Examinations by federal banking regulators are intended to assess the safety and soundness of banks and identify conditions that may require prompt corrective action to remedy unsafe and unsound banking practices. In recent years, banking regulators have changed their examination techniques by placing increased emphasis on an institution’s internal control systems and on the way it manages and controls its risks. This evolution to a risk-focused approach is in response to rapid changes in the banking industry and the speed with which an institution’s risk profile can change. This approach is particularly important since, in recent years, major consolidations have resulted in a number of large, complex banking organizations with diverse risks and sophisticated risk management systems. This trend can be expected to continue in light of the recent enactment of the Gramm-Leach-Bliley Act of 1999 that allows banks, securities firms, and insurance companies to acquire one another. The Federal Reserve and Office of the Comptroller of the Currency (OCC) have developed similar examination programs specifically for large, complex banks; but the two agencies differ in their implementation of the programs. Because of the growing number of large, complex banking organizations, the Chairwoman and Ranking Minority Member, Subcommittee on Financial Institutions and Consumer Credit, House Committee on Banking and Financial Services asked that we study the risk-focused approaches used by the Federal Reserve and OCC to examine these institutions. The objectives of this report are to (1) describe the general characteristics of the regulators’ risk-focused approach to examinations of large, complex banks, explaining how they differ from past examination practices; (2) compare the implementation of the Federal Reserve’s and OCC’s risk- focused examination approaches; and (3) identify the challenges faced by both agencies as they continue to implement their examination programs for large, complex banks. Section 111 of the Federal Deposit Insurance Corporation Improvement Act of 1991 (FDICIA) generally requires that each appropriate federal banking and thrift agency conduct a full-scope, on-site examination of federally insured depository institutions under its jurisdiction at least once during each 12-month period. The primary objectives of bank examinations done by the federal bank regulators are (1) to provide an objective evaluation of the bank’s safety and soundness, ensuring that it maintains capital commensurate with its risk, (2) to appraise the quality and overall effectiveness of management systems, and (3) to identify and follow up in those areas where corrective action is required to strengthen the bank’s performance and compliance with laws and regulations. The bank examination assesses six components of a bank’s performance – capital adequacy, asset quality, management, earnings, liquidity, and sensitivity to market risk. These components combine to form the CAMELS rating system, which includes a rating for each component and an overall composite CAMELS rating. Each CAMELS element and the composite is rated on a five-point scale. This rating is to be updated annually. Commercial banks in the United States are supervised by three different federal agencies, depending on their type of charter. The OCC supervises nationally chartered banks. The Federal Reserve Board supervises state chartered banks that are members of the Federal Reserve System. The Federal Reserve Board has delegated its examination authority to the 12 Federal Reserve district banks. The Federal Deposit Insurance Corporation (FDIC) supervises state banks that are not members of the Federal Reserve System. Most banks are owned or controlled by a bank holding company. Holding companies may consist of one or more bank subsidiaries, nonbank subsidiaries, and even other holding companies. The largest bank subsidiary in a holding company is typically referred to as the lead bank and often holds most of the company’s assets. The Federal Reserve is responsible for supervising all bank holding companies while OCC, FDIC, or the Federal Reserve may be the supervisor for the lead bank. Our focus for this report is on the examination of the lead bank of large, complex banking organizations. However, as is discussed further below, when examining large, complex banks, examiners are to consider the operation of the organization’s other subsidiaries because their risk can affect the risk profile of the lead bank. For the purposes of this report, we use the term “bank” to refer to the lead bank in a large banking organization. Either the Federal Reserve or OCC supervises the largest most complex banks operating in the United States. Therefore, in our discussion, we discuss those two agencies. Technological advances and financial product innovation, combined with regulatory and legislative changes, have expanded the type and scope of activities undertaken by banks. Since the 1970s, significant changes have been occurring in the financial services industry due to a number of market shocks, combined with advances in and application of financial theory and information technology. The interaction of these factors has led to significant expansion of such financial products as derivatives and asset-backed securities, improved methods of measuring and managing risks, increased competition in financial services, and mergers of financial firms within and across financial sectors. The creation and growth in derivatives, large increases in other trading activities, including the development of new secondary markets, along with the creation of asset-backed securities, have changed the financial landscape. Advances in information technology and financial theory have helped reduce various barriers to competition. The increased speed and lower costs in communicating and transmitting data over large geographic distances has reduced such distance as an obstacle to competition. Moreover, new financial theories and faster computers helped financial firms handle large amounts of data at low cost and analyze the risks and returns created by new financial products. Swaps, options, and other derivatives, which have been growing rapidly, are examples of such technology- and theory-dependent products. The Regulators also have acted in ways to expand the activities in which banks may engage. For example, the Federal Reserve Board has approved several additional financial products that banks are permitted to offer, including providing investment advice, underwriting insurance related to the extension of credit, tax planning and preparation, data processing, and operating a credit bureau or collection agency. The Federal Reserve Board also approved bond and stock underwriting powers for Section 20 subsidiaries of bank holding companies. Effective in March 1997, the Federal Reserve Board enhanced these powers when it increased from 10 to 25 percent, the share of total revenues a bank holding company’s Section 20 subsidiary may derive from corporate equity and debt underwriting. On the basis of these decisions, banks have increasingly acquired or created securities broker-dealer affiliates or subsidiaries. OCC has amended its regulations to permit subsidiaries of national banks to engage in activities that OCC determines, on a case-by-case application basis, to be “part of or incidental to the business of banking.” Consolidation in the banking industry in recent years has resulted in a growing number of large, complex banking organizations. Banking resources are now concentrated in fewer and larger banking organizations. According to FDIC, at year-end 1998, the 25 largest banking organizations held approximately 54 percent of industry assets compared with about 22 percent at year-end 1990. These developments have resulted in a number of large complex banking organizations with risk profiles that include traditional banking along with differing amounts of trading and other activities. Not only are some of the profiles different, but they are subject to a rapid change. Many of these companies have aligned their risk-management processes along lines of business like commercial lending. In some cases, the alignment of risk management along lines of business results in operations being managed in a unified manner, where possible, without regard to charter. Such institutions are also subject to oversight by more than one regulator. For example, a bank could include several bank charters, some of which engage in securities activities. To keep pace with the changes occurring in the risk profile of such institutions, examinations must focus on