Monday,
July 20, 2009
Part III
Federal Deposit
Insurance
Corporation
12 CFR Parts 308 and 363
Annual Independent Audits and Reporting
Requirements; Final Rule
VerDate Nov<24>2008 15:42 Jul 17, 2009 Jkt 217001 PO 00000 Frm 00001 Fmt 4717 Sfmt 4717 E:\FR\FM\20JYR2.SGM 20JYR2
erowe on DSK5CLS3C1PROD with RULES_2
July 20, 2009
Part III
Federal Deposit
Insurance
Corporation
12 CFR Parts 308 and 363
Annual Independent Audits and Reporting
Requirements; Final Rule
VerDate Nov<24>2008 15:42 Jul 17, 2009 Jkt 217001 PO 00000 Frm 00001 Fmt 4717 Sfmt 4717 E:\FR\FM\20JYR2.SGM 20JYR2
erowe on DSK5CLS3C1PROD with RULES_2
35726 Federal Register / Vol. 74, No. 137 / Monday, July 20, 2009 / Rules and Regulations
1 72 FR 62310, November 2, 2007.
FEDERAL DEPOSIT INSURANCE
CORPORATION
12 CFR Parts 308 and 363
RIN 3064–AD21
Annual Independent Audits and
Reporting Requirements
AGENCY: Federal Deposit Insurance
Corporation (FDIC).
ACTION: Final rule; correction.
SUMMARY: The FDIC is amending part
363 of its regulations concerning annual
independent audits and reporting
requirements for certain insured
depository institutions, which
implements section 36 of the Federal
Deposit Insurance Act (FDI Act), largely
as proposed, but with certain
modifications made in response to the
comments received. The amendments
are designed to further the objectives of
section 36 by incorporating certain
sound audit, reporting, and audit
committee practices from the Sarbanes-
Oxley Act of 2002 (SOX) into part 363
and they also reflect the FDIC’s
experience in administering part 363.
The amendments will provide clearer
and more complete guidance to
institutions and independent public
accountants concerning compliance
with the requirements of section 36 and
part 363. As required by section 36, the
FDIC has consulted with the other
Federal banking agencies. The FDIC is
also making a technical amendment to
its rules and procedures (part 308,
subpart U) for the removal, suspension,
or debarment of accountants and
accounting firms.
The FDIC previously published this
final rule in the Federal Register on July
7, 2009, however the document is being
republished in its entirety in order to
correct an error in the DATES section
which caused the applicability date to
be incorrect and to correct language
relating to holding company depository
institution subsidiaries.
DATES: Effective Dates: The final rule is
effective August 6, 2009. Part 363
Annual Reports with a filing deadline
on or after the effective date of these
amendments should be prepared in
accordance with the final rule.
The compliance date for the provision
of the final rule that directs covered
institutions’ boards of directors to
develop and adopt an approved set of
written criteria for determining whether
a director who is to serve on the audit
committee is an outside director and is
independent of management (guideline
27) is delayed until December 31, 2009.
The provision of the final rule that
requires the total assets of a holding
company’s insured depository
institution subsidiaries to comprise 75
percent or more of the holding
company’s consolidated total assets in
order for an institution to be eligible to
comply with part 363 at the holding
company level (§ 363.1(b)(1)(ii)) is
effective for fiscal years ending on or
after June 15, 2010.
FOR FURTHER INFORMATION CONTACT:
Harrison E. Greene, Jr., Senior Policy
Analyst (Bank Accounting), Division of
Supervision and Consumer Protection,
at hgreene@fdic.gov or (202) 898–8905;
or Michelle Borzillo, Senior Counsel,
Corporate and Legal Operations Section,
Legal Division, at mborzillo@fdic.gov or
(202) 898–7400.
SUPPLEMENTARY INFORMATION:
I. Executive Summary
Section 36 of the Federal Deposit
Insurance Act (FDI Act) and the FDIC’s
implementing regulations (part 363) are
generally intended to facilitate early
identification of problems in financial
management at insured depository
institutions with total assets above
certain thresholds through annual
independent audits, assessments of the
effectiveness of internal control over
financial reporting and compliance with
laws and regulations pertaining to
insider loans and dividend restrictions,
the establishment of independent audit
committees, and related reporting
requirements. The asset-size threshold
for an institution for internal control
assessments is $1 billion and the
threshold for the other requirements
generally is $500 million. Given changes
in the industry; certain sound audit,
reporting, and audit committee practices
incorporated in the Sarbanes-Oxley Act
of 2002 (SOX); and the FDIC’s
experience in administering part 363,
the FDIC is amending part 363 of its
regulations. These amendments are
designed to further the objectives of
section 36 by incorporating these sound
practices into part 363 and to provide
clearer and more complete guidance to
institutions and independent public
accountants concerning compliance
with the requirements of section 36 and
part 363.
