TO THE OFFICER IN CHARGE OF SUPERVISION
AT EACH FEDERAL RESERVE BANK
Introduction
Keeping pace with technological advances in the banking industry, financial
product innovation, and improvements in management systems and techniques requires that
supervisory procedures constantly evolve, especially with respect to the assessment of risk
management processes and internal controls. To meet this requirement, over the last several
years, the Federal Reserve has taken a number of steps to enhance the effectiveness of its
examinations and inspections by sharpening its focus on the areas of greatest risk to the
soundness of banking organizations. These efforts have been directed at adapting
examination and inspection processes so that they remain responsive to changing market
realities, while retaining those practices that have proven most successful in supervising
institutions under a variety of economic circumstances and industry conditions. The purpose
of this letter is to summarize and place in context these changes and suggest those broad
areas where further changes will occur.
Recent enhancements to the examination and inspection process stemming
from such initiatives include the development of guidance for the evaluation of the key risks of
complex trading and derivatives activities; the implementation of formal supervisory ratings for
risk management processes, including internal controls; and the initiation of a risk-based
framework for the assessment of U.S. branches and agencies of foreign banking
organizations.1 In addition, the Federal Reserve has initiated a number of projects discussed
below to further refine examination and inspection processes.
One such project was the formation under the aegis of the Strategic Plan
Steering Committee of the Rx21 Committee in May 1995. This Committee, which is
comprised of senior officials from Reserve Banks and the Board, has as its objective the
review of the examination process in order to identify near- and long-term opportunities to
enhance effectiveness, efficiency, and responsiveness to the changing and ever more
complex banking and financial environment. This group has made a number of
recommendations consistent with current System efforts to provide a more risk-focused
approach to the examination of banking organizations. Many of these recommendations are
reflected in this SR letter.
This letter sets forth the various techniques that have been adopted in recent
years to sharpen the focus on risk in the Federal Reserve's examinations and inspections of
state member banks, bank holding companies, and U.S. branches and agencies of foreign
banking organizations. Risk-focused supervisory reviews emphasize effective planning and
scoping in order to customize examinations and inspections to suit the size and activities of
financial institutions and to concentrate examiner resources on areas that expose an institution
to the greatest degree of risk. In addition, under a risk-focused approach, the resources
directed to assessing a banking organization's management processes are generally
increased, while the degree of transaction testing that is conducted during an examination or
inspection is adjusted depending on the quality of management practices and the materiality
of the activities or functions being reviewed. This approach results in comprehensive
examinations and inspections that minimize supervisory burdens by better focusing transaction
testing activities.2 An appropriate level of transaction testing, nonetheless, is still performed to
verify: (i) the adequacy of, and adherence to, internal policies, procedures, and limits; (ii) the
accuracy and completeness of management reports and financial records; and (iii) the
adequacy and reliability of internal control systems.
Overview of Examinations and Inspections
In its supervisory capacity, the Federal Reserve is responsible for promoting the
safe and sound operation of banking organizations and for ensuring stability in the overall
financial system. The System fulfills these responsibilities through a wide range of activities,
including the distribution of supervisory guidance to financial institutions' management and
directors, the review and approval of regulatory applications filed by banking organizations, the
monitoring and surveillance of banking activities, the conduct of on-site examinations and
inspections, the holding of meetings with the management and directors of financial
organizations, and, when warranted, the initiation of formal and informal enforcement actions
to require corrective actions by individual institutions. Most important among these activities,
however, are on-site safety and soundness examinations of state member banks, U.S.
branches and agencies of foreign banking organizations, and Edge and Agreement
corporations, and on-site inspections of bank holding companies and nonbank subsidiaries.
Examinations and inspections are intended primarily to evaluate the condition, management
processes, and prospects of financial institutions; to identify deficiencies that may threaten
their soundness; to assess compliance with applicable laws and regulations; and, when
necessary, to develop recommendations for corrective action.