management’s ability to control rapidly changing risks. Examining such banks requires that the primary regulators coordinate with other regulators in assessing the entire risk profile of the institution. With the continued consolidation of the banking industry, both the Federal Reserve and OCC have developed separate examination programs for community banks and large, complex banking organizations. The development of separate programs is in recognition of differences in the supervisory requirements for small community banks and large, complex banks. These differences include the complexity of financial products, sophistication of risk-management systems, management structure, geographic dispersion of operations, and the importance of coordinating with other supervisory agencies who have supervisory responsibility for various parts of the complex organization. In December 1995, OCC issued a revised Comptroller’s Handbook for large bank supervision, which became the cornerstone of its new supervision by risk approach to bank examination. This handbook was revised in April 1996 and July 1998. In August 1997, the Federal Reserve issued its handbook entitled “Framework for Risk-Focused Supervision of Large Complex Institutions.” More recently, the Federal Reserve issued a supervisory letter entitled, “Risk-Focused Supervision of Large Complex Banking Organizations.” Large, complex banks are defined by both the Federal Reserve and OCC as those that generally have a functional management structure; a broad array of products, services, and activities; operations that span multiple supervisory jurisdictions; and consolidated assets of $1 billion or more. OCC has further designated the largest most complex banks, with assets of $25 billion or more, for supervision by one of three deputy comptrollers in Washington, D.C. The Federal Reserve has also identified certain large banks as being the largest and most complex and therefore subjects these institutions to heightened scrutiny, assigning a Federal Reserve Board analyst, in addition to staff from the Federal Reserve district bank. We selected banks from these groups for our review. Each of the agencies’ programs includes similar elements, such as continuous monitoring of the bank and frequent contact with the bank’s top management. OCC’s program covers the largest national banks operating in the United States. Because the Federal Reserve has responsibility for bank holding companies as well as state banks that are members of the Federal Reserve System, many of the institutions included in its program include bank holding companies for the national banks that fall under OCC’s program. The Federal Reserve has overall supervisory authority for foreign banking organizations (FBO) operating in the United States, and the largest of these are included in the Federal Reserve’s large, complex bank list as well. As of September 30, 1999, the Federal Reserve’s and OCC’s large bank programs each included approximately 30 institutions. In this report, we use the term “risk-focused supervision” to describe both the Federal Reserve’s risk-focused supervision program and OCC’s supervision by risk. The Federal Reserve and OCC risk-focused examination programs for large banks have similar goals and techniques for achieving them. Although the agencies did not formally coordinate the development of their programs, they did develop their programs in the same environment, with informal communication between the agencies regarding their programs. Both agencies have developed specific terminology for the purpose of shaping their risk analyses and communicating the results of those analyses to bank management. Both agencies develop supervisory strategies through ongoing monitoring of the bank and engage in ongoing communication with bank management. The structures of the banks covered by their programs require that they coordinate their examinations with other regulators and that both agencies employ specialists to understand and assess the increasingly complex operations of large banks. Although the principles of their respective approaches are similar, the Federal Reserve and OCC differ in the way they implement their programs. Chapter 3 discusses differences between the two agencies’ programs. The Federal Reserve’s risk-focused supervision and OCC’s supervision by risk have several common goals: to determine the condition of the bank and the risks associated with current and planned activities, including risks originating in relevant subsidiaries and affiliates; to be more flexible and responsive to changing conditions at the bank in planning examinations, rather than reacting to prior events; to use examiner and bank resources more efficiently. Risk-focused supervision does not replace the CAMELS rating system. Examiners use the CAMELS rating to report their conclusions about a bank’s current condition. Under risk-focused supervision, examiners focus their attention on areas of current and emerging risk to judge the bank’s condition, which is summarized and reported using a CAMELS rating. The risk assessment is a key phase of the examination planning process. It is intended to identify both the strengths and vulnerabilities of an institution and provide a foundation from which to determine the procedures to be completed during the examination. Examination staffs for OCC and the Federal Reserve said that they do not have sufficient resources to do an in-depth examination of every risk at a bank. The risk assessment is therefore necessary to focus examiner resources on those risks with the largest potential impact on the safety and soundness of the bank. Risk assessments entail the identification of the financial activities in which the banking the determination of the types and quantities of risks to which these activities expose the institution; and the consideration of the quality of the management and control of these risks. In performing the risk assessment, examiners are to make and record judgments regarding risk exposure and the ability of a bank to manage that exposure, and to determine the anticipated future direction of risk at the bank for the coming year. The risk assessment is to form the basis for a supervisory strategy for the organization. The evaluation of the risk management process for each activity or business line also assists in determining the extent of transaction testing that should be planned for each area. Assessing risk at large, complex banks often requires that examiners consider risks posed by subsidiaries that are regulated by other regulatory agencies. Therefore, examiners must coordinate their examination activities with examiners from those agencies, including bank and securities regulators. Because the Federal Reserve examines state banks, it is necessary for Federal Reserve examiners to coordinate their activities with examiners from state banking agencies. Such coordination and avoidance of unnecessary duplication are essential to effective supervision of large, complex banks. Both the Federal Reserve and OCC encourage their examiners, as appropriate, to incorporate the findings and conclusions of other supervisors into their overall assessment of the consolidated banking organization. The Federal Reserve and OCC have agreements in place to guide their coordination with the Securities and Exchange Commission (SEC), other bank regulators, and each other. Under risk-focused supervision, both the Federal Reserve and OCC have developed sets of risk definitions for use in communications between examiners and bank management and to serve as a basis for examination strategies that are customized to the risks of each bank. As presented in table 1.1 and 1.2, the Federal Reserve has six risk categories and OCC has nine. Along with their own common risk terminologies, OCC and the Federal Reserve have issued risk assessment guidelines intended to assist examiners to make consistent risk assessments across geographic lines and products, regardless of the diversity or complexity of the financial institution. These guidelines present factors that examiners should consider to quantify risks as low, moderate, or high and to assess the management of those risks as weak, acceptable, or strong. Under the risk-focused approach of both the Federal Reserve and OCC, examiners are to engage in ongoing monitoring and communication to keep abreast of the current financial condition and business strategies of a bank. Ongoing monitoring includes a formal quarterly update of a bank’s risk assessment. This periodic assessment is based, in part, on internal management reports, internal and external audit reports, and