Regulatory Background

1.15 Declining real estate markets in the mid-1980s contributed heavily to widespread losses in the savings institutions industry, evidenced by the insolvency of the savings industry's federal deposit insurance fund. The FIRREA provided funds for the resolution of thrift institutions, replaced the existing regulatory structure, introduced increased regulatory capital requirements, established limitations on certain investments and activities, and enhanced regulators' enforcement authority. The FIRREA redefined responsibilities for federal deposit insurance by designating separate insurance funds, the Bank Insurance Fund (BIF), and the Savings Associations Insurance Fund (SAIF). The FIRREA also established the Resolution Trust Corporation (RTC) to dispose of the assets of failed thrifts. The RTC is no longer in existence and its work is now being done by the FDIC.

1.16 As the 1980s came to a close, record numbers of bank failures began to drain the BIF. The FDICIA provided additional funding for the BIF but also focused the least-cost resolution of and prompt corrective action (PCA) for troubled institutions and improved supervision and examinations. The FDICIA also focused the regulatory enforcement mechanism on capital adequacy. Many of the FDICIA's provisions were amendments or additions to the existing Federal Deposit Insurance Act (FDI Act).

1.17 In April 2006, the FDIC merged the BIF and the SAIF to form the Deposit Insurance Fund (DIF). This action was pursuant to the provisions in the Federal Deposit Insurance Reform Act of 2005 (Reform Act). Under the Reform Act, the FDIC may set the designated reserve ratio, calculated as the target insurance fund size as a percentage of estimated insured deposits, within a range of 1.15 percent to 1.50 percent of estimated insured deposits.

1.18 A desire to allow banks to serve a broad spectrum of customer financial needs caused Congress to pass legislation in 1999. The Gramm-Leach-Bliley Act (also known as the Financial Services Modernization Act) changed the types of activities that are permissible for bank holding company affiliates and for subsidiaries of banks. The bill created so-called financial holding companies that may engage in a broad array of activities. Financial holding company affiliates could provide insurance as principal, agent, or broker and may issue annuities. These affiliates may engage in expanded underwriting, dealing in, or making a market in securities, as well as engage in expanded merchant banking activities. The legislation affirmed the concept of functional regulation.

1.19 Federal banking regulators continue to be the primary supervisors of the banking affiliates of financial holding companies and state insurance authorities supervise the insurance companies, and the SEC and securities self-regulatory organizations supervise the securities business. Each functional regulator determines appropriate capital standards for the companies it supervises. The Treasury and the Federal Reserve have the authority to approve additional activities to be permissible for financial holding companies. To maintain financial holding company status, all of a bank holding company's insured deposit taking subsidiaries must be "well capitalized," "well managed," and have at least a satisfactory Community Reinvestment Act rating.

1.20 In 1970, the Bank Secrecy Act (BSA) was enacted to address the problem of money laundering. The BSA authorized the Treasury to issue regulations requiring financial institutions to file reports, keep certain records, implement anti-money-laundering programs and compliance procedures, and report suspicious transactions to the government. (See Title 31 U.S. Code of Federal Regulations [CFR] Chapter X). These regulations, promulgated under the authority of the BSA, and subsequently the USA-Patriot Act of 2001, are intended to help federal authorities detect, deter, and prevent criminal activity. The Financial Crimes Enforcement Network (FinCEN), an arm of the Treasury, administers these regulations.

1.21 On December 2, 2014, the FFIEC released the revised Bank Secrecy Act/Anti-Money Laundering (BSA/AML) Examination Manual (manual). The revised manual provides current guidance on risk-based policies, procedures, and processes for banking organizations to comply with the BSA and safeguard operations from money laundering and terrorist financing. The manual has been updated to further clarify supervisory expectations and incorporate regulatory changes since the manual’s 2010 update.

