Susan S Bies: Restoring our confidence in bank controls and financial
statements
Speech by Ms Susan S Bies, Member of the Board of Governors of the US Federal Reserve System,
before the Conference of State Bank Supervisors, Asheville, 30 May 2003.
* * *
This conference is always an important gathering, but not simply because of what we discuss over
these few days. It serves as an annual reminder of the remarkable strength of the dual banking system
in the United States. The diversity and flexibility of our banking system are unique. Bankers can make
charter choices on the basis of their business needs and particular circumstances. Thousands of
community banks coexist comfortably - indeed, thrive - alongside a much smaller number of very large
regional and global institutions, regardless of charter. Our system provides a rich menu of choices to
the marketplace, encouraging financial institutions to innovate and respond dynamically to the
changing economic needs of depositors and borrowers. Under the dual banking system states have
fostered innovations that likely would not have occurred as rapidly - if at all - had only federal
regulation existed. The dual banking system also helps to safeguard against regulatory excesses.
In short, this structure has been critical in producing a banking system that is the most innovative,
responsive, and flexible in the world. U.S. banks have developed those characteristics to survive in a
market economy that is subject to rapid change and periodic stress. Our banking system is thus better
able to finance growth and serve customer needs and has demonstrated its ability to rebound from
crises that have, from time to time, devastated more rigid systems.
This conference also reminds us of the long history of close and successful cooperation among state
and federal regulators that allows state-chartered banks to flourish in the marketplace while remaining
safe and sound. As you know, the Federal Reserve has consistently been a strong supporter of the
dual banking system, and that will continue. We understand, as you do, the importance of a safe and
sound banking system to the proper functioning of the economy, and the role of effective supervision
in ensuring sound banks.
Supervising these state-chartered banks is a very significant responsibility, considering the scope and
vitality of these institutions. State-chartered banks continue to represent about half of the commercial
banking industry by assets - $3.41 trillion, or 47.6 percent of the industry at year-end 2002. By number
of institutions, roughly three-fourths of banks operate under a state charter - 6,311 institutions or
75.2 percent of the industry as of December. Perhaps most significant, over the past three years the
vast majority of new bank charters - once again, about three-fourths of them - have been granted by
states.
We have a long history of working with the states to coordinate our supervisory programs and achieve
quality results. We rely on state supervisors as equal partners to ensure consistent, effective, and
high-quality supervision. Together with the Federal Deposit Insurance Corporation, we believe we
have a strong relationship with the states, bolstered by our common effort to develop the supervisory
protocols of the last decade and, more recently, by our work with the states and the FDIC to foster
consistent examination processes and procedures.
I believe the flexibility and dynamism of our banking system contributes to the financial soundness and
performance of U.S. banks. The banking industry continues to be strong and profitable despite a tepid
economy and corporate governance issues. After a record year in 2002, insured commercial banks in
the United States earned $24.6 billion in the first quarter of 2003 - a quarterly record. Robust growth in
core deposits and vibrant activity in mortgage lending have been the key forces behind recent strong
earnings, which have been offset in part by weak loan demand from businesses. Aggregate
nonaccrual loans and foreclosed assets remain at about 1.2 percent of loans while credit costs have
declined, as first-quarter net charge-offs dropped to 0.91 percent of average loans - the lowest level
since June 2001. Although all the facts are not yet in, it appears that this credit cycle hasn't tested us
nearly as significantly as we have been tested in the past.
Community banks have also remained strongly profitable through this period, although over the past
two years they experienced far less of a run-up in problem assets and charge-offs than their larger
counterparts. The number of problem banks remains at about 120, but actual failures remain quite low,
only ten in all of last year.
Corporate governance
Based on the current condition of the industry, you might ask what's on the supervisory agenda and
where should we focus our attention? Although there are a number of supervisory issues that require
our attention, there are two specific areas - corporate governance and quality assurance in the audit
process - where I believe we should focus some of our supervisory attention.