publicly available information. Information for ongoing monitoring is also collected through frequent contact with key bank officials. As described in more detail in chapter 3, examination activities may be conducted during targeted examinations done throughout the year. Prior to the adoption of risk-focused supervision, examiners conducted out-of- cycle targeted examinations in addition to annual examinations when regulators identified specific areas of immediate supervisory concern. Targeted examinations are now considered routine and are used to focus examination activities on a specific activity or line of business at the bank. For example, targets can include the examination of a bank’s internal audit function; a review of a particular lending activity such as energy lending; or an assessment of the bank’s management of derivatives activities in a specific market. A targeted examination will generally result in a letter to bank management describing the results of the targeted examination. Depending on the examination findings and bank management’s reaction to them, the results of the targeted examination may or may not be included in the annual report of examination for the bank. Under the risk-focused approach, the Federal Reserve and OCC continue to produce an annual report of examination. However, examination reports for both agencies are generally a summary of events that occurred over the course of a year. However, they may not mention supervisory issues that were raised by examiners to management and resolved since the last examination report. Regulators told us that issues that were not remedied during the year would be included in the examination report . To raise issues as early as possible and before they further adversely affect the bank, examiners employ various communication vehicles to communicate with bank management and the bank’s board of directors throughout the year. The Chairwoman and Ranking Minority Member of the Subcommittee on Financial Institutions and Consumer Credit, House Banking Committee asked us to provide information on banking regulators’ risk-focused approaches to large domestic bank examinations. Our objectives were to (1) describe the general characteristics of the regulators’ risk-focused approach to examinations of large, complex banks, explaining how they differ from past examination practices; (2) compare the implementation of the Federal Reserve’s and OCC’s risk-focused examination approaches; and (3) identify the challenges faced by both agencies as they continue to implement their examination programs for large, complex banks. Large, complex banks are defined by both the Federal Reserve and OCC as those that generally have a functional management structure; a broad array of products, services, and activities; operations that span multiple supervisory jurisdictions; and consolidated assets of $1 billion or more. OCC has further designated the largest most complex banks, with assets of $20 billion or more, for supervision by one of three deputy comptrollers in Washington, D.C. The Federal Reserve has also identified certain large banks as being the largest and most complex and therefore subjects these institutions to heightened scrutiny, assigning a Federal Reserve Board analyst in addition to staff from the Federal Reserve district bank. We selected banks from these groups for our review. The largest banks chartered in the United States are either national banks or state member banks of the Federal Reserve whose primary federal regulators are either OCC or the Federal Reserve, respectively. Accordingly, this report does not address the efforts of the Federal Deposit Insurance Corporation (FDIC) and the Office of Thrift Supervision (OTS) to shift to risk-focused safety and soundness examinations. To gather information on the structure and rationale for implementing a risk-focused approach as well as the key differences between past and present examination approaches, we conducted interviews with supervisory officials from the Federal Reserve and OCC. We also reviewed various documents from the agencies, including bank examination handbooks, guidance to examiners and banking industry officials on risk- focused examinations, and supervisory officials’ testimonies and speeches related to this subject matter. To further enable us to describe the risk-focused approach, we reviewed each agency’s implementation of their approach at seven large, complex banks. We selected three large, complex banks supervised by the Federal Reserve and four by OCC. Our selection was based on the criteria that the banks be included on the agencies’ list of large, complex institutions; that the institutions selected would spread across several Federal Reserve and OCC districts; and that the institutions were primarily engaged in commercial banking activities. The results of this work are not projectible to the rest of the large, complex banks examined by the Federal Reserve and OCC. In preparation for our interviews with the examination staff, we reviewed the supervisory strategies and risk-assessment documents prepared for those seven banks. Using a structured interview guide, we interviewed examination staff assigned to these banks on their overall planning and scoping of examination activities. In addition, using a data collection instrument, we reviewed examination work papers for two bank activities that were examined at each of the seven banks. We attempted to select similar areas in each of the bank examinations; but because of the diversity in the scope of the examinations, we were not always able to do this. We were, however, able to identify and review a credit and internal audit related examination activity for most of the banks. To identify the challenges faced by both agencies as they continue to implement their examination programs for large, complex banks, we spoke to Federal Reserve and OCC officials and examination staff as well as staff from OCC’s Quality Assurance Division. In addition, we reviewed various studies that analyzed bank examinations in the 1980s and early 1990s. This report also draws upon work that we have done this year on the near failure of the Long-Term Capital Management hedge fund. We did our work in accordance with generally accepted government auditing standards, between May 1999 and November 1999 in Washington, D.C., and other cities where Federal Reserve and OCC examination staff for the large, complex banks included in our review were located. We obtained written comments on a draft of this report from the Federal Reserve and OCC. Their comments are reprinted in appendixes I and II. Both the Federal Reserve and OCC commented that this report presented an accurate description of their risk-focused programs for supervising large banks. In addition, both the Federal Reserve and OCC expanded on a number of points made in the draft pertaining to their large bank examination programs and provided clarifying and technical comments that were incorporated where appropriate. The Federal Reserve and OCC also both commented that their programs will continue to develop in response to changes in the industry, such as the recent passage of the Gramm-Leach-Bliley Act. As implemented by the Federal Reserve and OCC, the risk-focused examination procedures for large, complex banks differ from earlier procedures in several important ways, as outlined in table 2.1. First, the risk-focused procedures provide a perspective for supervisory assessments of banks’ safety and soundness that differs from the perspective of earlier examination procedures. In the past, examinations were aimed at determining a bank’s safety and soundness at a specific point in time, along with the bank’s compliance with banking laws. Although examiners were to review a bank’s risk-management, the earlier procedures emphasized transaction testing to verify the existence and value of bank assets and provide an assurance that the bank operated at a specific point in time, in a safe and sound manner. Risk-focused examinations are based on the belief that a large, complex bank’s risk profile changes too rapidly to expend extensive resources testing transactions that may offer little insight to the bank’s current condition. Therefore, risk-focused examination procedures are designed to be more forward looking; they emphasize proactively assessing a bank’s actions to manage risks. Examiners are to focus on individual bank’s risk-management practices and controls, using transaction testing to validate the findings from these process reviews. Under the risk-based approach, transaction testing may be less extensive and may require fewer resources