# Annual Independent Audits and Reporting Requirements

> Briefs, arguments, decisions, and more.

URL: https://www.frixlaw.com/law-library/documents/fr%3AE9-17009

## Record

- **Collection:** Federal Register
- **Document type:** Rule
- **Published:** July 20, 2009
- **Citation:** 74 FR 35726

## Text

FEDERAL DEPOSIT INSURANCE CORPORATION
12 CFR Parts 308 and 363
RIN 3064-AD21
Annual Independent Audits and Reporting Requirements

AGENCY:

Federal Deposit Insurance Corporation (FDIC).

ACTION:

Final rule; correction.

SUMMARY:

The FDIC is amending part 363 of its regulations concerning annual independent audits and reporting requirements for certain insured depository institutions, which implements section 36 of the Federal Deposit Insurance Act (FDI Act), largely as proposed, but with certain modifications made in response to the comments received. The amendments are designed to further the objectives of section 36 by incorporating certain sound audit, reporting, and audit committee practices from the Sarbanes-Oxley Act of 2002 (SOX) into part 363 and they also reflect the FDIC's experience in administering part 363. The amendments will provide clearer and more complete guidance to institutions and independent public accountants concerning compliance with the requirements of section 36 and part 363. As required by section 36, the FDIC has consulted with the other Federal banking agencies. The FDIC is also making a technical amendment to its rules and procedures (part 308, subpart U) for the removal, suspension, or debarment of accountants and accounting firms.

The FDIC previously published this final rule in the
Federal Register
on July 7, 2009, however the document is being republished in its entirety in order to correct an error in the
DATES
section which caused the applicability date to be incorrect and to correct language relating to holding company depository institution subsidiaries.

DATES:

Effective Dates:
The final rule is effective August 6, 2009. Part 363 Annual Reports with a filing deadline on or after the effective date of these amendments should be prepared in accordance with the final rule.

The compliance date for the provision of the final rule that directs covered institutions' boards of directors to develop and adopt an approved set of written criteria for determining whether a director who is to serve on the audit committee is an outside director and is independent of management (guideline 27) is delayed until December 31, 2009. The provision of the final rule that requires the total assets of a holding company's insured depository institution subsidiaries to comprise 75 percent or more of the holding company's consolidated total assets in order for an institution to be eligible to comply with part 363 at the holding company level (§ 363.1(b)(1)(ii)) is effective for fiscal years ending on or after June 15, 2010.

FOR FURTHER INFORMATION CONTACT:

Harrison E. Greene, Jr., Senior Policy Analyst (Bank Accounting), Division of Supervision and Consumer Protection, at
hgreene@fdic.gov
or (202) 898-8905; or Michelle Borzillo, Senior Counsel, Corporate and Legal Operations Section, Legal Division, at
mborzillo@fdic.gov
or (202) 898-7400.

SUPPLEMENTARY INFORMATION:

I. Executive Summary

Section 36 of the Federal Deposit Insurance Act (FDI Act) and the FDIC's implementing regulations (part 363) are generally intended to facilitate early identification of problems in financial management at insured depository institutions with total assets above certain thresholds through annual independent audits, assessments of the effectiveness of internal control over financial reporting and compliance with laws and regulations pertaining to insider loans and dividend restrictions, the establishment of independent audit committees, and related reporting requirements. The asset-size threshold for an institution for internal control assessments is $1 billion and the threshold for the other requirements generally is $500 million. Given changes in the industry; certain sound audit, reporting, and audit committee practices incorporated in the Sarbanes-Oxley Act of 2002 (SOX); and the FDIC's experience in administering part 363, the FDIC is amending part 363 of its regulations. These amendments are designed to further the objectives of section 36 by incorporating these sound practices into part 363 and to provide clearer and more complete guidance to institutions and independent public accountants concerning compliance with the requirements of section 36 and part 363.

After making certain modifications to the proposed amendments to part 363
1

in response to the comments received, the most significant revisions to existing part 363 that are included in the final rule will: (1) Extend the time period for a non-public institution to file its Part 363 Annual Report by 30 days and replace the 30-day extension of the filing deadline that may be granted if an institution (public or non-public) is confronted with extraordinary circumstances beyond its reasonable control with a late filing notification requirement that would have general applicability; (2) provide relief from the annual reporting requirements for institutions that are merged out of existence before the filing deadline; (3) provide relief from reporting on internal control over financial reporting for businesses acquired during the fiscal year; (4) require management's assessment of compliance with the laws and regulations pertaining to insider loans and dividend restrictions to state management's conclusion regarding compliance and disclose any noncompliance with such laws and regulations; (5) require an institution's management and the independent public accountant to identify the internal control framework used to evaluate internal control over financial reporting and disclose all identified material weaknesses that have not been remediated prior to the institution's most recent fiscal year-end; (6) clarify the independence standards with which independent public accountants must comply and enhance the enforceability of compliance with these standards; (7) specify that the duties of the audit committee include the appointment, compensation, and oversight of the independent public accountant, including ensuring that audit engagement letters do not contain unsafe and unsound limitation of liability provisions; (8) require certain communications by independent public accountants to audit committees; (9) establish retention requirements for audit working papers; (10) require boards of directors to adopt written criteria for evaluating an audit committee member's independence and provide expanded guidance for boards of directors to use in determining independence; (11) provide that ownership of 10 percent or more of any class of voting securities of an institution is not an automatic bar for considering an outside director to be independent of management; (12) require the total assets of a holding company's insured depository institution subsidiaries to comprise 75 percent or more of the holding company's consolidated total assets in order for an institution to be eligible to comply with part 363 at the holding company level; and (13) provide illustrative management reports to assist institutions in complying with the annual reporting requirements.

1
72 FR 62310, November 2, 2007.

The FDIC is also amending its rules and procedures (part 308, subpart U) for

the removal, suspension, or debarment of accountants and accounting firms from performing audit services required by section 36 of the FDI Act to specify where an accountant or accounting firm should file required notices of orders and actions with the FDIC.

II. Background

Section 112 of the Federal Deposit Insurance Corporation Improvement Act of 1991 (FDICIA) added section 36, “Early Identification of Needed Improvements in Financial Management,” to the FDI Act (12 U.S.C. 1831m). Section 36 is generally intended to facilitate early identification of problems in financial management at insured depository institutions above a certain asset size threshold through annual independent audits, assessments of the effectiveness of internal control over financial reporting and compliance with designated laws and regulations, and related reporting requirements. Section 36 also includes requirements for audit committees at these insured depository institutions. Section 36 grants the FDIC discretion to set the asset size threshold for compliance with these statutory requirements, but it states that the threshold cannot be less than $150 million. Sections 36(d) and (f) also obligate the FDIC to consult with the other Federal banking agencies in implementing these sections of the FDI Act, and the FDIC has performed the required consultation.

Part 363 of the FDIC's regulations (12 CFR part 363), which implements section 36 of the FDI Act, was initially adopted by the FDIC's Board of Directors in 1993. At present, part 363 requires each insured depository institution with $500 million or more in total assets (covered institution) to submit to the FDIC and other appropriate Federal and State supervisory agencies an annual report (Part 363 Annual Report) comprised of audited financial statements, and a management report containing a statement of management's responsibilities and an assessment by management of compliance with laws and regulations pertaining to insider loans and dividend restrictions. The management report component of the annual report for an institution with $1 billion or more in total assets must also include an assessment by management of the effectiveness of internal control over financial reporting and an independent public accountant's attestation report on internal control over financial reporting. In addition, part 363 provides that each covered institution's board of directors must establish an independent audit committee comprised of outside directors. For an institution with between $500 million and $1 billion in total assets, part 363 requires a majority of the members of the audit committee to be independent of management of the institution. For a larger institution, all of the members of the audit committee must be independent of management. Part 363 also includes Guidelines and Interpretations (Appendix A to part 363), which are intended to assist institutions and independent public accountants in understanding and complying with section 36 and part 363.

III. Discussion of Proposed Amendments and Comments Received

On October 16, 2007, the FDIC's Board approved the publication of proposed amendments to part 363 and part 308, subpart U, of the FDIC's regulations, which were published in the
Federal Register
on November 2, 2007, for a 90-day comment period (72 FR 62310). The comment period closed on January 31, 2008.

Given the number and extent of changes to part 363 and its Guidelines and Interpretations and to enable readers to more easily understand the context of the changes, this notice includes the entire text of part 363 as amended, not just the amended text. Also, the following “Table of Changes to Part 363 and Appendices” is intended to assist readers in determining which sections of part 363 are affected by the final rule.

Table of Changes to Part 363 and Appendices

Unchanged
Revised
New
Reserved

Part 363—Annual Independent Audits and Reporting Requirements:

Table of Contents

X

OMB Control Number: § 363.0
X

Scope and Definitions:

§ 363.1(a)

X

§ 363.1(b)(1)

X

§ 363.1(b)(2)

X

§ 363.1(b)(3)
X

§ 363.1(c)

X

§ 363.1(d)

X

Annual Reporting Requirements:

§ 363.2(a)

X

§ 363.2(b)

X

§ 363.2(b)(1)

X

§ 363.2(b)(2)

X

§ 363.2(b)(3)

X

§ 363.2(c)

X

Independent Public Accountant:

§ 363.3(a)
X

§ 363.3(b)

X

§ 363.3(c)

X

§ 363.3(d)

X

§ 363.3(e)

X

§ 363.3(f)

X

§ 363.3(g)

X

Filing and Notice Requirements:

§ 363.4(a)

X

§ 363.4(b)

X

§ 363.4(c)

X

§ 363.4(d)
X

§ 363.4(e)

X

§ 363.4(f)

X

Audit Committees:

§ 363.5(a)

X

§ 363.5(b)

X

§ 363.5(c)

X

Appendix A to Part 363—Guidelines and Interpretations:

Table of Contents

X

Introduction
X

Scope (§ 363.1):

Guideline 1
X

Guideline 2
X

Guideline 3

X

Guideline 4

X

Guideline 4A

X

Annual Reporting Requirements (§ 363.2):

Guideline 5

X

Guideline 5A

X

Guideline 6

X

Guideline 7

X

Guideline 7A

X

Guideline 8

X

Guideline 8A

X

Guideline 8B

X

Guideline 8C

X

Guideline 9

X

Guideline 10

X

Guideline 11

X

Guideline 12

X

Role of Independent Public Accountant (§ 363.3):

Guideline 13

X

Guideline 14

X

Guideline 15

X

Guideline 16

X

Guideline 17
X

Guideline 18

X

Guideline 18A

X

Guideline 19
X

Guideline 20

X

Guideline 21
X

Filing and Notice Requirements (§ 363.4):

Guideline 22

X

Guideline 23

X

Guideline 24
X

Guideline 25

X

Guideline 26

X

Audit Committees (§ 363.5):

Guideline 27

X

Guideline 28

X

Guideline 29

X

Guideline 30

X

Guideline 31

X

Guideline 32

X

Guideline 33
X

Guideline 34
X

Guideline 35

X

Other: Guideline 36

X

Table 1 to Appendix A—Designated Federal Laws and Regulations

X

Appendix B—Illustrative Management Reports

X

In response to its request for comments, the FDIC received 23 comment letters that addressed the proposed amendments to part 363. These commenters represented 12 financial institutions; 3 bankers' trade organizations; 4 accounting firms; 1 accountants' trade organization; 1 State regulatory organization; and 2 law firms.

