs auditing and attestation
services, the accountant must conduct his or her work under, and may be
held accountable for departures from, professional standards.
Furthermore, when the external auditing program includes an audit of
the financial statements, the board or audit committee obtains an
opinion from the independent public accountant stating whether the
financial statements are presented fairly, in all material respects, in
accordance with generally accepted accounting principles (GAAP). When
the external auditing program includes an examination of the internal
control structure over financial reporting, the board or audit
committee obtains an opinion from the independent public accountant
stating whether the financial reporting process is subject to any
material weaknesses.
Both the staff performing an internal audit function and the
independent public accountant or other external auditor should have
unrestricted access to the board or audit committee without the need
for any prior management knowledge or approval. Other duties of an
audit committee may include reviewing the independence of the external
auditor annually, consulting with management, seeking an opinion on an
accounting issue, and overseeing the quarterly regulatory reporting
process. The audit committee should report its findings periodically to
the full board of directors.

External Auditing Programs

Basic Attributes

External auditing programs should provide the board of directors
with information about the institution's financial reporting risk
areas, e.g., the institution's internal control over financial
reporting, the accuracy of its recording of transactions, and the
completeness of its financial reports prepared in accordance with GAAP.
The board or audit committee of each institution at least annually
should review the risks inherent in its particular activities to
determine the scope of its external auditing program. For most
institutions, the lending and

[[Page 57097]]

investment securities activities present the most significant risks
that affect financial reporting. Thus, external auditing programs
should include specific procedures designed to test at least annually
the risks associated with the loan and investment portfolios. This
includes testing of internal control over financial reporting, such as
management's process to determine the adequacy of the allowance for
loan and lease losses and whether this process is based on a
comprehensive, adequately documented, and consistently applied analysis
of the institution's loan and lease portfolio.
An institution or its subsidiaries may have other significant
financial reporting risk areas such as material real estate
investments, insurance underwriting or sales activities, securities
broker-dealer or similar activities (including securities underwriting
and investment advisory services), loan servicing activities, or
fiduciary activities. The external auditing program should address
these and other activities the board or audit committee determines
present significant financial reporting risks to the institution.

Types of External Auditing Programs

The agencies consider an annual audit of an institution's financial
statements performed by an independent public accountant to be the
preferred type of external auditing program. The agencies also consider
an annual examination of the effectiveness of the internal control
structure over financial reporting or an audit of an institution's
balance sheet, both performed by an independent public accountant, to
be acceptable alternative external auditing programs. However, the
agencies recognize that some institutions only have agreed-upon
procedures/state-required examinations performed annually as their
external auditing program. Regardless of the option chosen, the board
or audit committee should agree in advance with the external auditor on
the objectives and scope of the external auditing program.
Financial Statement Audit by an Independent Public Accountant. The
agencies encourage all institutions to have an external audit performed
in accordance with generally accepted auditing standards (GAAS). The
audit's scope should be sufficient to enable the auditor to express an
opinion on the institution's financial statements taken as a whole.
A financial statement audit provides assurance about the fair
presentation of an institution's financial statements. In addition, an
audit may provide recommendations for management in carrying out its
control responsibilities. For example, an audit may provide management
with guidance on establishing or improving accounting and operating
policies and recommendations on internal control (including internal
auditing programs) necessary to ensure the fair presentation of the
financial statements.
Reporting by an Independent Public Accountant on an Institution's
Internal Control Structure Over Financial Reporting. Another external
auditing program is an independent public accountant's examination and
report on management's assertion on the effectiveness of the
institution's internal control over financial reporting. For a smaller
institution with less complex operations, this type of engagement is
likely to be less costly than an audit of its financial statements or
its balance sheet. It would specifically provide recommendations for
improving internal control, including suggestions for compensating
controls, to mitigate the risks due to staffing and resource
limitations.
Such an attestation engagement may be performed for all internal
controls relating to the preparation of annual financial statements or
specified schedules of the institution's regulatory
reports.<SUP>6</SUP> This type of engagement is performed under
generally accepted standards for attestation engagements
(GASAE).<SUP>7</SUP>