from supervisory agencies and banks, compared with resource requirements of the earlier approach. A second key difference between the two approaches is the organizational scope of the examination. Under previous approaches, examinations focused on bank operations defined by their charters or legal entities. However, as more large banking organizations have begun managing their key activities along business lines and centralized risk-management systems that cross legal entities, the Federal Reserve and OCC have focused their examination activities in the same way. Consequently, the risk-focused approach generally incorporates risk assessments and examination procedures that are organized by lines of business. Finally, other differences between risk-focused examinations and the earlier approach are differences in the planning of examinations, allocation of examiner resources, ongoing monitoring of bank operations, and communication of examination findings. One way in which the current risk-focused approach differs from the previous approach is that it is more forward looking. While past examination procedures included reviews of risk-management processes, they primarily tested a bank’s records of its transactions to validate the bank’s valuation of its assets and thus judge whether the bank is being safely and soundly managed. In contrast, the risk-focused approach is designed to stress reviews of ongoing management practices, internal controls, and internal audit activities. Transaction testing remains important but is intended to validate examiners’ judgment on the reliability of an institution’s controls. Past examination procedures provided a historic picture of a bank and were largely a retrospective look at how risks were managed. According to Federal Reserve officials, in the past 10 years, bank examinations placed significant reliance on transaction testing procedures to determine a bank’s condition at a point in time. Transaction testing is defined to include examination of underlying support for transactions and the reconciliation of internal accounting records to financial reports (to evaluate the accuracy of account balances), the comparison of day-to-day practices to the requirements of policies and procedures (to assess compliance with internal systems), and all other supervisory testing procedures, such as the review of the quality of individual loans and investments. For example, examiners determined the risk posed by a loan portfolio through a transaction-by-transaction review of a sample of loans. To evaluate the credit administration process, the quality of loans, and the allowance for loan and lease losses (ALLL), examiners reviewed a high percentage of the loan files for commercial and industrial (C&I) loans and for commercial real estate loans. In contrast, Federal Reserve and OCC officials said that the risk-focused approach is an attempt to look forward and to provide a proactive assessment of a bank’s actions to manage risks. Rather than focusing on the results of practices based on past decisions, examiners are to communicate with bank management to understand and strengthen their risk-management strategies. Examinations now place a greater emphasis on evaluating the appropriateness of risk-management processes and have moved away from a high degree of transaction testing. Our review of two examination segments from each of the seven examinations found that the examiners evaluated the soundness of management policies and practices and used transaction testing to validate these process reviews. In one examination that assessed a bank’s credit asset review function, the examiners traveled to offices of the banking organization that conducted significant numbers of credit reviews to determine review procedures. The examiners discussed the procedures with key managers and working level staff and reviewed randomly selected credit files to validate their discussions. This process review determined that asset appraisals were not being obtained in a timely manner and resulted in a clarification of the bank’s policies on obtaining appraisals. Our review of work papers from the 14 bank examination segments indicated that, in the instances where transaction testing was performed, examiners tested transactions to support their assessments of risk- management rather than to verify the bank’s valuation of its assets. As an example, the workpapers for a bank’s credit administration examination indicated that the examiners reviewed a sample covering 59 percent of the bank’s commercial loan portfolio. However, using their discretion, the examiners did not specifically target commercial real estate loans from this sample. The workpapers noted several reasons for that decision: The prior year’s examination, which covered a 70 percent statistical sample of real estate credits over $25 million, as well as a 20 percent statistical sample of those credits below this amount, did not note major discrepancies between the examiner’s and the bank’s internal credit risk ratings. The bank had historically maintained very conservative classification guidelines and management was quick to downgrade credits internally when warranted. The bank’s internal audit review of the overall quality of the loan portfolio, which included 61 percent of real estate loans, did not find any systemic or trend weaknesses evident in the bank’s total loan portfolio. Instead of relying as extensively on transaction testing, risk-focused examinations may use the results of the banks’ internal audit and loan review functions, provided that examiners find those results reliable. Both Federal Reserve and OCC officials said that risk-focused examination plans often involve some test of the internal audit or loan review function in a bank to determine whether these functions yield useful self- assessments. We found this to be true in the supervisory plans we reviewed. The Federal Reserve and OCC sought to “leverage” the work of these functions by using the results of the banks’ findings if the examiners found them to be reliable. Of the 14 examination segments we selected, 7 included a review of one of these functions. Another way in which the approach has changed is the departure from the traditional alignment of examinations with legal entities. As chapter 1 notes, large, complex banking organizations generally contain several banks, sometimes with different bank charters and management teams, as well as other businesses providing financial services, such as leasing or residential mortgages. Most large, complex banking organizations have centralized their operations and shifted to a centralized functional management approach for business lines that cross legal banking charters. In response to such changes, examination strategies have shifted as well. Rather than examining each entity in a banking organization separately, examiners are centralizing examination activities to assess the risks generated by each line of business. Federal Reserve inspections of bank holding companies have often involved institutions with different bank charters. The risk-focused approach to bank examinations is designed to recognize that risks at the lead bank may be mitigated or increased by the entire banking organization as a whole. In the past, examinations were largely undertaken on the basis of legal entities. If entities within a banking organization were chartered by different agencies, regulators from those respective agencies generally supervised them. While regulators still must be cognizant of legal entities, Federal Reserve and OCC are also interested in how banking organizations are actually managed. Many large, complex banks manage their key bank activities on a business line basis (for example, lending, treasury, or retail banking) that crosses the legal structure of the organization, including different banking charters and entities conducting nontraditional banking activities. Accordingly, the bank may not maintain certain information or manage risk according to which subsidiary, branch, or department “books” a transaction. Risk management and bank information is commonly organized by type of activity, for example whether it is a trading or credit function, and the risk posed by the activity. A key implication of this shift in management structure is that much of the information and insight gathered on examinations of individual legal entities can only be fully understood in the context of examination findings of other related legal entities or centralized functions. Consequently, under the risk-focused approach, examiners are to focus on how business lines and activities that