After making certain modifications to
the proposed amendments to part 363 1
in response to the comments received,
the most significant revisions to existing
part 363 that are included in the final
rule will: (1) Extend the time period for
a non-public institution to file its Part
363 Annual Report by 30 days and
replace the 30-day extension of the
filing deadline that may be granted if an
institution (public or non-public) is
confronted with extraordinary
circumstances beyond its reasonable
control with a late filing notification
requirement that would have general
applicability; (2) provide relief from the
annual reporting requirements for
institutions that are merged out of
existence before the filing deadline; (3)
provide relief from reporting on internal
control over financial reporting for
businesses acquired during the fiscal
year; (4) require management’s
assessment of compliance with the laws
and regulations pertaining to insider
loans and dividend restrictions to state
management’s conclusion regarding
compliance and disclose any
noncompliance with such laws and
regulations; (5) require an institution’s
management and the independent
public accountant to identify the
internal control framework used to
evaluate internal control over financial
reporting and disclose all identified
material weaknesses that have not been
remediated prior to the institution’s
most recent fiscal year-end; (6) clarify
the independence standards with which
independent public accountants must
comply and enhance the enforceability
of compliance with these standards; (7)
specify that the duties of the audit
committee include the appointment,
compensation, and oversight of the
independent public accountant,
including ensuring that audit
engagement letters do not contain
unsafe and unsound limitation of
liability provisions; (8) require certain
communications by independent public
accountants to audit committees; (9)
establish retention requirements for
audit working papers; (10) require
boards of directors to adopt written
criteria for evaluating an audit
committee member’s independence and
provide expanded guidance for boards
of directors to use in determining
independence; (11) provide that
ownership of 10 percent or more of any
class of voting securities of an
institution is not an automatic bar for
considering an outside director to be
independent of management; (12)
require the total assets of a holding
company’s insured depository
institution subsidiaries to comprise 75
percent or more of the holding
company’s consolidated total assets in
order for an institution to be eligible to
comply with part 363 at the holding
company level; and (13) provide
illustrative management reports to assist
institutions in complying with the
annual reporting requirements.
The FDIC is also amending its rules
and procedures (part 308, subpart U) for
VerDate Nov<24>2008 15:42 Jul 17, 2009 Jkt 217001 PO 00000 Frm 00002 Fmt 4701 Sfmt 4700 E:\FR\FM\20JYR2.SGM 20JYR2
erowe on DSK5CLS3C1PROD with RULES_2
1 72 FR 62310, November 2, 2007.
FEDERAL DEPOSIT INSURANCE
CORPORATION
12 CFR Parts 308 and 363
RIN 3064–AD21
Annual Independent Audits and
Reporting Requirements
AGENCY: Federal Deposit Insurance
Corporation (FDIC).
ACTION: Final rule; correction.
SUMMARY: The FDIC is amending part
363 of its regulations concerning annual
independent audits and reporting
requirements for certain insured
depository institutions, which
implements section 36 of the Federal
Deposit Insurance Act (FDI Act), largely
as proposed, but with certain
modifications made in response to the
comments received. The amendments
are designed to further the objectives of
section 36 by incorporating certain
sound audit, reporting, and audit
committee practices from the Sarbanes-
Oxley Act of 2002 (SOX) into part 363
and they also reflect the FDIC’s
experience in administering part 363.
The amendments will provide clearer
and more complete guidance to
institutions and independent public
accountants concerning compliance
with the requirements of section 36 and
part 363. As required by section 36, the
FDIC has consulted with the other
Federal banking agencies. The FDIC is
also making a technical amendment to
its rules and procedures (part 308,
subpart U) for the removal, suspension,
or debarment of accountants and
accounting firms.
The FDIC previously published this
final rule in the Federal Register on July
7, 2009, however the document is being
republished in its entirety in order to
correct an error in the DATES section
which caused the applicability date to
be incorrect and to correct language
relating to holding company depository
institution subsidiaries.
DATES: Effective Dates: The final rule is
effective August 6, 2009. Part 363
Annual Reports with a filing deadline
on or after the effective date of these
amendments should be prepared in
accordance with the final rule.
