Está en la página 1de 8

71226 Federal Register / Vol. 70, No.

227 / Monday, November 28, 2005 / Rules and Regulations

2. The transfer and presentment warranties FEDERAL DEPOSIT INSURANCE institutions) through annual
for remotely created checks supplement the CORPORATION independent audits, assessments of the
Federal Trade Commission’s Telemarketing effectiveness of internal control over
Sales Rule, which requires telemarketers that 12 CFR Part 363 financial reporting and compliance with
submit checks for payment to obtain the designated laws and regulations, and
RIN 3064–AC91
customer’s ‘‘express verifiable authorization’’ related requirements. Section 36 also
(the authorization may be either in writing or Independent Audits and Reporting includes requirements for audit
tape recorded and must be made available committees at these insured depository
Requirements
upon request to the customer’s bank). 16 CFR institutions. Section 36 grants the FDIC
310.3(a)(3). The transfer and presentment AGENCY: Federal Deposit Insurance discretion to set the asset size threshold
warranties shift liability to the depositary Corporation (FDIC). for compliance with these statutory
bank only when the remotely created check ACTION: Final rule. requirements, but it states that the
is unauthorized, and would not apply when threshold cannot be less than $150
the customer initially authorizes a check but SUMMARY: The FDIC is amending part million. Sections 36(d) and (f) also
then experiences ‘‘buyer’s remorse’’ and 363 of its regulations concerning annual obligate the FDIC to consult with the
subsequently tries to revoke the authorization independent audits and reporting other Federal banking agencies in
by asserting a claim against the paying bank requirements, which implement section implementing these sections of the FDI
under U.C.C. 4–401. If the depositary bank 36 of the Federal Deposit Insurance Act Act, and the FDIC has performed that
suspects ‘‘buyer’s remorse,’’ it may obtain (FDI Act), as proposed, but with consultation requirement.
from its customer the express verifiable modifications to the composition of the Part 363 of the FDIC’s regulations (12
authorization of the check by the paying audit committee and the effective date. CFR part 363), which implements
bank’s customer, required under the Federal The FDIC’s amendments raise the asset- section 36 of the FDI Act, requires each
Trade Commission’s Telemarketing Sales size threshold from $500 million to $1 covered institution to submit to the
Rule, and use that authorization as a defense billion for internal control assessments FDIC and other appropriate Federal and
to the warranty claim. by management and external auditors. state supervisory agencies an annual
3. The scope of the transfer and For institutions between $500 million report that includes audited financial
presentment warranties for remotely created and $1 billion in assets, the statements, a statement of management’s
checks differs from that of the corresponding amendments require the majority, rather responsibilities, assessments by
U.C.C. warranty provisions in two respects. than all, of the members of the audit management of the effectiveness of
The U.C.C. warranties differ from the committee, who must be outside internal control over financial reporting
§ 229.34(d) warranties in that they are given directors, to be independent of and compliance with designated laws
by any person, including a nonbank and regulations, and an auditor’s
management and create a hardship
depositor, that transfers a remotely created attestation report on internal control
exemption. The amendments also make
check and not just to a bank, as is the case over financial reporting. In addition,
certain technical changes to part 363 to
under § 229.34(d). In addition, the U.C.C. part 363 provides that each covered
correct outdated titles, terms, and
warranties state that the person on whose institution must establish an
references in the regulation and its
account the item is drawn authorized the independent audit committee of its
appendix. As required by section 36, the
issuance of the item in the amount for which board of directors comprised of outside
the item is drawn. The § 229.34(d) warranties
FDIC has consulted with the other
federal banking agencies. directors who are independent of
specifically cover the amount as well as the
EFFECTIVE DATE: The final rule is management of the institution. Part 363
payee stated on the check. Neither the U.C.C.
effective December 28, 2005 and applies also includes Guidelines and
warranties, nor the § 229.34(d) warranties
to part 363 annual reports with a filing Interpretations (Appendix A to part
apply to the date stated on the remotely
deadline (90 days after the end of an 363), which are intended to assist
created check.
institution’s fiscal year) on or after the institutions and independent public
4. A bank making the § 229.34(d)
effective date of these amendments. accountants in understanding and
warranties may defend a claim asserting
complying with section 36 and part 363.
violation of the warranties by proving that FOR FURTHER INFORMATION CONTACT: When it adopted part 363 in 1993, the
the customer of the paying bank is precluded Harrison E. Greene, Jr., Senior Policy FDIC stated that it was setting the asset
by U.C.C. 4–406 from making a claim against Analyst (Bank Accounting), Division of size threshold at $500 million rather
the paying bank. This may be the case, for Supervision and Consumer Protection, than the $150 million specified in
example, if the customer failed to discover at hgreene@fdic.gov or (202) 898–8905; section 36 to mitigate the financial
the unauthorized remotely created check in or Michelle Borzillo, Counsel, burden of compliance with section 36
a timely manner. Supervision and Legislation Section, consistent with safety and soundness. In
5. The transfer and presentment warranties Legal Division, at mborzillo@fdic.gov or selecting $500 million in total assets as
for a remotely created check apply to a (202) 898–7400. the size threshold, the FDIC noted that
remotely created check that has been
SUPPLEMENTARY INFORMATION: approximately 1,000 of the then nearly
reconverted to a substitute check.
14,000 FDIC-insured institutions would
* * * * * I. Background
be subject to part 363. These covered
By order of the Board of Governors of the Section 112 of the Federal Deposit institutions held approximately 75
Federal Reserve System, November 21, 2005. Insurance Corporation Improvement Act percent of the assets of insured
Jennifer J. Johnson, of 1991 (FDICIA) added section 36, institutions at that time. By imposing
‘‘Early Identification of Needed the audit, reporting, and audit
Secretary of the Board.
Improvements in Financial committee requirements of part 363 on
[FR Doc. 05–23331 Filed 11–25–05; 8:45 am] Management,’’ to the FDI Act (12 U.S.C. institutions with this percentage of the
BILLING CODE 6210–01–P 1831m). Section 36 is generally industry’s assets, the FDIC intended to
intended to facilitate early identification ensure that the Congress’s objectives for
of problems in financial management at achieving sound financial management
insured depository institutions above a at insured institutions when it enacted
certain asset size threshold (covered section 36 would be focused on those