Regarding the technical amendment to part 308, Subpart U, the FDIC did not receive any comments on its proposal to specify the location where an accountant or accounting firm should file required notices of orders and actions regarding removal, suspension, or debarment.

With respect to the comments received on the proposed amendments to part 363, eight commenters expressed general support for the proposal, seven commenters were generally not supportive, and eight commenters did not express an overall view on the proposal. While comments were received on almost every aspect of the proposed amendments, no commenter specifically commented on each aspect.

However, eleven commenters expressed concerns regarding the regulatory burden associated with various aspects of the proposal. In addition, commenters expressed concerns about the following aspects of the proposed amendments:

• Disclosure of noncompliance with the designated laws and regulations,

• Insured depository institution percentage-of-consolidated-total-assets threshold for eligibility to comply with part 363 at a holding company level,

• Management's report on internal control over financial reporting,

• Independent public accountant's report on internal control over financial reporting,

• Independent public accountant's communications with audit committees,

• Time period for the retention of the independent public accountant's working papers,

• Independence standards applicable to independent public accountants,

• Filing requirement for and public availability of AICPA peer review reports and PCAOB inspection reports on independent public accountants,

• Filing requirement for and public availability of audit engagement letters, and

• Audit committee member independence.

The following sections discuss the proposed amendments and the comments and concerns raised by the commenters, including the responses received on two specific aspects of the proposed amendments for which the FDIC specifically requested comments: (1) Disclosure of noncompliance with the designated safety and soundness laws and regulations pertaining to insider loans and dividend restrictions, and (2) the 75 percent of total assets threshold for eligibility to comply with the requirements of part 363 at the holding company level.

A. Scope and Definitions (§ 363.1 and Guidelines 1-4A)

1. Applicability

The FDIC proposed to amend § 363.1(a) to more clearly state that part 363 applies to any insured depository institution that has consolidated total assets of $500 million or more at the beginning of its fiscal year.

One commenter that represents over 30 community banks recommended that the FDIC raise the asset size threshold from $500 million to $1 billion for requiring compliance with part 363. In November 2005, when the FDIC increased the asset size threshold for assessments of internal control over financial reporting from $500 million to $1 billion, it concluded that exempting all institutions below this higher size level from all of the requirements of part 363 would not be consistent with the objective of the underlying statute,
i.e.,
early identification of needed improvements in financial management. The Federal banking agencies rely upon financial information to evaluate the condition of insured depository institutions and to determine the adequacy of regulatory capital. Accurate and reliable measurement of an institution's loans, other assets, and earnings has a direct bearing on the determination of regulatory capital. The agencies are able to place greater reliance on measurements contained in financial statements that have been subject to an independent audit. Independent audits help to identify weaknesses in internal control over financial reporting and risk management at institutions and reinforce corrective measures, thus complementing supervisory efforts in contributing to the safety and soundness of insured depository institutions. Therefore, after considering this comment, the FDIC has determined that, except where a $1 billion or higher asset threshold already applies, the $500 million asset size threshold continues to be the appropriate level for requiring compliance with part 363.

2. Compliance by Subsidiaries of Holding Companies

At present, an insured depository institution that is a subsidiary of a holding company may use consolidated holding company financial statements to satisfy the audited financial statements requirement of part 363 regardless of whether the assets of the insured depository institution subsidiary or subsidiaries of the holding company represent substantially all or only a minor portion of the holding company's consolidated total assets. When the assets of insured depository institution subsidiaries do not comprise a substantial portion of a holding company's consolidated total assets, the FDIC staff has found that the holding company's consolidated financial statements, including the accompanying notes to the financial statements, do not tend to provide sufficient information that is indicative of the financial position and results of operations of these institutions. Also, when the insured depository institution subsidiaries do not contribute significantly to the holding company's financial position and results of operations, the extent of audit coverage given to these institutions in the audit of the consolidated holding company may be limited. Such limited audit coverage would not be consistent with the purpose and intent of section 36 of the FDI Act, which focuses on insured depository institutions rather than holding companies. In this situation, the assurance that would be provided by an independent audit performed substantially at the level of the insured depository institution subsidiaries is not otherwise available.

Therefore, given the differing characteristics of the holding companies that own insured depository institutions as well as the relationship of an insured depository institution's total assets to the consolidated total assets of its parent holding company, and in keeping with the intent and purpose of section 36 of the FDI Act, the FDIC proposed to amend §§ 363.1(b)(1) and (2) by revising the criteria for determining whether the audited financial statements requirement and the other requirements of part 363 may be satisfied at a holding company level. More specifically, in order for a covered institution to be eligible to comply with the requirements of part 363 at the top-tier or any other mid-tier holding company level, the FDIC proposed that the consolidated total assets of the insured depository institution (or the consolidated total assets of all of the holding company's insured depository institution subsidiaries, regardless of size, if the top-tier or mid-tier holding company owns or controls more than one insured depository institution) must comprise 75 percent or more of the consolidated total assets of the top-tier or mid-tier holding company. The FDIC believes that this percentage-of-assets threshold should ensure that the extent of independent audit work performed at the insured depository institution level is sufficient to satisfy the intent of section 36 of the FDI Act, that is, the early identification of needed improvements in financial management at insured institutions. The FDIC also believes that this threshold will continue to provide flexibility to the vast majority of covered institutions that are part of a holding company structure with respect to the level at which they may comply with part 363.

When determining an appropriate percentage-of-assets threshold for compliance with part 363 at a holding company level, the FDIC considered the range of percentage-of-assets ratios for covered institutions that are part of a holding company structure. The vast majority of insured institutions subject to part 363 that are in a holding company structure are subsidiaries of organizations where the assets of the insured depository institution

subsidiaries of the holding company comprise 90 percent or more of the holding company's consolidated total assets. Of the remaining institutions subject to part 363 that are in a holding company structure, most are subsidiaries of organizations where the assets of the insured institutions comprise either from 75 to 90 percent or less than 25 percent of the top-tier parent company's consolidated total assets. Smaller numbers of institutions are subsidiaries of organizations where the assets of the insured institutions comprise from 25 to 50 percent or from 50 to 75 percent of the top-tier parent company's consolidated total assets. However, in a number of cases where the insured institution subsidiaries comprise less than 75 percent of the top-tier holding company's consolidated total assets, the insured institution subsidiaries that are subject to part 363 currently comply with the regulation at a mid-tier holding company level where the assets of the insured institution subsidiaries comprise 90 percent or more of the mid-tier holding company's consolidated total assets. Thus, these institutions would not need to change how they comply with part 363 in response to the establishment of the proposed 75 percent threshold, provided they continue to comply at the same mid-tier holding company level and this holding company continues to meet the 75 percent threshold.

To assist it in considering the costs and benefits of a threshold, the FDIC specifically requested comment as to whether 75 percent or more of consolidated total assets is an appropriate threshold. Six commenters expressed views that the 75 percent threshold is reasonable, is in the public's best interest, and provides ease of application while obtaining appropriate audit coverage of the insured depository institutions.

Three commenters were opposed to the proposed 75 percent threshold. These commenters expressed the following concerns:

• The goal is reasonable but the proposed 75 percent threshold may not be appropriate. Instead, lower the threshold and require institutions that are below the threshold to consult with the FDIC prior to reporting at the holding company level.

• Compliance at the holding company level should not be dependent on the aggregate size of the subsidiary insured depository institutions relative to the holding company.

• Institutions should have until the end of their first full fiscal year after the FDIC promulgates the final rule to comply with the proposed change.

• The 75 percent threshold is arbitrary and may result in treating very similar institutions differently. An objectives-based approach should be used.

The FDIC continues to recognize that those institutions currently complying with part 363 at the holding company level that will not meet the proposed 75-percent-of-consolidated-total-assets threshold will incur additional costs from having to comply with the regulation at the institution level or at a suitable mid-tier holding company level. Requiring institutions that do meet the 75 percent threshold, or a lower percentage threshold, to consult with the FDIC prior to reporting at a holding company level would add a new element of regulatory burden and would not provide certainty nor contribute to the ease of application of the 75 percent threshold. The FDIC has concluded that the 75-percent-of-assets threshold strikes an appropriate balance between insured institution financial data and audit coverage and the cost of compliance with part 363.

The FDIC agrees with the comment that institutions that currently report at the holding company level, but do not meet the 75-percent-of-consolidated-total-assets threshold, should be afforded sufficient time to comply with this new requirement. Accordingly, the FDIC has decided to delay the effective date for implementing this threshold until fiscal years ending on or after June 15, 2010. Thus, for fiscal years ending on or before June 14, 2010, all insured depository institutions may continue to satisfy the audited financial statements requirement of part 363 at a holding company level whether or not the institution's consolidated total assets (or the consolidated total assets of all of its parent holding company's insured institutions) comprise 75 percent or more of the holding company's consolidated total assets at the beginning of the fiscal year.

Guideline 3 to part 363,
Compliance by Holding Company Subsidiaries,
states that when a holding company submits audited consolidated financial statements and other reports or notices required by part 363 on behalf of any subsidiary institution, an accompanying cover letter should identify all subsidiary institutions to which the statements, reports, or other notices pertain. Because many cover letters received by the FDIC have not sufficiently identified these subsidiary institutions, the FDIC proposed to amend guideline 3 to clarify what information should be included in the cover letter. No comments were received on this aspect of the proposal.

3. Financial Reporting

The FDIC proposed to add a new § 363.1(c) and a new guideline 4A,
Financial Reporting,
to specify that “financial reporting” includes both financial statements prepared in accordance with generally accepted accounting principles and those prepared for regulatory reporting purposes. Also, as proposed, guideline 4A clarifies that financial statements prepared for regulatory reporting purposes consist of the schedules equivalent to the basic financial statements that are included in an institution's appropriate regulatory report and that financial statements prepared for regulatory reporting purposes do not include regulatory reports prepared by a non-bank subsidiary of a holding company or an institution.

One commenter recommended that the FDIC further clarify the definition of financial reporting for purposes of part 363 to more clearly align it with current reporting practices. This commenter also stated that, when reporting at a holding company level, “regulatory reporting” would not extend to assertions about internal control over financial reporting at the subsidiary institution level. Another commenter, an accountants' trade organization, stated that the proposed amendment seems to imply that institutions' regulatory reports may not be prepared in conformity with generally accepted accounting principles (GAAP). This commenter recommended that the FDIC clarify the definition of financial reporting to state that both financial statements and the regulatory reports be prepared in accordance with GAAP to make it consistent with current practice.