cut across legal entities are managed and controlled and how they affect the overall risk profile of the organization. Examination staff said that given the structure of their assigned financial institutions, their examinations have focused on business lines and the management practices that support the business lines across the various corporate entities. As an example, one examination we reviewed was an evaluation of the quality of credit risk-management as it related to the bank’s trading credit. This bank had a centralized trading credit review function that supported its foreign exchange and derivatives trading activities. Instead of evaluating the quality of credit risk-management during each examination of foreign exchange and derivative products, the examiners conducted their evaluation of trading credit review by examining the centralized function as a separate examination activity. In another examination, the examiners grouped the bank’s operations into related business lines and organized their examinations along these lines: retail banking, which encompassed retail deposit gathering and retail secured and unsecured consumer lending products; commercial lending, which encompassed commercial and industrial mortgage banking, which encompassed residential first mortgages and the bank’s servicing and investment portfolios; and fiduciary activities, which encompassed personal trust accounts, employee benefit accounts, and corporate trust and agency activities. To ensure that all of the risks inherent in a particular line of business are properly addressed, examiners may need to cross legal boundaries within organizations to trace information flows and control mechanisms. This may involve banking operations that are organized as subsidiaries of national banks (under OCC supervision) or those organized as subsidiaries of the bank holding company (under Federal Reserve supervision). In some cases, this can mean that OCC is interested in the risk-management practices of the bank holding company. OCC officials said that they are interested in business activities that can materially affect the safety and soundness of the national bank for which they are responsible, but not other entities or activities that do not affect the condition of the national bank. For example, one of the national banks in our sample had a large portion of its assets located overseas. Based on the legal organization of the national bank and its bank holding company, most of that bank’s international operations were conducted in the national bank or its subsidiaries and thus fell under OCC’s supervision. However, some important operations were conducted in other subsidiaries of the bank holding company and thus fell under Federal Reserve supervision. According to the examination staff, however, the lead bank managed the risk of these operations centrally. Our review of OCC’s supervisory strategies for this bank noted that, in assessing credit risk associated with international operations, OCC examiners included all international operations (including those outside the bank) in their risk assessments and examination activities as well. In another example, the supervisory strategy for one of the three Federal Reserve member banks whose examination we reviewed said that the bank had over half of its credit exposure in consumer credit. The majority of the consumer credit portfolios were located in the bank’s holding company’s national bank subsidiaries, which were supervised by OCC. The strategy said that to fully assess that bank’s credit risk, Federal Reserve examiners had to coordinate with OCC examiners to jointly examine certain operations of that bank. Further, in cases where the bank holding company contained banks with OCC charters, the Federal Reserve and OCC coordinated reviews of the banks’ operations, sometimes doing them jointly. These reviews included audit and control systems as well as the bank’s efforts to address potential Year 2000 computer problems. Other differences between OCC’s and the Federal Reserve’s risk-focused approach to examinations of large, complex banks and earlier procedures include differences in the planning of examinations, allocation of examiner resources, ongoing monitoring of bank operations, and communication of the results of the examination to a bank’s management and board of directors. Compared with past examination practices, present-day risk-focused supervision adopts a more formal examination planning process. In the planning process, examiners are to identify an individual bank’s key risk areas and tailor examination activities to the bank’s unique risk profile. This results in certain bank operations receiving less scrutiny than others. Such an approach necessarily relies on examiner judgement in identifying sources of greatest risk to a bank. Previously, examinations were planned, but plans were seldom institutionally unique. We reviewed the supervisory plans for all the banking organizations that we selected for our analysis. Although we did not independently verify any of the information upon which decisions were based, we found that examiners considered the size, activities, and organizational structure of the institution in developing the plan. Generally, the plans we reviewed described the areas examiners would review throughout the course of the year, established priorities for examinations, and considered resource needs and coordination with other supervisors. Some of the banks whose examinations we reviewed were undergoing major mergers. In these cases, we observed that the risk assessments and supervisory strategies in the plans were modified to reflect changes in resources and examination requirements. At one bank, examination staff said that the plan and examination scope was altered when bank management informed them of a decision to eliminate a business function. In some cases where merger-related reorganizations were under way, we noted in our review that some planned activities were delayed until the reorganization was completed. The risk-focused approach is intended, in part, to optimize the use of examiner resources and provide the most useful and relevant examination results by concentrating on the riskiest areas. Traditionally, examinations were planned and staffed by examiners who often did not possess specific knowledge of the banking organization. This required examiners to spend more time at the onset of the examination learning about the bank’s policies and procedures, and use procedures and checklists designed to ensure that they covered as many of the bank activities as possible. In contrast, the risk-focused approach is designed to institute a team of examiners at each large, complex banking organization. While the Federal Reserve and OCC differ in their implementation strategy, as explained in chapter 3, both agencies are making a conscious effort to ensure that the examiners remain a part of a bank’s examination team long enough to develop expertise and institutional knowledge. This approach also more explicitly incorporates examiner judgment to identify and apply appropriate examination procedures, compared to prior approaches. A concept common to both the past and present risk-focused supervision process is ongoing monitoring. In the past, however, monitoring generally did not target anticipated risks but tracked past performance and sometimes acted as a stopgap measure for postponed on-site examination activity. Under a risk-focused approach, examiners are to maintain ongoing monitoring and communication to keep abreast of the current financial condition and business strategies of a bank and use this information to update their supervisory strategies. They are to do this through the review of a variety of management reports and frequent meetings with key bank officials. Examination staff said that they have been able to identify anomalies or changes in risk profiles that warrant further examination. For example, after examiners identified a large loss at one bank’s trading operations through review of bank data, they decided to examine that operation more closely. Similarly, through discussions with another bank’s management, examiners learned of that bank’s plans to acquire an investment entity. Therefore, the examiners planned to complete an examination of the risk-management processes for the new entity. Formerly, communication outside of the examination cycle or in a form other than the annual examination report was often considered pejorative. Under the current risk-focused approach, examination staff are to communicate with bank management frequently, and both formally and informally. Examination