VerDate Aug<31>2005 17:18 Nov 25, 2005 Jkt 208001 PO 00000 Frm 00016 Fmt 4700 Sfmt 4700 E:\FR\FM\28NOR1.SGM 28NOR1
Federal Register / Vol. 70, No. 227 / Monday, November 28, 2005 / Rules and Regulations 71227

institutions posing the greatest potential An institution subject to part 363 has have the effect of requiring greater
risk to the insurance funds administered the added requirement that its documentation and testing of internal
by the FDIC. Today, due to management perform an assessment of control over financial reporting by an
consolidation in the banking and thrift the internal control structure and institution’s management in order for
industry and the effects of inflation, procedures for financial reporting and the auditor to perform his or her
more than 1,150 of the 8,900 insured that its external auditor examine, attest attestation work.
institutions have $500 million or more to, and report on management’s
As the environment has changed and
in total assets and are therefore subject assertion concerning the institution’s
internal control over financial reporting. continues to change since the enactment
to part 363. These covered institutions
For purposes of these internal control of the Sarbanes-Oxley Act, the FDIC has
hold approximately 90 percent of the
assets of insured institutions. provisions of part 363, the FDIC has observed that compliance with the audit
advised covered institutions that the and reporting requirements of part 363
II. Discussion of Proposed Amendments term ‘‘financial reporting’’ includes both has and will continue to become more
On July 19, 2005, the FDIC’s Board financial statements prepared in burdensome and costly, particularly for
approved the publication of proposed accordance with generally accepted smaller nonpublic covered institutions.
amendments to part 363 of the FDIC’s accounting principles and those Thus, the FDIC reviewed the current
regulations, which were published in prepared for regulatory reporting asset size threshold for compliance with
the Federal Register on August 2, 2005, purposes.1 Until year-end 2004, external part 363 in light of the discretion
for a 45-day comment period (70 FR auditors performed their internal granted by section 36 that permits the
44293). The comment period closed on control assessments in accordance with FDIC to determine the appropriate size
September 16, 2005. As more fully an attestation standard issued by the threshold (at or above $150 million) at
discussed below, the FDIC proposed to American Institute of Certified Public which insured institutions should be
raise the asset-size threshold in part 363 Accountants (AICPA) known as ‘‘AT subject to the various provisions of
from $500 million to $1 billion for 501.’’ section 36. Based on this review, the
internal control assessments by The Sarbanes-Oxley Act was enacted FDIC proposed to amend part 363 to
management and external auditors and into law on July 30, 2002. Section 404 increase the asset size threshold for
for the members of the audit committee, of this Act imposes a requirement for internal control assessments by
who must be outside directors, to be internal control assessments by the management and external auditors from
independent of management. The FDIC management and external auditors of all $500 million to $1 billion. Raising the
also proposed to make certain technical public companies that is similar to the threshold to $1 billion would achieve
changes to part 363 to correct outdated FDICIA requirement. The Securities and meaningful burden reduction without
titles, terms, and references in the Exchange Commission’s (SEC) rules
sacrificing safety and soundness.
regulation and its appendix. As implementing these requirements took
effect at year-end 2004 for ‘‘accelerated In reaching this decision, the FDIC
proposed, the effective date of these
filers,’’ i.e., generally, public companies concluded that raising the $500 million
amendments was to be December 31,
whose common equity has an aggregate asset size threshold to $1 billion and
2005.
market value of at least $75 million, but exempting all institutions below this
In its proposal, the FDIC also noted higher size level from all of the
that it had identified other aspects of they will not take effect until 2007 for
‘‘non-accelerated filers.’’ For the section reporting requirements of part 363
part 363 that may warrant revision in
404 auditor attestations, the Public would not be consistent with the
light of changes in the industry and the
Company Accounting Oversight Board’s objective of the underlying statute, i.e.,
passage of the Sarbanes-Oxley Act of
(PCAOB) Auditing Standard No. 2 (AS early identification of needed
2002. However, the FDIC stated that it
2) applies. AS 2 replaces the AICPA’s improvements in financial management.
had decided to proceed first with the
AT 501 internal control attestation In contrast, the FDIC believes that
proposed amendments to the asset-size
threshold in part 363 in order to reduce standard for public companies, but AS relieving smaller covered institutions
compliance burdens and expenses for 2 does not apply to nonpublic from the burden of internal control
affected institutions in 2005. These companies. The SEC’s section 404 rules assessments, while retaining the
further revisions to part 363 are for management and the provisions of financial statement audit and other
expected to be proposed as soon as AS 2 for section 404 audits of internal reporting requirements for all
practicable. control establish more robust institutions with $500 million or more
documentation and testing requirements in total assets, strikes an appropriate
A. Increasing the Asset Size Threshold than those that have been applied by balance in accomplishing this objective.
for Internal Control Assessments covered institutions and their auditors By raising the size threshold for internal
to satisfy the internal control reporting control assessments to $1 billion, about
An effective internal control structure
requirements in part 363. 600 of the largest insured institutions
is critical to the safety and soundness of For internal control attestations of
each insured institution. Given its with approximately 86 percent of
nonpublic companies, the AICPA is industry assets would continue to be
importance, internal control is currently developing proposed revisions covered by the internal control reporting
evaluated as part of the supervision of to AT 501 that are expected to bring it
individual institutions and its adequacy requirements of part 363. At the same
closer into line with the provisions of time, the managements of all covered
is a factor in the management rating AS 2. The revisions also are likely to institutions would remain responsible
assigned to an institution. Furthermore,
in the audit of an institution’s financial 1 See FDIC Financial Institution Letter (FIL) 86–
for establishing and maintaining an
statements, the external auditor must 94, dated December 23, 1994. FIL–86–94 indicates adequate internal control structure and
obtain an understanding of internal that financial statements prepared for regulatory procedures for financial reporting, and
control, including assessing control risk, reporting purposes encompass the schedules all institutions with $500 million or
equivalent to the basic financial statements in an
and must report certain matters institution’s appropriate regulatory report, e.g., the
more in total assets would continue to
regarding internal control to the bank Reports of Condition and Income and the include a statement to that effect in their
institution’s audit committee. Thrift Financial Report. part 363 annual report.

