status of the underlying assets. we are incorporating these items into our supervisory monitoring screens, and we assume market analysts are also making use of these public data for their own analysis of banking risk. clearly, more can and should be done by banking organizations to demystify and clarify the risks they are taking. other areas being discussed include disclosures on the risk profile of bank credit portfolios by internal risk ratings. the first three elements of risk management that i have discussed are fundamental to bank safety and soundness, but without the fourth element - - internal controls - - none of the other elements can be effective. for that reason, an evaluation of internal controls has always been a fundamental part of bank supervision. it is a key to improving the odds that problems are found early and addressed before the bank insurance fund or taxpayer dollars are at risk. in response to a rising trend of unexpected weaknesses in control found at banks, supervisors are seeking to ensure that risk - focused supervision is striking the right balance between reviewing riskmanagement processes and performing procedures to validate whether the procedures are working as advertised. supervisors need to place more emphasis on determining whether the strength and effectiveness of those controls are tested by an independent third party other than supervisors and if they are, how frequently. in particular, as part of our risk - focused supervision, we have endeavored to use the work of internal auditors when it is deemed to be reliable. however, it is becoming clearer that we must bring a new level of skepticism to bear in this area for some institutions. in that regard, supervisors must return to the fundamentals of risk - focused supervision and require substantive verification procedures to confirm the effectiveness and reliability of internal audit, before placing substantial reliance on its findings. in the past, supervisors have taken some comfort in the fact that external accountants have also been looking at an institution's internal controls. as you know, for many banks the federal deposit insurance corporation improvement act ( fdicia ), section 112, requires that the external auditor attest to management's assertions regarding the adequacy of internal controls over financial reporting. recent events among certain banks that have had material financial consequences have caused us to question the usefulness of these attestations. in certain instances, we have been asking external accountants for their fdicia 112 work papers for banking organizations that we have found to have had significant control weaknesses. we are looking into that work to formulate some views on whether this area needs improvements and what actions

mark w olson : risk management in a changing economic environment remarks by mr mark w olson, member of the board of governors of the us federal reserve system, before the bank administration institute, phoenix, arizona, 30 april 2002. * * * it is a pleasure to appear at this year's bank administration institute's audit, compliance, and electronic security conference. the bai has historically been the repository for thoughtful leadership on a wide range of management, operations, and system - related issues. this is an appropriate forum for sharing the fed's perspective on certain risk - management issues as they are being addressed by the financial services industries. to put my comments in perspective, let me first identify four key environmental factors that have changed in the financial services industry and have required the industry to improve both its monitoring and its management of risk exposures. the four major environmental factors affecting financial services are the following : • industry consolidation, • increased competition, • technological changes, and • management focus on shareholder value. these factors, of course, are not the only ones affecting your industry, but their combined influence has clearly altered your management challenges. all of you are familiar with these factors so we have no need for elaborate description, but let me touch on a few ways in which these factors have affected risk management - - starting with consolidation. twenty years ago, america's largest bank was citicorp, with assets of around $ 120 billion. though citicorp had a major international banking presence, its domestic banking operation was contained largely in the state of new york. its major national credit card operation was its most significant departure from traditional banking lines. in contrast, today's citigroup has $ 1 trillion in assets and is a highly diversified financial services provider operating not only throughout the united states but also internationally. citigroup's expanded scope is by no means unique. rather, it is typical of the bank and nonbank consolidation that has taken place. today, thirteen financial holding companies hold more than $ 100 billion in assets. though we still have more than 6, 000 separate banking organizations in this country, our largest organizations now have nationwide presence and offer a broad array of financial products. let's move on to competition. despite the consolidation that has taken place, the financial services industry remains highly competitive. not only do banks face intra - industry competition, but they also face competition from nonbank financial service providers. as of all of you know, virtually every financial product offered by