of internal auditors'professional standards focus on adding value by meeting the needs of management and the board. internal auditors add value by being effective independent assessors of the quality of the internal control framework and processes. auditors lose their independence when they perform management consulting roles for which they later will have to render an opinion. internal audit is one of the few corporate functions that has both the ability and the responsibility to look across all of the management silos within the corporation and make sure that the system of internal controls has no gaps and that the control framework is continually reviewed to keep up with corporate strategic initiatives, reorganizations, and process changes. when an auditor becomes part of management, the independent view is lost. external audit let's turn to the topic of quality assurance in the external audit process. as supervisors, we must take steps to encourage a high standard of professionalism among auditors. in some cases, this may mean undertaking an enforcement action against an accountant. the agencies are finalizing the accountant debarment rule, which will be one more tool we can use to correct errant behavior. however, before we do that, we should look at the lessons learned from some recent audit failures. the typical fact pattern in these failures indicates that some auditors are focusing on the form rather than the substance of transactions when making critical audit judgments. moreover, when looking at assurance services, such as the fdicia 112 auditor attestations, some auditors have a tendency to gloss over internal control deficiencies or simply ignore significant control deficiencies because they are " immaterial. " it is not meaningful for auditors to apply a financial statement concept of materiality to an attestation engagement on internal controls. from a supervisory perspective, we would consider the existence of a series of such immaterial deficiencies to be useful information in assessing the quality of the internal and external audit process. we need to change this mindset in the auditing community. some of this can be done through dialogue with the american institute of certified public accountants and the public company accounting oversight board, which we are doing. once auditors start to routinely report known deficiencies in internal controls, we should begin to eliminate the gap between what we expect an audit or attestation engagement to include and actual services provided by auditors. however, if we continue to find significant internal control deficiencies in safety and soundness examinations that the auditor knows about but fails to disclose, because they are judged to be

desks for particular asset classes, instead of at the firm level. the proposal would also introduce a standardized approach that is well - aligned with the modeled approach, for use where the modeled approach is not feasible. these changes would raise market risk capital requirements by correcting for gaps in the current rules. requiring banks to model market risk at the level of individual trading desks better reflects the observation that correlations across risks can change dramatically in times of stress. requiring banks to use a standardized approach for hard - - 8to - model risks is appropriate, in light of the weaknesses that were exposed in the 2008 financial crisis, when many firms did not have acceptable models for their risks. in addition, the proposal appropriately charges more capital for positions that are less liquid, in order to better capture the risks of illiquid trading positions. third, for operational losses — such as trading losses or litigation expenses — the proposed rules would replace an internal modeled operational risk requirement with a standardized measure. the proposal would approximate a firm ’ s operational risk charge based on the firm ’ s activities, and adjust the charge upward based on a firm ’ s historical operational losses to add risk sensitivity and provide firms with an incentive to mitigate their operational risk. one important question involves the size of institutions that the new risk - based capital rules should apply to, and i will recommend that the enhanced capital rules apply to banks and bank holding companies with $ 100 billion or more in assets. a threshold of $ 100 billion would subject more banks to our most risk - sensitive capital rules compared to the current framework, which applies to firms that are internationally active or have $ 700 billion or more in assets. this expanded scope is appropriate for two reasons. first, the proposed rules are less burdensome for banks to implement than the current requirements, since they don ’ t require a bank to develop a suite of internal credit risk and operational risk models to calculate regulatory capital. second, our recent experience shows that even banks of this size can cause stress that spreads to other institutions and threatens financial stability. the risk of contagion implies that we need a greater degree of resilience for these firms than we previously thought, as the losses posed to society by the failure of a given firm are greater, and the probability that another firm may be a - 9victim to another firm ’ s failure are higher. the enhancements to the capital rules should improve the resilience of these firms. importantly, the proposed adjustments would require banks with