tend to follow. many of you can recall the time and attention management devoted to section 112 of fdicia, which first required management reports and auditor attestations in the early 1990s. then the process became routine, delegated to lower levels of management, and stale to the changes in the way the business was being run. that is when the breaks in internal controls occur. unfortunately, trying to change the culture again is taking an exceptional amount of senior management and directors ’ time time taken away from building the business. the challenge, therefore, is to ensure that the corporate governance at community banks keeps pace with the changing risks that you will face in the coming years. another consequence of so much public attention on the breakdowns in controls at a few organizations is difficulty in finding good directors. one common theme we have heard during our examinations is the challenge facing banks of all sizes to retain, or attract, board members with the appropriate depth of understanding and commitment to sound corporate governance practices. many potential directors who have the experience needed are cautious about the potential liability they face. they also would rather join a board on which they are able to balance their time among all of the areas of oversight - strategy, marketing, financial performance, human resource development, community involvement, and so on - and not just governance, compliance, audits, and internal controls. this is another result of inconsistent attention over time to good governance practices. operational risk the federal reserve system is also conducting selected reviews for operational risk at community banks. by operational risk, i mean “ the risk of direct or indirect loss resulting from inadequate or failed internal processes, people and systems or from external events, ” which is the definition used by the basel committee on banking supervision. at the federal reserve, we are placing an increasing focus on operational risk. in part, this is due to the significant improvements we have seen in the last two decades in interest rate and credit risk management. thus, weaknesses in governance and internal controls and operational risks become more apparent. for example, at one of our reserve banks we are conducting a pilot program specifically geared toward the operational risk activities of smaller community banks, those with less than $ 500 million in assets. one of the objectives of the program is to identify and test the key internal controls used by banks to mitigate operational risk exposures. the reviews focus on specific business processes with high operational risk - for example, the wire transfer and loan administration areas. based on the results of these reviews, the bankers involved

have responded very favorably to the program and indicated they have received measurable benefits. moreover, the program has identified some common operational control weaknesses to which we believe community banks should pay particular attention. let ’ s use wire transfers and loan administration as examples. with wires and similar transactions, the bank could suffer a significant financial loss from unauthorized transfers, as well as incur considerable damage to its reputation if operational risk factors are not properly mitigated. a few recurring recommendations from our reviews, are to : ( 1 ) establish reasonable approval and authorization requirements for these transactions to ensure that an appropriate level of management is aware of the transaction and establish better accountability ; ( 2 ) establish call - back procedures, passwords, funds transfer agreements, and other authentication controls related to customer wire transfer requests ; and ( 3 ) pay increased attention to authentication controls, since this area may also be particularly susceptible to external fraud. loan administration is an area where a bank could suffer a significant financial loss from the lack of appropriate segregation of duties or dual controls, as well as incur considerable damage to its reputation if operational risk factors are not properly mitigated. a few recurring recommendations from our reviews, are to : ( 1 ) ensure that loan officers do not have the ability to book and maintain their own loans, ( 2 ) limit employee access to loan system computer applications that are inconsistent with their responsibilities, and ( 3 ) provide consistent guidance - policies and procedures - to line staff on how to identify and handle unusual transactions. we have several other recommendations that resulted from these reviews and have a number of operational risk initiatives underway currently. we expect to summarize these findings and provide further updates and guidance to the industry as we move forward. but given the examples of best practice i just mentioned, these are not revolutionary insights. well - run organizations have these or similar controls in place. we hope these studies serve as reminders that can be used to help bank managers keep the focus on continuous improvements in internal controls as part of the normal business process. observations on best practices finally, i would like to focus on some best practices for corporate governance at community banks. rather than talk broadly about best practices, i ’ ll focus on certain aspects of internal controls and operational risk management. best practice 1 : adopt a recognized internal control framework that works for the bank. all banks have some framework for internal control. what i ’ m suggesting as a best practice is to adopt a version of the committee of sponsoring organizations ( coso ) of