VerDate Aug<31>2005 17:18 Nov 25, 2005 Jkt 208001 PO 00000 Frm 00017 Fmt 4700 Sfmt 4700 E:\FR\FM\28NOR1.SGM 28NOR1
71228 Federal Register / Vol. 70, No. 227 / Monday, November 28, 2005 / Rules and Regulations

B. Composition of the Audit Committee of $500 million or more but less than $1 departments, stated that there is value
Currently, part 363 requires each billion would continue to be required to in maintaining a significant level of
covered institution to establish an have an audit committee comprised of independence when fulfilling the
independent audit committee of its outside directors. Consistent with important role of an audit committee
board of directors, comprised of outside Guideline 29 of Appendix A to part 363, member. Although it saw benefit in
directors who are independent of an outside director would be defined as alleviating some of the burden of a fully
management of the institution. The an individual who is not, and within the independent audit committee, for safety
duties of the audit committee include preceding year has not been, an officer and soundness considerations, the CSBS
reviewing with management and the or employee of the institution or any recommended that the chairman and a
institutions’ independent public affiliate of the institution. majority of the audit committee
accountant the basis for the reports The proposed amendment to the audit members at institutions in the $500
included in the part 363 annual report committee requirements for institutions million to $1 billion asset size range be
submitted to the FDIC and other with between $500 million and $1 required to be independent of
appropriate Federal and state billion in total assets would allow an management rather than allowing all of
supervisory agencies. The FDIC’s outside director who is, for example, a the outside directors on the audit
Guidelines to part 363 provide that, at consultant or legal counsel to the committee not to be independent of
least annually, the board of directors of institution, a relative of an officer or management.
a covered institution should determine employee of the institution or its Five other commenters concurred
whether all existing and potential audit affiliates, or the owner of 10 percent or with the FDIC’s observation that some
committee members are ‘‘independent more of the stock of the institution to smaller covered institutions have
of management of the institution.’’ The serve as an audit committee member. encountered difficulty in establishing an
guidelines also describe factors to Nevertheless, the FDIC indicated in the audit committee, all of whose members
consider in making this determination.2 proposal that it would encourage each are independent of management. In this
Section 36 provides that an institution with between $500 million regard, the CSBS’s comment letter also
appropriate federal banking agency may and $1 billion in assets to make a acknowledged the difficulties in
grant a hardship exemption to a covered reasonable good faith effort to establish attaining and keeping a fully
institution that would permit its an audit committee of outside directors independent audit committee,
independent audit committee to be who are independent of management. especially in smaller rural communities.
made up of less than all, but no fewer Individuals who serve as directors of
III. Comments Received on Proposed insured institutions, whether or not they
than a majority of, outside directors who
Amendments serve on the audit committee, are
are independent of management. To
grant the exemption, the agency must In response to its August 2, 2005, expected to be persons of independent
find that the institution has encountered request for comment on the proposed judgment. In this regard, under the
hardships in retaining and recruiting a amendments to part 363, the FDIC Uniform Financial Institutions Rating
sufficient number of competent outside received comment letters from 28 System (62 FR 752, January 6, 1997), a
directors. different respondents 3: 15 banking and factor that the federal banking agencies’
Notwithstanding this exemption thrift organizations, 7 bankers’ examiners assess when they evaluate
provision of section 36, the FDIC has associations, 3 accountants and the capability and performance of an
observed that a number of smaller accounting firms, the Conference of institution’s management and board of
covered institutions, particularly those State Bank Supervisors (CSBS), the directors for purposes of assigning an
with few shareholders that have FDIC’s Office of Inspector General appropriate Management component
recently exceeded $500 million in total rating is the extent to which the
(FDIC–OIG), and one other party.
assets and become subject to part 363, management and board members are
Generally, the comment letters
have encountered difficulty in satisfying affected by, or susceptible to, dominant
expressed support for the proposed
the independent audit committee influence or concentration of authority.
amendments. All but one of the
requirement. To comply with this Hence, the agencies’ examination staffs
respondents favored the proposal to
requirement, these institutions must are cognizant of the heightened level of
increase the asset-size threshold for
identify and attract qualified risk presented by the existence of a
internal control assessments by
individuals in their communities who dominant officer, whether or not outside
management and external auditors to $1
would be willing to become a director directors, including those on the audit
billion. As for the proposed increase to
and audit committee member and who committee, are independent of
$1 billion in the asset-size threshold for management.
would be independent of management. the members of the audit committee,
To relieve this burden, but also After carefully considering the CSBS’s
who must be outside directors, to be recommendation, the FDIC has decided
recognizing that the FDIC has long held independent of management, 24 of the
that individuals who serve as directors to amend the proposal to require that a
28 respondents supported this aspect of majority of the audit committee
of any insured depository institution the proposal, two respondents opposed
should be persons of independent members of institutions with $500
it, and two respondents did not directly million to $1 billion in assets, all of
judgment, the FDIC proposed to amend comment on it. Respondents also raised
part 363 to increase from $500 million whom must be outside directors, be
a number of other issues. independent of management. In
to $1 billion the asset size threshold for The CSBS commented on the
requiring audit committee members to addition, in recognition of the
proposed change in the audit committee difficulties that some individual
be independent of management. provisions of part 363 for institutions
Conforming changes were also proposed institutions in this size range may have
with $500 million to $1 billion in assets. in attaining such an audit committee,
to be made to Guidelines 27–29 of The CSBS, on behalf of state banking
Appendix A to part 363. Each insured the final rule will provide an exemption
depository institution with total assets 3 The FDIC received 58 comment letters, which
under which an appropriate Federal
included 20 identical letters from individuals at one
banking agency may, by order or
2 See Guidelines 27 through 29 of Appendix A to institution and 12 identical letters from individuals regulation, permit the audit committee
part 363. at another institution. of such an institution to be made up of