Over the past two years, corporate scandals have focused our attention on the deficiencies in
corporate governance at major companies. The reforms of the Sarbanes-Oxley Act of 2002 focused
on the need to enhance the governance, accounting, and disclosure practices at public companies,
and the resulting dialogue has focused attention on the need to improve governance practices at other
companies. The Securities and Exchange Commission has launched significant regulatory reforms
and initiatives to address these issues, and the banking agencies have been actively involved in a
dialogue with the SEC on matters of mutual interest. The focal point of this dialogue is to implement
practical steps to move the corporate governance practices of public and nonpublic companies
forward, particularly with regard to the adequacy of internal controls and audits. I want to focus the rest
of my remarks on steps that we can take to improve the quality assurance process surrounding
internal controls and audits.
Internal controls
The essence of corporate governance is ensuring that the company is operated, at all times, in a
manner that manages risk, achieves the company's stated operating objectives, and protects the best
interests of the shareholders. The Internal Control-Integrated Framework of the Committee of
Sponsoring Organizations (COSO) of the Treadway Commission is the most-often-mentioned
standard on internal control at banking organizations. The COSO framework defines internal control as
"a process, effected by an entity's board of directors, management and other personnel, designed to
provide reasonable assurance regarding the achievement of:
• effectiveness and efficiency of operations;
• reliability of financial reporting;
• compliance with applicable laws and regulations."
Based on this definition, it is clear that boards of directors are responsible for ensuring that their
organizations' internal controls are adequate for the nature and scope of their businesses and that line
management is responsible for ensuring that internal controls are functioning on a day-to-day basis.
Thus, the board of directors and management need to have a quality assurance process in place for
internal controls. So, how do we know that the quality assurance process surrounding the internal
controls at banking organizations is working?
With respect to this quality assurance process, the Federal Reserve conducted reviews of the
documentation and support for management's assessment of internal controls and the auditor's
related attestations at a few problem institutions that are subject to section 112 of the Federal Deposit
Insurance Corporation Improvement Act. What we found was evidence that notable deficiencies had
crept into the quality of the work performed by management over time as the businesses grew and
new products were added. Management became less vigilant in the internal control area because of
increased performance pressures. This behavior is actually counterintuitive when dealing with internal
controls. As the business grows and new products are added, that is precisely the time when
management needs to ensure that adequate controls are in place to mitigate risks. We are talking to
the other banking agencies about these concerns and are considering the need for more detailed
guidance for management that will strengthen banks' internal control practices.
Internal audit
Recent corporate governance events clearly demonstrate the importance of the internal audit function.
While Sarbanes-Oxley does not focus on the role of the internal auditor, bank supervisors have long
recognized the importance of an effective internal audit function to the control environment. With
respect to the quality of internal audit, the audit committee must pave the way for quality assurance.
As we indicated in a recently amended interagency policy statement on the internal audit function, the
committee should provide for the utmost independence, objectivity, and professionalism of the internal
audit process. The audit committee sets the tone, and our role as supervisors is to reinforce it. The
goal for internal audit should be to have no internal control surprises.
To support this goal, internal audit should have an effective quality assurance process. Risk-focused
audit programs should be reviewed regularly to ensure audit resources are focused on the higher-risk
areas as the company grows and produces and processes change. As lower-risk areas come up for
review, auditors should do enough transaction testing to be confident in their risk rating. Audit
committees should receive reports on all breaks in internal controls to determine where the auditing
process can be strengthened.
Before a company moves into new or higher-risk areas, the board of directors and management
should receive assurances from internal audit that the tools are in place to ensure that the basics of
sound governance will be adhered to. The audit committee should actively engage the internal auditor
to ensure that the bank's risk assessment and control process over financial reporting are vigorous.
Many of the organizations that have seen their reputations tarnished in the past two years have simply
neglected to consider emerging conflicts of interest when adding new products and lines of business.
It is important to make sure that appropriate firewalls are in place before the product or activity begins.
