Supervisory Committee Audits and Verifications

---

SUMMARY: The National Credit Union Administration (NCUA) is proposing

to amend its regulations governing credit union supervisory committee

audits and verifications. The NCUA Board is proposing to amend the

regulations to clarify existing audit scope; expand audit scope and

reporting requirements in certain areas; clarify existing working paper

access requirements and strengthen administrative remedies for denial

of access; require a comprehensive engagement letter setting forth

minimum contracting terms and conditions; and add relevant definitions

of accounting/auditing terms used throughout the regulation.

DATES: Comments must be received on or before January 2, 1996.

ADDRESSES: Send comments to Becky Baker, Secretary of the Board,

National Credit Union Administration Board, 1775 Duke Street,

Alexandria, VA 22314-3428.

FOR FURTHER INFORMATION CONTACT: Karen Kelbly, Accounting Officer,

Office of Examination and Insurance (703) 518-6360, or Michael McKenna,

Attorney, Office of General Counsel (703) 518-6540, at the above

address.

SUPPLEMENTARY INFORMATION:

Background

On March 25, 1993, the NCUA Board issued for public comment a

proposed amendment to the ``then'' supervisory committee audit and

verification requirements. Two hundred two comment letters were

received over a 60-day comment period which ended June 7, 1993. Thirty-

one commenters gave their full support of the amendment as written;

fifty-three commenters offered mixed support; and one hundred eighteen

commenters opposed the amendment.

In their final amendment, the NCUA Board changed the regulations

governing supervisory committee audits and verification to: (1) Add a

nonstatistical sampling option for independent, licensed, certified

public accountants in the verification of members' accounts consistent

with applicable generally accepted auditing standards (GAAS); and (2)

change applicable sections of the ``then'' regulation to more properly

reflect accounting/auditing terms of art without otherwise changing the

intent of the regulation. Dropped from consideration in the final

amendment were the proposed amendments to require independent annual

audits (opinion audits) for federally insured credit unions with assets

exceeding $50 million, and to require that the supervisory committee

and/or its auditors provide NCUA the option to photocopy working papers

supporting the audit.

Since July 1993 when Sec. 701.12 was last amended, NCUA has had

continued concerns about the scope of the supervisory committee audit.

Many of these concerns are outlined in specific detail below. Rather

than again proposing an amendment for an opinion audit requirement,

which many commenters soundly rejected in their comment letters on the

last proposed amendment, the Board wishes to solicit views on a

proposed revision to the current regulation which expands audit scope

without requiring an opinion audit. This proposal is an opportunity to

consider a middle ground approach, with the goal of building a

consensus that both the regulated and the regulator would find

agreeable.

Currently, Sec. 701.12, 12 C.F.R. 701.12, sets forth the

supervisory committee's responsibility in meeting the audit and

verification requirements of section 115 of the Federal Credit Union

Act, 12 U.S.C. 1761d. A supervisory committee audit is required at

least once every calendar year covering the period since the last

audit. The scope of the audit must be sufficient, at a minimum, to test

the federal credit union's assets, liabilities, equity, income, and

expenses for existence, proper cut off, valuations, ownership,

disclosures and classification, and internal controls (current

Sec. 701.12(b)). A written report on the audit must be made to the

board of directors and, if requested, NCUA (current Sec. 701.12(c)).

Working papers must be maintained and made available to NCUA (current

Sec. 701.12(c)). Independence requirements must be met (current

Sec. 701.12(d)); standards governing verifications--100 percent

verification or statistical sampling--are set forth (current

Sec. 701.12(e)). Section 741.2 makes these requirements applicable to

federally insured state-chartered credit unions.

The proposed regulation will address practical enforcement problems

in the existing regulation, some of which have arisen through the

examination process as a matter of course and others of which have

arisen in litigation and in negotiating settlements. The proposed

changes in audit scope represent increased requirements which the Board

believes have grown out of necessity. The scope changes are more

specific and are aimed at eliminating vagueness regarding the audit

scope required, in certain targeted risk areas, to meet the provisions

of this regulation. The vagueness of audit scope has been the subject

of complaints from both the regulated and the regulator/insurer.