VerDate Aug<31>2005 17:18 Nov 25, 2005 Jkt 208001 PO 00000 Frm 00018 Fmt 4700 Sfmt 4700 E:\FR\FM\28NOR1.SGM 28NOR1
Federal Register / Vol. 70, No. 227 / Monday, November 28, 2005 / Rules and Regulations 71229

less than a majority of outside directors that, over the last several months, 15 condition of the institution. Problems
who are independent of management, if other insured institutions in this size and significant risks may be
the agency determines that the range with a composite rating of 2 had inadequately identified, measured,
institution has encountered hardships a Management component rating of 3. monitored, or controlled by
in retaining and recruiting a sufficient The FDIC–OIG indicated that, in management. Because management’s
number of competent outside directors reviewing past failures of insured ability to respond to changing
to serve on the audit committee of the institutions, it had observed that weak circumstances and address risks is an
institution. The FDIC believes that this corporate governance, including important factor in evaluating an
change to its proposal strikes an financial reporting problems and the institution’s overall risk profile and the
appropriate balance of reducing lack of independence of the board of level of supervisory attention that
regulatory burden without jeopardizing directors from institution management, should be devoted to an institution, the
safety and soundness. was often a factor in the failure of these Management component is given special
Another commenter who addressed institutions and contributed to material consideration when assigning the
the audit committee portion of the losses ($25 million or more) to the institution’s composite rating.
proposal suggested that the FDIC’s deposit insurance funds administered Institutions that have a composite
recommendation that institutions make by the FDIC. The FDIC–OIG also stated rating of 3 or lower are already subject
a ‘‘reasonable good faith effort’’ to that maintaining the full requirements to increased supervisory scrutiny and
establish an audit committee of outside of part 363 for less than satisfactory are normally subject to formal or
directors who are independent of institutions would help to address informal supervisory actions (e.g.,
management was vague and should be potential concerns about deficiencies by Memorandum of Understanding or
deleted from the proposal. This the board of directors and in internal Cease and Desist Order) to address the
commenter added that, if the control, internal audit, and external need for corrective actions for
recommendation were not deleted, the audit and thereby mitigate the weaknesses and deficiencies cited in
FDIC should include a definition of, or possibility of institution failure. reports of examination or otherwise
list of criteria that would constitute, a As defined in the Uniform Financial identified through supervisory
‘‘reasonable good faith effort’’ and Institutions Rating System, institutions oversight. In reviewing the institutions
provide guidance on how an institution with a composite rating of 2 are cited in the FDIC–OIG’s comment letter,
should document that it has undertaken fundamentally sound. There are no the FDIC notes that all of the
such an effort. While the FDIC material supervisory concerns and, as a institutions with a composite rating of 3
encourages each institution with result, the supervisory response is or lower are subject to formal and/or
between $500 million and $1 billion in informal and limited. Institutions with a informal supervisory actions and all of
assets to make a reasonable good faith composite rating of 3 exhibit some the institutions with a composite rating
effort to establish an audit committee degree of supervisory concern in one or of 2 and a Management component
comprised entirely of outside directors more of the six component areas rating of 3 or lower are subject to
who are independent of management, (Capital Adequacy, Asset Quality, supervisory actions. The FDIC further
each institution faces a unique set of Management, Earnings, Liquidity, and notes that approximately half of these
circumstances when it seeks to attract Sensitivity to Market Risk). These institutions are public companies or
competent individuals to be outside financial institutions require more than subsidiaries of public companies that
directors who would be willing to serve normal supervision, which may include are subject to the filing and reporting
on its audit committee. Because a list of formal or informal enforcement actions. requirements of the Federal securities
criteria that would constitute evidence Failure appears unlikely, however, laws as implemented by the SEC.
of a ‘‘reasonable good faith effort’’ could given the overall strength and financial The examination staffs of the FDIC
not consider all of the situations in capacity of these institutions. and the other Federal banking agencies
which institutions engaging in such a Institutions with a composite rating of 4 look to the assessments by management
search might find themselves, the FDIC generally exhibit unsafe and unsound of internal control over financial
has chosen not to restrict institutions practices or conditions. There are reporting and the independent auditors’
and itself to a specific list. serious financial or managerial attestation reports on those assessments
In its comment letter on the proposal, deficiencies that result in unsatisfactory as one source of information on the
the FDIC–OIG recommended that performance. Failure is a distinct existence of any significant deficiencies
insured institutions with total assets of possibility if the problems and and material weaknesses in this internal
$500 million or more, but less than $1 weaknesses are not satisfactorily control structure. Nevertheless, the
billion, that have or receive either a addressed and resolved. Institutions agencies’ examiners are expected to
composite rating or Management with a composite rating of 5 exhibit perform their own evaluation of an
component rating of 3, 4, or 5, i.e., 3 or extremely unsafe and unsound practices institution’s internal control
lower, under the Uniform Financial or conditions and a critically deficient environment and audit programs when
Institutions Rating System (also known performance. They are of the greatest determining the condition of the
as the CAMELS rating system) be supervisory concern and ongoing institution and the need for and degree
required to comply with all of the supervisory attention is necessary. of any supervisory action. Moreover, the
requirements of Part 363 rather than These institutions pose a significant risk examiners’ assessment of the internal
being provided the proposed relief for to the deposit insurance funds and control environment encompasses not
institutions in this size range. The failure is highly probable. only internal control over financial
FDIC–OIG indicated that, as of A Management component rating of 3 reporting, but also internal control as it
September 12, 2005, 16 insured indicates management and board relates to the effectiveness and
institutions with $500 million to $1 performance that need improvement or efficiency of the institution’s operations
billion in assets had less than a risk management practices that are less and to its compliance with laws and
satisfactory composite CAMELS rating. than satisfactory given the nature of the regulations.
Specifically, 11 institutions had a institution’s activities. The capabilities The agencies’ examination staffs
composite rating of 3 and 5 institutions of management or the board of directors consider many factors in determining an
had a 4 rating. The FDIC–OIG also noted may be insufficient for the type, size, or institution’s composite rating and