The compliance date for the provision
of the final rule that directs covered
institutions’ boards of directors to
develop and adopt an approved set of
written criteria for determining whether
a director who is to serve on the audit
committee is an outside director and is
independent of management (guideline
27) is delayed until December 31, 2009.
The provision of the final rule that
requires the total assets of a holding
company’s insured depository
institution subsidiaries to comprise 75
percent or more of the holding
company’s consolidated total assets in
order for an institution to be eligible to
comply with part 363 at the holding
company level (§ 363.1(b)(1)(ii)) is
effective for fiscal years ending on or
after June 15, 2010.
FOR FURTHER INFORMATION CONTACT:
Harrison E. Greene, Jr., Senior Policy
Analyst (Bank Accounting), Division of
Supervision and Consumer Protection,
at hgreene@fdic.gov or (202) 898–8905;
or Michelle Borzillo, Senior Counsel,
Corporate and Legal Operations Section,
Legal Division, at mborzillo@fdic.gov or
(202) 898–7400.
SUPPLEMENTARY INFORMATION:
I. Executive Summary
Section 36 of the Federal Deposit
Insurance Act (FDI Act) and the FDIC’s
implementing regulations (part 363) are
generally intended to facilitate early
identification of problems in financial
management at insured depository
institutions with total assets above
certain thresholds through annual
independent audits, assessments of the
effectiveness of internal control over
financial reporting and compliance with
laws and regulations pertaining to
insider loans and dividend restrictions,
the establishment of independent audit
committees, and related reporting
requirements. The asset-size threshold
for an institution for internal control
assessments is $1 billion and the
threshold for the other requirements
generally is $500 million. Given changes
in the industry; certain sound audit,
reporting, and audit committee practices
incorporated in the Sarbanes-Oxley Act
of 2002 (SOX); and the FDIC’s
experience in administering part 363,
the FDIC is amending part 363 of its
regulations. These amendments are
designed to further the objectives of
section 36 by incorporating these sound
practices into part 363 and to provide
clearer and more complete guidance to
institutions and independent public
accountants concerning compliance
with the requirements of section 36 and
part 363.
After making certain modifications to
the proposed amendments to part 363 1
in response to the comments received,
the most significant revisions to existing
part 363 that are included in the final
rule will: (1) Extend the time period for
a non-public institution to file its Part
363 Annual Report by 30 days and
replace the 30-day extension of the
filing deadline that may be granted if an
institution (public or non-public) is
confronted with extraordinary
circumstances beyond its reasonable
control with a late filing notification
requirement that would have general
applicability; (2) provide relief from the
annual reporting requirements for
institutions that are merged out of
existence before the filing deadline; (3)
provide relief from reporting on internal
control over financial reporting for
businesses acquired during the fiscal
year; (4) require management’s
assessment of compliance with the laws
and regulations pertaining to insider
loans and dividend restrictions to state
management’s conclusion regarding
compliance and disclose any
noncompliance with such laws and
regulations; (5) require an institution’s
management and the independent
public accountant to identify the
internal control framework used to
evaluate internal control over financial
reporting and disclose all identified
material weaknesses that have not been
remediated prior to the institution’s
most recent fiscal year-end; (6) clarify
the independence standards with which
independent public accountants must
comply and enhance the enforceability
of compliance with these standards; (7)
specify that the duties of the audit
committee include the appointment,
compensation, and oversight of the
independent public accountant,
including ensuring that audit
engagement letters do not contain
unsafe and unsound limitation of
liability provisions; (8) require certain
communications by independent public
accountants to audit committees; (9)
establish retention requirements for
audit working papers; (10) require
boards of directors to adopt written
criteria for evaluating an audit
committee member’s independence and
provide expanded guidance for boards
of directors to use in determining
independence; (11) provide that
ownership of 10 percent or more of any
class of voting securities of an
institution is not an automatic bar for
considering an outside director to be
independent of management; (12)
require the total assets of a holding
company’s insured depository
institution subsidiaries to comprise 75
percent or more of the holding
company’s consolidated total assets in
order for an institution to be eligible to
comply with part 363 at the holding
company level; and (13) provide
illustrative management reports to assist
institutions in complying with the
annual reporting requirements.
The FDIC is also amending its rules
and procedures (part 308, subpart U) for
VerDate Nov<24>2008 15:42 Jul 17, 2009 Jkt 217001 PO 00000 Frm 00002 Fmt 4701 Sfmt 4700 E:\FR\FM\20JYR2.SGM 20JYR2
erowe on DSK5CLS3C1PROD with RULES_2