Risk Management Manual of Examination Policies - FDIC

INTERNAL ROUTINE AND CONTROLS Section 4.2
registered with the Securities and Exchange Commission
(SEC) or the appropriate Federal banking agency under
Section 12 of the Securities Exchange Act of 1934, i.e.,
public companies. Applicability of the Sarbanes-Oxley
Act to insured depository institutions depends, in large
part, on an institution’s size and whether it is a public
company or a subsidiary of a public company.
FDIC- Supervised Banks That Are
Public Companies or
Subsidiaries of Public Companies
Some FDIC-supervised banks have registered their
securities pursuant to Part 335 of the FDIC’s regulations
and are, therefore, public companies. Other FDICsupervised
banks are subsidiaries of bank holding
companies that are public companies. These public
companies and their independent public accountants must
comply with the Sarbanes-Oxley Act – including those
provisions governing auditor independence, corporate
responsibility and enhanced financial disclosures.
Non-public FDIC-Supervised Banks With
Less Than $500 Million in Total Assets
Non-public, FDIC-supervised banks that have less than
$500 million generally do not fall within the scope of the
Act. Nevertheless, certain provisions of the Act mirror
existing policy guidance related to corporate governance
issued by the FDIC and other banking agencies. Other
provisions of the Act represent sound corporate
governance practices; and although such practices are not
mandatory for smaller, non-public institutions, the FDIC
recommends that each institution consider implementation
to the extent possible, given the institution’s size,
complexity and risk profile.
Insured Depository Institutions With
$500 Million or More in Total Assets
Institutions that have $500 million or more in total assets
as of the beginning of their fiscal year are subject to the
annual audit and reporting requirements of Section 36 of
the FDI Act as implemented by Part 363 of the FDIC’s
Rules and Regulations. Some large institutions are also
public companies or subsidiaries of public companies, and
some institutions subject to Part 363 satisfy the
requirements of the Act on a holding company basis.
There are selected provisions of the Act that are applicable
to FDIC-supervised banks with $500 million or more in
total assets. For example, the auditor independence
requirements, management’s responsibility for financial
reporting and controls, and management’s assessment of
internal controls and accountant’s attestation on this
assessment are applicable for FDIC-supervised banks with
$500 million or more in total assets.
When performing a review of the Act and its applicability
to the institution being examined, examiners should refer to
outstanding guidance and, when necessary, should consult
with the Regional Accountant.
THE EXAMINER'S RESPONSIBILITIES
Examinations are not undertaken for the detection of fraud,
nor are their sole or primary purpose to assure the
complete correctness or appropriateness of records. The
overall assessment of a bank's system of internal control is,
however, an important examination function. In most
cases, such an appraisal can be accomplished by an overall
evaluation of the internal control system, a specific review
of audit systems and reports, performance of standard
examination procedures, and recommendations to
management. In some instances, all or a portion of a
bank's system of internal control may be deficient, or
management or the condition of a particular institution may
be such that more intensive audit tests, suited to the
particular circumstances and needs of the bank under
examination, should be undertaken. These matters are
discussed in a following section on possible audit
techniques.
These techniques may lead to an indication of possible
fraud or insider abuse. Such situations should be
thoroughly investigated by the examiner. Please refer to
the Bank Fraud and Insider Abuse section of this Manual
for further information.
Overall Evaluation of Internal Controls
The examiner's principal efforts should be focused on the
detection, exposure and correction of important
weaknesses in the bank's records, operating systems, and
auditing procedures. Information should be developed
through discussions with management and employees and
examiner observation of performance and procedures.
Each bank presents specific situations to which common
sense and technical knowledge must be applied. The
institution’s size, the number of employees, and the
character of the bank's operations must be considered in
any meaningful evaluation.
Specific Review of Audit Systems and Reports
The examiner's evaluation of internal/external audit
procedures and reports plays a key role in the overall
Internal Routine and Controls (12-04) 4.2-14 DSC Risk Management Manual of Examination Policies
Federal Deposit Insurance Corporation