VerDate Aug<31>2005 17:18 Nov 25, 2005 Jkt 208001 PO 00000 Frm 00019 Fmt 4700 Sfmt 4700 E:\FR\FM\28NOR1.SGM 28NOR1
71230 Federal Register / Vol. 70, No. 227 / Monday, November 28, 2005 / Rules and Regulations

individual component ratings, including supervisory attention focused on management and those charged with
the Management component. While identified problem areas, imposing governance (the board of directors and/
these factors include the capability and additional requirements for internal or the audit committee) significant
performance of management and the control assessments by management and deficiencies and material weaknesses in
board of directors (including the board’s the external auditor and for the internal control of which the auditor
committees such as the audit replacement of all audit committee becomes aware. Under current SAS 60,
committee), they also include the members who are not independent of the auditor should report such
adequacy of, and conformance with, management would levy burdens on all deficiencies and weaknesses to the audit
appropriate internal policies and such institutions, regardless of whether committee, preferably in writing, but
controls addressing the operations and this burden would address weaknesses oral communication of this information
risks of significant activities; the identified in a given institution. is also permitted. As proposed, the
accuracy, timeliness, and effectiveness However, as previously noted, the FDIC improved communication provisions in
of management information and risk believes that, in response to comments the SAS would be effective for audits of
monitoring systems; the adequacy of from the CSBS, amending the proposal financial statements for periods ending
audits and internal control, including to require a majority of the audit on or after December 15, 2006. Part 363
internal control over financial reporting; committee members to be independent requires covered institutions, regardless
compliance with laws and regulations; of management strikes an appropriate of size, to submit copies of reports
and the overall performance of the balance between reducing regulatory related to their audits that are issued by
institution and its risk profile. burden and maintaining safety and their external auditors, including these
As a consequence, when an soundness. written reports on significant
institution is assigned a composite Additionally, as a practical matter, weaknesses and material weaknesses, to
rating or a Management component CAMELS ratings often change during the FDIC and other appropriate Federal
rating of 3 or lower, its Federal banking the year as a result of examination and state supervisory agencies.
agency’s supervisory response, which findings or other supervisory oversight. After fully considering the FDIC–
may include formal or informal The FDIC–OIG’s recommendation OIG’s comment and the agencies’
enforcement actions, is tailored to the would subject institutions to supervisory tools and processes for
specific weaknesses, deficiencies, and uncertainty if the subject provisions of evaluating the soundness of institutions,
problems identified by the examination part 363 would apply immediately identifying institutions exhibiting
staff and seeks appropriate and timely during any given year in which an financial and operational weaknesses or
corrective action by management and institution’s composite or Management adverse trends, and focusing
the board of directors. The factors component rating fell to 3 or lower. If appropriate supervisory attention on
contributing to such a less than applied in the year following receipt of such institutions, the FDIC has decided
satisfactory rating may or may not have the 3 or lower rating, the not to revise its proposed increase in the
included ineffective internal control recommendation would often result in asset-size threshold in the manner
over financial reporting and/or requiring compliance with the subject proposed by the FDIC–OIG and accord
unacceptable audit committee oversight provisions of part 363 after the a different treatment to institutions with
and performance. In this regard, institution had corrected its problems $500 million to $1 billion in assets that
although the FDIC–OIG reported in its and obtained a higher composite or have a composite rating or Management
comment letter that 15 institutions with Management rating. The first of these component rating of 3 or lower.
$500 million to $1 billion in assets had approaches would be difficult, at best, However, the FDIC believes that the
recently been assigned a composite to plan for and implement on a timely change to the composition of the audit
rating of 2 and a Management basis, while the alternative (lagging) committee that it is making in response
component rating of 3, the majority of approach would often impose burden to the comments from the CSBS, which
these institutions received this after (the often unrelated) problems had will require a majority of the members
Management rating for reasons been addressed. of the audit committee, who must be
unrelated to deficiencies in internal Furthermore, under the proposed outside directors, to be independent of
control over financial reporting (e.g., the amendments to part 363, each management, will help to address the
reasons were related to compliance with institution with $500 million to $1 FDIC-OIG’s concerns about deficiencies
the Bank Secrecy Act). Nevertheless, in billion in assets must continue to in the performance of the board and
those cases where examiners detect undergo an annual audit of its financial audit committee of institutions with less
such internal control deficiencies at an statements. In a financial statement than satisfactory ratings.
institution with $500 million to $1 audit, the external auditor must obtain Six commenters urged the FDIC to
billion in assets, if it is deemed an understanding of internal control and approve the proposed amendments to
necessary and appropriate for must report certain matters regarding part 363 as soon as feasible because
addressing these deficiencies, the internal control to the institution’s audit many procedures related to the
supervisory response by the institution’s committee. In this regard, on September assessment of internal control over
Federal banking agency could include a 1, 2005, the AICPA Auditing Standards financial reporting are addressed prior
requirement for management to perform Board issued a proposed Statement on to an institution’s fiscal year-end,
an assessment of internal control over Auditing Standards (SAS) on the particularly in the fourth fiscal quarter.
financial reporting and for the external ‘‘Communication of Internal Control These commenters further
auditor to attest to management’s Related Matters Noted in an Audit’’ that recommended that the FDIC either
assertion or for the external auditor to will supersede its current SAS on this change the effective date of the
report directly on internal control over topic, which is known as ‘‘SAS 60.’’ The amendments from December 31, 2005,
financial reporting. comment period for this auditing as proposed, to September 30, 2005, or
Given that each institution with $500 proposal ended on October 31, 2005, grant an institution’s primary Federal
million to $1 billion in assets with a with the final standard expected in the regulator the authority to waive the
composite rating or Management first quarter of 2006. Among other 2005 internal control assessment
component rating of 3 or lower is things, the proposed SAS requires the requirements for institutions with total
receiving closer than normal auditor to communicate, in writing, to assets of $500 million or more but less

