 |
BOARD OF GOVERNORS |
|
|
DIVISION OF BANKING |
||
SR 96-27 (SUP) November 12, 1996 |
||
TO THE OFFICER IN CHARGE OF SUPERVISION AT EACH FEDERAL RESERVE BANK
Introduction This
letter sets forth policy guidelines for special audit procedures that are
to be implemented in situations where significant internal control weaknesses
are detected in U.S. branches or agencies of foreign banking organizations
(FBOs). The guidelines are intended to reduce the risk of losses due to
misconduct or fraud in the U.S. operations of FBOs and to promote prompt
correction of situations that can cause an unsafe and unsound banking environment. This
guidance furthers overall supervisory goals and is consistent with supervisory
policies applicable to all institutions supervised by the Federal Reserve
System. However, the guidelines set forth below are designed
specifically to deal with special considerations in supervising the U.S.
operations of FBOs, which arise due to the fact that U.S. supervisors generally
have authority for only a portion of an FBO--i.e., the offices located
in the United States. When to Require Special Audit Procedures The
supervisory evaluation of the adequacy of internal controls and operations
of a branch or agency is reflected in the operational controls (i.e., "O")
component of the ROCA rating system. The extent to which internal
control problems alone or in conjunction with problems in other areas may
adversely affect the overall condition of a branch or agency also is reflected
in the composite rating. Therefore, both the "O" component and
the composite rating should be used as guidelines in determining whether
special audit procedures are required to be implemented in a branch or
agency. The procedures outlined below should be required when
both the "O" rating and the composite rating are "3"
or worse, because such ratings indicate that the overall condition of the
branch or agency is less than satisfactory, and that, at least in part,
the problems are due to internal control weaknesses. The required
procedures should be coordinated with Board staff. Any departures
from the guidelines must be documented by the Reserve Bank responsible
for coordinating the supervision of the combined U.S. operations of the
FBO (the "coordinating Reserve Bank") and discussed with Board
staff. In
addition, significant internal control weaknesses in the operations of
an FBO at one office may be an indication that similar weaknesses exist
at other U.S. operations of the FBO, especially if other U.S. components
of the foreign bank are conducting business of the type in which weaknesses
were noted at a particular branch or agency. Therefore, the
coordinating Reserve Bank, in consultation with other federal and state
regulatory authorities, should determine whether the special audit procedures
should be applied to the other U.S. operations of the FBO.1
This decision must be documented and discussed with Board staff. Use of Internal Auditors In
some cases, it may be acceptable to have the special audit procedures performed
by the internal audit staff of the branch or agency. However, if the adequacy
of the internal audit function at a particular branch or agency is among
the reasons why internal controls are considered to be less than satisfactory,
the procedures must be conducted by regional or head office internal audit
staff or by external auditors. In the situations cited below,
the branch or agency will be required to engage external auditors to perform
the procedures. Use of External Auditors External
auditors are required to be used: (a)
when there are extremely serious deficiencies in internal controls, as
reflected in an "O" rating of "4" or worse, and the
composite rating is also "4" or worse; (b)
in cases where internal auditors had performed the special audit procedures
following the previous examination, and the current examination still demonstrates
that the branch or agency is in less than satisfactory condition (i.e.,
rated composite "3" or worse) and internal controls are again
rated "3" or worse; or (c)
in other situations, if the coordinating Reserve Bank, after consultation
with Board staff, other federal and state regulatory authorities, and the
home country supervisor, is of the opinion that the use of an external
auditor is necessary. This would usually occur when there are
significant concerns about the competence or independence of head office
internal audit staff. In
instances where it is determined that the use of an external auditor is
needed, it is the responsibility of the FBO to engage a qualified independent
public accountant and enter into a contract to perform the necessary work. The
scope of the audit should be agreed upon between the FBO and the Federal
Reserve. In this connection, in its engagement letter with the
FBO, the accountant would be expected to acknowledge that all substantive
information, including work papers, programs and procedures related to
the audit would be provided to the Federal Reserve upon request. Prior
to the commencement of the engagement, the coordinating Reserve Bank should
receive a copy of the engagement letter indicating its terms. Scope of Special Audit Procedures A
