susan s bies : strengthening compliance through effective corporate governance remarks by ms susan s bies, member of the board of governors of the us federal reserve system, at the american bankers association, annual regulatory compliance conference in washington dc, 11 june 2003. * * * good morning. i thank you for the invitation to speak to this american bankers association regulatory compliance conference. since coming to the federal reserve board, i have spent much of my time dealing with corporate governance, internal control, and risk management issues. today, i would like to talk with you about the important role that the compliance function plays in banking organizations, and how the current emphasis on improving corporate governance is an opportunity for you to strengthen the compliance function in your organization. introduction over the past two years, we all have been shocked by the headlines announcing corporate governance or accounting problems at a variety of companies, such as enron, worldcom, and healthsouth. as we read these headlines, the question that comes to mind is, " what were the underlying deficiencies in the internal control processes of these companies that rendered their governance practices ineffective? " as the details about the scandals have been made public, it has become clear that they exemplify breakdowns in fundamental systems of internal control. why, then, have we seen so many headlines highlighting corporate governance and accounting problems? because these companies lost track of the basics of effective corporate governance - internal controls and a strong ethical compass. while most companies have effective governance processes in place, these events remind all of us of the importance of doing the basics well. internal control framework after an earlier series of corporate frauds, the national commission on fraudulent financial reporting, also known as the treadway commission, was created in 1985 to make recommendations to reduce the incidence of these types of frauds. the committee of sponsoring organizations ( coso ) of the treadway commission issued a report titled internal control - integrated framework that has become the most - referenced standard on internal control. if one re - reads that report, the need to return to focusing on the basics becomes clear. the report defines internal control as : a process, effected by an entity's board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of... • effectiveness and efficiency of operations • reliability of financial reporting • compliance with applicable laws and regulations. the coso framework was the model considered when the federal deposit insurance corporation improvement act ( fdicia ) was enacted in 1991. section

. simply stated, the current status quo for corporate governance is unacceptable and must change. this message is applicable to both public and private companies alike and affects everyone within a company. • the message for boards of directors is : uphold your responsibility for ensuring the effectiveness of the company's overall governance process. • the message for audit committees is : uphold your responsibility for ensuring that the company's internal and external audit processes are rigorous and effective. • the message for chief executive and chief financial officers and senior management is : uphold your responsibility to maintain effective financial reporting and disclosure controls and adhere to high ethical standards. this requires meaningful certifications, codes of ethics, and conduct for insiders that, if violated, will result in fines and criminal penalties, including imprisonment. • the message for external auditors is : focus your efforts solely on auditing financial statements and leave the add - on services to other consultants. • the message for internal auditors is : you are uniquely positioned within the company to ensure that its corporate governance, financial reporting and disclosure controls, and riskmanagement practices are functioning effectively. although internal auditors are not specifically mentioned in the sarbanes - oxley act, they have within their purview of internal control the responsibility to examine and evaluate all of an entity's systems, processes, operations, functions, and activities. what are the challenges for compliance officers in the sarbanes - oxley era? first, compliance officers must help corporate risk officers and managers reinvigorate the risk assessment, internal controls, and ethical compass of the organization. recently, the fed has been looking at the fdicia 112 management reports on internal controls for several banks that have had significant breaks in internal controls. from these banks, we have identified several whose fdicia 112 processes were not effective. a closer look at these situations indicates that managements had essentially put this process on autopilot. further, the external auditors had not done effective reviews of the basis of management reports. before you say, " that could not happen at my company, " let me remind you how we started our discussion today. in each of the cases involving banks, management seemed to be content with the loss of vigor in the process and the external auditor was apparently satisfied to simply collect a fee. this is totally unacceptable. further, as the organization evolves by offering new products, changing processes, outsourcing services, complying with new regulations, or growing through mergers, the controls need