1.22 In 2002, the Sarbanes-Oxley Act was enacted in response to high-profile business failures which called into question the effectiveness of the CPA profession's self-regulatory process as well as the effectiveness of the audit to uphold the public trust in the capital markets. The requirements of the Sarbanes-Oxley Act and the SEC regulations implementing the Act are wide-ranging. The banking regulatory agencies also passed regulations implementing certain provisions of the Sarbanes-Oxley Act. Paragraphs 1.99–.111 provide additional information regarding regulatory issuances related to the Sarbanes-Oxley Act. In addition, the Sarbanes-Oxley Act created the PCAOB, which has the authority to set and enforce auditing, attestation, quality control, and ethics (including independence) standards for auditors of entities subject to the oversight authority of the PCAOB. It also is empowered to inspect the auditing operations of public accounting firms that audit entities subject to the oversight authority of the PCAOB as well as impose disciplinary and remedial sanctions for violations of the board's rules, securities laws, and professional auditing and accounting standards.

1.23 Key economic issues affecting the regulations are centered on the ability of financial institutions to operate profitably—for example, the costs and benefits of regulations, the effects of unemployment and future corporate layoff plans, levels of interest rates, and the availability of credit.

Deposit Insurance Fund

1.24 On October 7, 2008, the FDIC established a Restoration Plan for the DIF to return the DIF to its statutorily mandated minimum reserve ratio of 1.15 percent within 5 years. In February 2009, the FDIC amended its Restoration Plan to extend the restoration period from 5 to 7 years. Congress then amended the statute governing the Restoration Plan, in May 2009, to allow the FDIC up to 8 years to return the DIF reserve ratio to 1.15 percent. In September 2009, the FDIC amended the Restoration Plan consistent with the statutory change and, pursuant to the amended Restoration Plan, adopted a uniform 3 basis point increase in initial assessment rates effective January 1, 2011.

1.25 The Dodd-Frank Act requires the FDIC to set a designated reserve ratio of not less than 1.15 percent for any year and to increase the level of the DIF to 1.35 percent of estimated insured deposits by September 30, 2020.¹ In March 2016, the FDIC approved a final rule, effective July 1, to increase the DIF to the statutorily required minimum level of 1.35 on institutions with total consolidated assets of $10 billion or more while providing credits to institutions that have assets or less than $10 billion. Readers are encouraged to consult the full text of this final rule on FDIC’s website at www.fdic.org. The Dodd-Frank Act also called for a revision to the definition of the deposit insurance assessment base. The intent of changing the assessment base was to shift a greater percentage of overall total assessments away from community institutions and toward the largest institutions.

1.26 In response to the provisions of the Dodd-Frank Act, in February 2011, the FDIC’s board of directors, through the issuance of Financial Institution Letter (FIL)-8-2011, adopted the final rule Deposit Insurance Assessment Base, Assessment Rate Adjustments, Dividends, Assessment Rates, and Large Bank Pricing Methodology to redefine the deposit insurance assessment base, as required by the Dodd-Frank Act; alter the assessment rates; implement the Dodd-Frank Act’s DIF dividend provisions; and revise the risk-based assessment system for all large insured depository institutions (IDIs).² The final rule

• redefines the deposit insurance assessment base as average consolidated total assets minus average tangible equity (the assessment base had previously been defined as total domestic deposits).
• makes generally conforming changes to the unsecured debt and brokered deposit adjustments to assessment rates.
• creates a depository institution debt adjustment.
• eliminates the secured liability adjustment.
• adopts a new assessment rate schedule which became effective April 1, 2011, and, in lieu of dividends, other rate schedules when the reserve ratio reaches certain levels.

1.27 In addition, the final rule establishes a new methodology for calculating deposit insurance assessment rates for highly complex and other large IDIs (commonly referred to as the Large Bank Pricing Rule). The new methodology combines capital adequacy, asset quality, management, earnings, liquidity, and sensitivity to market risk (CAMELS) ratings and financial measures to produce a score that is converted into an institution's assessment rate. The Large Bank Pricing Rule authorizes the FDIC to adjust, up or down, an institution's total score by 15 basis points. The final rule became effective on April 1, 2011. For further information, readers can access the final rule on the FDIC website at www.fdic.gov.

1.28 In September 2011, the FDIC adopted guidelines describing the process that the FDIC will follow to determine whether to make an adjustment, to determine the size of any adjustment, and to notify an institution of an adjustment made to its assessment rate score, as allowed under the Large Bank Pricing Rule. The guidelines also provide examples of circumstances that might give rise to an adjustment. Further information on the guidelines can be found in FIL-64-2011, Assessments: Assessment Rate Adjustment Guidelines, on the FDIC website at www.fdic.gov.