The majority of added requirements are not applicable to credit

unions which do not employ a compensated auditor. If the supervisory

committee or an uncompensated designated representative will be

performing the supervisory committee audit as described in

Sec. 701.12(4)(iv), the following portions of the proposed regulation

do not apply to the supervisory committee audit: Sec. 701.12(c)(3)

[increased scope requirements in designated areas];

Sec. 701.12(4)(i)(A)-(C) [opinion audits and agreed-upon-procedures in

relation to compensated auditors]; and Sec. 701.12(d) [engagement

letter requirements].

Proposed Regulation

Added to the first part of proposed Sec. 701.12(a) is a set of

definitions for terms used in the regulation. Many of these terms,

while familiar to accounting/auditing professionals, may be less well

known to supervisory committee volunteers. For example, the definition

of ``audit'' is intended to closely follow the language in AICPA,

Professional Standards, volume 1, AU

[[Page 55664]]

section 110.01; the definition of ``independence'' is intended to be

consistent with Rule 101 of the AICPA Code of Professional Conduct; the

definition of ``related party transactions'' is intended to be

consistent with FASB Statement No. 57; and the definition of ``internal

control reportable conditions'' is intended to be consistent with

Statement of Auditing Standard (SAS) No. 60, Communication of Internal

Control Structure Related Matters Noted in an Audit (AICPA,

Professional Standards, volume 1, AU section 325).

Additionally, as concerns ``independence,'' the auditor must be

intellectually honest and be recognized as independent, i.e., free from

any material obligation to or interest in the credit union or its

officials. The independent auditor must enjoy the confidence of the

general public. Such confidence may be compromised by evidence that

independence is lacking, or by the existence of circumstances which

reasonable people might believe likely to influence independence. The

definition of ``related party transactions'' uses as examples of senior

management the chief executive officer (CEO), president, treasurer/

manager, assistant CEO, and the chief financial officer (Comptroller)

of a credit union, and their families, etc. However, this is not

intended to be an all inclusive list of related parties.

The proposed definitions rely on accepted supplemental references,

e.g., a reference for the definition of ``generally accepted accounting

principles'' is SAS No. 69, The Meaning of ``Present Fairly in

Conformity With Generally Accepted Accounting Principles'' in the

Independent Auditor's Report which establishes a GAAP hierarchy (GAAP

serves to provide a standard by which to measure financial statement

presentations); a reference for the definition of ``internal controls''

is Internal Control--Integrated Framework, published by the Committee

of Sponsoring Organizations of the Treadway Commission; and a reference

for the definition of ``illegal acts'' is SAS No. 54, Illegal Acts By

Clients, (AICPA, Professional Standards, volume 1 AU section 317). The

definitions section was added to elucidate terms used in the

regulation. The NCUA Board seeks comments as to whether the definitions

clarify the regulation. The NCUA Board also is interested to learn of

any additional terms which should be defined in the regulation.

Subsections 701.12(b)(1), (b)(2), and (c)(1), (c)(2) of the

proposed regulation represent a reordering of the existing regulatory

provisions with minor changes in language which are intended not to

change, but to clarify, the existing regulation's meaning or

provisions. However, the supervisory committee is expected to conduct

such further tests and reviews as may, in the committee's judgment, be

necessary to meet its responsibilities. Additionally, the changes

incorporate in part enhancements suggested by the American Institute of

Certified Public Accountants, Credit Unions Committee (``the AICPA

Committee''). The AICPA Committee reviewed the proposed regulation for

technical accuracy of usage of accounting/auditing technical terms and

concepts. NCUA is grateful to the AICPA Committee for its advice during

the drafting of the proposed regulation.

The audit scope changes added to Sec. 701.12(c)(3) expand the

required audit scope when a supervisory committee employs the services

of a compensated auditor. The additional requirements are not intended

to discourage a credit union from hiring a compensated auditor, but are

intended to achieve a more definitive audit scope in targeted areas,

which experience indicates are of higher risk in credit unions. The

AICPA audit guide, Audits of Credit Unions, prepared by the AICPA

Credit Unions Committee, is a proper reference for the auditor in

making judgments, based on the facts and circumstances of the

engagement, as to what procedures to perform to obtain sufficient,

competent evidential matter to afford a reasonable basis for

conclusions regarding the financial statements under audit. The NCUA

Board believes the expanded scope will provide those credit unions

having the resources to employ a compensated auditor with an enhanced

audit product that meets the applicable GAAS requirements of an opinion

audit in the following areas: internal controls; cash; loans and

interest thereon; investments and interest thereon; shares and

dividends and/or interest thereon; related party transactions; and the

detection and reporting of errors and irregularities. NCUA believes

this increased scope requirement not only will give the credit union a

greater return on the dollars invested in the audit, but will result in

a more useful audit report for the examiner, whether regulator or

insurer.