While the FDIC believes that the proposed amendments are consistent with explanatory guidance it issued on this subject in December 1994,
2

the FDIC has decided to modify the proposed definition of financial reporting set forth in § 363.1(c) and guideline 4A,
Financial Reporting,
to state more clearly that, when reporting at a holding company level, it includes the financial statements and regulatory reports of an institution's holding company. The modified definition would also state that, for recognition and measurement purposes, regulatory reporting requirements shall conform to GAAP.

2

See
FDIC Financial Institution Letter (FIL) 86-94, dated December 23, 1994.

4. Definitions

The FDIC proposed to add § 363.1(d),
Definitions,
to define several common terms used in part 363 and the guidelines and received no comments on these definitions.

B. Annual Reporting Requirements (§ 363.2 and Guidelines 5-12)

1. Audited Financial Statements

Consistent with sound management practices and the objective of internal control over financial reporting, the FDIC proposed to amend § 363.2(a) to require that the annual financial statements reflect all material correcting adjustments identified by the independent public accountant. Financial statements issued by insured depository institutions that are public companies or by their parent holding companies that are public companies are already subject to such a requirement pursuant to section 401 of SOX. The FDIC believes this requirement should also apply to institutions subject to part 363 that are not public companies.

In response to a commenter's recommendation, the FDIC revised this proposed requirement to provide additional context regarding the phrase “material correcting adjustments identified by the independent public accountant” by explaining that these adjustments should be those that are necessary for the financial statements to conform with GAAP.

2. Part 363 Management Report Contents

The FDIC has noted differences in the content of the management reports included in Part 363 Annual Reports and the adequacy of the information in these management reports regarding the results of management's assessments of the effectiveness of internal control over financial reporting and compliance with the laws and regulations pertaining to insider loans and dividend restrictions. Identified material weaknesses in internal control over financial reporting and instances of noncompliance with insider lending requirements and dividend restrictions have not always been disclosed.

In addition, management's assessment of internal control over financial reporting has often failed to disclose the internal control framework used to perform the assessment of the effectiveness of these controls and to clearly state whether controls over the preparation of the regulatory financial statements have been included within the scope of management's assessment. The omission of this information from an institution's management report reduces the usefulness of the report as a means of identifying needed improvements in financial management, which is the objective of section 36 of the FDI Act. The regulations adopted by the Securities and Exchange Commission (SEC) in 2003 implementing the requirement in section 404 of SOX for a management report on internal control over financial reporting requires management to identify the internal control framework it used to evaluate the effectiveness of these controls and to disclose any identified material weakness.

To provide clearer guidance on the information that should be included in the management report, the FDIC proposed to expand § 363.2(b) to require management's assessment of compliance with the laws and regulations pertaining to insider loans and dividend restrictions to include a clear statement as to management's conclusion regarding compliance and to disclose any noncompliance with such laws and regulations. In addition, the proposed amendment to § 363.2(b) would require management's assessment of internal control over financial reporting to identify the internal control framework that management used to make its evaluation, include a statement that the evaluation included controls over the preparation of regulatory financial statements, include a clear statement as to management's conclusion regarding the effectiveness of internal control over financial reporting, disclose all material weaknesses identified by management, and preclude management from concluding that internal control over financial reporting is effective if there are any material weaknesses.

The FDIC specifically requested comment as to whether the disclosure in the management report of instances of noncompliance with the laws and regulations pertaining to insider loans and dividend restrictions should be made available for public inspection or be designated as privileged and confidential and not be made available to the public by the FDIC. Three commenters supported public availability only for disclosures of “material” noncompliance and twelve commenters were not supportive of public availability of disclosures of noncompliance. These commenters were concerned that minor errors may be mistaken for a systemic compliance failure and stated that noncompliance should be addressed through the examination process.

The FDIC has considered these comments and notes that all insured depository institutions, regardless of size, are required to comply with the designated safety and soundness laws and regulations that deal with insider loans and dividend restrictions. Moreover, these laws and regulations have not substantially changed since part 363 was first implemented in 1993. Thus, well before an insured depository institution reaches $500 million in total assets and becomes subject to part 363, it should already have appropriate policies, procedures, controls, and systems in place to monitor insider lending activities and assess its dividend-paying capacity and thereby ensure compliance with the safety and soundness laws and regulations in these two designated areas. Public availability of disclosures of instances of noncompliance with these designated laws and regulations should act as a further stimulus to management's efforts to ensure that its policies, procedures, controls, and systems are sound and operating effectively. Therefore, the FDIC has concluded that, to reinforce the importance of management's responsibility for complying with the laws and regulations pertaining to insider loans and dividend restrictions, instances of noncompliance with these laws and regulations should be disclosed in management's assessment (that is included in the management report) and made available to the public.

Nevertheless, based on the comments it received on this issue, the FDIC believes it would be useful to provide further guidance regarding disclosure of noncompliance with the designated safety and soundness laws and regulations. Accordingly, the FDIC is adding guideline 8C,
Management's Disclosure of Noncompliance with Designated Laws and Regulations,
to Appendix A to part 363. This guideline states that management is not required to specifically identify the individual or individuals (
e.g.,
officers or directors) who were responsible for or were the subject of any such noncompliance and provides general parameters for making the disclosure. For example, the disclosure should include appropriate qualitative and quantitative information to describe the nature, type, and severity of the noncompliance. Also, similar instances of noncompliance may be aggregated.

While the majority of commenters did not comment on the proposed revisions applicable to management's report on internal control over financial reporting, four commenters expressed concerns or made recommendations as follows:

• The report is not necessary, its costs exceed the benefits derived, and it is difficult for small community banks to

recruit personnel with the level of training and experience necessary to implement the accounting and reporting rules.

• Consider a “delayed phase-in” of the requirements for assessing internal control over financial reporting similar to the phase-in utilized by the SEC in its rules implementing section 404 of SOX.

• Raise the asset size threshold for this requirement from $1 billion to $3 billion to ease regulatory burden.

• The requirement to disclose all identified material weaknesses in internal control over financial reporting in management's report should be clarified as to whether the disclosure covers all identified material weaknesses, regardless of their status as of the institution's fiscal year-end, or only those in existence as of the end of the fiscal year that have not been remediated prior to that date.

Management has been required to assess and report on the effectiveness of an institution's internal control over financial reporting since part 363 was first implemented in 1993. In November 2005, when the FDIC increased the asset size threshold for internal control assessments from $500 million to $1 billion, it concluded, and continues to believe, that the $1 billion asset size threshold is appropriate for requiring assessments and reports on internal control over financial reporting. Therefore, the FDIC has decided to retain the $1 billion asset size threshold for requiring assessments and reports on internal control over financial reporting. Also, for the reasons previously stated, the FDIC does not believe that a “delayed phase-in” of the requirement for assessing and reporting on internal control over financial reporting is necessary or appropriate. Moreover, a phase-in of the requirement for management to assess and report on internal control over financial reporting in effect already exists because this requirement takes effect only when an institution's total assets exceed $1 billion, not when the institution first becomes subject to the other audit and reporting requirements of section 36 and part 363 when its assets reach $500 million.

With respect to management's reporting on the material weaknesses it has identified in the management report component of its Part 363 Annual Report, the FDIC notes that section 36 of the FDI Act requires management to perform an assessment of internal control over financial reporting as of year-end. Therefore, to clarify management's reporting responsibility, the FDIC has revised § 363.2(b)(3)(iii) to explain that management must disclose all material weaknesses in internal control over financial reporting that it has identified and that have not been remediated prior to the end of the institution's fiscal year.

Because part 363 and its guidelines provide only limited guidance concerning the contents of the management report and the related signature requirements for this report, institutions and auditors have expressed interest in examples of acceptable reports. Therefore, to assist managements of insured depository institutions in complying with the annual reporting requirements of § 363.2, the FDIC proposed to add
Appendix B to Part 363—Illustrative Management Reports.
Appendix B provides guidance regarding reporting scenarios that satisfy the annual reporting requirements of part 363, illustrative management reports, and an illustrative cover letter for use when an institution complies with the annual reporting requirements at the holding company level. The FDIC also states in Appendix B that the use of the illustrative management reports and cover letter is not required. The FDIC encourages the managements of insured depository institutions to tailor the wording of their management reports to fit their particular circumstances, especially when reporting on material weaknesses in internal control over financial reporting or noncompliance with designated laws and regulations.

Two commenters stated that the illustrative management reports are helpful and will mitigate regulatory burden. Another commenter suggested that the illustrative management reports would be better suited in an accounting and auditing guide that could be updated regularly to reflect changes in professional standards or other requirements that would affect these reports and that the accounting and auditing guide could illustrate the differences in reporting under AICPA and PCAOB standards. This commenter also stated that the illustrative management report on internal control over financial reporting at the holding company level is inconsistent with current practice and that it does not clearly and appropriately describe the scope of the internal control assessments by management or the independent public accountant. This commenter added that the language in the illustrative management report on internal control at the holding company level does not make it clear to a reader whether management has separately assessed the effectiveness of internal control over financial reporting at each subsidiary institution listed in the report.

The FDIC has considered this commenter's suggestion that the illustrative management reports would be better suited in an accounting and auditing guide. In this regard, the FDIC notes that auditing and attestation standards require auditors to evaluate the elements that management is required to present in its report on its assessment of internal control over financial reporting, but these standards do not fully address the requirements of part 363 for management reports on internal control nor do they provide guidance to management regarding the preparation of management reports for part 363 purposes. Given the varying degrees of familiarity of institution management with professional auditing and attestation standards as well as the lack of availability of illustrative management reports that satisfy the requirements of part 363, the FDIC has determined that the illustrative management reports should be provided in Appendix B to part 363. However, in response to this commenter's statements concerning the illustrative management reports on internal control over financial reporting at the holding company level, the FDIC has revised the text of these illustrative management reports, which are presented in sections 5(c) and (d) and 6(b) of Appendix B. More specifically, the sample text in these illustrative reports that identifies the subsidiary institutions that are subject to part 363 has been revised by removing the language stating that these institutions are included in the scope of management's assessment of internal control over financial reporting. The FDIC believes that the revised illustrative management reports on internal control over financial reporting at the holding company level are consistent with current practices and professional auditing and attestation standards.

Regarding management's responsibility for assessing compliance with the laws and regulations pertaining to insider loans and dividend restrictions, the FDIC proposed to revise and update Table 1 to Appendix A of part 363 to reflect changes in these laws and regulations that have occurred since this table was last revised in 1997. The FDIC received no comments on the revised and updated Table 1.

3. Management Report Signatures

Section 36(b)(2) of the FDI Act requires an institution's management report to be signed by the chief executive officer and the chief accounting officer or chief financial

officer. In its reviews of management reports, the FDIC has noted that these reports are often not signed by the officers at the appropriate corporate level when the audited financial statements requirement is satisfied at the holding company level or when one or more of the components of the management report is satisfied at the holding company level and the remaining components of the management report are satisfied at the insured depository institution level. Therefore, the FDIC proposed to add § 363.2(c) to specify which corporate officers must sign the management report and also the level of the corporate signers (
i.e.,
insured depository institution level or the holding company level). No comments were received on this aspect of the proposal.