Full-scope examinations and inspections under a risk-focused approach are not
comprised of a fixed set of routine procedures. Rather, the procedures that must be
performed to fulfill the objectives of a full-scope examination or inspection must be adjusted
depending on the circumstances of the institution being evaluated. At a minimum, however,
full-scope examinations conducted by the Federal Reserve should include sufficient
procedures to reach an informed judgment on the financial, managerial, operational, and
compliance factors rated under the CAMEL and ROCA rating systems, while full-scope
inspections should include sufficient procedures to assign ratings to the factors addressed by
the BOPEC rating system. The business of banking is fundamentally predicated on taking
risks and the components of the CAMEL, ROCA, and BOPEC rating systems are strongly
influenced by risk exposure. Consequently, the procedures of full-scope examinations and
inspections focus to a large degree on assessing the types and extent of risks to which a
banking organization is exposed, evaluating the organization's methods of managing and
controlling its risk exposures, and ascertaining whether management and directors fully
understand and are actively monitoring the organization's exposure to these risks. Given the
Federal Reserve's responsibility for assuring compliance with banking laws and regulations,
examinations and inspections also include an appropriate level of compliance testing.
Evolution of Examinations and Inspections
Historically, Federal Reserve examinations and inspections have placed
significant reliance on transaction testing procedures. For example, to evaluate the adequacy
of the credit administration process, assess the quality of loans, and ensure the adequacy of
the allowance for loan and lease losses (ALLL), a high percentage of commercial and
industrial (C&I) and commercial real estate loans traditionally have been individually reviewed.
Similarly, the assessment of the accuracy of regulatory reporting often has involved extensive
review of reconciliations of a banking organization's general ledger to the Call Report, Y-9C
report, or FFIEC 002 report. Other similar procedures typically have been completed to
ascertain compliance with applicable laws and regulations, to determine whether institutions
are following their internal policies and procedures, and to evaluate the adequacy of internal
control systems.
Transaction testing remains a reliable and essential examination technique for
use in the assessment of a banking organization's condition and the verification of its
adherence to internal policies, procedures, and controls. In a highly dynamic banking market,
however, such testing by itself is not sufficient for assuring the continued safe and sound
operation of financial institutions. Indeed, as evolving financial instruments and markets have
enabled banking organizations to rapidly reposition their portfolio risk exposures, it has
become clear that periodic assessments of the condition of financial institutions based on
transaction testing alone cannot keep pace with the moment-to-moment changes occurring in
financial risk profiles.
Consequently, in order to ensure that institutions have in place the processes
necessary to identify, measure, monitor, and control their risk exposures, examinations and
inspections have increasingly placed a greater emphasis on evaluating the appropriateness of
such processes and have been evolving away from a very high degree of transaction testing.
Under a risk-focused examination approach, the degree of transaction testing should be
reduced when internal risk management processes are determined to be adequate or risks
are considered minimal. It is important to note, however, that when risk management
processes or internal controls are considered inappropriate, such as when there is an
inadequate segregation of duties or when they are determined to be lacking as a result of on-site testing, additional transaction testing sufficient to fully assess the degree of risk exposure
in that function or activity must be performed. In addition, in the event that an examiner
believes that a banking organization's management is being less than candid, has provided
false or misleading information, or has omitted material information, then substantial on-site
transaction testing should be undertaken, and appropriate follow-up actions should be
initiated, including the requirement of additional audit work and appropriate enforcement
actions.