VerDate Aug<31>2005 17:18 Nov 25, 2005 Jkt 208001 PO 00000 Frm 00020 Fmt 4700 Sfmt 4700 E:\FR\FM\28NOR1.SGM 28NOR1
Federal Register / Vol. 70, No. 227 / Monday, November 28, 2005 / Rules and Regulations 71231

than $1 billion that have fiscal year- annual reports with a filing deadline 4 financial reporting that satisfies both the
ends other than December 31. The FDIC on or after the rule’s effective date. For FDIC’s requirements and the SEC’s
concurs with these commenters’ example, for insured institutions (both requirements.5
suggestion concerning the effective date public and non-public) with fiscal years For more complete information on
and, in response, is changing the that ended on September 30, 2005, or these two options, institutions (and
effective date of the amendments to part that will end on December 31, 2005, that holding companies) should refer to
363 from December 31, 2005, to had $500 million or more in total assets, section II.H.4. of the preamble to the
December 28, 2005. The final rule will but less than $1 billion in total assets, SEC’s section 404 final rule release (68
apply to part 363 annual reports with a at the beginning of the fiscal year, the FR 36648, June 18, 2003).
filing deadline (90 days after the end of final rule means that the part 363
an institution’s fiscal year) on or after annual report that these institutions Paperwork Reduction Act
the effective date of these amendments. must submit to the FDIC and other This regulation contains
Four commenters recommended that appropriate Federal and state modifications to a collection of
the $1 billion asset-size threshold be supervisory agencies within 90 days information that have been reviewed
tied to an index that would after the end of the fiscal year needs to and approved by the Office of
automatically increase the threshold include only audited financial Management and Budget under control
annually. For reasons of practicality and statements, statements of management’s number 3064–0113, pursuant to the
to provide certainty to institutions responsibilities, management’s Paperwork Reduction Act (44 U.S.C.
concerning the size at which full assessment of the institution’s 3501 et seq.). The primary modification
compliance with part 363 is required, compliance with designated laws and increases the asset size threshold for
the FDIC has decided not to adopt this regulations, and an auditor’s report on compliance with certain reporting
indexing recommendation. the financial statements. requirements in part 363.
The FDIC also received several For insured depository institutions
The estimated reporting burden for
recommendations from commenters that that are public companies or
the collection of information under part
are outside the scope of the proposed subsidiaries of public companies,
363 is 65,612 hours per year.
amendments to part 363 and, regardless of size, the FDIC’s
amendments to part 363 do not relieve Number of Respondents: 5,243.
accordingly, the FDIC has decided not
to implement these recommendations as public companies of their obligation to Total Annual Responses: 15,684.
part of the final rule. These comments comply with the internal control Total Annual Burden Hours: 65,612.
included the following: (1) Increase the assessment requirements imposed by
Regulatory Flexibility Act
asset size threshold for applying the section 404 of the Sarbanes-Oxley Act in
SEC independence rules to external accordance with the effective dates for The Regulatory Flexibility Act
auditors, (2) have the FDIC adopt its compliance set forth in the SEC’s requires that each Federal agency either
own independence rules for external implementing rules. certify that a proposed rule would not,
auditors, (3) enhance the FDIC’s review Nevertheless, the FDIC reminds if adopted in final form, have a
of external audit reports, (4) make the insured institutions with $1 billion or significant economic impact on a
standards for performing audits of more in total assets that are public substantial number of small entities or
internal control over financial reporting companies or subsidiaries of public prepare an initial regulatory flexibility
the same for both public and non-public companies that they have considerable analysis of the proposal and publish the
companies, and (5) establish a fraud flexibility in determining how best to analysis for comment. See 5 U.S.C. 603,
hotline for both examiners and bank satisfy the internal control assessment 605. The Small Business Administration
employees. requirements in the SEC’s section 404 (SBA) defines small banks as those with
rules and the FDIC’s part 363. As less than $150 million in assets. Because
IV. Final Rule indicated in the preamble to the SEC’s this rule expressly exempts insured
The FDIC has considered the section 404 final rule release, the FDIC depository institutions having assets of
comments received on its proposed (and the other Federal banking agencies) less than $500 million, it is inapplicable
amendments to part 363 and is adopting agreed with the SEC that insured to small entities as defined by the SBA.
the amendments as proposed, but with depository institutions that are subject Therefore, it is certified that this
modifications to the composition of the to both part 363 (as well as holding proposed rule would not have a
audit committee and the effective date. companies permitted under the holding significant economic impact on a
This final rule raises the asset-size company exception in part 363 to file an substantial number of small entities.
threshold from $500 million to $1 internal control report on behalf of their
billion for internal control assessments insured depository institution 5 Footnote 117 in the preamble to the SEC’s

by management and external auditors. subsidiaries) and the SEC’s rules section 404 final rule releases states that ‘‘[a]n
implementing section 404 can choose insured depository institution subject to both the
For institutions between $500 million FDIC’s [internal control assessment] requirements
and $1 billion in assets, it also requires either of the following two options: and our new requirements [i.e., a public depository
the majority, rather than all, of the • They can prepare two separate institution] choosing to file a single report to satisfy
members of the audit committee, who reports of management on the both sets of requirements will file the report with
must be outside directors, to be institution’s or the holding company’s its primary Federal regulator under the Exchange
internal control over financial reporting Act and the FDIC, its primary Federal regulator (if
independent of management and creates other than the FDIC), and any appropriate state
a hardship exemption. In addition, the to satisfy the FDIC’s part 363 depository institution supervisor under part 363 of
final rule makes certain technical requirements and the SEC’s section 404 the FDIC’s regulations. A [public] holding company
changes to part 363 to correct outdated requirements; or choosing to prepare a single report to satisfy both
titles, terms, and references in the • They can prepare a single report of sets of requirements will file the report with the
[Securities and Exchange] Commission under the
regulation and its appendix. management on internal control over Exchange Act and the FDIC, the primary Federal
This final rule takes effect December regulator of the insured depository institution
4 Under section 363.4(a), an institution’s filing subsidiary subject to the FDIC’s requirements, and
28, 2005, not on December 31, 2005, as deadline is 90 days after the end of the institution’s any appropriate state depository institution
proposed, and it applies to part 363 fiscal year. supervisor under part 363.’’