The more definitive audit scope is designed to address and to

reduce confusion which occurs when the supervisory committee and the

compensated auditor agree that the audit engagement will consist of

less than the full scope of a supervisory committee audit as prescribed

in 701.12 (b) and (c). Experience indicates that supervisory committees

often do not realize that, due to the compensated auditor's exclusion

of scope provisions (e.g., evaluation of the reasonableness of the

allowance for loan losses, evaluation of securities held, adequacy of

loan collateral, etc.), the final audit product is not a complete

supervisory committee audit. Nor do supervisory committees realize that

in such instances they remain responsible for performing the additional

audit work needed to ``fill the gaps'' and produce a complete

supervisory committee audit. The NCUA Board believes that vagueness in

the existing audit scope provision may have contributed to the

confusion, and that a more definitive audit scope will end the finger

pointing between supervisory committees and compensated auditors as to

who is responsible for the audit scope components excluded from the

audit engagement.

To further reduce confusion about responsibility for required scope

components that are excluded from the audit engagement, the NCUA Board

has added a requirement in Sec. 701.12 (d)(2) and (d)(3) for the

engagement letter between the supervisory committee and the compensated

auditor to address audit scope either by (1) certifying that the

compensated auditor is to complete the full scope of a supervisory

committee audit or, alternatively (2) specifying what prescribed

financial statement elements and/or attributes will be excluded from

the engagement, and expressly cautioning the supervisory committee that

it is responsible for fulfilling the scope of the supervisory committee

audit with respect to the excluded elements and attributes.

The additions to Sec. 701.12(c)(4) of the proposed regulation set

forth how the requirements of this part may be satisfied. The

revisions, like those discussed above, represent minor changes in

language which are not intended to change the existing regulation's

meaning or provisions. Instead, the revisions incorporate technical

improvements suggested by the AICPA Committee. The additional

requirement that the compensated auditors contract for the audit

engagement only with the supervisory committee and return the written

audit report(s) to the supervisory committee clarifies requirements

contained in the current regulation.

The NCUA Board had considered including a requirement in the

proposed regulation's audit scope for certain credit unions to have an

ongoing internal audit function in the form of

[[Page 55665]]

either an internal auditor or an internal audit department. Such a

function would benefit the credit union, the regulator, and the

insurer. Internal auditors would neither take the place nor diminish

the role of the supervisory committee in any way. Ideally, the internal

auditor would be hired by, receive instructions from, and report to,

the supervisory committee. The work of the internal auditor would

supplement the mandated role and responsibilities of the supervisory

committee. Although the NCUA Board has decided against requiring credit

unions to employ an internal auditor, it encourages credit unions that

have the resources, to consider the benefits of employing an internal

auditor (e.g., testing of the effectiveness of internal controls on an

interim and/or on-going basis; routine and on-going testing for

material errors and omissions, and irregularities and illegal acts;

continuous testing of the electronic data processing system for

reliance thereon; and improving economy and efficiency). Internal

auditors can play an important role in maintaining strong operational

and financial management controls. The NCUA Board invites comments as

to whether it should reconsider mandating an internal audit function

and, if so, whether such a requirement should be imposed on all or only

some credit unions, and on what basis., i.e., according to asset size,

complexity of services, etc.

The NCUA Board is inclined to add requirements in Sec. 701.12(d)

for credit unions which employ compensated auditors to memorialize the

terms and conditions of the engagement in a comprehensive engagement

letter, which constitutes an enforceable contract between the

compensated auditor and the supervisory committee. The proposed

regulation sets forth the minimum requirement of an audit engagement to

be addressed in such a letter. The majority of items required are

fairly consistent with standard items included in engagement letters as

used in current practice: terms and objectives of engagement; nature

and limitations; identification of the basis of accounting to be used;

identification of areas excluded from the scope; and an appendix

setting forth the procedures to be performed (if not an opinion audit).