4. Institutions Merged Out of Existence

To reduce regulatory burden and provide certainty for merging institutions, the FDIC proposed to add guideline 5A,
Institutions Merged Out of Existence,
to explicitly provide relief from filing a Part 363 Annual Report for an institution that is merged out of existence after the end of its fiscal year, but before the deadline for filing its Part 363 Annual Report. However, a covered institution that is acquired after the end of its fiscal year, but retains its separate corporate existence rather than being merged out of existence, would continue to be required to file a Part 363 Annual Report for that fiscal year. Three commenters commented in support of this aspect of the proposal, one of whom stated that the proposed amendment will reduce both regulatory burden and uncertainty.

5. Management's Assessment of the Effectiveness of Internal Control Over Financial Reporting

The FDIC has publicly advised institutions with $1 billion or more in total assets that are public companies or subsidiaries of public companies that they have considerable flexibility in determining how best to satisfy the SEC's requirements for management's assessment of internal control over financial reporting which implement section 404 of SOX, and the FDIC's requirements in part 363.
3

The reporting flexibility available to institutions subject to both the section 404 and the part 363 requirements was initially described in the preamble to the SEC's section 404 final rule release (68 FR 36642, June 18, 2003). This final rule release explained that the flexible reporting approach described in the preamble had been developed by the SEC staff in consultation with the staff of the Federal banking agencies. To codify this reporting flexibility in part 363, the FDIC proposed to add guideline 8A,
Management's Assessment of the Effectiveness of Internal Control Over Financial Reporting.
For an institution with $1 billion or more in total assets that is subject to both part 363 and the SEC's rules implementing section 404 of SOX (or whose parent holding company is subject to section 404 and the condition in § 363.1(b)(2) is met), the proposed guideline describes two options for complying with the filing requirements regarding management's report on internal control over financial reporting. These options are to prepare (1) two separate reports, one to satisfy the FDIC's part 363 requirements and another to satisfy the SEC's section 404 requirements, or (2) a single report that satisfies all of the FDIC's part 363 requirements and all of the SEC's section 404 requirements. No comments were received on proposed new guideline 8A.

3
70 FR 71231, November 28, 2005; 70 FR 44295, August 2, 2005; FDIC Financial Institution Letter (FIL) 137-2004, December 21, 2004.

6. Internal Control Reports for Acquired Businesses

Currently, under the reporting requirements of part 363, both management's and the independent public accountant's evaluation of an institution's internal control over financial reporting must include controls at an institution in its entirety, including all of its consolidated businesses, including businesses that were recently acquired. However, like the SEC staff, the FDIC recognizes that it may not always be possible for management to conduct an evaluation of the internal control over financial reporting of an acquired business in the period between the consummation date of the acquisition and the due date of management's internal control evaluation. The SEC staff has provided guidance to public companies stating that the staff would not object to the exclusion of the acquired business from management's evaluation of internal control over financial reporting, provided certain disclosures are made and other conditions are met.
4

The FDIC has received and granted several written requests from institutions subject to the internal control reporting requirements of part 363 to exclude recently acquired businesses from the scope of management's internal control evaluation.

4

See
Question 3 in the SEC staff's
Frequently Asked Questions on Management's Report on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports
at
http://www.sec.gov/info/accountants/controlfaq1004.htm.

To reduce regulatory burden, including the burden of submitting written requests to the FDIC, and provide certainty to institutions, the FDIC proposed to add guideline 8B,
Internal Control Reports for Acquired Businesses,
to explicitly provide relief from the reporting requirements regarding internal control over financial reporting related to business acquisitions made by an institution during its fiscal year. As proposed and consistent with the SEC staff's guidance, guideline 8B would permit management's evaluation of internal control over financial reporting to exclude internal control over financial reporting for the acquired business, provided management's report identifies the acquired business, states that the acquired business is excluded from management's evaluation of internal control over financial reporting, and indicates the significance of the acquired business to the institution's consolidated financial statements. Also, proposed guideline 8B would clarify that if the acquired business is an insured depository institution that is subject to part 363 and it is not merged out of existence before the deadline for filing its Part 363 Annual Report, the acquired business (institution) must continue to comply with all of the applicable requirements of part 363. One commenter commented on this aspect of the proposal and supported the amendment as proposed, stating that it will reduce both regulatory burden and uncertainty.

7. Standards for Internal Control

At present, guideline 10,
Standards for Internal Control,
provides that each institution should determine its own standards for establishing, maintaining, and assessing the effectiveness of its internal control over financial reporting, but it does not describe the characteristics of a suitable internal control framework. The FDIC proposed to amend guideline 10 to provide guidance regarding the attributes of a suitable internal control framework. The proposed attributes are consistent with the attributes the SEC described in the preamble to the SEC's section 404 final rule release (68 FR 36648, June 18, 2003). The FDIC believes that a framework with these attributes is appropriate for all institutions whether or not they are public companies. No comments were received on this aspect of the proposal.

C. Independent Public Accountant (§ 363.3 and Guidelines 13-21)

1. Internal Control Over Financial Reporting

As with its experience in reviewing the portion of the management report in which management provides its assessment of the effectiveness of the institution's internal control over financial reporting, the FDIC has found some independent public accountants' internal control attestation reports to be less than sufficiently informative. Such attestation reports are, therefore, inconsistent with the objectives of section 36 of the FDI Act. As a consequence, the FDIC proposed to amend § 363.3(b), which governs the independent public accountant's report on internal control over financial reporting, to specify that, consistent with generally accepted standards for attestation engagements, the Public Company Accounting Oversight Board's (PCAOB) auditing standards, and related PCAOB staff implementation guidance, the accountant's report must:

• Not be dated prior to the date of management's report on its assessment of the effectiveness of internal control over financial reporting;

• Identify the internal control framework that the accountant used to make the evaluation (which must be the same as the internal control framework used by management);

• Include a statement that the accountant's evaluation included controls over the preparation of regulatory financial statements;

• Include a clear statement as to the accountant's conclusion regarding the effectiveness of internal control over financial reporting;

• Disclose all material weaknesses identified by the accountant; and

• Conclude that internal control is ineffective if there are any material weaknesses.

The FDIC also proposed to amend guideline 18,
Attestation Report,
to be consistent with § 363.3(b)(2) by reiterating that the attestation report on internal control over financial reporting should include a statement as to regulatory reporting.

The majority of commenters did not comment on the independent public accountant's report on internal control over financial reporting. However, four commenters expressed concerns or made recommendations as follows:

• Since the AICPA Auditing Standards Board's proposed revisions to the attestation standards for nonpublic companies will likely be similar to the requirements for public companies, and based upon the experiences of public companies complying with SOX 404, the requirement for the independent public accountant to examine, attest to, and report on management's assertion concerning internal control over financial reporting for both GAAP and regulatory reporting purposes will be too costly. Instead of having the accountant examine internal control, banking regulators should assess the adequacy of internal control over financial reporting as part of the examination process.

• The requirements that the independent public accountant's report on internal control over financial reporting identify the internal control framework used, state that the evaluation included controls over the preparation of regulatory financial statements, express the accountant's conclusion as to whether internal control is effective, and disclose all material weaknesses can be deleted because they are already addressed by the AICPA and PCAOB standards. The rule should instead refer to the professional auditing and attestation standards.

• The FDIC should consider a delayed phase-in of the requirement for the independent public accountant to assess internal control over financial reporting similar to the phase-in set forth in the SEC's rules implementing SOX 404.

• The requirement to disclose material weaknesses in internal control over financial reporting in the independent public accountant's report should be clarified as to whether the disclosure covers all identified material weaknesses, regardless of their status as of the institution's fiscal year-end, or only those in existence as of the end of the fiscal year that have not been remediated prior to that date, which is the disclosure requirement in the professional auditing and attestation standards.

Independent public accountants have been required to examine, attest to, and report on management's assertion concerning the effectiveness of an institution's internal control over financial reporting since part 363 was first implemented in 1993. This requirement is also set forth in section 36 of the FDI Act. In November 2005, the FDIC increased the asset size threshold for internal control assessments from $500 million to $1 billion for both management and the independent public accountant. At that time, the FDIC noted that recent and impending changes to the auditing and attestation standards governing internal control assessments that were making them more robust had and would continue to increase the cost and burden of the audit and reporting requirements of part 363. The FDIC concluded then that the increase to a $1 billion asset size threshold for requiring assessments and reports on internal control over financial reporting achieved an appropriate balance between burden reduction and maintaining safety and soundness for institutions subject to part 363. The FDIC continues to believe today that $1 billion remains a suitable size threshold for internal control assessments. Also, for the reasons previously stated in Section III.B.2, the FDIC does not believe that a “delayed phase-in” of the requirement for the independent public accountant to report on management's assertion regarding internal control over financial reporting is necessary or appropriate. Additionally, the FDIC notes that under the SEC's most recent amendments, a non-accelerated filer need not file the auditor's attestation report on internal control over financial reporting until it files an annual report for a fiscal year ending on or after December 15, 2009. Since part 363 has long required such internal control audits, the FDIC believes that it would be contrary to the objectives of section 36 of the FDI Act to allow institutions subject to part 363 with $1 billion or more in total assets, that are not accelerated filers or subsidiaries of accelerated filers for Federal securities law purposes, to discontinue undergoing assessments of the effectiveness of their internal control over financial reporting by their external auditors until the SEC requires such audits for non-accelerated filers.

In response to the comments regarding the disclosure of material weaknesses in internal control over financial reporting, the FDIC has revised § 363.3(b)(3) to clarify that the independent auditor's internal control report must disclose all material weaknesses that the independent auditor has identified and that have not been remediated prior to the end of the institution's fiscal year.

The FDIC has considered the suggestion that the rule be revised to refer to the existing standards of the auditing standard setters rather than including specific requirements in the rule. In this regard, both the current and proposed rule state that the independent public accountant's attestation and report on internal control over financial reporting shall be made in accordance with generally accepted standards for attestation engagements. However, as previously noted, the FDIC has found some independent public accountants' internal control attestation reports to be less than sufficiently informative, and

given the varying degrees of familiarity of institution management and audit committee members with professional auditing standards, the FDIC has decided to retain the specific requirements set forth in the proposed rule. The FDIC also believes that including these requirements in the proposed rule will assist audit committee members in the performance of their duties regarding the oversight of the external auditor. However, the FDIC has revised § 363.3(b) to clarify that the auditor's report on internal control over financial reporting should satisfy the requirements set forth in both part 363 and applicable professional standards. In this regard, and consistent with guidance the FDIC issued in February 2008,
5

the FDIC has also revised § 363.3(b) and added guideline 18A to clarify that the attestation report on internal control over financial reporting may be made in accordance with the PCAOB's auditing standards even if the institution is a nonpublic company or a subsidiary of a nonpublic company.

5

See
FDIC Financial Institution Letter (FIL) 5-2008, dated February 1, 2008.