fundamental purpose of a special audit is to determine whether the internal
control weaknesses have already led to unreported losses and the extent
of any such losses. The other principal objective is to identify
the degree of internal control deficiencies and the risks posed to the
branch or agency so that management can implement appropriate corrective
action on both an interim and longer-term basis. In
order to determine if unreported losses have occurred, it is expected that
in all cases auditors will perform direct verification, usually on an appropriate
sample basis. These procedures may include direct observations,
interviews, confirmations with third parties, or other forms of direct
verification. While direct verification efforts should be focused
principally on those areas identified by the examiner as having significant
internal control weaknesses, there also should be some verification of
key accounts in other areas of the branch or agency that may have been
affected by these weaknesses. The
auditors also must determine the accuracy of reports filed by the branch
or agency with U.S. bank regulatory authorities. In all cases,
the auditors would perform sufficient tests to verify the items from the
Report of Assets and Liabilities of U.S. Branches and Agencies of Foreign
Banks (FFIEC 002) designated in the engagement letter, to related schedules
or source documents. These would include items related to the
areas where significant deficiencies in internal controls existed. For
example, if weaknesses were noted in internal controls in the letter of
credit department, the auditors would verify the relevant line items in
Schedule L of the FFIEC 002 report to source documents. The
auditors also will be expected to report on the type, nature and extent
of any significant internal control weaknesses found during the audit. This
should include a discussion of the interim steps management has taken to
minimize the risks to the branch or agency until comprehensive improvements
in the internal control environment can be implemented. The
review would be concentrated within the areas specifically criticized by
examiners; however, there should also be some review of internal controls
in other significant branch or agency operations. The
engagement letter for the audit should contain target dates for interim
and final reports. The coordinating Reserve Bank should monitor
the general progress of the audit and obtain a copy of the final report
upon its completion. The coordinating Reserve Bank should review
the report and discuss with the Board staff any additional steps that should
be taken. In addition, the coordinating Reserve Bank should
prepare a brief report of actions taken. Related Matters The
guidelines outlined in this letter, when relevant, should be implemented
as part of a supervisory action undertaken with an FBO. This
guidance is effective immediately and should be applied to all branches
and agencies currently under examination and in cases in which the Reserve
Bank is in the process of formulating a supervisory action resulting from
a recently completed examination. In addition, while this letter
discusses the guidelines in terms of branches and agencies of foreign banks,
the procedures outlined in this letter are applicable to all U.S. financial
operations of FBOs. The Federal Reserve is developing further
guidance as to the appropriate use of internal and external auditors in
conducting reviews of U.S. banking organizations when similar situations
arise. A
copy of this SR letter should be provided to the senior management of each
U.S. branch and agency of a foreign banking organization. Attached
is a draft transmittal letter that may be used for that purpose. If
you have any questions, please contact Joel Shapiro, Manager, International
Supervision Section at 202-452-2056 or Betsy Cross, Manager, International
Regulatory and Examination Policy Section at 202-452-2574.
As
you are aware, the Federal Reserve System has undertaken several recent
initiatives to enhance the supervision of the operations of U.S. branches
and agencies of foreign banking organizations. We believe that
these initiatives have provided more effective oversight of these offices. In
the ongoing review of the supervision program, the Federal Reserve has
determined that the use of internal or external auditors to address certain
significant supervisory concerns would enhance the supervisory process. The
attached guidelines have been developed to assist Reserve Banks in determining
when special audit procedures should be implemented. The guidelines
are intended to reduce the risk of losses due to misconduct or fraud and
to promote prompt correction of situations that can cause an unsafe or
unsound banking environment. The guidelines are consistent with supervisory
policies applicable to all institutions supervised by the Federal Reserve. Attached
for your information is a copy of the guidelines. Please contact_________________of
this Reserve Bank if you have any questions. Footnotes 1. This would include coordination with the OCC and FDIC if the foreign banking organization also has a national or state non-member bank subsidiary. Return to text |