Other requirements were added to ensure access by NCUA to a complete

set of original working papers and delivery of the required report(s)

to the supervisory committee within a reasonable period of time. The

NCUA Board seeks comment on any additional areas which should be

addressed in the engagement letter memorializing the terms and

conditions of the audit engagement.

Additional reporting requirements have been added in

Sec. 701.12(e)(1). Along with the existing requirement for a written

audit report is a requirement for two additional written reports where

applicable--a written report of internal control exceptions or

reportable conditions noted, if any, and a written report of

irregularities or illegal acts noted during the audit, if any. The

addition of these two reporting requirements does not necessitate

additional audit work (i.e., do not require separate engagements to

report on the credit union's system of internal accounting control or

its compliance with laws and regulations). These are simply reports of

information already obtained in the normal course of the supervisory

committee audit. This requirement corrects the current regulation,

which does not require such reports to be communicated to either the

credit union, the regulator, or the insurer.

A clarifying sentence was added to Sec. 701.12(e)(2) to ensure that

NCUA access to a complete set of original working papers includes all

the existing documentation relative to the audit: audit programs,

working papers documenting conclusions or judgments, supervisory

reviewer's notes (if any), etc. This is a response to increasing

instances where NCUA examiners find that information deemed by the

auditor to be ``proprietary information'' is excluded from the working

papers. The exclusion of this additional and pertinent documentation

(e.g., audit programs) impairs NCUA's ability to assess the adequacy of

the work performed by the auditor to satisfy the requirements of this

section. Proposed Sec. 701.12(d)(1)(vii) requires the supervisory

committee to incorporate in the comprehensive engagement letter a

certification by the outside compensated auditors that a complete set

of original working papers supporting the audit, including the audit

program, will be provided upon request for inspection by NCUA.

Finally, the NCUA Board has added an enforcement mechanism to

ensure compliance with the requirements of this section and with the

requirements of the comprehensive engagement letter memorializing the

audit engagement between the supervisory committee and its compensated

auditor. In the event of failure to comply, proposed Sec. 701.12(e)(3)

authorizes the Regional Director, as a first step toward enforcement,

to reject as deficient the supervisory committee audit and the reports

thereof. An additional and more severe sanction for failure to comply

is available under section 206(r) of the FCU Act, 12 U.S.C. 1786(r),

which authorizes NCUA to seek formal administrative sanctions (e.g., an

order to cease and desist, or imposition of civil money penalties)

against the supervisory committee and/or its compensated auditor as

``institution affiliated parties'' of the credit union.

Parts of the existing regulation relating to the independence and

verification of members' accounts were unchanged in substance, although

redesignated as subsections 701.12 (f) and (g), respectively.

One change to part 701.13 was made to give recognition to the

redesignation of old Sec. 701.12(e) to new Sec. 701.12(g).

Regulatory Procedures

Regulatory Flexibility Act

The Regulatory Flexibility Act requires NCUA to prepare an analysis

to describe any significant economic impact a proposed regulation may

have on a substantial number of small credit unions (primarily those

under $1 million in assets). The NCUA Board has determined and

certifies that the proposed amendment, if adopted, will not have a

significant economic impact on a substantial number of small credit

unions. As to small credit unions, the proposed amendment clarifies

without imposing additional burden. Accordingly, the NCUA Board

determines and certifies that this proposed amendment does not have a

significant economic impact on a substantial number of small credit

unions and that a Regulatory Flexibility Analysis is not required.

Paperwork Reduction Act

NCUA has determined that the three requirements: (1) to prepare and

sign an engagement letter memorializing the terms and conditions of the

audit engagement in a comprehensive engagement letter, which

constitutes an enforceable contract between the compensated auditor and

the supervisory committee; (2) to provide a written report of internal

control exceptions or reportable conditions noted, if any; and (3) to

provide a written report of irregularities or illegal acts noted during

the audit, if any; do constitute a collection of information under the

Paperwork Reduction Act. The Paperwork Reduction Act of 1995 and

regulations of the Office of Management and Budget (OMB) require that

the public be provided an opportunity to comment on information

collection requirements, including an

[[Page 55666]]

agency's estimate of the burden of the collection of information. NCUA

estimates that most federal credit unions will be affected by this

regulation. However, it is the NCUA's view that the time a credit union

spends developing an enforceable engagement contract and provides in

writing, known internal control exceptions and reportable conditions,

if any, and/or irregularities and illegal acts, if any, is necessary to

the effectiveness of the audit and verification function and thus, the

safety and soundness of the credit union. The paperwork burden created

by this rule is the requirement that such actions be put in writing.