2. Communications With Audit Committee

According to section 204 of SOX, an accountant who audits a public company's financial statements should report on a timely basis to the company's audit committee: (1) All critical accounting policies, (2) alternative accounting treatments discussed with management, and (3) written communications provided to management, such as a management letter or schedule of unadjusted differences. The FDIC has encouraged institutions, regardless of whether they are public companies, to arrange with their accountant to institute these reporting practices.
6

Requirements that are similar, but not identical, to those set forth in section 204 apply to accountants who audit the financial statements of entities that are not public.
7

Therefore, consistent with current best practices and standards for audits of both public and non-public entities, the FDIC proposed to amend part 363 by adding § 363.3(d),
Communications with audit committee,
to set a uniform minimum requirement for such communication. As proposed, § 363.3(d) would require the independent public accountant to report the information identified in section 204 of SOX to the audit committee.

6

See
FDIC Financial Institution Letter (FIL) 17-2003, dated March 5, 2003.

7

See
Statement on Auditing Standards No. 114,
The Auditor's Communication With Those Charged With Governance,
December 2006.

While the majority of commenters did not comment on the independent public accountant's communications with audit committees, three commenters expressed the following concerns:

• The communication requirements for auditors of nonpublic entities are included in the AICPA's standards and those for auditors of public companies are established by the PCAOB and the SEC. Rather than memorializing these communication requirements in the rule, refer to the existing standards of the AICPA, the PCAOB, and the SEC.

• The proposed amendments overlap the requirements of the AICPA standards and do not align with the communication required by SEC rules and regulations and may cause confusion as to the required communications. The requirements should either be removed in their entirety or clarified and aligned.

• SOX practices and principles regarding audit committee communications should be restricted to publicly held banks.

• Auditors should not be required to report critical accounting policies, alternative accounting treatments, and schedules of unadjusted differences to the audit committee. Management should have discretion as to whether these communications should be reported to the audit committee.

The FDIC has considered the concerns raised by the commenters, including the suggestion that the rule be revised to refer to the existing standards of the auditing standard setters (AICPA, PCAOB, and SEC) rather than including specific requirements in the rule. Although the existing auditing standards for both public and nonpublic companies set forth the requirements for the independent public accountant's communications with audit committees, the FDIC believes that, given the varying degrees of familiarity of audit committee members with professional auditing standards, setting forth the requirements for the auditor's communications with audit committees in the proposed rule will assist audit committee members in the performance of their duties regarding the oversight of the external auditor. Therefore, the FDIC has decided to retain the requirements set forth in the proposed rule. However, the FDIC has revised § 363.3(d) to clarify that the auditor should satisfy the audit committee communication requirements set forth in both part 363 and applicable professional standards. Also, based on its review of the professional standards regarding auditors' communications with audit committees, the FDIC believes that the revised requirements in the proposed rule are consistent with the existing professional standards.

3. Retention of Working Papers

Section 36(g)(3)(A) of the FDI Act states that an independent public accountant who performs audit services required by section 36 must agree to provide related working papers to the FDIC, any appropriate Federal banking agency, and any State bank supervisor. The SEC's rules and the auditing standards for public companies specify a 7-year retention period for audit working papers while the auditing standards for nonpublic companies provide that the retention period for audit working papers should not be shorter than five years.
8

The FDIC believes that a uniform retention period should apply to audits of all institutions subject to part 363. Accordingly, the FDIC proposed to amend part 363 by adding § 363.3(e),
Retention of working papers.
As proposed, § 363.3(e) would require the independent public accountant to retain the working papers related to its audit of the financial statements and, if applicable, its evaluation of internal control over financial reporting for seven years.

8

See
Rule 2-06 of the SEC's Regulation S-X, the PCAOB's Auditing Standard No. 3,
Audit Documentation
, June 2004, and the AICPA's Statement on Auditing Standards No. 103,
Audit Documentation
, December 2005.

One commenter stated that the five-year retention period specified by the AICPA's auditing standards is appropriate for nonpublic companies. Another commenter was concerned that the proposed seven-year retention period may cause extra burden and expense for independent public accountants of nonpublic institutions.

Under section 36 and part 363, the requirement for institutions to undergo audits of their financial statements and, if applicable, assessments of their internal control over financial reporting does not depend on whether they are public or nonpublic companies. Thus, the FDIC believes that the retention requirement for the working papers associated with auditors' performance of these services should also be independent of whether institutions are public or nonpublic companies. In this regard, the FDIC notes that the AICPA's auditing standards for nonpublic companies acknowledge that working paper retention periods may exceed five years. After considering the comments, the FDIC continues to believe that a uniform retention period for audit working papers should apply to all institutions subject to part 363. Therefore, the FDIC has decided to

retain the proposed seven-year retention period for working papers related to audits of financial statements and evaluations of internal control over financial reporting.

4. Independence

Section 36 of the FDI Act states that an “independent public accountant” must perform the audit and attestation services required by section 36 but it does not define “independent,” leaving this to the FDIC's rulemaking authority. As adopted by the FDIC in 1993, part 363 includes guideline 14,
Independence
, which identifies the independence standards applicable to accountants performing services under section 36 and part 363. This guideline specifies that the independent public accountant must comply with the independence standards applicable to audits of both nonpublic and public companies. In 2003, the agencies jointly issued rules of practice to implement the enforcement provisions of section 36(g)(4), which authorize the FDIC or an appropriate Federal banking agency to remove, suspend, or bar an accountant, for good cause, from performing audit and attestation services for institutions subject to section 36 and part 363.
9

To enhance the enforceability of the independence standards with which an accountant must comply for purposes of part 363, the FDIC proposed to move the independence requirements for independent public accountants from guideline 14,
Independence
, to new § 363.3(f),
Independence
. As proposed, § 363.3(f) would retain the original independence concept of part 363,
i.e.
, auditor compliance with the independence standards applicable to both nonpublic and public company audits, by clarifying that the independent public accountant must comply with the independence standards and interpretations of the PCAOB for audits of public companies that have been approved by the SEC in addition to the independence standards and interpretations of the AICPA and the SEC.

9
68 FR 48256, August 13, 2003.

Two commenters stated that the proposed amendment with its explicit reference to compliance with the PCAOB's independence standards represents a best practice and that the coordination of the independence standards in part 363 with the independence standards of the AICPA, the SEC, and the PCAOB will reduce uncertainty. Nevertheless, one commenter recommended that the FDIC clarify whether an independent public accountant should (a) comply with the most restrictive independence requirement addressing a particular matter or (b) comply with the independence requirements that pertain only to public companies. In contrast, six commenters (which included the three bankers' trade organizations and two of the four accounting firms) were opposed to or expressed concerns about the proposed amendment. These commenters stated that:

• The FDIC should individually evaluate and clarify the applicability of each new SEC and PCAOB independence standard.

• The FDIC should revise part 363 to require the auditors of public institutions to meet the independence rules of the SEC and the PCAOB and the auditors of nonpublic institutions to meet only the AICPA's independence rules.

• Applying the independence standards of the SEC and the PCAOB equally to all independent public accountants may prohibit certain independent public accountants from performing engagements for nonpublic institutions subject to part 363.

• Adding the PCAOB's independence rules to the existing requirement for compliance with the independence rules of the SEC and the AICPA could be problematic for some community banks because: (1) Some banks may not have ready access to multiple accounting firms that satisfy the independence requirements of the PCAOB, the SEC, and the AICPA; and (2) it creates a third set of standards that the audit committee will need to review on a regular basis in order to fulfill its duties.

• Education efforts to explain the auditor independence requirements of part 363 will be needed because: (1) Many institutions subject to part 363 are nonpublic; and (2) many independent public accountants that provide services to nonpublic institutions are not registered with the PCAOB and may not be familiar with the independence standards of the SEC and the PCAOB.

The foundation for auditor independence standards is the principle that auditors who provide audit services must be independent in fact and appearance with respect to their audit clients. The FDIC notes that the independence rules of the SEC and AICPA have been applicable to audits of both public and nonpublic institutions subject to part 363 since the implementation of part 363 in 1993. More recently, SOX granted additional authority to set independence standards for accounting firms performing audits of public companies (issuers) to the PCAOB. In this regard, the PCAOB's independence standards do not become effective unless and until they are approved by the SEC, which means that they are tantamount to SEC independence standards.

The FDIC acknowledges that both the AICPA's and the SEC's auditor independence standards, including those of the PCAOB, have evolved over time. The FDIC recognizes that the effect of periodic changes in these auditor independence standards carries over to accountants with insured depository institution audit clients subject to part 363 regardless of whether these clients are public or nonpublic institutions. Thus, as the AICPA, the SEC, and the PCAOB periodically revise their auditor independence standards, independent public accountants performing audit and attest services under part 363 must take appropriate steps to ensure that they continue to satisfy the qualifications for accountants with respect to independence that are set forth in part 363. While changes in independence standards can be burdensome to auditors and their clients, given the importance of the independence of the accountants who provide audit services to institutions subject to part 363, which in number comprise the largest 17 percent of the insured depository institutions, the FDIC continues to believe that it is in the public interest for independence standards to apply uniformly to all accountants performing these services. To achieve this objective, auditors of institutions subject to part 363 should continue to comply with all of the independence standards applicable to both nonpublic and public institutions that are established by the AICPA, the SEC, and the PCAOB rather than to comply with these standards on a selective or exclusionary basis. Therefore, the FDIC has decided to proceed with the proposed amendment to the auditor independence provisions of part 363.

However, as recommended by a commenter, the FDIC has revised the proposed rule to clarify that if a provision within one of the applicable independence standards is more restrictive than a provision addressing the same subject matter in one of the other independence standards, the independent public accountant must comply with the more restrictive independence requirement. For example, an external auditor is permitted to provide internal audit outsourcing services to an audit client under the AICPA's independence rules, but the independence rules of the SEC and the PCAOB generally prohibit an external auditor from providing such

services to an audit client. In this example, the external auditor would have to comply with the more restrictive independence requirements of the SEC and the PCAOB.

5. Peer Reviews

Section 36(g)(3)(A)(ii) of the FDI Act requires an independent public accountant to have received a peer review or be enrolled in a peer review program that meets acceptable guidelines. At present, guideline 15 to part 363 provides that to be acceptable, a peer review should, among other things, be generally consistent with AICPA standards. Since part 363 was originally adopted, the PCAOB has been created and conducts inspections of registered public accounting firms, some of which audit insured depository institutions subject to part 363 or their parent holding companies. These inspections serve a similar purpose as peer reviews. In addition, the PCAOB issues reports on its inspections of these accounting firms.