\6\ Since the lending and investment securities activities
generally present the most significant risks that affect an
institution's financial reporting, management's assertion and the
accountant's attestation generally should cover those regulatory
report schedules. If the institution has trading or off-balance
sheet activities that present material financial reporting risks,
the board or audit committee should ensure that the regulatory
report schedules for those activities also are covered by
management's assertion and the accountant's attestation. (See Note.)
However, the schedules listed in the Note are not intended to
address all possible risks in an institution.
\7\ An attestation engagement is not an audit. It is performed
under different professional standards than an audit of an
institution's financial statements or its balance sheet.
---------------------------------------------------------------------------

Note: For banks and savings associations, the lending,
investment securities, trading, and off-balance sheet schedules
consist of:

----------------------------------------------------------------------------------------------------------------
Reports of condition and income
Area schedules schedules Thrift financial report
----------------------------------------------------------------------------------------------------------------
Loans and Lease Financing Receivables......... RC-C, Part I................... SC, CF.
Past Due and Nonaccrual Loans, Leases, and RC-N........................... PD.
Other Assets.
Allowance for Credit Losses................... RI-B........................... SC, VA.
Securities.................................... RC-B........................... SC, SI, CF.
Trading Assets and Liabilities................ RC-D........................... SO, SI.
Off-Balance Sheet Items....................... RC-L........................... SI, CMR.
----------------------------------------------------------------------------------------------------------------

Balance Sheet Audit Performed by an Independent Public Accountant.
With this program, the institution engages an independent public
accountant to examine and report only on the balance sheet. As with the
audit of the financial statements, this audit is performed in
accordance with GAAS. The cost of a balance sheet audit is likely to be
less than a financial statement audit. However, under this type of
program, the accountant does not examine or report on the fairness of
the presentation of the institution's income statement, statement of
changes in equity capital, or statement of cash flows.
Agreed-Upon Procedures/State-Required Examinations. Some state-
chartered depository institutions are required by state statute or
regulation to have specified procedures performed annually by their
directors or independent persons.<SUP>8</SUP> The bylaws of many
national banks also require that some specified procedures be performed
annually by directors or others, including internal or independent
persons. Depending upon the scope of the engagement, the cost of
agreed-upon procedures or a state-required examination may be less than
the cost of an audit. However, under this type of program, the
independent auditor does

[[Page 57098]]

not report on the fairness of the institution's financial statements or
attest to the effectiveness of the internal control structure over
financial reporting. The findings or results of the procedures are
usually presented to the board or the audit committee so that they may
draw their own conclusions about the quality of the financial reporting
or the sufficiency of internal control.
---------------------------------------------------------------------------

\8\ When performed by an independent public accountant,
``specified procedures'' and ``agreed-upon procedures'' engagements
are performed under standards, which are different professional
standards than those used for an audit of an institution's financial
statements or its balance sheet.
---------------------------------------------------------------------------

When choosing this type of external auditing program, the board or
audit committee is responsible for determining whether these procedures
meet the external auditing needs of the institution, considering its
size and the nature, scope, and complexity of its business activities.
For example, if an institution's external auditing program consists
solely of confirmations of deposits and loans, the board or committee
should consider expanding the scope of the auditing work performed to
include additional procedures to test the institution's high risk
areas. Moreover, a financial statement audit, an examination of the
effectiveness of the internal control structure over financial
reporting, and a balance sheet audit may be accepted in some states and
for national banks in lieu of agreed-upon procedures/state-required
examinations.