NCUA estimates that it should reasonably take one hour per requirement

(thus, 1 hour minimum--3 hours maximum) to comply with the three

requirements, if applicable to a given circumstance. Therefore, 12,000-

36,000 total burden hours are required to comply with the collection

requirement. For the majority of credit unions, 1 hour would be

required, or 12,000 total burden hours.

The NCUA Board invites comment on: (1) whether the collection of

the information is necessary for the proper performance of the

functions of NCUA, including whether the information will have

practical utility; (2) the accuracy of NCUA's estimate of the burden of

the collection of information; (3) ways to enhance the quality,

utility, and clarity of the information to be collected; and (4) ways

to minimize the burden of collection of information. Send comments to

Attn: Milo Sunderhaug, OMB Reports Management Branch, New Executive

Office Building, Rm. 10202, Washington, DC 20530.

Executive Order 12612

Executive Order 12612 requires NCUA to consider the effect of its

actions on state interests. The proposed amendment will not have a

substantial direct effect on the states, on the relationship between

the national government and the states, or on the distribution of

rights and responsibilities among the various levels of government.

List of Subjects in 12 CFR Part 701

Credit unions, Reporting and recordkeeping requirements.

By the National Credit Union Administration Board on October 19,

1995.

James Engel,

Acting Secretary of the Board.

Accordingly, it is proposed that 12 CFR, part 701 be amended to

read as set forth below:

PART 701--[AMENDED]

1. The authority citation for Part 701 continues to read as

follows:

Authority: 12 U.S.C. 1752(5), 1755, 1756, 1757, 1759, 1761a,

1761b, 1766, 1767, 1782, 1784, 1787, 1789, 1798 and Public Law 101-

73. Section 701.6 is also authorized by 31 U.S.C. 3717. Section

701.31 is also authorized by 15 U.S.C. 1601, et seq., 42 U.S.C. 1981

and 42 U.S.C. 3601-3610.

2. Section 701.12 is amended by redesignating paragraphs (d) and

(e) as paragraphs (f) and (g), by revising paragraphs (a) through (c),

and by adding new paragraphs (d) and (e) to read as follows:

Sec. 701.12 Supervisory committee audits and verifications.

(a) Definitions. As used in this chapter:

(1) Agreed-upon procedures means the performance by an independent,

licensed certified public accountant of an engagement in which the

scope is limited to applying specified agreed-upon procedures to one or

more specified elements, accounts, or items of a financial statement.

Such procedures are insufficient to express an opinion regarding either

the financial statements taken as a whole, or the specified elements,

accounts, or items.

(2) Applicable generally accepted auditing standards (GAAS) means

generally accepted auditing standards to the extent applicable in the

circumstances. The second general standard of GAAS relating to

independence and the four standards relating to reporting are not

applicable to a compensated auditor who is not an ``independent,

licensed, certified public accountant'' as defined in paragraph (a)(9)

of this section; all other requirements of GAAS would apply to such an

auditor.

(3) Audit or Opinion audit means an examination of the financial

statements performed by an independent, licensed, certified public

accountant in accordance with generally accepted auditing standards.

The objective of an ``audit'' or ``opinion audit'' is to express an

opinion as to whether those financial statements present fairly, in all

material respects, the financial position and the results of its

operations and its cash flows in conformity with generally accepted

accounting principles or an ``other comprehensive basis of

accounting,'' as defined in paragraph (a)(11) of this section.

(4) Compensated auditor means any accounting/auditing professional

who is compensated for performing the supervisory committee audit and/

or verification services.

