Spst0113-08a

SUPPORTING STATEMENT

EXTERNAL AUDITS

OMB No. 3064-0113

INTRODUCTION

The FDIC requests OMB approval to revise the approved collection of information captioned above. The collection imposes annual independent audit and reporting requirements on insured depository institutions with assets of $500 million or more, and extends these requirements on a voluntary basis to institutions with assets less than $500 million. The revisions bear on the collection of information only from institutions with assets of $500 million or more and relate to management’s assessment and reporting of noncompliance with laws and regulations; management’s report on internal control over financial reporting and the related independent public accountant’s attestation report; the requirements related to audit committee composition and duties; a new notification of late filing; and the requirements for public institutions with assets under $1 billion to file the management assessments and auditors’ reports on internal control over financial reporting required by section 404 of the Sarbanes-Oxley Act. It is anticipated that the overall effect of these changes will be a small burden increase for affected insured institutions. However, as explained below, the changes will not greatly affect the percentage of covered industry assets. Therefore, the FDIC believes the resulting burden increase will not have a negative impact on the industry’s safety and soundness. Current OMB approval for this collection will expire on October 31, 2008.

A. JUSTIFICATION

1. Circumstances and Need

Section 112 of the Federal Deposit Insurance Corporation Improvement Act of 1991 (FDICIA) added Section 36, “Early Identification of Needed Improvements in Financial Management,” to the FDI Act (12 U.S.C. 1831m) and was effective as of December 31, 1992. Section 36 is generally intended to facilitate early identification of problems in financial management at insured depository institutions above a certain asset size threshold through annual independent audits, assessments of the effectiveness of internal control over financial reporting and compliance with designated laws and regulations, and related requirements. Section 36 also includes requirements for audit committees at these insured depository institutions. Section 36 grants the FDIC discretion to set the asset size threshold for compliance with these statutory requirements, but it states that the threshold cannot be less than $150 million. In June 1993, the FDIC published 12 CFR Part 363, Annual Independent Audits and Reporting Requirements (58 FR 31332, June 2, 1993), to implement the provisions of Section 36 of the FDI Act. Under Part 363, the requirements of Section 36 apply to each insured depository institution with $500 million or more in total assets at the beginning of its fiscal year (covered institution). Section 36 and Part 363 are often referred to as the “FDICIA reporting requirements.”

As most recently amended in November 2005, Part 363 requires each covered institution with total assets of $500 million or more but less than $1 billion to submit to the FDIC and other appropriate federal and state supervisory agencies an annual report that includes audited financial statements, a statement of management’s responsibilities, and an assessment by management of compliance with designated laws and regulations. Each covered institution with total assets of $1 billon or more must submit an annual report that includes audited financial statements, a statement of management’s responsibilities, assessments by management of the effectiveness of internal control over financial reporting and of compliance with designated laws and regulations, and an auditor’s attestation report on internal control over financial reporting. In addition, Part 363 provides that each covered institution with total assets of $500 million or more but less than $1 billion must establish an audit committee of its board of directors composed of outside directors, the majority of whom are independent of management of the institution. Each covered institution with total assets of $1 billon or more must establish an independent audit committee of its board of directors composed of outside directors who are independent of management of the institution. Part 363 also includes Guidelines and Interpretations (Appendix A to Part 363), which are intended to assist institutions and independent public accountants in understanding and complying with Section 36 and Part 363.

When it adopted Part 363 in 1993, the FDIC stated that it was setting the asset size threshold at $500 million, $350 million above the statutory minimum of $150 million specified in Section 36, to mitigate the financial burden of compliance consistent with safety and soundness. In selecting $500 million in total assets as the size threshold, the FDIC noted that approximately 1,000 of the then nearly 14,000 FDIC-insured institutions would be subject to Part 363. These covered institutions held approximately 75 percent of the assets of insured institutions at that time. By imposing the audit, reporting, and audit committee requirements of Part 363 on institutions with this percentage of the industry’s assets, the FDIC intended to focus on those institutions posing the greatest potential risk to the deposit insurance funds. Today, due to consolidation in the banking and thrift industry and the effects of inflation, approximately 1,350 of the 8,450 insured institutions have $500 million or more in total assets and are therefore subject to Part 363. These covered institutions hold approximately 92 percent of the assets of insured institutions.