1.29 In October 2012, the FDIC’s board of directors, through the issuance of FIL-44-2012, Assessments: Final Rule on Assessments, Large Bank Pricing, adopted a final rule to amend and clarify definitions related to higher risk assets as used by the deposit insurance pricing scorecards for large and highly complex IDIs. The rule applies only to institutions with $10 billion or more in assets. Specifically, the rule revises the definition of certain higher risk assets, such as leveraged loans and subprime consumer loans; clarifies the timing of identifying an asset as higher risk; clarifies the way securitizations (including those that meet the definition of nontraditional mortgage loans) are identified as higher risk; and further defines terms that are used in the large bank pricing rule adopted in February 2011. The final rule became effective on April 1, 2013. For further information, readers are encouraged to access the final rule in FIL-44-2012 on the FDIC website at www.fdic.gov.

1.30 In November 2014, the FDIC issued the Assessments final rule to revise the FDIC’s risk-based deposit insurance assessment system to reflect changes in the regulatory capital rules. The final rule

• conforms the capital ratios and ratio thresholds in the small institution assessment system to the new PCA capital ratios and ratio thresholds.
• conforms the assessment base calculation for custodial banks to the new asset risk weights using the standardized approach in the regulatory capital rules.
• requires that all highly complex institutions measure counterparty exposure for the assessment purposes using the Basel III standardized approach credit equivalent amount for derivatives and the Basel III standardized approach exposure amount for securities financing transactions in the regulatory capital rules.

For further information, readers can access the final rule in FIL-57-2014, Assessments: Final Rule, on the FDIC website at www.fdic.gov.

The Dodd-Frank Act

1.31 The Dodd-Frank Act was signed into law by President Obama on July 21, 2010. It aims to promote U.S. financial stability by improving accountability and transparency in the financial system, putting an end to the belief that certain financial institutions were too big to fail, protecting American taxpayers by ending bailouts, and protecting consumers from abusive financial services practices. The Dodd-Frank Act contains many provisions; some highlights that may be of particular interest to readers are summarized in the following sections.

1.32 A copy of the full Dodd-Frank Act, as signed by the president, can be found at www.gpo.gov. The AICPA is also following any developments related to the Dodd-Frank Act on its website at aicpa.org on the "Federal Issues" page under “Advocacy.”

Capital Adequacy

1.66 The FDIC, the OCC, and the Federal Reserve historically had common capital adequacy guidelines which differed in some respects from those of the OTS, prior to its transfer of powers, involving minimum (a) leverage capital and (b) risk-based capital requirements.¹³ Capital adequacy guidelines are now substantially the same for banks and savings associations. A summary of the general requirements follows. Specific requirements are set forth in Title 12, Banks and Banking, of U.S. CFR and in the instructions for the FFIEC’s Consolidated Reports of Condition and Income (Call Report) and the Federal Reserve's Consolidated Financial Statements for Holding Companies—FR Y-9C. The reports are required to be filed quarterly and contain certain financial information, including information used in calculating regulatory capital ratios and amounts.¹⁴

1.67 The OCC, the Federal Reserve, and the FDIC established a minimum common equity tier 1 capital ratio of 4.5 percent, tier 1 capital ratio of 6 percent, total capital ratio of 8 percent, and leverage ratio of 4 percent. The capital rules limit capital distributions and certain discretionary bonus payments if banks do not maintain a capital conservation buffer of common equity tier 1 capital above minimum capital requirements. Advanced approaches organizations (defined as banking organizations with $250 billion or more in total consolidated assets or total consolidated on-balance sheet foreign exposure of $10 billion or more) must also maintain a minimum supplementary leverage ratio of 3 percent. Although advanced approaches banking organizations are not required to comply with the minimum supplementary leverage ratio until January 1, 2018, they were required to begin reporting the ratio as of January 1, 2015. By statute, the FDIC and the OCC also require all federal and state savings associations to maintain a tangible capital requirement of 1.5 percent of assets. The advanced approaches and standardized capital ratio calculations can be found at 12 CFR 3.10 (OCC), 12 CFR 217.10 (Federal Reserve), and 12 CFR 324.10 (FDIC).