(5) Financial statements means a presentation of financial data,

including accompanying notes, derived from accounting records of the

credit union, and intended to disclose a credit union's economic

resources or obligations at a point in time, or the changes therein for

a period of time, in conformity with generally accepted accounting

principles (GAAP) or an ``other comprehensive basis of accounting,'' as

defined in paragraph (a)(11) of this section. Each of the following is

considered to be a financial statement: a balance sheet or statement of

financial condition; statement of income or statement of operations;

statement of retained earnings; statement of cash flows; statement of

changes in owners' equity; statement of assets and liabilities that

does not include owners' equity accounts; statement of revenue and

expenses; summary of operations; and statement of cash receipts and

disbursements.

(6) Generally accepted accounting principles (GAAP) means the

conventions, rules, and procedures which define accepted accounting

practice. GAAP includes both broad general guidelines and detailed

practices and procedures, provides a standard by which to measure

financial statement presentations, and encompasses not only accounting

principles and practices but also the methods of applying them.

(7) Generally accepted auditing standards (GAAS) means the

standards approved and adopted by the American Institute of Certified

Public Accountants which apply when an ``independent, licensed

certified public accountant'' audits financial statements. Auditing

standards differ from auditing procedures in that ``procedures''

address acts to be performed, whereas ``standards'' measure the quality

of the performance of those acts and the objectives to be achieved by

use of the procedures undertaken. In addition, auditing standards

address the auditor's professional qualifications as well as the

judgment exercised in performing the audit and in preparing the report

of the audit. Copies of GAAS may be obtained from Harcourt Brace & Co.,

6277 Sea Harbor Drive, Orlando, FL 32887.

(8) Independence and Independent means to be without bias with

respect to the credit union so as to maintain the impartiality

necessary for the reliability of the compensated auditor's findings.

Independence requires the exercise of fairness toward credit union

management, members, creditors and others who may rely upon the

independent, compensated auditor's

[[Page 55667]]

report. Auditors must be independent in fact and in appearance.

(9) Independent, licensed, certified public accountant means an

individual who has passed the Uniform Certified Public Accounting

Examination, is licensed by a state board of accountancy to practice

accounting/auditing, and is independent as defined in paragraph (a)(8)

of this section.

(10) Internal controls means the process, established by the credit

union's board of directors, officers and employees, designed to provide

reasonable assurance of reliable financial reporting and safeguarding

of assets against unauthorized acquisition, use, or disposition. A

credit union's internal control structure consists of five components:

control environment; risk assessment; control activities; information

and communication; and monitoring. Reliable financial reporting refers

to preparation of financial statements that ``present fairly'' the

financial position and results of its operations and its cash flows, in

conformity with GAAP or an ``other comprehensive basis of accounting,''

as defined in paragraph (a)(11) of this section. Internal control over

safeguarding of assets against unauthorized acquisition, use, or

disposition refers to prevention or timely detection of transactions

involving such unauthorized access, use, or disposition of assets which

could result in a loss which is material to the financial statements. -

-

(11) Other comprehensive basis of accounting means a comprehensive

basis of accounting or definite set of criteria, other than GAAP,

having substantial support. In this case the ``other comprehensive

basis of accounting'' is limited to applicable regulatory accounting

practices (RAP), i.e., that basis of accounting which has the

substantial support of NCUA or the state supervisor, when applicable.

(12) Related party transactions means transactions among or between

parties where one party controls or can significantly influence the

management or operating policies of the other so as to prevent the

other party from pursuing exclusively its own interests. Examples of

related parties include: credit union members and their families, and

credit union officials and their families. Examples of ``related party

transactions'' include: interest-free loans or loans at below market

rates; sale of real estate significantly below appraised value;

nonmonetary exchange of property; and making of loans lacking scheduled

terms for repayment.

(13) Reportable Conditions means a matter coming to the compensated

auditor's attention that, in his or her judgment, represents a

significant deficiency in the design or operation of the internal

control structure of the credit union, which could adversely affect its

ability to record, process, summarize, and report financial data

consistent with the representations of management in the financial

statements.

(14) Substantive testing means testing of details and analytical

procedures to detect material misstatements in the account balance,

transaction class, and disclosure components of financial statements.

(15) Supervisory committee means a supervisory committee as defined

in Section 111(b) of the Federal Credit Union Act, 12 U.S.C. 1761(b).