In most cases, full-scope examinations and inspections are conducted on or
around a single date. This is appropriate for the vast majority of institutions supervised by the
Federal Reserve. However, as the largest banking organizations have undergone
considerable geographic expansion and the range of their products has become more
diversified, it has become increasingly difficult to coordinate the efforts of the large number of
examiners necessary to conduct examinations and inspections at a single point in time for
these organizations without causing undue burden. Accordingly, full-scope examinations or
inspections for many large companies are now conducted over the course of a year, rather
than over a span of weeks, in a series of targeted reviews focusing on one or two significant
aspects of the institution's operations. This approach to conducting full-scope examinations
and inspections has the advantage of providing more continuous supervisory contact with the
largest institutions and may facilitate improved coordination with other federal banking
agencies. It also facilitates more flexibility in the allocation of examiner resources. This
flexibility in allocating resources has been especially important as the complexity of banking
markets and products has increased and has led to the development of cadres of examiners
with specialized skills.
As the speed with which financial institutions can reconfigure their balance
sheets has accelerated, the Federal Reserve has also supplemented its techniques for off-site
monitoring of the condition of financial institutions between on-site examinations and
inspections. For instance, within the last two years, the surveillance programs for banks and
bank holding companies have both been considerably improved through the adoption of a
more rigorous screening technique for the identification of troubled institutions and specialized
screens to evaluate investment activities.3 At many Reserve Banks, these improvements in
the surveillance system have been accompanied by efforts to increase the role of Reserve
Bank monitoring staffs in the assessment of banking trends, the development of supervisory
strategies, and the administration of outstanding enforcement actions.
Several Reserve Banks have also adopted a portfolio management approach in
which one person is assigned responsibility for monitoring, and overseeing the supervision of,
a selected group of institutions. Such portfolio management structures facilitate ongoing
communication between Reserve Banks and financial institutions, which results in greater
familiarity with developments at supervised organizations. This ongoing communication is
particularly useful in planning and implementing risk-oriented supervisory strategies for
institutions engaged in the most dynamic and complicated financial activities.
In addition, the Federal Reserve, together with the other federal banking
agencies, has also actively promoted sound disclosure and accounting standards, particularly
for newer products and services. Recent efforts in this area include revisions to publicly
available regulatory reports to collect additional information on trading activities, derivatives,
structured notes, mortgage securities, and mutual funds and investment management activity.
Furthermore, the Federal Reserve has consistently advocated improvement in public annual
report disclosures about trading activities and, more broadly, about credit and market risks.
Such information can allow market discipline to foster sound practices at financial institutions,
without requiring direct regulatory intervention. Risk-focused Examinations and Inspections
The Federal Reserve has long relied on examiners to demonstrate the
judgment, expertise, and initiative necessary to select the procedures appropriate to the
evaluation of the risks faced by each institution. Recent developments in the business of
banking that have increased the range of activities at many financial institutions and
correspondingly heightened demands on examiner resources have made the need for
examiners to effectively focus their activities on areas of the greatest risk even more crucial.
Recent experience and surveys of bankers and examiners conducted by the Rx21 group have
further suggested areas in which efficiencies can be gained in conducting on-site
examinations and inspections through improved planning. As a result, many Reserve Banks
have been increasing the amount of time available to plan and prepare for examinations and
inspections. In-office planning results in more effective examinations and inspections that are
focused on risks particular to specific institutions and, thus, minimizes supervisory burdens.
Further, such planning facilitates the close coordination of the efforts of the Federal Reserve
with those of the other state and federal banking agencies. Moreover, consistent with SR 95-13, "Recommendations to Increase the Portion of Examinations and Inspections Conducted in
Reserve Bank Offices," this planning allows information requests to be better tailored to
specific institutions and, in many cases, makes possible the completion on Reserve Bank
premises of certain procedures that have typically been conducted on-site. This, too, can help
reduce supervisory burden without compromising the quality of the evaluation process.