In response to this development and in light of the agencies' issuance of rules of practice implementing the enforcement provisions of section 36, the FDIC proposed to add new § 363.3(g) on peer reviews. The FDIC proposed to move the requirements for peer reviews, the filing of peer review reports, and the retention of peer review working papers from guideline 15,
Peer Reviews
, and guideline 16,
Filing Peer Review Reports
, to § 363.3(g). As proposed, § 363.3(g) clarified that acceptable peer reviews include peer reviews performed in accordance with the AICPA's Peer Review Standards and inspections conducted by the PCAOB. It also provided that the FDIC would not make available for public inspection the portion of any peer review report and inspection report determined to be nonpublic by the AICPA and the PCAOB, respectively. Finally, the FDIC proposed to revise guideline 15 to explain that to be acceptable a peer review, other than a PCAOB inspection, should be generally consistent with AICPA Peer Review Standards.

In their comments on the proposal, all four accounting firms and the accountants' trade organization did not object to filing the public portions of PCAOB inspection reports, but were opposed to filing the nonpublic portions of these reports. These commenters also expressed the following concerns:

• The proposed requirement is contrary to existing law (SOX) and the professional standards of the PCAOB. An accounting firm should be required to submit the nonpublic portion of a PCAOB inspection report to the FDIC only if it is made public by the PCAOB.

• Pursuant to Section 104(g)(2) of SOX, the PCAOB cannot disclose the nonpublic portion of an inspection report unless criticisms of the accounting firm's quality controls remain unremediated 12 months after the issuance of the report. There are only two exceptions to the statutory prohibition: (1) Disclosure to the SEC and State boards of public accountancy, and (2) to a “Federal functional regulator” when the PCAOB Board, in its discretion, determines that disclosure is necessary. The PCAOB has not made such a determination regarding any Federal banking agency.

• Since AICPA peer review reports and public portions of the PCAOB inspection reports are available to the FDIC on the AICPA and PCAOB Web sites, there should not be a requirement for auditors to submit reports directly to the FDIC.

In response to the concerns raised by the commenters, the FDIC has revised the proposed amendment to require independent public accountants to file only the public portions of PCAOB inspection reports. The revised amendment also requires independent public accountants to file previously nonpublic portions of any PCAOB inspection report within 15 days of the PCAOB making such portions public. The FDIC has retained the existing requirement for independent public accountants to file peer review reports, accompanied by any letters of comments, response, and acceptance.

Regarding AICPA peer review reports, the FDIC notes that these reports are publicly available on the AICPA Web site for some, but not all, independent public accountants and accounting firms. The AICPA's standards for performing and reporting on peer reviews do not require independent public accountants or accounting firms to post their peer review reports on the AICPA Web site. However, members of the AICPA's audit quality centers and the Private Companies Practice Section post their review reports on the AICPA Web site, certain firms voluntarily make their peer review reports public, and other firms make some aspects of their peer review reports available when required by a State board of public accountancy or the Government Accountability Office. Furthermore, since section 36 of the FDI Act requires peer review reports to be filed with the FDIC and made available for public inspection, the FDIC cannot override this statutory requirement despite the present availability of most of these reports on the PCAOB and AICPA Web sites. The FDIC has therefore retained the filing requirement for AICPA peer review reports and the public portions of PCAOB inspection reports.

6. Notice of Termination

Guideline 26,
Notices Concerning Accountants
, permits an institution that is a public company or a subsidiary of a public company to satisfy the requirement for filing a notice of termination of its independent public accountant by using its current report (
e.g.
, SEC Form 8-K) concerning a change in accountant to satisfy the similar notice requirements of part 363. To reduce regulatory burden and provide flexibility to the independent public accountant of such an institution, the FDIC proposed to amend guideline 20,
Notice of Termination
, to permit the independent public accountant to satisfy the requirement to file a notice of termination of its services in a similar manner. No comments were received on this aspect of the proposal.

D. Filing and Notice Requirements (§ 363.4 and Guidelines 22-26)

1. Annual Reporting

At present, the annual reporting requirements of part 363 require each insured depository institution to file its Part 363 Annual Report within 90 days after the end of its fiscal year. Each institution is also required to file the independent public accountant's report on the audited financial statements and, if applicable, the accountant's attestation report on management's assessment of internal control over financial reporting, both of which are components of the Part 363 Annual Report, within 15 days of receipt by the institution, which, at times, has presented a conflict with the annual report filing requirement. The FDIC has also noted that earlier filing deadlines established by the SEC for annual reports filed by certain public companies under the Federal securities laws (
e.g.
, SEC Form 10-K) and more robust auditing standards related to internal control over financial reporting have had an impact on the management of institutions, on the resources of independent public accountants, and on auditing costs.

To reduce cost and burden, the FDIC proposed to amend § 363.4(a) by extending the time period within which an insured depository institution that is not a public company or a subsidiary of a public company must file its Part 363 Annual Report from within 90 days to within 120 days after the end of its fiscal year. As proposed, an insured depository institution that is a public

company, or that is a subsidiary of a public company that meets certain criteria, would continue to be required to file its Part 363 Annual Report within 90 days after the end of its fiscal year, which is consistent with the maximum time frame that public companies have for filing annual reports under the Federal securities laws. The proposed amendment would also eliminate the ambiguity in § 363.4 concerning the filing deadline for the components of the Part 363 Annual Report that are prepared by the independent public accountant.

An insured depository institution with consolidated total assets of less than $1 billion that is a public company or a subsidiary of a public company is required to file management's assessment of the effectiveness of internal control over financial reporting with the SEC or the appropriate Federal banking agency in accordance with the compliance dates of the SEC's rules implementing section 404 of SOX. Management's findings and conclusions with respect to internal control over financial reporting, as disclosed in the assessment that management files with the SEC or the appropriate Federal banking agency, provide information that would aid in meeting the objective of section 36 of the FDI Act. Therefore, the FDIC proposed to add a provision to § 363.4(a) that would require an institution of this size to submit a copy of management's section 404 internal control assessment with its Part 363 Annual Report, but this assessment would not be considered part of the institution's Part 363 Annual Report.

Five commenters expressed support for the proposed extension of the filing deadline for the Part 363 Annual Report for an institution that is not a public company or a subsidiary of a public company. These commenters stated that the additional 30 days will help to ensure that auditors are able to devote sufficient resources to the nonpublic engagements, provide nonpublic institutions with the additional time needed to comply with the filing requirements, and may help to reduce the cost of independent audits.

At present, part 363 specifies that the Part 363 Annual Reports and reports on peer reviews shall be available for public inspection. Except for management letters, which are exempt from public disclosure pursuant to existing guideline 18, part 363 does not address the availability of other reports and notifications required to be filed under part 363. Consistent with the FDIC's longstanding practice, the FDIC has revised the proposed rule to clarify that, except for the annual reports, AICPA peer review reports, and PCAOB inspection reports, which shall be available for public inspection, all other reports and notifications required to be filed under part 363 are exempt from public disclosure by the FDIC.

2. Independent Public Accountant's Reports

Section 36(h)(2)(A) of the FDI Act and § 363.4(c) require an institution to file a copy of any management letter or other report issued by its independent public accountant that pertains to the financial statement audit and the attestation on internal control over financial reporting within 15 days after receipt by the institution. The FDIC's experience in administering part 363 indicates that institutions are often uncertain as to which types of reports they receive from their independent public accountant must be submitted to the FDIC, the appropriate Federal banking agency, and any appropriate State bank supervisor pursuant to this filing requirement. As stated above, this uncertainty extends to this 15-day filing requirement and its relationship to the filing deadline for the Part 363 Annual Report. To clarify the requirements for the filing of accountants' reports, the FDIC proposed to amend § 363.4(c),
Independent public accountant's letters and reports
, by providing examples of the types of reports issued by an institution's independent public accountant, except for the accountant's reports that are required to be included in the institution's Part 363 Annual Report, that are to be filed within 15 days after receipt. As proposed, Guideline 25,
Independent Accountant's Reports
, would be deleted because it would be redundant and no longer needed.

In the
Interagency Advisory on the Unsafe and Unsound Use of Limitation of Liability Provisions in External Audit Engagement Letters
, the Federal banking agencies expressed their concerns about limitation of liability provisions included in external audit engagement letters and advised institutions against entering into engagement letters containing such provisions.
10

To enable the FDIC to timely review institutions' engagement letters with their independent public accountants, the FDIC also proposed to amend § 363.4(c) to require institutions to file copies of audit engagement letters, including any related agreements and amendments, with the FDIC, the appropriate Federal banking agency, and any appropriate State bank supervisor within 15 days of acceptance by the institution.

10

See
71 FR 6847, February 9, 2006, and FDIC Financial Institution Letter (FIL) 13-2006, issued on the same date.

Eight commenters (which included two bank trade organizations, three accounting firms, and the accountants' trade organization) opposed requiring institutions to file audit engagement letters and were concerned about their public availability. These commenters stated that:

• It is not essential, practical, or beneficial for an institution to file the audit engagement letter. The requirement for the audit committee to ensure that the letter does not contain any inappropriate limitation of liability provisions is sufficient and appropriate.

• Instead of requiring institutions to file audit engagement letters, the FDIC could require management's report to include a statement that the audit engagement letter has been reviewed for unsafe and unsound limitation of liability provisions.

• The final rule should specify that audit engagement letters filed with the FDIC are “exempt from disclosure” under FOIA.

The FDIC notes that, since the publication of the proposed rule, the AICPA's Professional Ethics Executive Committee has adopted Interpretation No. 501-8,
Failure to Follow Requirements of Governmental Bodies, Commissions, or Other Regulatory Agencies on Indemnification and Limitation of Liability Provisions in Connection With Audit and Other Attest Services
, which became effective July 31, 2008.
11

This ethics interpretation states:

11
The full text of the Interpretation can be found on the AICPA's Web site at the following link:
http://www.aicpa.org/download/ethics/EDITED_Adopted_501_8_final.pdf
.

Certain governmental bodies, commissions, or other regulatory agencies (collectively, regulators) have established requirements through laws, regulations, or published interpretations that prohibit entities subject to their regulation (regulated entity) from including certain types of indemnification and limitation of liability provisions in agreements for the performance of audit or other attest services that are required by such regulators or that provide that the existence of such provisions causes a member to be disqualified from providing such services to these entities. For example, Federal banking regulators, State insurance commissions, and the Securities and Exchange Commission have established such requirements.

If a member enters into, or directs or knowingly permits another individual to enter into, a contract for the performance of audit or other attest services that are subject to the requirements of these regulators, the member should not include, or knowingly permit or direct another individual to include, an indemnification or limitation of

liability provision that would cause the regulated entity or member to be disqualified from providing such services to the regulated entity. A member who enters into, or directs or knowingly permits another individual to enter into, such an agreement for the performance of audit or other attest services that would cause the regulated entity or a member to be in violation of such requirements, or that would cause a member to be disqualified from providing such services to the regulated entity, would be considered to have committed an act discreditable to the profession.