When the FDIC amended Part 363 in November 2005, the FDIC noted that it had identified other aspects of Part 363 that warranted revision in light of the changes in the industry; certain sound audit, reporting, and audit committee practices incorporated in the Sarbanes-Oxley Act of 2002; and the FDIC’s experience in administering Part 363. The FDIC’s current Notice of Proposed Rulemaking (NPR) to amend Part 363, published in the Federal Register on November 2, 2007 (72 FR 62310) attached hereto, is intended to further the objectives of Section 36 of the FDI Act by incorporating these sound practices into Part 363 and to provide clearer and more complete guidance to institutions and independent public accountants concerning compliance with the requirements of Section 36 of the FDI Act and Part 363. The most significant proposed revisions to section 363 are set forth in the Introduction of this Supporting Statement. The estimates of annual burden set forth herein reflect the effect of those proposed revisions on this information collection.

An interagency Policy Statement on External Auditing Programs of Banks and Savings Associations was approved on October 15, 1999. The Policy Statement encourages institutions with assets less than $500 million to adopt an annual external auditing program, preferably a financial statement audit by an independent public accountant.

2. Use of Information Collected

The currently approved collection of information requires each insured depository institution which has total assets of $500 million or more to:

1. file an annual report with the FDIC and its appropriate federal and state banking regulators that includes audited financial statements, a statement of management’s responsibilities, and an assessment by management of compliance with designated laws and regulations,

2. notify the FDIC when it selects or changes its independent public accountant, and

3. file any management letter, qualification, and other report issued by the independent public accountant pertaining to its financial reporting.

In addition, the annual report filed by an insured depository institution which has total assets of $1 billion or more must include an assessment by management of the effectiveness of internal control over financial reporting and an auditor’s attestation report on internal control over financial reporting.

As discussed more fully in the preamble to the interagency Policy Statement on External Auditing Programs of Banks and Savings Associations (attached), the federal banking agencies believe that a well-planned annual external auditing program is an important component of any bank’s or savings association’s risk management process. The agencies believe that an external auditing program provides significant benefits even for smaller institutions and facilitates early identification of problems in financial management at these institutions. Thus, institutions with assets less than $500 million are encouraged to adopt an annual external auditing program. The Policy Statement requests institutions to submit the external auditor’s report and notices of the selection or change in external auditor to the appropriate federal banking agency and any appropriate state supervisory agency.

a. Insured Institutions with assets of $500 million or more.

The information collected in the Part 363 Annual Report, other reports, and the notice of selection or change in accountant is used by the FDIC and other federal and state banking agencies for supervisory/surveillance, regulatory, and informational purposes. The information is used in the offsite evaluation of the institutions and to determine the frequency and scope of examinations. The Part 363 Annual Reports are also available to the public.

b. Insured Institutions with assets less than $500 million.

The information provided in the external auditor’s report and the notice of selection or change in external auditor is used by the FDIC and other federal and state banking agencies for supervisory/ surveillance, regulatory, and informational purposes. The information is used in the offsite evaluation of the institutions and to determine the frequency and scope of examinations.

3. Use of Technology to Reduce Burden

The information is not collected electronically.

4. Efforts to Identify Duplication

a. Insured Institutions with assets of $500 million or more.

The collection requirements parallel the statutory language of Section 36. Much of the information in the annual report and notice of selection or change in accountant is currently required to be filed by institutions and holding companies registered under the Securities Exchange Act of 1934 (public companies) with the appropriate federal banking agency or the Securities and Exchange Commission (SEC). The requirements of Part 363 were developed so that institutions that are public companies or subsidiaries of public companies will be able to file identical information with the SEC and the FDIC, supplemented by the additional information required by the differing statutory mandates.

b. Insured Institutions with assets of less than $500 million.

