The FDIC adopted a final rule (the “Final Rule”) that amends FDIC-insured financial institutions’ (“FIs”) annual audit and reporting requirements under section 36 (“Section 36”) of the Federal Deposit Insurance Act and its implementing regulations, Part 363 (“Part 363”). In general, the Final Rule incorporates into Part 363 certain audit, reporting and audit committee practices derived from the Sarbanes-Oxley Act of 2002 as well as FDIC experience in administering Part 363. The FDIC stated that Section 36 and Part 363 are “generally intended to facilitate early identification of problems in financial management” at FIs with total assets greater than certain thresholds. The asset threshold for internal control assessments is $1 billion, and the threshold for the other requirements of Part 363 is $500 million. In October 2007, the FDIC issued a proposed version (the “Proposed Rule”) of the Final Rule that was discussed in the October 23, 2007 Alert.
In addition to making certain technical amendments to the enforcement rules and procedures used against accountants and accounting firms, the FDIC cites 13 significant changes made by the Final Rule to Part 363. The 13 key changes:
- Require management of the FI and its independent public accountant to identify the internal control framework used to evaluate internal control over financial reporting and disclose all identified material weaknesses that have not been remediated;
- Extend the time period for a non-public FI to file its Part 363 Annual Report by 30 days and replace the 30-day extensions of the filing deadline that may be granted if an FI (public or non-public) is confronted with extraordinary circumstances beyond its reasonable control with a late filing notification requirement that would have general applicability;
- Provide relief from the annual reporting requirements for FIs that are merged out of existence before the filing deadline;
- Provide relief from reporting on internal control over financial reporting for businesses acquired during the fiscal year;
- Require management’s assessment of compliance with designated safety and soundness laws and regulations to state management’s conclusion regarding compliance and disclose (with more specificity than is currently required) any noncompliance with such laws and regulations (the safety and soundness laws currently covered are those concerning insider loans and dividend restrictions);
- Clarify the independence standards with which independent public accountants must comply and enhance the enforceability of compliance with these standards;
- Specify that the duties of the audit committee include the appointment, compensation and oversight of the independent public accountant and require audit committees to ensure that audit engagement letters do not contain unsafe and unsound limitation of liability provisions. The Proposed Rule’s requirement that FIs must file copies of audit engagement letters does not appear in the Final Rule;
- Require certain communications by independent public accountants to audit committees.
- Establish retention requirements for audit working papers;
- Require boards of directors to adopt written criteria for evaluating an audit committee member’s independence and provide expanded guidance for boards of directors to use in determining independence. In a change from the Proposed Rule, the Final Rule states that a committee member is deemed independent if his total annual compensation from the institution (other than director and committee fees) is $100,000 or less (raised from $60,000 or less);
- Provide that ownership of 10% or more of any class of voting securities of an institution is not an automatic bar for considering an outside director to be independent of management;
- Require the total assets of a holding company’s insured depository institution subsidiaries to comprise 75 percent or more of the holding company’s consolidated total assets in order for an FI to comply with Part 363 at the holding company level; and
- Provide illustrative management reports to assist FIs in complying with the annual reporting requirements.
Except for certain items specifically noted in the Final Rule, the Final Rule will become effective 30 days after its publication in the Federal Register.