In consideration of the comments received and the issuance of this ethics interpretation, the FDIC has reevaluated this aspect of the proposal and has decided to remove the proposed requirement to file audit engagement letters, which will eliminate the burden that would have been associated with this filing requirement. However, the FDIC cautions institutions and independent public accountants that including unsafe and unsound limitation of liability provisions in audit engagement letters could result in adverse consequences. For example, the FDIC could determine that an audit of an institution's financial statements and, if applicable, its internal control over financial reporting that has been performed pursuant to an engagement letter containing these unsafe and unsound provisions does not satisfy the requirements of part 363. The institution could then be directed to engage a different independent public accountant to perform another audit. The independent public accountant whose engagement letter contained the unsafe and unsound limitation of liability provisions could also be subject to supervisory action by the FDIC or the institution's primary Federal regulator as well as disciplinary action by the relevant State board of public accountancy and the AICPA for an act discreditable to the profession.

3. Notification of Late Filing

Guideline 23,
Relief from Filing Deadlines
, currently provides that in the occasional event that an institution is confronted with extraordinary circumstances beyond its reasonable control that justifies an extension of the deadline for filing its Part 363 Annual Report or another required report or notice, the institution may submit a written request for an extension of the filing deadline of not more than 30 days that explains the reasons for the request. Such a request may be granted for good cause. Over the last several years, the reasons set forth in the requests for extensions of time for filing Part 363 Annual Reports that have been submitted to the FDIC generally did not represent extraordinary circumstances beyond the institution's reasonable control, the standard currently set forth in guideline 23. Also, several extension requests were repeats of requests from the same institutions from the previous year.

Based upon this experience and given the proposed amendment to § 363.4(a) to extend the filing deadline for Part 363 Annual Reports for non-public institutions from 90 to 120 days, the FDIC proposed to replace the extensions of time for filing reports that are available only in extraordinary circumstances under guideline 23 with a new § 363.4(e),
Notification of late filing.
In place of filing extensions that have limited applicability, this new section would be applicable to all institutions and would require an institution that is unable to timely file all or any portion of its Part 363 Annual Report or any other report or notice required to be filed under part 363 to submit a written notice of late filing before the filing deadline for the report or notice. The late filing notice must disclose the institution's inability to timely file all or specified portions of its Part 363 Annual Report or other report or notice, the reasons therefore in reasonable detail, and the date by which the report or notice will be filed.

The FDIC also proposed to amend guideline 23 by changing its focus from extension requests to late filing notices consistent with the approach taken in new § 363.4(e). Amended guideline 23 explains that submitting a late filing notice will not cure the apparent violation of part 363 arising from an institution's failure to timely file a Part 363 Annual Report or any other required report or notice. The supervisory response to such an apparent violation would take into account the facts and circumstances surrounding an institution's delay in filing. As proposed, guideline 23 also provides that, if the late filing applies to only a portion of the Part 363 Annual Report or any other report or notice, the components of the report or notice that have been completed should be filed within the prescribed filing period accompanied by either a cover letter that indicates which components are omitted or a combined late filing notice and cover letter.

One commenter suggested that the FDIC revise the proposed rule to provide for extensions of the filing due date for up to 60 days for institutions that are not public companies or subsidiaries of public companies instead of establishing a late filing notification requirement. In the FDIC's dealings with institutions unable to file their Part 363 Annual Reports by the filing deadline in the current rule, whether they are seeking extensions of the deadline or not, it is not uncommon for institutions to experience delays in their ability to file these reports that extend well in excess of 60 days after the filing deadline. Therefore, the FDIC believes that establishing a late filing notification requirement is a more practical approach for addressing the broad range of situations when institutions are unable to timely file reports required under part 363 than providing for longer extensions of the filing deadline in those cases where an institution meets an extraordinary circumstances standard. Accordingly, the FDIC has decided to adopt this aspect of the rule as proposed without revision.

4. Place for Filing

Current guideline 22 identifies the office of the FDIC, the appropriate Federal banking agency, and the appropriate State bank supervisor to which reports and notices (other than peer review reports) required by part 363 are to be filed. Nevertheless, the FDIC has found that some institutions submit required reports and notices to incorrect locations. The FDIC staff also receives questions from institutions asking where reports and notices should be filed. To make the information as to where Part 363 Annual Reports, written notices of late filing, and other reports and notices (except peer review reports) are to be filed more prominent, the FDIC proposed to move this information from guideline 22,
Place for Filing,
to a new § 363.4(f),
Place for filing.
No comments were received on this aspect of the proposal.

E. Audit Committees (§ 363.5 and Guidelines 27-35)

1. Composition

Section 36(g)(1) of the FDIC Act and § 363.5(a) require each insured depository institution subject to part 363 to have an independent audit committee comprised entirely of outside directors. As defined in § 363.5(a)(3), in general, an outside director is a director who is not an officer or employee of the institution or any affiliate of the institution. In addition, the outside directors who serve on the audit committee must be “independent of management,” although a minority of the audit committee members of institutions with $500 million or more but less than $1 billion in total assets need not be “independent of management.” Guideline 27,
Composition,
requires each institution's

board of directors to determine at least annually whether existing and potential audit committee members satisfy the requirements governing audit committee composition.

In order for a board of directors to perform its evaluation of audit committee members in a consistent, effective, and reviewable manner, the FDIC believes the board should be guided by an approved policy or set of criteria that identifies the factors to be taken into account by the board. Accordingly, the FDIC proposed to amend guideline 27 to require each institution's board of directors to maintain an approved set of written criteria for determining whether a director who is to serve on the audit committee is an outside director and is independent of management and to apply these criteria, at least annually, to determine whether each existing or potential audit committee member meets the requirements of section 36 and part 363. The proposed amendment to guideline 27 also requires that the results of and basis for the board's determination with respect to each existing and potential audit committee member be recorded in the board's minutes.

Two commenters expressed support for the proposed requirement in guideline 27 for each institution's board of directors to adopt written criteria for determining if audit committee members meet the requirements of section 36 and part 363 and view it as a best practice. One of these commenters also recommended that the FDIC revise or expand § 363.5(b) or guideline 28 to clarify the extent to which audit committee members who meet the SEC's definition of “audit committee financial expert” will be deemed to have “banking or related financial management expertise” for part 363 purposes.

However, three commenters, including one bankers' trade organization, were not supportive of the proposed amendments to guideline 27. These commenters objected to the documentation requirements for audit committee members' independence and the requirements for the board of directors' minutes to reflect the results of and basis for the board's determinations regarding audit committee members' independence. As an alternative, two of these commenters recommended that audit committees be permitted to survey existing and potential members and make the survey available to examiners but not reflect the survey results in the board of directors' minutes.

In addition to being a best practice, the FDIC believes that the adoption and implementation by an institution's board of directors of an approved policy or set of criteria that identify the factors to be taken into account for evaluating audit committee member independence improves corporate governance. Documenting the results of and basis for determinations with respect to each existing and potential audit committee member in the board's minutes further supports good corporate governance and provides evidence that the board is properly discharging its responsibilities under part 363 in the process for selecting audit committee members. Applying an approved policy or set of criteria and documenting the results provide a more robust and consistent process than having audit committees themselves survey existing and potential committee members for review by examiners, but with no oversight by the entire board of directors. Nevertheless, an annual survey of existing and potential audit committee members by the board may be a useful mechanism for determining whether these individuals satisfy the board's policy or set of criteria. For these reasons, the FDIC has decided to adopt guideline 27 as proposed without any revision.

As to the suggestion regarding clarification of the extent to which audit committee members who have the attributes of an “audit committee financial expert” under the SEC's rules will be deemed to have “banking or related financial management expertise,” the FDIC has revised guideline 32,
Banking or Related Financial Management Expertise,
to clarify that such persons will satisfy the criteria set forth in the guideline.

Guideline 30,
Holding Company Audit Committees,
provides guidance for complying with the audit committee requirements of part 363 at the holding company level. The FDIC proposed to amend guideline 30 for consistency with the proposed revisions to the holding company provisions of § 363.1(b) and to reflect the difference in the audit committee composition requirements in § 363.5(a) for institutions with more than and less than $1 billion in total assets. No comments were received on this aspect of the proposal.

2. “Independent of Management” Considerations

Guideline 28,
“Independent of Management” Considerations,
identifies five factors for a board of directors to consider when determining the independence of an outside director. Guideline 29,
Lack of Independence,
states that a director who owns or controls 10 percent or more of any class of the institution's voting securities should not be considered “independent of management.” The FDIC has found that some of the factors in guideline 28 are so general that they fail to provide meaningful guidance to boards of directors. At the same time, many of the institutions subject to part 363 or their parent holding companies are public companies with securities listed on a national securities exchange. Under the SEC's Rule 10A-3 (17 CFR 240.10A-3), each audit committee member of a listed issuer must be a director of the issuer and must otherwise be independent. The listing standards of the national securities exchange must set forth the criteria for determining the independence of directors who are to serve on a listed issuer's audit committee.

Based on its review, the FDIC stated in the proposal to amend part 363 that it believed that the independence criteria for audit committee members included in the listing standards of the national securities exchanges, together with the FDIC's existing stock ownership criterion in guideline 29, represented an appropriate framework for determining whether an outside director is “independent of management” for purposes of part 363. Furthermore, for an institution whose audit committee members or whose parent holding company's audit committee members, if the holding company meets the holding company provisions of § 363.1(b), are subject to the listing standards of a national securities exchange, the FDIC observed that allowing the institution to use these standards for part 363 purposes would reduce the institution's burden.

Therefore, the FDIC proposed to combine guidelines 28 and 29 and provide expanded guidance for an institution's board of directors to use in its assessment of an outside director's relationship to the institution for the purposes of making “independent of management” determinations regarding audit committee members. For example, the proposed amendment to guideline 28 included a list of criteria that an institution's board of directors should consider when determining whether an outside director would be considered “independent of management.” In developing the proposed list of criteria, the FDIC considered, but did not entirely replicate, the portion of the listing standards of the national securities exchanges that apply to audit committees. An institution's board of directors may also conclude that it

should consider additional criteria that may be appropriate in its particular circumstances. As an alternative to these criteria, revised guideline 28 would permit an institution that is a public company or a subsidiary of a public company (when the holding company provisions of § 363.1(b) are met) that is subject to the listing standards of a national securities exchange to apply the audit committee provisions of the listing standards for purposes of determining audit committee member independence. Similarly, all other institutions, including those that are not public companies, may elect, but would not be required, to adopt the audit committee provisions of the listing standards of a national securities exchange or association as their criteria for determining audit committee member independence.

While two commenters supported the proposed amendments regarding audit committee independence, five commenters (which included two bankers' trade organizations and three financial institutions) expressed certain concerns or suggested changes to the proposal. These commenters suggested that:

• Shareholders of closely-held companies should not be automatically prohibited from serving on the audit committee solely because they own 10 percent or more of the institution's voting stock.

• The FDIC should raise the proposed compensation limitation threshold from $60,000 to $100,000.

• The meaning of “financial services” as it relates to indirect compensation should be clarified. Furthermore, the need for “indirect compensation” limits is questionable given all of the other independence requirements.

• Proposed guideline 28(b)(7) should be revised by removing from the definition of “payment” loans and other services extended to directors in the ordinary course of an institution's business as well as payments arising solely from investments in the bank's securities and payments made under non-discretionary charitable contribution matching programs. The $200,000 or 5 percent of gross revenues test in this guideline should be measured against the revenues of the recipient of the payment, and not the outside employer.