For institutions registered under the Securities Exchange Act of 1934 with the appropriate federal banking agency, the information requested, such as the auditor’s report and any notice of selection or change in accountant, is currently required to be filed. Other institutions are requested to submit the report that they obtain from the performance of their external auditing program and a notice of any change in auditors. However, they are not required to file any specific type of report, and may use the report required by the state or their by-laws under certain circumstances.

5. Minimizing the Burden on Small Institutions

The SBA defines “small” banks as those with assets of $165 million or less. All small institutions (in fact, all institutions with less than $500 million in assets) are exempt from Part 363. However, with the Policy Statement, the agencies recommend that even small institutions consider their need for an external auditing program and record the rationale for their decision regarding it. Unless required to do so under another law or regulation, obtaining an external audit is voluntary for small institutions under the Policy Statement. The burden estimates for this collection take account of the small institutions that file voluntarily.

6. Consequences of Less Frequent Collections

The frequency of collection is consistent with the statutory mandate in Section 36 of the FDI Act. Less frequent collection would result in non-compliance with the law. For institutions not subject to Section 36, an annual external auditing program is consistent with longstanding commercial practices in the banking industry.

7. Special Circumstances

None.

8. Consultation with Persons Outside the FDIC

This collection was developed through extensive consultation with the other financial institutions regulators, and its requirements were not finalized until after the notice-and-comment rulemaking process had been completed.

9. Payment or Gift to Respondents

Not applicable.

10. Confidentiality

Part 363 Annual Reports are available to the public. Other reports and notices filed under Part 363 and reports and notices filed under the Policy Statement are afforded confidential treatment.

11. Information of a Sensitive Nature

No questions of a sensitive nature are included in the collection.

12. Estimates of Annual Burden

a. FDIC-Supervised Institutions with assets of $1 billion or more.

Number of Respondents: 296

Annual Responses: 1,038

Annual Burden Hours: 67,525

b. FDIC-Supervised Institutions with assets of $500 million or more but less than $1 billion.

Number of Respondents: 377

Annual Responses: 1,529

Annual Burden Hours: 12,400

c. FDIC-Supervised Institutions with assets less than $500 million.

Number of Respondents: 4,532

Annual Responses: 13,596

Annual Burden Hours: 3,399

Total number of respondents: 5,205

Total annual responses: 16,163

Total annual burden hours: 83,324

13 Estimates of Annualized Cost.

None.

14. Estimates of Cost to the Government

a. FDIC-Supervised Institutions with assets of $500 million or more.

The FDIC estimates that it will spend approximately 8 hours having the professional staff (average $38 per hour) review this information and 2 hours on clerical functions (average $22 per hour). With 673 respondents, the annual cost to the government is approximately $234,204.

b. FDIC-Supervised Institutions with assets of less than $500 million or more.

The FDIC estimates that it will spend approximately 4 hours having the professional staff (average $38 per hour) review this information and 1 hour on clerical functions (average $22 per hour). With 4,532 respondents, the annual cost to the government is approximately $788,568.

The total annual cost to the government for all FDIC-supervised institutions, 5,205 respondents, is estimated to be $1,022,772.

15. Reason for Change in Burden

The burden estimate will increase from 65,612 hours to 83,324 hours or by 17,712 hours. The majority of the burden increase, 13,968 hours, is attributable to the increase in the number of FDIC-supervised institutions subject to Part 363 from 537 institutions as of March 31, 2005, to 673 institutions as of December 31, 2007, together with the increasing size of these institutions. The burden increase attributable to the proposed amendments to Part 363 is 3,744 hours.

16. Publication

The reports and notices filed with the FDIC are not published. The information is retained in the files of the Regional Offices of the Division of Supervision and Consumer Protection, FDIC. Part 363 Annual Reports are available to the public.

17. Display of Expiration Dates

Not Applicable.

17. Exceptions to Certification

None.

B. STATISTICAL METHODS

Statistical methods are not employed in this collection.

Attachments

1. Section 36 of the Federal Deposit Insurance Act (12 U.S.C. 1831m).

2. NPR (12 CFR 363)

3. Interagency Policy Statement on External Auditing Programs of Banks and Savings Associations.

7