1.68 Risk-based capital standards of the FDIC, the OCC, and the Federal Reserve explicitly identify concentrations of credit risk, risks of nontraditional activities, and IRR as qualitative factors to be considered in examiner assessments of an institution's overall capital adequacy; however, the standards require no specific quantitative measure of such risks.

1.69 The FDIC, the OCC, and the Federal Reserve have augmented their IRR requirements through a joint policy statement, Joint Agency Policy Statement on Interest Rate Risk, that explains how examiners will assess institutions' IRR exposure.^15,16 The policy statement also suggests that institutions with complex systems for measuring IRR may seek assurance about the institution's risk management process from internal and external auditors.

1.70 The Market Risk Rule (MRR) establishes risk-based regulatory capital requirements for bank holding companies, state member banks, SLHCs, national banks, federal savings associations, and state savings associations (collectively, banking organizations) with significant exposure to certain market risks. The MRR implements the Amendment to the Capital Accord (Market Risk Amendment or MRA) to incorporate market risks issued by the Basel Committee on Banking Supervision in 1996 and modified in 1997, 2005, 2009, and 2010. The MRR is set forth at 12 CFR 217, subpart F (Federal Reserve), 12 CFR 3, subpart F (OCC), and 12 CFR 324, subpart F (FDIC).

1.71 The effect of the market risk capital rules is that any banking organization regulated by the federal banking agencies, with significant exposure to market risk, generally must measure that risk using its own internal value at risk model, and hold a commensurate amount of capital. The amount of capital required to be held includes tier 1 and tier 2 capital. The regulatory capital requirements only apply to banking organizations whose trading activity on a worldwide consolidated basis equals 10 percent or more of the total assets or totals $1 billion or more.

1.72 In June 2012, the OCC, the Federal Reserve, and the FDIC amended the market risk capital rule. The amendment revises the calculation of market risk to better characterize the risks facing a particular institution and to help ensure the adequacy of capital related to the institution’s market risk-related positions. Under the amendment, additional charges were implemented for stressed VaR, credit risk, correlation trading, and other securitizations. The amendment became effective on January 1, 2013, and can be accessed from any of the agencies’ websites.

1.73 Institutions are required to report certain financial information to regulators in quarterly Call Reports, which include amounts used in calculations of the institution's various regulatory capital ratios and amounts.

1.74 Under the capital adequacy standards of the OCC, the Federal Reserve, and the FDIC, a banking organization must deduct certain assets from common equity tier 1 capital. A banking organization is permitted to net associated deferred tax liability against some of those assets prior to making the deduction from tier 1 capital, if the deferred tax liability is associated with the assets and the deferred tax liability would be extinguished if the associated asset becomes impaired or is derecognized under GAAP. Deductions from common equity tier 1 capital include goodwill and other intangible, deferred tax assets that arise from net operating loss and tax credit carryforwards, gains on sale in connection with a securitization, any defined benefit pension fund net asset held by entities that are not depository institutions (unless the banking organizations has unrestricted and unfettered access to the assets in that fund), investments in a banking organization’s own capital instruments, mortgage servicing rights (above certain levels) and investments in the capital of unconsolidated financial institutions (above certain levels).

Prompt Corrective Action

1.75 The FDICIA made capital an essential tool for regulators to monitor the financial health of insured banks and savings institutions. Regulatory intervention is now focused primarily on an institution's capital levels relative to regulatory standards. In Section 38, "Rules, Regulations, and Orders," of the FDI Act, the FDICIA added (to the existing capital adequacy guidelines set forth by each agency) a uniform framework for prompt corrective regulatory action. Holding companies are not subject to the PCA provisions.

1.76 Section 38 provides for supervisory action at certain institutions based on their capital levels. Each institution falls into one of five regulatory capital categories (see paragraph 1.79) based primarily on four capital measures, total risk-based capital; tier 1 based capital; common equity tier 1 capital; and leverage ratios.¹⁷ These capital ratios are defined in the same manner for Section 38 purposes as under the respective agencies' capital adequacy guidelines and regulations. For savings associations, tier 1 leverage capital is comparable to core capital.