Other Considerations

Timing. The preferable time to schedule the performance of an
external auditing program is as of an institution's fiscal year-end.
However, a quarter-end date that coincides with a regulatory report
date provides similar benefits. Such an approach allows the institution
to incorporate the results of the external auditing program into its
regulatory reporting process and, if appropriate, amend the regulatory
reports.
External Auditing Staff. The agencies encourage an institution to
engage an independent public accountant to perform its external
auditing program. An independent public accountant provides a
nationally recognized standard of knowledge and objectivity by
performing engagements under GAAS or GASAE. The firm or independent
person selected to conduct an external auditing program and the staff
carrying out the work should have experience with financial institution
accounting and auditing or similar expertise and should be
knowledgeable about relevant laws and regulations.

Special Situations

Holding Company Subsidiaries

When an institution is owned by another entity (such as a holding
company), it may be appropriate to address the scope of its external
audit program in terms of the institution's relationship to the
consolidated group. In such cases, if the group's consolidated
financial statements for the same year are audited, the agencies
generally would not expect the subsidiary of a holding company to
obtain a separate audit of its financial statements. Nevertheless, the
board of directors or audit committee of the subsidiary may determine
that its activities involve significant risks to the subsidiary that
are not within the procedural scope of the audit of the financial
statements of the consolidated entity. For example, the risks arising
from the subsidiary's activities may be immaterial to the financial
statements of the consolidated entity, but material to the subsidiary.
Under such circumstances, the audit committee or board of the
subsidiary should consider strengthening the internal audit coverage of
those activities or implementing an appropriate alternative external
auditing program.

Newly Insured Institutions

Under the FDIC Statement of Policy on Applications for Deposit
Insurance, applicants for deposit insurance coverage are expected to
commit the depository institution to obtain annual audits by an
independent public accountant once it begins operations as an insured
institution and for a limited period thereafter.

Institutions Presenting Supervisory Concerns

As previously noted, an external auditing program complements the
agencies' supervisory process and the institution's internal auditing
program by identifying or further clarifying issues of potential
concern or exposure. An external auditing program also can greatly
assist management in taking corrective action, particularly when
weaknesses are detected in internal control or management information
systems affecting financial reporting.
The agencies may require a financial institution presenting safety
and soundness concerns to engage an independent public accountant or
other independent external auditor to perform external auditing
services.<SUP>9</SUP> Supervisory concerns may include:
---------------------------------------------------------------------------

\9\ The Office of Thrift Supervision requires an external audit
by an independent public accountant for savings associations with a
composite rating of 3, 4, or 5 under the Uniform Financial
Institution Rating System, and on a case-by-case basis.
---------------------------------------------------------------------------

<bullet> Inadequate internal control, including the internal
auditing program;
<bullet> A board of directors generally uninformed about internal
control;
<bullet> Evidence of insider abuse;
<bullet> Known or suspected defalcations;
<bullet> Known or suspected criminal activity;
<bullet> Probable director liability for losses;
<bullet> The need for direct verification of loans or deposits;
<bullet> Questionable transactions with affiliates; or
<bullet> The need for improvements in the external auditing
program.
The agencies may also require that the institution provide its
appropriate supervisory office with a copy of any reports, including
management letters, issued by the independent public accountant or
other external auditor. They also may require the institution to notify
the supervisory office prior to any meeting with the independent public
accountant or other external auditor at which auditing findings are to
be presented.

Examiner Guidance

Review of the External Auditing Program

The review of an institution's external auditing program is a
normal part of the agencies' examination procedures. An examiner's
evaluation of, and any recommendations for improvements in, an
institution's external auditing program will consider the institution's
size; the nature, scope, and complexity of its business activities; its
risk profile; any actions taken or planned by it to minimize or
eliminate identified weaknesses; the extent of its internal audit
program; and any compensating controls in place. Examiners will
exercise judgment and discretion in evaluating the adequacy of an
institution's external auditing program.
Specifically, examiners will consider the policies, processes, and
personnel surrounding an institution's external auditing program in
determining whether:
<bullet> The board of directors or its audit committee adequately
reviews and approves external auditing program policies at least
annually.
<bullet> The external auditing program is conducted by an
independent public accountant or other independent auditor and is
appropriate for the institution.
<bullet> The engagement letter covering external auditing
activities is adequate.
<bullet> The report prepared by the auditor on the results of the
external auditing program adequately explains the auditor's findings.
<bullet> The external auditor maintains appropriate independence
regarding relationships with the institution under relevant
professional standards.

