simply collect a fee. this type of situation is totally unacceptable. further, as the organization evolves over time by offering new products, changing processes, outsourcing services, complying with new regulations, or growing through mergers, the controls need to be modified to reflect the changes in risks. in some cases, the controls failed with respect to newer risk exposures that were not identified, or growth put strains on existing control processes that were not suitable for a larger organization. section 302 of sarbanes - oxley requires senior management to assess and report on the effectiveness of disclosure controls and procedures as well as on internal controls for financial reporting. this broader certification addresses controls and procedures related to public disclosure, including financial information, such as management ’ s discussion and analysis, that is reported outside of the financial statements. to address these new disclosure control certifications, companies are undertaking steps to • set up disclosure committees composed of the cfos, the corporate risk officers, in - house counsels, chief internal auditors, and other members of senior management, • identify the controls and procedures necessary for gathering information and preparing periodic reports, • determine whether the controls and procedures capture the appropriate information for disclosures and enable the necessary information to be recorded, processed, summarized, and reported on a timely basis, and • establish an audit program that includes quarterly evaluations of the assessment, control activities, information and communication, and monitoring elements of the disclosure control framework. we have not had enough experience to assess the effectiveness of these new certifications. however, for any framework to be successful, the ceos and cfos need to establish strong controls for maintaining and enforcing procedures for collecting, processing, and disclosing information in their securities filings. now here ’ s the challenge for you. first, as the company ’ s internal auditor, you should be proactive in ensuring that your company ’ s risk assessment and control process over financial reporting and disclosures are vigorous. in this regard • if you are an internal auditor of a financial services company that is subject to fdicia 112, you should seize this opportunity to take a fresh, objective look at the risk assessment and control process in your company ’ s internal control framework. • if you are an internal auditor of a publicly traded financial services company, you now have the same responsibility, since section 404 of sarbanes - oxley is modeled after fdicia 112. however, don ’ t assume that what was acceptable in the past is good

will remain vigilant, on an ongoing basis, in monitoring and assessing the impact of basel ii on both individual and aggregate minimum regulatory capital requirements and in employing rigorous and thorough analysis to support our evaluation. by so doing, we believe that the proposals being discussed today can be implemented responsibly and in a safe and sound manner. proposed interagency guidance on commercial real estate concentration risk the four federal bank and thrift regulatory agencies issued joint proposed guidance in january 2006 on the sound risk management of commercial real estate concentrations. the comment period closed in april. the proposed guidance generated significant interest. the federal reserve received more than 1, 600 comment letters on the proposed guidance. typically, the comments raised concerns about the intent and purpose of the proposed guidance. over the past few months, the federal reserve and the other federal banking agencies have been reviewing these comments carefully and have met with industry trade groups and individual bankers. in my testimony today, i would like to provide some perspective on why the agencies are concerned about cre concentrations and the risks they may pose, and why we saw the need to issue the proposed guidance. i will also address the intent of the proposed guidance and some misconceptions that have arisen. first, i would like to explain how we define commercial real estate. for purposes of this guidance, cre loans include land development and construction loans ( both commercial and 1 - to - 4 family residential construction ) and loans secured by raw land, multi - family property, or nonfarm nonresidential property where the primary or a significant source of repayment is derived from rental income associated with the property or the proceeds of the sale, refinancing, or permanent financing of the property. the proposed guidance does not apply to owner - occupied cre loans where the majority of repayment comes from income from the borrower's business operations. over the past dozen years, the agencies have observed a material rise in cre concentrations at many banks. for small - to medium - sized banks, in particular, the growth in cre concentrations has been significant. this growth in cre concentrations is understandable as community - based banks have experienced increasing competitive pressure from larger banks and other financial services institutions in other lending areas. we recognize that asset concentrations can, on a practical basis, be difficult to avoid due to an institution's marketplace, area of expertise, or competitive environment. however, as experience has amply demonstrated, large and growing asset concentrations such