staff told us that they communicate with bank management formally through the quarterly risk assessments and the annual report of examination. They also issue less formal letters to a bank’s management on issues that do not require top management or board of director attention. In addition, some examiners told us they often have informal meetings with bank management. In the 1990s, the Federal Reserve and OCC developed and refined risk- focused approaches to supervise and examine large, complex banks. According to both agencies, the process has been and will continue to be one of continuous evolution to adapt to the growing complexity of these organizations. The Federal Reserve and OCC programs are generally similar in their increased focus on planning, continuous monitoring, risk- focused examinations, and communication with the banking organizations’ management as described in chapter 2. There are some differences, however, in the way they manage their programs, with a decentralized Federal Reserve System and a more centralized OCC. Although both agencies maintain continuous oversight of a bank’s operations and management, they do so in different ways, with OCC depending on a continuous on-site presence while the Federal Reserve continues to do much of its oversight off site. The Federal Reserve also continues to focus most of its on-site examination activities on a single point in time during the year, while OCC conducts continuous examination activities on a year-round basis. OCC strives for continuity in its examinations by maintaining examiner staffs full time at a single large bank. While the Federal Reserve strives to maintain a measure of continuity in its examinations, it does not maintain a continuous examiner presence at large banks. Board officials have stated that they are at an earlier stage of implementing their large bank program than OCC and some elements of their risk-based program, including examination staffing and timing, may change over time to a model more closely resembling that currently employed by OCC. Because of the structure of the Federal Reserve System, the Federal Reserve operates its large bank program using a decentralized structure that combines local control exercised by each reserve bank, with broad oversight from the Board of Governors. Meanwhile, OCC manages its program centrally from its headquarters. Centralized control of the program by three deputy comptrollers and reviews by a Quality Assurance Division are key features of the program designed to ensure consistency across examinations of large banks. Federal supervision of state-chartered banks that are members of the Federal Reserve System, including large, complex banks, is designed to be a coordinated effort among the Federal Reserve Board of Governors (Board), located in Washington, D.C., and the 12 Reserve Banks located throughout the United States. The Reserve Banks, under delegated authority from the Board of Governors, conduct the day-to-day supervisory activities of the Federal Reserve, including safety and soundness examinations. The Board of Governors reviews examination reports prepared by the Reserve Banks and conducts special studies of issues related to supervision. The Board also issues guidance on examination policy and procedure through its Division of Banking Supervision and Regulation. The Board first issued formal guidance on risk-focused supervision of large, complex banking organizations in October 1997. On June 23, 1999, the Federal Reserve issued additional guidance to its supervisory staff, specifically tailored for the largest of these banking organizations- -those whose “growth and consolidation have reached a scale and diversity that would threaten the stability of financial markets around the world in the event of their failure.” The guidance reemphasized the importance of assessing an organization’s key risk-management processes and ongoing monitoring on the organization’s risk profile. The guidance also provided for the designation of a senior supervisor as the “Central Point of Contact.” While the Reserve Banks do not have a staff of examiners assigned continuously to specific large banks, the guidance does call for the assignment of a defined, stable supervisory team composed of reserve bank staff who possess skills to understand and evaluate the business lines and risk profile of large, complex banks. For example, teams may comprise examiners who have concentrated training and experience in the trust function, information systems, capital markets, and securities activities. However, reserve bank officials said they attempt to maintain some degree of continuity from year to year by assigning examiners who have participated in a previous examination at the bank or who have reviewed a similar activity at another bank. Under the Federal Reserve program, the Board provides overall program direction, oversight, and coordination of reserve bank supervision activities to foster consistency, quality, and compliance with Board policies and procedures. The individual Reserve Banks are responsible for managing the Central Point of Contact and the supervisory teams. In addition, the Reserve Banks are responsible for providing the examiner resources necessary to carry out the supervisory strategy planned for an institution. This is consistent with the Board’s delegation of supervisory authority to the district Reserve Banks. Because of the autonomy of the Reserve Banks, there is variation in the way the banks are structured to manage the large bank program. For example, the Federal Reserve Bank of New York has organized its banks into four clusters. Each cluster has a similar portfolio with a money center bank, a foreign banking organization, and a large regional bank as well as several smaller institutions. Both the money centers and foreign banking organizations may be included in the large, complex banking organization program. However, the Federal Reserve Bank of Chicago supervises large, complex banks under its “Global Supervision” group. This group supervises the largest financial institutions and branches of foreign banks in that district. Federal Reserve officials view this structural variation as a healthy situation that promotes experimentation and innovation as well as the sharing of best practices. One way in which the Board maintains oversight of the process is the assignment of Board analysts to work with the supervisory teams and participate in the development and execution of supervisory plans and programs. The analysts may also participate in examinations and other supervisory reviews. While some analysts are responsible for a single organization, others are assigned more than one, depending on the size and complexity of the organizations. Federal Reserve officials said that the analysts meet frequently to exchange information and share perspectives on supervisory activities or other relevant topics related to their assigned institutions. Supervisory strategies and plans are approved in the Reserve Banks, but Board staff also has the opportunity to provide comment and input. According to Federal Reserve officials, the assignment of dedicated analysts and possible Board staff involvement in the planning process are relatively new aspects of the program. In addition, as previously discussed, the Board has defined a framework of processes and products to facilitate consistency, communication, and coordination within the system. According to Federal Reserve officials, it is unlikely that the Board would move toward more centralized management of the program. However, these officials said they recognize a need to better define and develop supervisory teams in terms of matching available resources with an institution’s risk profile. Even though individuals with appropriate skills are not always available where they are needed within the Reserve Banks, examination staff at the Federal Reserve Bank of New York said that they have drawn resources from other districts in staffing their examinations. For example, examiners from the Federal Reserve Bank of Philadelphia who were specialists in capital market risks participated in an examination of a New York bank. In another examination, examiners also from the Philadelphia district conducted a review of that bank’s fund transfer business located in the Philadelphia district. Under such circumstances, maintaining consistent treatment of similar activities across banks becomes an increasing challenge. In October 1999, the Federal Reserve established a senior staff level position for coordinating supervisory staff resources on behalf of Reserve Banks for whom maintaining