Risk Assessment
In order to focus procedures on the areas of greatest risk to financial
institutions, a risk assessment should be performed in advance of on-site supervisory
activities. The risk assessment process highlights both the strengths and vulnerabilities of an
institution and provides a foundation from which to determine the procedures to be conducted
during an examination or inspection. Risk assessments entail the identification of the financial
activities in which a banking organization has chosen to engage; the determination of the
types and quantities of risks to which these activities expose the institution; and the
consideration of the quality of the management and control of these risks. At the conclusion
of the risk assessment process, a preliminary supervisory strategy for the institution and each
of its major activities can be formulated. Naturally, those activities that are most significant to
the organization's risk profile or that have inadequate risk management processes or
rudimentary internal controls represent the highest risks to the institution and should undergo
the most rigorous scrutiny and testing.
Identifying the significant activities of an institution, including those conducted
off-balance sheet, should be the first step in the risk assessment process. These activities
may be identified through the review of prior examination and inspection reports and
workpapers; surveillance and monitoring reports generated by Board and Reserve Bank staffs;
Uniform Bank Performance Reports and Bank Holding Company Performance Reports;
regulatory reports (e.g., Call Report, Y9-C, FFIEC 002); and other relevant supervisory
materials. Where appropriate, reviews should also be conducted of strategic plans and
budgets; internal management reports; board of directors information packages;
correspondence and minutes of meetings between the banking institution and the Reserve
Bank; annual reports and quarterly SEC filings; press releases and published news stories;
and stock analysts' reports. In addition, examiners should also hold periodic discussions with
management to gain insight into their latest strategies or plans for changes in activities or
management processes.
Once significant activities have been identified, the types and quantities of risks
to which these activities expose the institution should be determined. This allows identification
of the high risk areas that should be emphasized in conducting examinations and inspections.
The types of risk that may be encountered in banking activities individually or in various
combinations include, but are not limited to, credit, market, liquidity, operational, legal and
reputational risks4. For example, lending activities are a primary source of credit and liquidity
risks. They may also, however, present considerable market risk if an institution is originating
mortgage loans for later resale, interest rate risk if an institution is granting fixed-rate loans, or
legal risk if loans are poorly documented. Similarly, the asset/liability management function
has traditionally been associated with exposures to interest rate and liquidity risks. There are
also, however, operational risks associated with many of the transactions undertaken by this
function and other market risks associated with investments and hedging instruments
commonly used by the function. The quantity of risks associated with a given activity may be
indicated by the volume of assets and off-balance sheet items that the activity represents or
the portion of revenue for which the activity accounts. Activities that are new to an institution
or for which exposure is not readily quantified, however, may also represent high risks to an
institution that should be evaluated at examinations and inspections.
A number of analytical techniques may be used to estimate the quantity of risk
exposure depending on the activity or risk type being evaluated. For example, in order to
assess the quantity of credit risk in loans and commitments, the level of past due loans,
internally classified or watch list loans, nonperforming loans, and concentrations of credit
exposure to particular industries or geographic regions should be considered. In addition, as
part of the assessment of credit risk, the adequacy of the overall ALLL may be evaluated by
considering trends in past due, special mention, and classified loans; historic chargeoff levels;
and the coverage of nonperforming loans by the ALLL. Analytical techniques for gauging the
exposure of a banking institution to interest rate risk as part of the evaluation of asset/liability
management practices may include a review of the historic performance of net interest
margins, as well as the results of internal projections of future earnings performance or net
economic value under a variety of plausible interest rate scenarios. The measurement of the
quantity of market risk arising from an institution's trading in cash and derivative instruments
may take into account the historic volatility of trading revenues, the results of internal models
calculating the level of capital and earnings at risk under various market scenarios, and the
market value of contracts relative to their notional amounts.
Once the types and quantities of risk in each activity have been identified, a
preliminary assessment of the process in place to identify, measure, monitor, and control
these risks should be completed. This evaluation should be based on findings from previous
examination activities conducted by the Reserve Bank or the other banking agencies,
supplemented by the review of internal policies and procedures, management reports, and
other documents that provide information on the extent and reliability of internal risk
management systems. As described in SR 95-51, sound risk management processes vary
from institution to institution, but generally include four basic elements both for each individual
financial activity or function and for the organization in aggregate. These are: active board
and senior management oversight; adequate policies, procedures, and limits; adequate risk
measurement, monitoring, and management information systems; and comprehensive internal
audits and controls.