1.77 Regulations also specify a minimum requirement for tangible equity, which is defined as tier 1 capital plus outstanding perpetual preferred stock not included in tier 1 capital. In calculating the tangible capital ratio, the regulations specify specific deductions that should be applied to total assets included in the ratio denominator.

1.78 An institution may be reclassified between certain capital categories if its condition or an activity is deemed by regulators to be unsafe or unsound. A change in an institution's capital category initiates certain mandatory—and possibly additional discretionary—action by regulators.

1.79 Under Section 38 of the FDI Act, an institution is considered

1.80 The PCA levels are defined as follows:

1.81 Critically undercapitalized institutions are those having a ratio of tangible equity to total assets of 2 percent or less.

1.82 An institution will not be considered well capitalized if it is under a capital-related cease-and-desist order, formal agreement, capital directive, or PCA capital directive.

1.83 Actions that may be taken under the PCA provisions range from the restriction or prohibition of certain activities to the appointment of a receiver or conservator of the institution's net assets.

1.84 Regulators will also require undercapitalized institutions to submit a plan for restoring the institution to an acceptable capital category. For example, each undercapitalized institution is generally required to submit a plan that specifies the following:

• Steps the institution will take to become adequately capitalized
• Targeted capital levels for each year of the plan
• How the institution will comply with other restrictions or requirements put into effect
• Types and levels of activities in which the institution will engage

1.85 Noncompliance or expected noncompliance with regulatory capital requirements may be a condition that, when considered with other factors, could indicate substantial doubt about an entity's ability to continue as a going concern. The implementation of the PCA provisions warrants similar attention by independent accountants when considering an institution's ability to remain a going concern.

Additional Regulatory Requirements Concerning the Sarbanes-Oxley Act, Corporate Governance, and Services Outsourced to External Auditors

1.99 In connection with the Sarbanes-Oxley Act of 2002, the SEC issued regulations implementing sections of the act, addressing various areas such as certification of financial statements, auditor independence, non-U.S. GAAP financial measures, accounting firms’ record retention, audit committees, influencing auditors, and other matters. These regulations are not unique to financial institutions. Management, the board of directors, the audit committee, and auditors generally should be aware of the requirements of the Sarbanes-Oxley Act and the implementing SEC regulations.

1.100 In addition to the previously mentioned regulations, in June 2003, the SEC adopted rules requiring companies subject to the reporting requirements of the 1934 Act, other than registered investment companies, to assess the effectiveness of their internal control and include in their annual reports a report of management on the company's internal control over financial reporting. The rule also mandates quarterly reports on changes in internal control. See paragraphs 1.102–.105 and 1.111 for additional information regarding these rules.

1.101 The banking regulatory agencies also implemented regulations in connection with the Sarbanes-Oxley Act. These regulations can affect nonpublic as well as public entities. These regulations include the following:

• On March 17, 2003, the FDIC, the OTS, the OCC, and the Federal Reserve issued Interagency Policy Statement on the Internal Audit Function and Its Outsourcing.²⁰ This policy statement reflects the passage of the Sarbanes-Oxley Act and prohibits an external auditor from providing internal audit services during the same period for which the external auditor expresses an opinion on the financial statements. This prohibition applies to banks, savings associations, and their holding companies that

—  have a class of securities registered with either the SEC or the respective savings association agency under Section 12 of the 1934 Act or are required to file reports with the SEC under Section 15(d) of that act (commonly referred to as public companies) and, therefore, required to have an external audit.

—  are savings associations and banks with assets of $500 million or more that are subject to the FDIC's external audit and reporting requirements under Part 363.

—  are savings associations and savings association holding companies that are required to have an external audit by their respective primary federal regulator pursuant to 12 CFR 162 (OCC), 12 CFR 238.5 (Federal Reserve), or Subpart R to 12 CFR 390 (FDIC).

For all other banks, savings associations, and their holding companies that have external audits of their financial statements but are not mandated to do so, the policy encourages such organizations to follow the internal audit outsourcing prohibition in Section 201 of the Sarbanes-Oxley Act when the SEC's regulations implementing this prohibition take effect.