• Applying the director independence standards of the national securities exchanges to privately held banks will impose challenges for community banks located in areas where it is difficult to find competent directors to serve on the audit committee.

• Existing guidelines 28 and 29 provide sufficient guidance for institutions to determine the independence of a director.

• Audit committee independence criteria should consider an individual institution's complexity and risk profile. For community banks, audit committee member independence can be difficult to accomplish and maintain.

In response to these comments and concerns, the FDIC has carefully reviewed the provisions of proposed revised guideline 28 on the “independent of management” considerations that should be applied to audit committee members. First, the FDIC has reconsidered the existing 10 percent stock ownership limit for audit committee members. In this regard, the SEC's and the national securities exchanges' rules do not impose such a limit on audit committee members. Therefore, consistent with these entities' rules, the FDIC is revising guideline 28 to provide that ownership of 10 percent or more of any class of voting securities of an institution would not be an automatic bar for considering an outside director to be independent of management. The revised guideline further provides that when an outside director's stock ownership equals or exceeds the 10 percent threshold, the institution's board of directors would be required to determine and document its determination as to whether such ownership would interfere with the outside director's exercise of independent judgment in carrying out the responsibilities of an audit committee member.

Next, the FDIC has reconsidered the compensation limit applicable to audit committee members for direct and indirect compensation and, as suggested by commenters, has revised guideline 28 to increase the compensation threshold from $60,000 to $100,000. Additionally, the comments seeking greater clarity concerning the meaning of indirect compensation and the types of payments deemed to be compensation have merit. Therefore, the FDIC has revised the guideline to provide examples of indirect compensation and to specify that certain payments would not be included within the meaning of the terms direct and indirect compensation.

In response to the suggestion to remove loans and other services extended to directors in the ordinary course of an institution's business as well as payments arising solely from investments in the bank's securities and payments made under non-discretionary charitable contribution matching programs from the definition of “payment,” the FDIC has revised and expanded guideline 28(b)(8) to specify what payments are not included within the meaning of the terms direct and indirect compensation and payments. As to the suggestion regarding the basis of the measurement for the $200,000 or 5 percent of gross revenue test, the FDIC has decided to retain this requirement as proposed so as to maintain consistency with the similar requirements set forth in the listing standards of the national securities exchanges and thereby minimize confusion in the application of this requirement.

Based on questions it has received from covered institutions and its experience in administering the criteria set forth in the existing guidelines 28 and 29 regarding audit committee member independence, the FDIC concluded that these guidelines did not provide sufficient guidance for institutions to determine the independence of a director for the purposes of serving on an institution's audit committee. Therefore, the FDIC's experience contradicts the views of the commenter who asserted that the existing guidelines provide sufficient guidance.

The FDIC acknowledges that some community banks may encounter challenges in accomplishing and maintaining audit committee member independence. In recognition of these challenges, the FDIC amended the audit committee provisions of part 363 in 2005 to allow a minority of the outside directors who serve on the audit committee of covered institutions with less than $1 billion in total assets not to be independent of management. After reviewing the criteria listed in proposed guideline 28 as they would be modified as discussed above, the FDIC believes that the nature and types of relationships included in the list represent a reasonable framework for evaluating whether outside directors who are candidates for the audit committees of covered institutions of all sizes, both public and nonpublic, are independent of management. Of particular note, the criteria include a $100,000 limit on certain forms of direct and indirect compensation to a director or immediate family members. In contrast, the SEC's and the national securities exchanges' rules currently limit the compensation of audit committee members to fees received as a director and audit committee member and prohibit all other compensation, direct and indirect. The FDIC chose not

to impose this prohibition, which applies to audit committee members of certain public companies, on all insured institutions subject to part 363. The absence of this prohibition on compensation from the criteria in guideline 28 should benefit nonpublic community institutions subject to part 363. Similarly, the removal of the 10 percent stock ownership limit from the audit committee independence criteria should benefit community institutions. Therefore, the FDIC believes that the proposed amendments to guideline 28, as modified in response to comments, will provide institutions' boards of directors with appropriate guidance and sufficient flexibility for establishing their institutions' criteria for making “independent of management” determinations for audit committee members.

In light of the revisions to guideline 28 regarding the criteria for determining an audit committee member's independence, boards of directors and audit committee members of covered institutions are reminded that under part 363 the selection of a director to serve as an audit committee member is basically a three-step process. The first step is to determine which of the composition requirements set forth in § 363.5(a)(1) and (2) are applicable to the institution's audit committee. The second step is to determine if each director who is to serve on the audit committee is an “outside director” as defined in § 363.5(a)(3). The third step is to determine if each “outside director” is independent of management in accordance with the provisions of guideline 28.

3. Audit Committee Duties

According to section 36(g)(1)(B) of the FDI Act and § 363.5(a), an audit committee's duties include reviewing the basis for the Part 363 Annual Report with both management and the independent public accountant. Guideline 31 further provides that the audit committee's duties should be appropriate to the size of the institution and the complexity of its operations and it identifies additional duties that could be appropriate for the audit committee. These additional duties include discussing with management the selection and termination of the institution's independent public accountant. In addition, guideline 26 provides that, before engaging an independent public accountant, an institution should review and satisfy itself that the accountant is in compliance with the required qualifications set forth in guidelines 13 through 15, including the accountant's independence and receipt of a peer review.

Under section 301 of SOX, the audit committee of each public company listed on a national securities exchange or association must be responsible for the appointment, compensation, and oversight of the accounting firm engaged to prepare or issue an audit report or perform related work. As the SEC noted when it adopted its final rule implementing section 301, “the auditing process may be compromised when a company's outside auditors view their responsibility as serving the company's management rather than its full board of directors or audit committee. This may occur if the auditor views management as the employer with hiring, firing and compensating powers. Under these conditions, the auditor may not have the appropriate incentive to raise concerns and conduct an objective review. * * * One way to help promote auditor independence, then, is for the auditor to be hired, evaluated and, if necessary, terminated by the audit committee.” Because the intent and purpose of section 36 of the FDI Act is the early identification of needed improvements in financial management, it is critical for the accountants that perform audit and attestation services for insured depository institutions subject to section 36 to have an appropriate incentive to raise concerns and conduct an objective review. In this regard, the FDIC believes it is a sound corporate governance practice for an institution's audit committee, rather than its management, to be responsible for the appointment, compensation, and oversight of the accountant, regardless of whether the institution is a public company.

Therefore, the FDIC proposed to amend § 363.5(a),
Composition and duties,
and guideline 31,
Duties,
to specify that, in addition to reviewing with management and the independent public accountant the basis for the reports issued under part 363, the duties of the audit committee include the appointment, compensation, and oversight of the independent public accountant who performs services required under part 363. In order to discharge these duties with respect to the independent public accountant, the audit committee should also review and satisfy itself as to the independent public accountant's compliance with the independence, peer review, and other qualifications under part 363. Additionally, the audit committee should be familiar with and ensure management's compliance with the requirement to file notices concerning the engagement, resignation, or dismissal of an independent public accountant. The FDIC proposed to include these duties in guideline 31.

Three commenters expressed support for the proposed amendments regarding the duties of the audit committee and stated that it represents a best practice regardless of an entity's asset size. However, one commenter, who was not supportive of the proposed amendments, recommended that the proposal be revised to remove the mandate for the audit committee to appoint and oversee the independent accountants in cases where the bank is privately-owned, more than 80 percent of the voting shares are owned by a sole owner or the principal owner's immediate family, the shareholders authorize procedures to be followed with respect to the appointment and oversight of the independent accountants, and the bank has a Uniform Financial Institutions Rating of 1 or 2. This commenter also stated that while appointing the independent accountant is expected to be normal for an audit committee of a publicly-owned company, the value for a privately-owned company is less clear. Additionally, this commenter stated that banks that are wholly owned by a single or a few shareholders, who are all immediate family members, do not need a separate board committee to do what they can do directly and that the mandate for a separate audit committee in these cases adds nothing to safety and soundness but adds additional bureaucracy and cost to the bank.

Although the FDIC has considered these comments, this commenter's concerns, in essence, relate to the requirement for covered institutions, particularly for those that are privately-owned, to establish independent audit committees. In response, the FDIC notes that section 36(g) of the FDI Act requires each institution to which section 36 applies to have an independent audit committee made up of outside directors who are independent of management. Consequently, the FDIC lacks the rulemaking authority to permit a covered institution not to have an independent audit committee or to permit a covered institution's entire board of directors to act as an audit committee based on the nature of the institution's ownership. In this regard, in enacting section 36, Congress recognized the significant public interest in sound financial management and controls at covered institutions, including the important role of an independent audit committee, regardless of their ownership structure. Therefore, the FDIC has decided to adopt the proposed changes pertaining

to audit committee duties without revision.

4. Independent Public Accountant Engagement Letters

In response to an observed increase in the types and frequency of provisions in financial institutions' external audit engagement letters that limit the auditors' liability, the Federal banking agencies issued an
Interagency Advisory on the Unsafe and Unsound Use of Limitation of Liability Provisions in External Audit Engagement Letters
(Interagency Advisory) in February 2006.
12

When they issued the Interagency Advisory, the agencies stated their belief that when institutions agree to limit their external auditors' liability in provisions in engagement letters, such provisions may weaken the external auditors' objectivity, impartiality, and performance, which may reduce the reliability of audits and thereby raise safety and soundness concerns. The reliability of audits is central to achieving the intent and purpose of section 36 of the FDI Act. Therefore, the FDIC proposed to add § 363.5(c),
Independent public accountant engagement letters,
and amend guideline 31,
Duties,
to incorporate the principal provisions of the Interagency Advisory.

12

See
71 FR 6847, February 9, 2006, and FDIC Financial Institution Letter (FIL) 13-2006, issued on the same date.

As proposed, § 363.5(c) and guideline 31 would require the audit committee to ensure that audit engagement letters and any related agreements with the independent public accountant for services to be performed under part 363 do not contain any limitation of liability provisions that: (1) Indemnify the independent public accountant against claims made by third parties; (2) hold harmless or release the independent public accountant from liability for claims or potential claims that might be asserted by the client insured depository institution, other than claims for punitive damages; or (3) limit the remedies available to the client insured depository institution. Consistent with the Interagency Advisory, the proposed amendment would not preclude the use of alternative dispute resolution agreements and jury trial waivers. Four commenters expressed support for these proposed amendments to part 363. One of these commenters viewed this audit committee duty as a best practice. The FDIC is adopting these amendments as proposed.

5. Transition Period for Forming and Restructuring Audit Committees

When an insured depository institution first exceeds the $500 million total assets threshold and becomes subject to part 363, particularly an institution with few shareholders, the FDIC has observed that, in so

[Text truncated at 120,000 characters. The full text is on the page linked above.]

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3AE9-17009. Public record. Not legal advice.