The preliminary evaluation of the risk management process for each activity or
function also assists in determining the extent of transaction testing that should be planned for
each area. If the process appears appropriate and reliable, then a limited amount of
transaction testing may well suffice. If, on the other hand, the risk management process
appears inappropriate or inadequate to the types and quantities of risk in an activity or
function, examiners should plan a much higher level of transaction testing. They should also,
of course, plan to conduct the most testing in those areas that comprise the most significant
portions of a banking organization's activities and, thus, typically represent high potential
sources of risk.
Preparation of a Scope Memorandum
Once the examination planning and risk assessment processes are completed,
a scope memorandum should be prepared. A scope memorandum provides a detailed
summary of the supervisory strategy for an institution and assigns specific responsibilities to
examination team members. A scope memorandum should be tailored to the size and
complexity of the institution subject to review, should define the objectives of each
examination or inspection, and generally should include:
For large, complex organizations operating in a number of states, or
internationally, the planning and risk assessment processes are necessarily more complicated.
As a result, many Reserve Banks have broadened the traditional scope memorandum into a
more extensive set of planning documents to reflect the unique requirements of these complex
institutions. Examples of these planning documents include annual consolidated analyses,
periodic risk assessments, and supervisory plans.
On-site Procedures
As discussed above, the amount of review and transaction testing necessary to
evaluate particular functions or activities of a banking organization generally depend on the
quality of the process used by the institution to identify, measure, monitor, and control the
risks of the activity. When the risk management process is considered sound, then further
procedures are limited to only a relatively small number of tests of the integrity of the
management system. Once the integrity of the management system is verified through limited
testing, conclusions on the extent of risks within the function or activity are drawn based on
internal management assessments of those risks rather than on the results of more extensive
transaction testing by examiners. On the other hand, if initial inquiries into the risk
management system--or efforts to verify the integrity of the system--raise material doubts as to
the system's effectiveness, then no significant reliance should be placed on the system and a
more extensive series of tests should be undertaken to ensure that the banking organization's
exposure to risk from a given function or activity can be accurately gauged and evaluated.
More extensive transaction testing is also generally completed for activities that are very
significant to an institution than for other areas, although the actual level of testing for these
significant activities may be reduced commensurate with the quality of internal risk
management processes.
For example, given the risk exposure associated with a bank's commercial
lending activities, a relatively high number and dollar volume of C&I and commercial real
estate loans has traditionally been reviewed.5 However, if credit administration practices are
considered satisfactory, fewer loans need be reviewed to verify that this is the case than
would be reviewed if deficiencies in credit administration practices were suspected. This
review may be achieved through a valid statistical sampling technique, when appropriate. It
should be noted, though, that if credit administration practices are considered sound, but loans
reviewed to verify this raise doubts about the accuracy of internal assessments or the
compliance with internal policies and procedures, then the number and volume of loans
subject to review should generally be expanded to ensure that the level of risk is clearly
understood, an accurate determination of the adequacy of the ALLL can be made, and the
deficiencies in the credit risk management process can be comprehensively detailed.
Evaluation of Audit Function as Part of Assessment of Internal Control Structure
An institution's internal control structure is critical to the safe and sound
functioning of the organization in general and to its risk management system in particular.
When properly structured, internal controls promote effective operations and reliable financial
and regulatory reporting, safeguard assets, and help to ensure compliance with laws,
regulations, and internal policies and procedures. In many institutions, internal controls are
tested by an independent internal auditor who reports directly to the board of directors or its
audit committee. However, in some smaller institutions whose size and complexity of
operations do not warrant an internal audit department, reviews of internal controls may be
conducted by other institution personnel independent of the area subject to review.