As supervisors, we can focus attention on this area and watch for signs of any internal audit
deficiencies at our institutions.
The audit committee should also require the highest possible level of independence for the internal
audit process and eliminate any threats to this independence, such as the tendency for some internal
auditors to act as management consultants within the organization. Many of the proposed revisions to
the Institute of Internal Auditors' professional standards focus on adding value by meeting the needs of
management and the board. Internal auditors add value by being effective independent assessors of
the quality of the internal control framework and processes. Auditors lose their independence when
they perform management consulting roles for which they later will have to render an opinion. Internal
audit is one of the few corporate functions that has both the ability and the responsibility to look across
all of the management silos within the corporation and make sure that the system of internal controls
has no gaps and that the control framework is continually reviewed to keep up with corporate strategic
initiatives, reorganizations, and process changes. When an auditor becomes part of management, the
independent view is lost.
External audit
Let's turn to the topic of quality assurance in the external audit process. As supervisors, we must take
steps to encourage a high standard of professionalism among auditors. In some cases, this may mean
undertaking an enforcement action against an accountant. The agencies are finalizing the accountant
debarment rule, which will be one more tool we can use to correct errant behavior. However, before
we do that, we should look at the lessons learned from some recent audit failures.
The typical fact pattern in these failures indicates that some auditors are focusing on the form rather
than the substance of transactions when making critical audit judgments. Moreover, when looking at
assurance services, such as the FDICIA 112 auditor attestations, some auditors have a tendency to
gloss over internal control deficiencies or simply ignore significant control deficiencies because they
are "immaterial." It is not meaningful for auditors to apply a financial statement concept of materiality to
an attestation engagement on internal controls. From a supervisory perspective, we would consider
the existence of a series of such immaterial deficiencies to be useful information in assessing the
quality of the internal and external audit process. We need to change this mindset in the auditing
community.
Some of this can be done through dialogue with the American Institute of Certified Public Accountants
and the Public Company Accounting Oversight Board, which we are doing. Once auditors start to
routinely report known deficiencies in internal controls, we should begin to eliminate the gap between
what we expect an audit or attestation engagement to include and actual services provided by
auditors. However, if we continue to find significant internal control deficiencies in safety and
soundness examinations that the auditor knows about but fails to disclose, because they are judged to
be immaterial, then we should discuss the auditor's lack of action with the banking organization's audit
committee. Furthermore, in appropriate circumstances, we may need to refer the auditor to the
PCAOB or subject the auditor to sanctions under the agencies' debarment regulations if the bank is
subject to FDICIA 112.
A secondary cause of the audit failures was lax professional standards. Examples in the banking area
are the professional standards for attestation engagements. Currently, the standards don't require
auditors to perform any independent testing of controls. Under the current standards, auditors can
simply rely on the work of internal audit as the basis for issuing an attestation report on management's
report on the effectiveness of internal controls. There is virtually no guidance on the criteria auditors
should use to issue a qualified opinion. We have long argued that the professional standards in this
area need to be more robust. In response to our criticisms and those of others, the AICPA recently
proposed revisions to their professional standards to address some of these issues. However, the
AICPA no longer has the authority to issue standards or to administer the quality assurance (peer
review) function for audit or attestation engagements of public companies. The newly created Pubic
Company Accounting Oversight Board has this authority and is just beginning to develop a framework
for quality assurance. So, this may take a little time to correct. However, as supervisors, we will
continue to work with the AICPA and the PCAOB to ensure that high-quality professional standards
are created for public and nonpublic companies and that a robust process for ensuring audit quality is
implemented.
Conclusion
In closing, I would like to simply encourage all of us to be vigilant about sound corporate governance
and internal control processes at banking organizations. To accomplish this, we need to insist on
effective attestations on internal controls by external auditors and encourage bankers to improve the
quality assurance process and independence of the internal audit function. Finally, supervisors from all
regulatory agencies need to continually work together to ensure a consistent, high-quality examination
process throughout our banking system.