a large bank examination staff is not efficient because there are fewer large, complex banking organizations in their districts. The goal of this new position is to ensure an efficient allocation and deployment of expert resources across the Federal Reserve System. The new senior level officer is to work with existing Board and Reserve Bank managers to optimize the use of existing resources and develop and implement strategies to address any gaps in skills or expertise. This senior level officer is to work closely with supervising officials at the Board and New York Reserve Bank, whose district contains the largest number of large, complex banks. OCC’s large bank supervision program, which was formally established in 1995, previously was directed out of its district offices but now is centrally managed by the Bank Supervision Operations group located in its Washington, D.C. headquarters. As part of an agencywide reorganization in January 1997, OCC consolidated oversight of large bank supervision in its headquarters and structured its district operations to focus on community and mid-sized national banks. According to OCC, the reorganization reflected the continuing consolidation of the banking industry and took into account the basic distinction in supervisory needs between large banks and mid-sized/community banks. All banks in the large bank supervision program have a resident examiner- in-charge (EIC) and dedicated team of examiners and specialists. The EICs report directly to one of three deputy comptrollers in Bank Supervision Operations that are each assigned a portfolio of the banks included in the large bank program. The deputy comptrollers approve all supervisory plans and strategies. OCC also established a parallel structure of four geographic teams to provide administrative support to the large bank EICs. Each team has a resource coordinator who is to work with the EIC to ensure that examination activities are staffed and to provide examiners opportunities to enhance their skills and work experiences. OCC has also established a quality assurance program for its large bank supervision program. The goal of the program is to help ensure that the objectives of bank supervision are being achieved. The program is administered by OCC’s Quality Assurance Division and includes several processes and initiatives that are designed to assess OCC’s supervision processes before and after the fact. Among them are (1) EIC self- assessments about the supervisory processes they employ at their assigned banks; (2) collaborative sessions with EIC’s assigned to companies with similar product lines, risks, or business strategies to share views before supervisory activities are performed; (3) special focus reviews to assess individual institutions for which questions have been raised about whether the supervision is effective; and (4) surveys to obtain feedback from OCC employees, bank management, and others about how well OCC supervision is working. The Quality Assurance Division conducts supervisory program reviews and supervisory process studies. Supervisory program reviews are intended to determine whether the EIC had completed the supervisory program designed for the bank. According to Quality Assurance staff, they have generally been able to complete supervisory program reviews for three examinations annually. Supervisory process studies are horizontal reviews that assess whether the overall objectives of the large bank program are being met across a population of banks. Quality Assurance staff said that in 1999 they selected the supervision of internal audit function for the horizontal review. They studied how examiners supervised the internal audit function across 22 large and midsize banks, whether they had adhered to the core assessment, and whether they had conducted the necessary amount of transaction testing. We did not review the results of this study because the report was not completed at the time of completion of our review. The Federal Reserve and OCC place emphasis on continuous monitoring of the activities of the institutions in their programs to develop and maintain an understanding of the institutions’ operations and risk profiles. Both agencies accomplish this, in part, through a combination of ongoing planning and monitoring activities and maintaining continuity in staff. Reserve banks do not maintain an on-site presence at the institutions in their program, while OCC conducts its oversight activities through the use of on-site, resident examiners. While Federal Reserve officials said they are transitioning to a continuous on-site presence in its large institutions similar to OCC, they do have concerns that such a presence could undermine examiner independence. Board officials said that a continuous on-site presence may ultimately be desirable, however, some reserve bank staff suggested that it would compromise independence. Reserve bank staff said that they do not maintain an on-site presence primarily to maintain independence from the day-to-day activities of the institutions but also because such a presence could be intrusive to bank management and personnel. Although they see the advantages, they also are concerned about independence and said there was not a need for resident examiners because (1) the banks are located near their offices, and (2) they have ready access to the information and bank personnel they need to maintain an ongoing understanding of the banks’ activities and risk profile. OCC officials also expressed such concerns and said they take a number of steps to preserve independence, such as moving staff among banks, and through the Quality Assurance process. However, officials of both agencies said that, whether continuous monitoring is done on site or off site, it is critical to have staff move periodically not only to allay concerns about independence, but also to have frequent injection of different perspectives. Reserve banks monitor an institution through off-site review of information from various sources, such as publicly available information, internal management reports, regulatory reports, information from internal and external auditors, and information from other supervisors. For two of the banks in our review, reserve bank staffs had on-line access to the banks’ information systems, including key audit and management reports and senior management and board committee minutes. OCC conducts its supervision and examination activities through the use of on-site, resident examiners at each of the banks in its large bank program. According to OCC officials, having resident staff improves their access to bank management and staff and their ability to understand a bank’s risk-management processes and to redirect work quickly in response to changes in a bank’s risk profile or management. OCC officials said that examiner independence is a major concern and they attempt to foster independence in several ways. One method is through periodic rotation of EICs and examiners. Also, they said examiners are routinely assigned to work on examinations of other banks, which not only helps preserve independence but also provides them with a better perspective in doing work at their primary banks and opportunities to enhance their skills. In addition, they said the EICs and assigned staff regularly receive input from headquarters’ management and technical support staff. For example, the three deputy comptrollers in OCC headquarters are to review and approve all supervisory strategies for large, complex banks. OCC also can assign technical experts, based in headquarters, to assist in assessing the large banks’ risk models. Both the Federal Reserve and OCC guidance on large bank supervision require that examiners perform work and analyses necessary to satisfy the requirements of a full scope examination (i.e., the nature and scope of their supervisory activities must be sufficient to support safety and soundness determinations and the assignment of supervisory ratings). For the institutions included in our review, Reserve Banks conducted on-site, point-in-time examinations supplemented by off-site monitoring while OCC conducted examinations and on-site monitoring activities throughout the supervision cycle. Federal Reserve officials said they are in transition from the use of annual, point-in-time examinations to a continuous, targeted examination approach, similar to that of OCC’s. Some Reserve Banks have begun to do targeted examinations throughout the examination cycle, but most are conducting full scope, point-in-time examinations. Federal Reserve officials said that one reason for this is that state supervisors, with whom