Because the audit function is an integral part in the institution's own
assessment of its internal control system, examiners must include a review of the institution's
control assessment activities in every examination and inspection. Such reviews assist in the
identification of significant risks and facilitate a comprehensive evaluation of an institution's
internal control structure. These reviews also provide information for determining the
procedures to be completed in assessing internal controls for particular functions and activities
and for the institution overall. When conducting such a review, examiners should evaluate the
independence and competence of the personnel conducting control assessments and the
effectiveness of the assessment program in covering the institution's significant activities and
risks. In addition, examiners should meet with the internal auditors or other personnel
responsible for evaluating internal controls and review internal control risk assessments, work
plans, reports, workpapers, and related communications with the audit committee or board of
directors.
Depending on the size and complexity of the activities conducted by the
institution, the examiner should also consider conducting a similar review of the work
performed by the institution's external auditors. Such a review often provides added insight
into key risk areas by detailing the nature and extent of the testing of those areas that have
been conducted by auditors in the course of their work.
Evaluation of Overall Risk Management Process
In order to highlight the importance of an institution's risk management process,
banks and bank holding companies are assigned a risk management rating on a five point
scale as a significant part of the evaluation of the management components of the CAMEL
and BOPEC rating systems (see SR 95-51). In addition, U.S. branches and agencies of
foreign banking organizations are assigned a similar rating under the ROCA rating system6.
These risk management ratings encompass evaluations of the quality of risk management
processes for all significant activities and all types of risks. As such, they may largely reflect a
summation of conclusions on the adequacy of risk management processes for each individual
function or activity evaluated.
In assigning these risk management ratings, however, it is also important to
consider the quality of the risk management process for the institution overall, as well for each
individual function. At smaller organizations engaged in traditional banking activities, relatively
basic risk management processes established for each significant activity, such as lending or
asset/liability management, may be adequate to allow senior management to manage
effectively the overall risk profile of the organization. On the other hand, at larger institutions
that are typically engaged in more complex and widely diversified activities, effective risk
management systems must evaluate various functional management processes in
combination so that aggregate risk exposures can be identified and monitored by senior
management. This typically requires that management information reports be generated for
the overall institution, as well as for individual functional areas, and typically necessitates
some aggregate or specific institution-wide limits for the principal types of risks relevant to the
company's activities.
Further, since a critical aspect of ensuring that risk management and control
procedures remain adequate is ongoing testing of the strength and integrity of procedures and
the extent to which they are understood and followed throughout an institution, examiners
should also assess the adequacy of efforts to ensure that procedures are being followed when
assigning a risk management rating. Such validation efforts must be conducted by individuals
who have proper levels of organizational independence and expertise, such as internal or
external auditors, internal risk management units, or managers or other professionals within
the institution with no direct connection to activities for which procedures are being assessed.
Evaluation of Compliance with Laws and Regulations
Compliance with relevant laws and regulations should be assessed at every
examination and inspection. The steps taken to complete these assessments, however, will
vary depending on the circumstances of the institution subject to review. When an institution
has a history of satisfactory compliance with relevant laws and regulations or an effective
compliance function, only a relatively limited degree of transaction testing need be conducted
to assess compliance. For example, in evaluating compliance with the appraisal requirements
of Regulation H at an institution with a formal compliance function, compliance may be
ascertained by reviewing the scope and findings of internal and external audit activities,
evaluating internal appraisal ordering and review processes, and sampling a selection of
appraisals for compliance as part of the supervisory loan review process. On the other hand,
at institutions that have a less satisfactory compliance record or that lack a compliance
function, more appraisals would naturally need to be tested to assess the overall compliance
with the appraisal requirements of Regulation H.