On March 5, 2003, the FDIC issued FIL-17-2003, Corporate Governance, Audits, and Reporting Requirements, and the Federal Reserve, the OCC, and the OTS, in May 2003, issued Statement on Application of Recent Corporate Governance Initiatives to Non-Public Banking Organizations. This letter and statement require or recommend that certain nonpublic financial institutions comply with certain sections of the Sarbanes-Oxley Act. Familiarity with this guidance is recommended for external auditors.

• On August 12, 2003, the FDIC, the OCC, the Federal Reserve, and the OTS jointly issued final rules that establish procedures under which the agencies could remove, suspend, or bar an accountant or firm from performing audit and attestation services for IDIs subject to the annual audit and reporting requirements of Section 36. Section 36 applies to institutions with $500 million or more in total assets.
• Effective April 1, 2003, the Federal Reserve adopted a final rule to reflect the amendments made to Section 12(i) of the 1934 Act. These amendments vest the Federal Reserve with the authority to administer and enforce several of the enhanced reporting, disclosure, and corporate governance obligations imposed by the Sarbanes-Oxley Act in respect to state member banks that have a class of securities registered under the 1934 Act.
• On June 30, 2005, the FFIEC issued the BSA/AML manual. The manual was the result of a collaborative effort of the federal banking agencies and the Treasury's FinCEN. The manual does not set new standards; instead, it is a compilation of existing regulatory requirements, supervisory expectations, and sound practices in the BSA/AML area.
• On November 28, 2005, the FDIC amended Part 363 of its regulations by raising the asset-size threshold from $500 million to $1 billion for internal control assessments by management and external auditors. For institutions between $500 million and $1 billion in assets, the audit committee of its board of directors should be outside directors, the majority of whom should be independent of management of the institution.
• In June 2009, as previously noted, the FDIC’s Board of Directors approved amendments to Part 363 of its regulations. Among other requirements, the amendments require both management’s assessment and the auditor’s report on internal control over financial reporting to disclose the internal control framework used by management and the auditor and to identify all material weaknesses that have been identified that have not been remediated as of the end of the institution’s fiscal year. See the following for additional information.

1.102 Sarbanes-Oxley Act Section 404 and Part 363. Public companies that are subject to Section 36 of the FDI Act and Part 363 (more than $500 million in assets) must prepare reports for the SEC, the FDIC, and other regulators that are similar in nature. Section 404(a) of the Sarbanes-Oxley Act mandates that registrants (a) take responsibility for establishing and maintaining adequate internal control structure and procedures and (b) assess their effectiveness at the end of each fiscal year. According to the SEC’s final rule Management's Report on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports, management generally must create a Management’s Annual Internal Control Report as part of the Annual Report. (Quarterly updating is necessary only if the internal control environment has changed or is likely to change materially.) The report must contain the following:

• A statement of management’s responsibility for establishing and maintaining adequate internal control over financial reporting for the company.
• A statement identifying the framework used by management to evaluate the effectiveness of this internal control.
• Management’s assessment of the effectiveness of internal control as of the end of the company’s most recent fiscal year, including a statement about whether internal control over financial reporting is effective.
• Disclosure of any material weaknesses. Management is not permitted to conclude that the registrant’s internal control over financial reporting is effective if there are one or more material weaknesses in the issuer’s internal control over financial reporting.
• A statement that its auditor has issued an attestation report on management’s assessment, which is normally included in the company’s annual report.

1.103 The SEC coordinated with the FDIC to eliminate any unnecessary duplication between the aforementioned requirements and Section 36 of the FDI Act and Part 363. Many internal control requirements of the Sarbanes-Oxley Act were structured after Section 36 of the FDI Act and Part 363. A comparison of Sarbanes-Oxley and the Part 363 management requirements are indicated in the following table for clarity.

1.104 IDIs with $1 billion or more in total assets as of the beginning of its fiscal year that are subject to both Part 363 and the SEC’s rules implementing Section 404 of Sarbanes-Oxley Act (as well as holding companies permitted to file an internal control report on behalf of their IDI subsidiaries in satisfaction of the FDIC and SEC regulations) can choose to either prepare two separate management reports to satisfy the FDIC’s and Sarbanes-Oxley Act Section 404 requirements or prepare a single management report that satisfies both the FDIC and Sarbanes-Oxley Act Section 404 requirements.