VerDate Aug<31>2005 17:18 Nov 25, 2005 Jkt 208001 PO 00000 Frm 00021 Fmt 4700 Sfmt 4700 E:\FR\FM\28NOR1.SGM 28NOR1
71232 Federal Register / Vol. 70, No. 227 / Monday, November 28, 2005 / Rules and Regulations

Small Business Regulatory Enforcement ■ 4. Section 363.3 is amended by ■ 6. Appendix A to part 363 is amended
Fairness Act revising paragraph (b) to read as follows: as follows:
■ a. Footnote 2, Guideline 10, is
The Small Business Regulatory § 363.3 Independent public accountant. amended by adding ‘‘Risk Management’’
Enforcement Fairness Act of 1996 * * * * * after ‘‘FDIC’s Division of Supervision
(SBREFA) (Title II, Pub. L. 104–121) (b) Additional reports. For each and Consumer Protection (DSC)’’;
provides generally for agencies to report insured depository institution with total ■ b. Guideline 16 is amended by
rules to Congress and the General assets of $1 billion or more at the removing ‘‘Registration and Disclosure
Accounting Office (GAO) for review. beginning of the institution’s fiscal year, Section’’ and adding in its place
The reporting requirement is triggered such independent public accountant ‘‘Accounting and Securities Disclosure
when a Federal agency issues a final shall examine, attest to, and report Section’’;
rule. The FDIC will file the appropriate separately on, the assertion of ■ c. Guideline 22 is amended by
reports with Congress and the GAO as management concerning the revising the first sentence of paragraph
required by SBREFA. The Office of institution’s internal control structure (a) to read as set forth below;
Management and Budget has and procedures for financial reporting. ■ d. Guideline 27 is amended by
determined that the rule does not The attestation shall be made in revising the second sentence to read as
constitute a ‘‘major rule’’ as defined by accordance with generally accepted set forth below;
SBREFA. standards for attestation engagements. ■ e. Guideline 28 is amended by
List of Subjects in 12 CFR Part 363 * * * * * revising paragraph (a) to read as set
forth below;
Accounting, Administrative practice ■ 5. Section 363.5 is amended by ■ f. Guideline 29 is revised to read as set
and procedure, Banks, Banking, revising paragraph (a) to read as follows: forth below; and
Reporting and recording keeping § 363.5 Audit committees. ■ g. The first sentence of Guideline 36
requirements. is revised to read as set forth below.
(a) Composition and duties. Each The revisions read as follows:
■ For the reasons set forth in the
insured depository institution shall
preamble, the Board of Directors of the establish an audit committee of its board Appendix A to Part 363—Guidelines
FDIC hereby amends part 363 of title 12, of directors, the composition of which and Interpretations
chapter III, of the Code of Federal complies with paragraphs (a)(1), (2), and
Regulations as follows: * * * * *
(3) of this section, and the duties of
which shall include reviewing with Filing and Notice Requirements (§ 363.4)
PART 363—ANNUAL INDEPENDENT 22. * * *
AUDITS AND REPORTING management and the independent
public accountant the basis for the (a) FDIC: Appropriate FDIC Regional or
REQUIREMENTS Area Office (Supervision and Consumer
reports issued under this part.
Protection), i.e., the FDIC regional or area
■ 1. The authority citation for part 363 (1) Each insured depository office in the FDIC region or area that is
continues to be read as follows: institution with total assets of $1 billion responsible for monitoring the institution or,
Authority: 12 U.S.C. 1831m. or more as of the beginning of its fiscal in the case of a subsidiary institution of a
year shall establish an independent holding company, the consolidated company.
■ 2. Section 363.1 is amended by audit committee of its board of * * *
revising paragraph (b)(2)(ii)(B) to read as directors, the members of which shall be * * * * *
follows: outside directors who are independent
Audit Committees (§ 363.5)
of management of the institution.
§ 363.1 Scope. 27. * * * At least annually, the board of
(2) Each insured depository
* * * * * institution with total assets of $500 an institution with $1 billion or more in total
(b) * * * assets at the beginning of its fiscal year
million or more but less than $1 billion should determine whether all existing and
(2) * * * as of the beginning of its fiscal year shall potential audit committee members are
(ii) * * * establish an audit committee of its board ‘‘independent of management of the
(B) Total assets of $5 billion or more of directors, the members of which shall institution’’ and the board of an institution
and a composite CAMELS rating of 1 or be outside directors, the majority of with total assets of $500 million or more but
2. whom shall be independent of less than $1 billion as of the beginning of its
* * * * * management of the institution. The fiscal year should determine whether the
appropriate Federal banking agency majority of all existing and potential audit
■ 3. Section 363.2(b) is amended by committee members are ‘‘independent of
revising paragraph (b)(2) and adding may, by order or regulation, permit the management of the institution.’’ * * *
paragraph (b)(3) to read as follows: audit committee of such an insured 28. * * *
depository institution to be made up of (a) Has previously been an officer of the
§ 363.2 Annual reporting requirements. less than a majority of outside directors institution or any affiliate of the institution;
* * * * * who are independent of management, if * * * * *
(b) * * * the agency determines that the 29. Lack of independence. An outside
(2) An assessment by management of institution has encountered hardships director should not be considered
the institution’s compliance with such in retaining and recruiting a sufficient independent of management if such director
laws and regulations during such fiscal number of competent outside directors owns or controls, or has owned or controlled
year; and to serve on the audit committee of the within the preceding fiscal year, assets
institution. representing 10 percent or more of any
(3) For an institution with total assets outstanding class of voting securities of the
of $1 billion or more at the beginning of (3) An outside director is a director
institution.
such fiscal year, an assessment by who is not, and within the preceding
fiscal year has not been, an officer or * * * * *
management of the effectiveness of such
internal control structure and employee of the institution or any Other
procedures as of the end of such fiscal affiliate of the institution. 36. Modifications of guidelines. The FDIC’s
year. * * * * * Board of Directors has delegated to the

VerDate Aug<31>2005 17:18 Nov 25, 2005 Jkt 208001 PO 00000 Frm 00022 Fmt 4700 Sfmt 4700 E:\FR\FM\28NOR1.SGM 28NOR1
Federal Register / Vol. 70, No. 227 / Monday, November 28, 2005 / Rules and Regulations 71233