Documentation of Supervisory Findings
Workpaper documentation of supervisory findings is necessary for Reserve
Bank management to verify objectively the work performed during examinations and
inspections. It also provides a source of information on the condition and prospects of an
institution that is invaluable to the planning of future reviews. Most important, however, this
documentation provides support for the conclusions and recommendations detailed in
examination and inspection reports. Given the importance of adequate documentation, the
Federal Reserve has for some time been working to refine its standards for workpapers,
particularly with regard to the examination of state member banks. Additional enhancements
in documentation standards are likely to be developed in coming months to balance the
requirement for consistent and comprehensive documentation with the need for flexibility in
supervisory procedures.
Communication of Supervisory Findings
Effective and open communication between supervisors and financial
institutions is essential to ensuring that banking organizations understand fully the results of
examinations and inspections, are aware of any identified deficiencies, and, when necessary,
take appropriate corrective actions. The Federal Reserve has established a number of
standards for the communication of supervisory findings to the management and directors of
financial institutions.7
In order to ensure that supervisory findings are communicated to financial
institutions in a concise and effective manner, the Federal Reserve has also consistently
directed its examiners to focus supervisory report comments on the discussion of material
deficiencies. During recent years, communication guidelines have been further refined
through the adoption of a combined examination and inspection report for bank holding
companies with lead state member banks and through revisions designed to streamline and
better focus the bank holding company inspection report.8 In light of the increasing risk focus
of examinations and inspections, the Federal Reserve is continuing to review its report formats
in order to identify opportunities for further enhancements.
Other Enhancements to Examinations and Inspections
While the Federal Reserve's current supervisory processes are comprehensive
and tested, further enhancements will likely be warranted to ensure that they remain adequate
as innovation and technological change continue within the banking industry. As a result, the
Federal Reserve has initiated several projects designed to identify its key supervisory
challenges and to determine the additional steps that must be taken. As noted above, the
Rx21 group was established by the System's Strategic Plan Steering Committee and charged
with developing specific recommendations to help preserve the best aspects of the existing
examination process, while identifying ways to improve its effectiveness and efficiency in light
of the rapid pace of changes occurring in the financial services industry.
Consistent with the steps that have already been taken, the supervisory
initiatives that are currently underway, and the dramatic changes continuing to take place in
the banking industry, our efforts to make the supervisory/examination function more risk-focused, process-oriented, and burden sensitive will continue and, where appropriate, be
accelerated. The supervision function's strategic planning exercise, as well as discussions
within the Federal Reserve and with the other banking agencies, have identified the following
general areas where further efforts and initiatives could yield potentially fruitful results in terms
of sharpening the efficiency, effectiveness, and risk-orientation of the examination process:
The Federal Reserve will work internally, as well as with the other federal and state banking
and financial institution regulators, to achieve further improvements and enhancements in
each of these areas.
The Federal Reserve has already undertaken major initiatives to improve and
standardize the use of technology by its examiners. This includes the development of an
Examiner Workstation that automates many functions of the supervisory loan review process
and an automated workpaper system that facilitates more efficient planning and more effective
documentation of examination activities. In addition, the Federal Reserve has undertaken a
major reengineering of its trust examination process to sharpen its risk focus9. Moreover, to
ensure that examiners remain adequately trained, the Federal Reserve is also augmenting its
training programs for examiners to provide additional grounding in internal controls, greater
expertise in the assessment of bank's use of information system technology, and further
opportunities for the development of specialized skills and areas of expertise.
In addition, a number of initiatives are underway to increase coordination with
other banking agencies. For example, for some time, the Federal Reserve has been working
with the Conference of State Bank Supervisors, the Federal Deposit Insurance Corporation,
and several state banking agencies to develop a seamless, risk-focused, and consistent
supervisory program for state-chartered banks. These efforts recently came to fruition with
the adoption of the State/Federal Supervisory Protocol. The Federal Reserve has also been
working with these agencies to streamline current application procedures for state-chartered
banks, adopt common information technologies and supervisory systems, and coordinate
training efforts. Moreover, the federal banking agencies are currently developing
implementation procedures for a unified examination approach mandated by section 305 of
the Riegle Community Development and Regulatory Improvement Act of 1994. Effective
coordination with the state banking departments and the other Federal banking agencies will
remain a very high priority of the Federal Reserve's supervisory program.