1.105 If a single report is prepared it must contain the following combined requirements of the preceding chart:

• A statement of management’s responsibility for preparing the registrant’s annual financial statements, for establishing and maintaining adequate internal control over financial reporting for the registrant, and for the institution’s compliance with laws and regulations relating to safety and soundness designated by the FDIC and the appropriate federal banking agencies.
• A statement identifying the framework used by management to evaluate the effectiveness of the registrant’s internal control over financial reporting as required by the 1934 Act Rule 13a-15 or 15d-15.
• Management’s assessment of the effectiveness of the registrant’s internal control over financial reporting as of the end of the registrant’s most recent fiscal year, including a statement regarding whether or not management has concluded that the registrant’s internal control over financial reporting is effective, and of the institution’s compliance with the designated safety and soundness laws and regulations pertaining to insider loans and dividend restrictions during the fiscal year. This discussion must include disclosure of any material weakness in the registrant’s internal control over financial reporting identified by management and disclosure of any instances of noncompliance with the designated safety and soundness laws and regulations pertaining to insider loans and dividend restrictions.
• A statement that the registered public accounting firm that audited the financial statements included in the registrant’s annual report, has issued an attestation report on the effectiveness of the registrant’s internal control over financial reporting.

Finally, it is important to note that the institution or holding company will have to provide the registered public accounting firm’s attestation report on management’s assessment in its annual report filed under the 1934 Act. For purposes of the report of management and the attestation report, financial reporting generally must encompass both financial statements prepared in accordance with GAAP and those prepared for regulatory reporting purposes.

1.106 Section 404(b) of the Sarbanes-Oxley Act and Part 363 require the external auditor to attest to, and publicly report on the effectiveness of the company’s internal control and procedures for financial reporting. Section 404(b) states, that any such attestation should not be the subject of a separate engagement. Auditors are expected to expand their scope in relation to internal control.

1.107 In September 2010, the SEC issued Final Rule Release No. 33-9142, Internal Control Over Financial Reporting in Exchange Act Periodic Reports of Non-Accelerated Filers, to conform its rules to Section 404(c) of the Sarbanes-Oxley Act, as added by Section 989G of the Dodd-Frank Act. Section 404(c) provides that Section 404(b) of the Sarbanes-Oxley Act should not apply with respect to any audit report prepared for an issuer that is neither an accelerated filer nor a large accelerated filer as defined in Rule 12b-2 under the 1934 Act. Prior to enactment of the Dodd-Frank Act, a nonaccelerated filer would have been required, under existing SEC rules, to include an attestation report of its registered public accounting firm on internal control over financial reporting in the filer’s annual report filed with the SEC for fiscal years ending on or after June 15, 2010. For further information on conforming changes adopted as a result of this ruling, Final Rule Release No. 33-9142 can be accessed on the SEC website at www.sec.gov. Notwithstanding the SEC’s final rule, IDIs subject to Part 363 of the FDIC’s rules and regulations must continue to comply with the requirements of Section 363.3(b) regarding the independent public accountant’s attestation report on management’s assessment of the effectiveness of internal control over financial reporting.

1.108 For an institution that is a public company or a subsidiary of a public company that is required to comply with the auditor attestation requirement of Section 404 of the Sarbanes-Oxley Act, the auditor’s report would be prepared in accordance with AS 2201.

1.109 Generally, for an institution that is not a public company or a subsidiary of a public company, the auditor’s report would be prepared in accordance with AU-C section 940.

1.110 Guideline 18A of Part 363 of the FDIC’s regulations provides additional guidance regarding the standards that auditors should follow when reporting on internal control.

1.111 Section 404 of the Sarbanes-Oxley Act does not specify where the management report might appear. However, SEC Final Rule Release No. 33-8238, Management's Reports on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports, explains that it is important for management's report to be in close proximity to the corresponding attestation report issued by the company's registered public accounting firm. Positioning the report near the company’s Management’s Discussion and Analysis disclosure or immediately preceding the company’s financial statements would be two appropriate locations.