Director of the FDIC’s Division of to modify the Minneapolis Class B proceed directly to MSP and then enter
Supervision and Consumer Protection (DSC) airspace area (68 FR 65859). The FAA an east/west downwind pattern will be
authority to make and publish in the Federal proposed the action due to a significant vectored to a downwind pattern via
Register minor technical amendments to the growth in aircraft operations and the northbound and southbound paths
Guidelines in this appendix, in consultation
with the other appropriate federal banking
construction of a new runway (Runway located to the east and west of MSP.
agencies, to reflect the practical experience 17/35) to accommodate the growth. The This change in traffic flow is needed to
gained from implementation of this proposed modifications were designed accommodate three arrival streams
part.* * * to contain large turbine-powered aircraft rather than the current practice of using
* * * * * within the MSP Class B airspace area two arrival streams. As a result of these
and included expanding the lateral new procedures, approximately 900
By order of the Board of Directors. dimensions of the existing MSP Class B high-performance aircraft will be
Dated at Washington, DC, this 8th day of airspace area as well as increasing the vectored to join arrival streams as far as
November, 2005. vertical limits from 8,000 feet above 30 nautical miles (NM) from MSP
Federal Deposit Insurance Corporation. mean sea level (MSL) to 10,000 feet between the altitudes of 7,000 and
Robert E. Feldman, MSL. 10,000 feet MSL on a daily basis.
Executive Secretary. Subsequent to the issuance of the In response to AOPA’s comment
[FR Doc. 05–23310 Filed 11–25–05; 8:45 am] NPRM, the FAA’s further analysis of pertaining to VFR flyways, the FAA
BILLING CODE 6714–01–P
airspace requirements revealed that agrees that charted VFR flyways could
additional airspace (beyond and below minimize the impact on aircraft that
that airspace proposed in the NPRM) choose to circumnavigate the MSP Class
will be needed to contain large B airspace area. However, because VFR
DEPARTMENT OF TRANSPORTATION
turbine’powered aircraft conducting flyways are not addressed in a Class B
Federal Aviation Administration approaches to the new Runway 35 rulemaking action, the FAA plans to
within the MSP Class B airspace area. develop and institute VFR flyways for
14 CFR Part 71 To provide the public an opportunity to the MSP terminal area through a
comment on the additional required separate, non-rulemaking process.
[Docket No. FAA–2003–15471; Airspace airspace, the FAA issued a ALPA and the NBAA expressed
Docket No. 03–AWA–6] supplemental notice of proposed concern that the ‘‘southeast cut-out’’ of
RIN 2120–AA66 rulemaking (SNPRM) that included a the proposed Area E would result in
new area F (70 FR 43803). Area F aircraft not being contained in Class B
Modification of the Minneapolis Class reflects the additional airspace that the airspace when operating on the
B Airspace Area; MN FAA determined will be needed, as well extended final approach course to the
as changes suggested by the Air Line new Runway 35. They suggest reducing
AGENCY: Federal Aviation the size of the cut-out by changing the
Pilots Association, International (ALPA)
Administration (FAA), DOT. western boundary of the proposed cut-
and the National Business Aviation
ACTION: Final rule. Association, Inc. (NBAA) in response to out from the Gopher 170 radial to the
SUMMARY: This action modifies the the NPRM (see ‘‘Discussion of Gopher 160 radial. The FAA agrees with
current Minneapolis, MN, Class B Comment’’ below). this comment and has adopted the
airspace area to contain large turbine- suggested modification.
Discussion of Comments The FAA received the following
powered aircraft during operations to In response to the NPRM, the FAA comments in response to the SNPRM:
the new Runway 17/35 and to address received three comments. AOPA again expressed a concern that
an increase in aircraft operations to and The Aircraft Owners and Pilots raising the vertical limits of the MSP
from the Minneapolis-St. Paul Association (AOPA) expressed a Class B airspace area from 8,000 feet
International (Wold-Chamberlain) concern that the dimensions of the MSP MSL to 10,000 feet MSL would ‘‘pose a
Airport (MSP). The FAA is taking this Class B airspace area should conform to serious operational limitation to those
action to enhance safety and improve the unique needs of users rather than pilots wishing to over fly’’ the MSP
the management of aircraft operations in conform to a national standard. They Class B airspace area and reiterated their
the Minneapolis terminal area. Further, also expressed a concern that raising the desire for charted VFR flyways. They
this action supports the FAA’s national vertical limits from 8,000 feet MSL to also mentioned that the ad hoc
airspace redesign goal of optimizing 10,000 feet MSL would ‘‘pose a serious committee recommendations did not
terminal and en route airspace areas to operational limitation to pilots wishing fully address their concerns. The FAA’s
reduce aircraft delays and improve to over fly’’ the MSP Class B airspace response to AOPA’s comments remains
system capacity. area. AOPA also expressed a desire for as stated previously in this document.
DATES: Effective Date: 0901 UTC, charted visual flight rules (VFR) flyways The FAA also received comments
February 16, 2006. in the MSP terminal area. from two pilots in response to the
FOR FURTHER INFORMATION CONTACT: The FAA has determined that some SNPRM. They commented that they
Steve Rohring, Airspace and Rules, aircraft may have to fly farther or at practice aerobatic maneuvers at and
Office of System Operations Airspace lower or higher altitudes to remain clear below 8,000 feet MSL approximately 15
and AIM, Federal Aviation of the modified MSP Class B airspace NM west of the Flying Cloud Airport
Administration, 800 Independence area; however, this is necessary to (between the cities of Belle Plaine and
Avenue, SW., Washington, DC 20591; separate them from large turbine- Cologne). They request that the FAA
telephone: (202) 267–8783. powered aircraft arriving and departing exclude the area that they practice in
SUPPLEMENTARY INFORMATION: MSP. The management of aircraft from the MSP Class B airspace area.
operations to the new runway will While the FAA acknowledges that
Background require several new arrival vector areas aerobatic operations in the area may be
On November 24, 2003, the FAA between the altitudes of 7,000 feet and impacted, the FAA is not able to
published in the Federal Register a 10,000 feet MSL over the MSP terminal accommodate this request because the
notice of proposed rulemaking (NPRM) area. Specifically, aircraft that currently area between Belle Plaine and Cologne

VerDate Aug<31>2005 17:18 Nov 25, 2005 Jkt 208001 PO 00000 Frm 00023 Fmt 4700 Sfmt 4700 E:\FR\FM\28NOR1.SGM 28NOR1

También podría gustarte