For some federally-insured state chartered credit unions, the ``audit

committee'' designated by state statute or regulation is the equivalent

of a supervisory committee.

(16) Supervisory committee audit means an examination of the credit

union's financial statements in accordance with applicable GAAS, which

is performed by the supervisory committee or its designated

representative as prescribed in paragraph (c)(4) of this section. An

audit as defined in paragraph (a)(3) of this section satisfies the

definition of a ``supervisory committee audit.''

(17) Working papers means the principal record, in any form, of the

work performed by the auditor and/or supervisory committee to support

its findings and/or conclusions concerning significant matters.

Examples include the written record of procedures applied, tests

performed, information obtained, and pertinent conclusions reached in

the engagement, audit programs, analyses, memoranda, letters of

confirmation and representation, abstracts of credit union documents,

reviewer's notes, if retained, and schedules or commentaries prepared

or obtained by the independent, compensated auditor.

(b) Supervisory committee responsibilities. (1) The supervisory

committee is responsible for ensuring that:

(i) The credit union's financial statements, taken as a whole,

fairly present, in all material respects, the financial position, the

results of its operations and its cash flows, in conformity with GAAP

or an ``other comprehensive basis of accounting,'' although this

requirement should not be interpreted to necessarily require an opinion

audit.

(ii) The credit union's management practices and procedures are

sufficient to safeguard members' assets.

(2)(i) To satisfy the requirements of paragraph (b)(1) of this

section, the supervisory committee shall determine whether:

(A) Internal controls are established and effectively maintained to

achieve the credit union's financial reporting objectives which, at a

minimum, must support the satisfaction of the requirements of

paragraphs (b) and (c) of this section;

(B) The credit union's accounting records and financial reports are

promptly prepared and accurately reflect operations and results;

(C) The plans, policies, and control procedures established by the

board of directors are properly administered; and

(D) Policies and control procedures are sufficient to safeguard

against error, carelessness, conflict of interest, self-dealing and

fraud.

(ii) The audit and verification of members' accounts, as mandated

in Section 115 of the Federal Credit Union Act, 12 U.S.C. 1761d, are

the minimum requirements for satisfying this paragraph (b).

(c) Supervisory committee audit. (1) A supervisory committee audit

of each Federal credit union's financial statements shall occur at

least once every calendar year and shall cover the period elapsed since

the last audit. The supervisory committee audit shall be made by the

supervisory committee or its designated representative, as described in

paragraph (c)(4) of this section, using applicable GAAS.

(2) The scope of the supervisory committee audit shall include:

(i) Gaining an understanding of the internal control structure;

(ii) Assessing the level of control risk; and

(iii) Based on paragraph (c)(2)(ii) of this section, determining

the nature, timing, and extent of substantive testing necessary to

confirm the assertions made by management, in the financial statements,

regarding each of assets, liabilities, equity, income, and expenses for

the following attributes:

(A) Existence or occurrence;

(B) Completeness;

(C) Valuation or allocation;

(D) Rights and obligations; and

(E) Presentation and disclosures.

(3) For the compensated auditor, audit testing of the following

areas must satisfy applicable GAAS for expressing an opinion on the

financial statements taken as a whole: internal controls, cash, loans

and interest thereon, investments and interest thereon, shares and

dividends and/or interest thereon, related party transactions, and the

detection and reporting of errors and irregularities with regard to

each of these areas.

[[Page 55668]]

(4)(i) The requirements of the annual supervisory committee audit

may be satisfied by one or more of the following:

(A) An audit of the credit union's financial statements performed

by an independent, licensed, certified public accountant in accordance

with GAAS;

(B) An ``agreed-upon procedures engagement'' performed by an

independent, licensed, certified public accountant in accordance with

applicable GAAS, which by itself or in combination with procedures

performed by the supervisory committee, fulfills the required scope of

the supervisory committee audit;

(C) A supervisory committee audit performed by an independent,

compensated auditor other than an independent, licensed, certified

public accountant in accordance with applicable GAAS, which by itself

or in combination with procedures performed by the supervisory

committee, fulfills the scope of a supervisory committee audit; or

(D) A supervisory committee audit by the supervisory committee or

its designated, uncompensated representative, performed in accordance

with applicable GAAS.