[[Page 57099]]

<bullet> The board of directors performs due diligence on the
relevant experience and competence of the independent auditor and staff
carrying out the work (whether or not an independent public accountant
is engaged).
<bullet> The board or audit committee minutes reflect approval and
monitoring of the external auditing program and schedule, including
board or committee reviews of audit reports with management and timely
action on audit findings and recommendations.

Access to Reports

Management should provide the independent public accountant or
other auditor with access to all examination reports and written
communication between the institution and the agencies or state bank
supervisor since the last external auditing activity. Management also
should provide the accountant with access to any supervisory memoranda
of understanding, written agreements, administrative orders, reports of
action initiated or taken by a federal or state banking agency under
section 8 of the FDI Act (or a similar state law), and proposed or
ordered assessments of civil money penalties against the institution or
an institution-related party, as well as any associated correspondence.
The auditor must maintain the confidentiality of examination reports
and other confidential supervisory information.
In addition, the independent public accountant or other auditor of
an institution should agree in the engagement letter to grant examiners
access to all the accountant's or auditor's workpapers and other
material pertaining to the institution prepared in the course of
performing the completed external auditing program.
Institutions should provide reports <SUP>10</SUP> issued by the
independent public accountant or other auditor pertaining to the
external auditing program, including any management letters, to the
agencies and any state authority in accordance with their appropriate
supervisory office's guidance.<SUP>11</SUP> Significant developments
regarding the external auditing program should be communicated promptly
to the appropriate supervisory office. Examples of those developments
include the hiring of an independent public accountant or other third
party to perform external auditing work and a change in, or termination
of, an independent public accountant or other external auditor.
---------------------------------------------------------------------------

\10\ The institution's engagement letter is not a ``report'' and
is not expected to be submitted to the appropriate supervisory
office unless specifically requested by that office.
\11\ When an institution's financial information is included in
the audited consolidated financial statements of its parent company,
the institution should provide a copy of the audited financial
statements of the consolidated company and any other reports by the
independent public accountant in accordance with their appropriate
supervisory office's guidance. If several institutions are owned by
one parent company, a single copy of the reports may be supplied in
accordance with the guidance of the appropriate supervisory office
of each agency supervising one or more of the affiliated
institutions and the holding company. A transmittal letter should
identify the institutions covered. Any notifications of changes in,
or terminations of, a consolidated company's independent public
accountant may be similarly supplied to the appropriate supervisory
office of each supervising agency.
---------------------------------------------------------------------------