Conclusion
In summary, the Federal Reserve has made considerable progress in adapting
its supervisory approach to focus appropriately on the management of risks in new and
significant banking activities. However, additional modifications clearly will be required to
adjust further to changes occurring in the financial services industry. Supervisory policies and
practices that were developed for less dynamic market environments and that may not fully be
consistent with a risk-focused approach will need to be changed or revised. Further,
additional steps may be needed to develop guidance on the procedural details of the risk-focused approach to ensure consistent application across the System. In refining its
examination process, however, the Federal Reserve does not intend to eliminate transaction
testing procedures, but rather will seek to achieve an optimal mix of transaction testing and
risk management process reviews for facilitating the continuous safe and sound operation of
state member banks, bank holding companies, and U.S. branches and agencies of foreign
banking organizations.
Reserve Banks are asked to see that each examiner receives a copy of this SR
letter. Should you have any questions regarding this letter, please contact Roger Cole,
Deputy Associate Director, at (202) 452-2618, or Kevin Bertsch, Supervisory Financial Analyst,
at (202) 452-5265.
Director
Cross-References:
Commercial Bank Examination Manual
Footnotes 1. Guidance to examiners on the evaluation of trading and derivatives activities is provided in SR 93-69, "Examining Risk Management and Internal Controls for Trading Activities of Banking Organizations;" SR 95-17, "Evaluating the Risk Management and Internal Controls of Securities and Derivative Contracts Used in Nontrading Activities;" and the Federal Reserve's Trading Activities Manual. The Federal Reserve's ratings for risk management are described in SR 95-22, "Enhanced Framework for Supervising the U.S. Operations of Foreign Banking Organizations," and SR 95-51, "Rating the Adequacy of Risk Management Processes and Internal Controls at State Member Banks and Bank Holding Companies." SR 95-22 details the risk-oriented approach followed in supervising the U.S. operations of foreign banking organizations. Return to text 2. For purposes of this letter, transaction testing is defined to include not only the reconciliation of internal accounting records to financial reports (in order to evaluate the accuracy of account balances) and the comparison of day-to-day practices to the requirements of policies and procedures (in order to assess compliance with internal systems), but also all other supervisory testing procedures, such as the review of the quality of individual loans and investments. Return to text 3. See SR 94-32, "Revised Bank Surveillance Procedures;" SR 95-33, "Incorporation of an Investment Activities Screen into the Bank Surveillance Program;" and SR 95-43, "Revised Bank Holding Company Surveillance Procedures." Return to text 4. These primary risk types are defined in an attachment to this letter. Return to text 5. Current guidance on the selection of loans for review is provided in SR 94-13, "Loan Review Requirements for On-site Examinations." This guidance is now being reviewed by a committee of senior Board and Reserve Bank officials as part of the Federal Reserve's efforts to optimize the efficiency and effectiveness of its examination process. Return to text 6. U.S. branches and agencies of foreign banking organizations are also assigned a separate rating for operational controls under guidance included in SR 95-22. Return to text 7. See SR 85-28, "Examination Frequency and Communicating with Directors," SR 95-12, "Revisions to Guidance for the Preparation of the Bank Holding Company Inspection and Bank Examination Reports and for the Preparation and Issuance of Director's Summaries of Examination/Inspection Findings," and SR 95-19, "Revisions to Guidance on Meetings with Boards of Directors." Return to text 8. See SR 94-46, "Combined Examination/Inspection Report for Bank Holding Companies with Lead State Member Banks." Return to text 9. See SR 96-10, "Risk-focused Fiduciary Examinations." Return to text |
||||||||||||||||||||||||||||||||||||||