(ii) In all cases, an independent, compensated auditor is required

to contract directly with the supervisory committee for the audit

engagement and to deliver its written reports directly to the

supervisory committee.

(d) Engagement letter. (1) The engagement of a compensated auditor

to perform all or part of the scope of a supervisory committee audit

shall be evidenced by an engagement letter. The engagement letter shall

be signed by the compensated auditor and acknowledged therein by the

supervisory committee prior to commencement of a supervisory committee

audit. The engagement letter shall:

(i) Specify the terms, conditions, and objectives of engagement;

(ii) Identify the basis of accounting to be used, e.g., GAAP or an

``other comprehensive basis'' as defined in paragraph (a)(11) of this

section;

(iii) Include an appendix setting forth the procedures to be

performed (if not an opinion audit);

(iv) Specify the compensation to be paid for audit;

(v) Provide that the auditor shall, upon completion of the

engagement, deliver to the supervisory committee written reports. All

such reports may be based on work performed during the normal course of

the audit; separate engagements are not required to report on the

credit union's system of internal accounting control or its compliance

with laws and regulations. The written reports shall consist of:

(A) The supervisory committee audit;

(B) Any internal control exceptions or reportable conditions noted

in the internal control review phase of the audit; and

(C) Any irregularities or illegal acts noted during the audit;

(vi) Specify a date of delivery of the written reports required by

paragraph (d)(1)(v) of this section; and

(vii) In the case of a compensated auditor, certify that NCUA staff

or its designated representative will be provided unconditional access

to a complete set of original working papers, as defined in paragraph

(a)(17) of this section, either at the credit union or at a mutually

agreeable location.

(2) In the case of a supervisory committee audit engagement which

will address all of the financial statement elements and attributes

prescribed in paragraph (c)(2) of this section, the engagement letter

shall, in addition to the requirements of paragraph (d)(1) of this

section, include a certification that the audit is a complete

supervisory committee audit.

(3)(i) In the case of a supervisory committee audit engagement

which will exclude any financial statement elements and attributes

prescribed in paragraph (c)(2) of this section, the engagement letter

shall, in addition to requirements of paragraph (d)(1) of this section:

(A) Specifically identify the elements and attributes excluded from

the audit;

(B) State that, because of the exclusion(s), the resulting audit

will not, in and of itself, fulfill the scope of a supervisory

committee audit; and

(C) Caution that the supervisory committee will remain responsible

for fulfilling the scope of a supervisory committee audit with respect

to the excluded elements and attributes.

(ii) A compensated audit fully satisfies the requirements of a

supervisory committee audit when it meets the requirements of

paragraphs (b) and (c)(1) of this section and addresses all of the

financial statement elements and attributes prescribed in paragraphs

(c)(2) and (c)(3) of this section.

(e) Audit reports and working paper access. (1) Upon completion or

receipt of the supervisory committee audit reports prescribed in

paragraph (d)(1)(v) of this section, the supervisory committee shall

provide the reports to the board of directors. The supervisory

committee shall ensure that the compensated auditor and its reports

comply with the terms of the engagement letter prescribed by paragraph

(d) of this section. The supervisory committee shall, upon request,

provide to the National Credit Union Administration a copy of each of

the written reports received from the auditor.

(2) The supervisory committee shall be responsible for preparing

and maintaining, or making available, a complete set of original

working papers (as defined in paragraph (a)(17) of this section)

supporting each supervisory committee audit. The supervisory committee

shall, upon request, provide NCUA staff unconditional access to such

complete set of original working papers either at the offices of the

credit union or at a mutually agreeable location.

(3) Failure of a supervisory committee and/or its compensated

auditor to comply with the requirements of this section, or the terms

of an engagement letter required by this section, may be grounds for:

(i) The Regional Director to reject the supervisory committee

audit; and

(ii) The NCUA to seek formal administrative sanctions against the

supervisory committee and/or its compensated auditor pursuant to

section 206(r) of the FCU Act, 12 U.S.C. 1786(r).

* * * * *

Sec. 701.13 [Amended]

3. Section 701.13 is amended in paragraph (a)(2) by revising

``Sec. 701.12(e)'' to read ``Sec. 701.12(g)''.

[FR Doc. 95-27045 Filed 11-1-95; 8:45 am]

BILLING CODE 7535-01-U