Appendix A--Definitions

Agencies. The agencies are the Board of Governors of the Federal
Reserve System (FRB), the Federal Deposit Insurance Corporation
(FDIC), the Office of the Comptroller of the Currency (OCC), and the
Office of Thrift Supervision (OTS).
Appropriate supervisory office. The regional or district office
of the institution's primary federal banking agency responsible for
supervising the institution or, in the case of an institution that
is part of a group of related insured institutions, the regional or
district office of the institution's federal banking agency
responsible for monitoring the group. If the institution is a
subsidiary of a holding company, the term ``appropriate supervisory
office'' also includes the federal banking agency responsible for
supervising the holding company. In addition, if the institution is
state-chartered, the term ``appropriate supervisory office''
includes the appropriate state bank or savings association
regulatory authority.
Audit. An examination of the financial statements, accounting
records, and other supporting evidence of an institution performed
by an independent certified or licensed public accountant in
accordance with generally accepted auditing standards (GAAS) and of
sufficient scope to enable the independent public accountant to
express an opinion on the institution's financial statements as to
their presentation in accordance with generally accepted accounting
principles (GAAP).
Audit committee. A committee of the board of directors whose
members should, to the extent possible, be knowledgeable about
accounting and auditing. The committee should be responsible for
reviewing and approving the institution's internal and external
auditing programs or recommending adoption of these programs to the
full board.
Balance sheet audit performed by an independent public
accountant. An examination of an institution's balance sheet and any
accompanying footnotes performed and reported on by an independent
public accountant in accordance with GAAS and of sufficient scope to
enable the independent public accountant to express an opinion on
the fairness of the balance sheet presentation in accordance with
GAAP.
Engagement letter. A letter from an independent public
accountant to the board of directors or audit committee of an
institution that usually addresses the purpose and scope of the
external auditing work to be performed, period of time to be covered
by the auditing work, reports expected to be rendered, and any
limitations placed on the scope of the auditing work.
Examination of the internal control structure over financial
reporting. See Reporting by an Independent Public Accountant on an
Institution's Internal Control Structure Over Financial Reporting.
External auditing program. The performance of procedures to test
and evaluate high risk areas of an institution's business by an
independent auditor, who may or may not be a public accountant,
sufficient for the auditor to be able to express an opinion on the
financial statements or to report on the results of the procedures
performed.
Financial statement audit by an independent public accountant.
See Audit.
Financial statements. The statements of financial position
(balance sheet), income, cash flows, and changes in equity together
with related notes.
Independent public accountant. An accountant who is independent
of the institution and registered or licensed to practice, and holds
himself or herself out, as a public accountant, and who is in good
standing under the laws of the state or other political subdivision
of the United States in which the home office of the institution is
located. The independent public accountant should comply with the
American Institute of Certified Public Accountants' (AICPA) Code of
Professional Conduct and any related guidance adopted by the
Independence Standards Board and the agencies. No certified public
accountant or public accountant will be recognized as independent
who is not independent both in fact and in appearance.
Internal auditing. An independent assessment function
established within an institution to examine and evaluate its system
of internal control and the efficiency with which the various units
of the institution are carrying out their assigned tasks. The
objective of internal auditing is to assist the management and
directors of the institution in the effective discharge of their
responsibilities. To this end, internal auditing furnishes
management with analyses, evaluations, recommendations, counsel, and
information concerning the activities reviewed.
Outside directors. Members of an institution's board of
directors who are not officers, employees, or principal stockholders
of the institution, its subsidiaries, or its affiliates, and who do
not have any material business dealings with the institution, its
subsidiaries, or its affiliates.
Regulatory reports. These reports are the Reports of Condition
and Income (Call Reports) for banks, Thrift Financial Reports (TFRs)
for savings associations, Federal Reserve (FR) Y reports for bank
holding companies, and the H-(b)11 Annual Report for thrift holding
companies.
Reporting by an independent public accountant on an
institution's internal control structure over financial reporting.

[[Page 57100]]

Under this engagement, management evaluates and documents its review
of the effectiveness of the institution's internal control over
financial reporting in the identified risk areas as of a specific
report date. Management prepares a written assertion, which
specifies the criteria on which management based its evaluation
about the effectiveness of the institution's internal control over
financial reporting in the identified risk areas and states
management's opinion on the effectiveness of internal control over
this specified financial reporting. The independent public
accountant is engaged to perform tests on the internal control over
the specified financial reporting in order to attest to management's
assertion. If the accountant concurs with management's assertion,
even if the assertion discloses one or more instances of material
internal control weakness, the accountant would provide a report
attesting to management's assertion.
Risk areas. Those particular activities of an institution that
expose it to greater potential losses if problems exist and go
undetected. The areas with the highest financial reporting risk in
most institutions generally are their lending and investment
securities activities.
Specified procedures. Procedures agreed-upon by the institution
and the auditor to test its activities in certain areas. The auditor
reports findings and test results, but does not express an opinion
on controls or balances. If performed by an independent public
accountant, these procedures should be performed under generally
accepted standards for attestation engagements (GASAE).

By order of the Board of Directors.

Dated at Washington, DC this 15th day of October, 1999.