the Federal Reserve shares supervisory responsibility for state banks that are members of the Federal Reserve System, have not all adopted the risk-based approach with its use of targeted examinations throughout the examination cycle. In this respect, the Federal Reserve wants to avoid a situation where states are doing full-scope, point-in-time examinations while Reserve Banks perform examinations throughout the year. The officials said this would result in an unreasonable burden on banks. Both agencies still issue annual reports of examination to the banks. OCC views the reports as summaries of events that occurred during the year and does not detail all examination findings because examiners communicate those findings and recommendations, in writing or meetings, throughout the year with a bank’s management and board of directors. The Federal Reserve views the report as a major method to communicate and emphasize matters of supervisory concern to management and the board of directors. The Reserve Banks issue less formal letters to a bank’s management on matters that do not require top management or board of director attention. The Federal Reserve and OCC face a number of challenges as they continue to implement their examination programs for large, complex banks. While some of these challenges existed under previous examination approaches, others are affected by, or attributable to, the risk-focused approach and the presence of an increasing number of large, complex banks. Recent passage of the Gramm-Leach-Bliley Act of 1999, which removed many of the legal barriers between banks, security firms, and insurance companies will likely increase the number of large, complex banks and the complexity of their operations. One key challenge, inherent in the design of the risk-based program, is how to identify the aspects of bank operations where examiner attention should be concentrated. A second challenge is maintaining an awareness of industrywide risk in an institution-specific examination program. Another is to ensure that examiners’ assessments of risk are sufficiently independent of the bank’s risk-management systems. The Federal Reserve and OCC have both stated that it is a challenge to apply their programs to banks with decentralized operations. The continued consolidation of the banking industry in the form of bank mergers or acquisitions presents another challenge because it can interrupt or postpone planned examination activities by disrupting the management structure of the bank and therefore planned examinations of various parts of that structure. Finally, the Federal Reserve and OCC will likely continue to be challenged by the need to ensure that their examiners possess sufficient expertise to assess the risk of increasingly complex organizations. This is particularly important because a risk-focused approach requires that examiners make judgments that may result in some bank operations receiving minimal scrutiny. Because a risk-focused examination is intended to focus examiner resources on the greatest risks facing a bank, its success is dependent on the examination staff’s ability to accurately identify and measure the risks posed by a bank’s operations. Federal Reserve and OCC examiners attempt to identify, review, and understand all sources of information on the risk posed by bank operations. However, under the best of circumstances, examiners cannot know all information relevant to the risk posed by a particular line of business. For example, examiners cannot anticipate unexpected future events that could cause major disruptions in a particular sector of the economy. They also cannot know information about counterparties that was not provided to the bank and is not available from other sources to which examiners have access. Although this was true prior to the adoption of risk-focused examinations, its importance is enhanced because risk-focused examinations attempt to focus resources on the areas of bank operations that pose the greatest risk. Because of this uncertainty with regard to future events and other information, examiners may make incorrect initial assessments of the risks posed by particular lines of business. This could result in those areas not receiving the appropriate level of examiner scrutiny. Recent events have highlighted the limitations in examiners’ abilities to identify all risks threatening a bank. As discussed below, examiners did not fully evaluate the risks posed by Long-Term Capital Management (LTCM) because they were not fully aware of the risks posed by the large hedge fund, and they presumed that the fund’s creditors had employed appropriate risk-management practices. Recent events have also illustrated the limitations of bank examinations in uncovering carefully conceived and executed cases of fraud at banks. Both OCC and Federal Reserve officials said that, although they would pursue any indication of fraud detected during a bank examination, bank examinations are based on an assumption of honesty on the part of bank staff, records, and financial statements and are not designed to uncover fraud. While these concerns have always existed with bank examinations, they are highlighted in risk-focused examinations because of examiners’ efforts to focus primarily on operations that pose the greatest risks while leaving other operations to the bank’s own internal audit and review processes. Examiners are challenged to avoid being overly influenced by banks’ risk- management systems while relying on those systems and other data furnished by the bank to make their assessments. Under risk-focused supervision, examiners assess a bank’s risk-management and internal controls. To do so, they must rely on the bank’s information systems and risk models in hopes of validating the bank’s risk-management processes. A key challenge is that assessments based on the different risk- management systems at different banks yield sufficiently comparable information to ensure that banks with similar risk profiles receive similar treatment. Making independent assessments of banks’ risk models is complicated by the fact that banks use models that may reflect their unique risk characteristics, including the particular risk factors the bank faces. Thus, even when supervisors attempt to apply objective criteria or specify the use of common procedures for developing internal models, banks’ models differ because each firm designs its model to measure what it sees as its own risk profile. Because a bank’s model is designed for use with a specific risk profile, another bank’s model applied to the same profile might produce a different risk estimate. This difference in how the banks assess their own risk makes it difficult for the regulators, who rely on the bank assessments, to treat similar risks in a similar manner. Moreover, both the consistency and the accuracy of these models depend on the quality of the raw data used. Examiners are challenged to make an objective assessment of processes that are often unique to the institution. For example, differences between supervisors’ and banks’ estimates of the risks that the banks have and how this affects the level of capital that the banks should hold provide an illustration of this. As we noted in a 1998 report, while both financial services firms, including banks, and regulators agree that capital serves as a buffer against unexpected losses, regulators set minimum capital requirements to serve the public interest while the firms set capital levels to maximize their market value. Some firms noted that, with increasingly sophisticated models, they see a divergence between their internal estimates of risk and the capital needed to support certain activities and the regulatory capital requirements for those activities. Although they may hold more total capital than the regulatory minimums, some of the firms said that the regulatory requirements for some activities are higher than levels they believe to be appropriate. Regulators, however, noted that these models had not been tested over sufficient time to assess their reliability in periods of extreme stress— precisely when losses may be unexpectedly high. OCC and the Federal Reserve do not formally aggregate examination findings for the purpose of identifying industrywide risk issues. OCC and the Federal Reserve try to ensure that their examiners are aware of larger issues affecting the banking industry so those examiners are aware of what type of problems could arise with banks they are examining. However, their examinations are intended to assess the safety and soundness of individual institutions; and they do not attempt to assess risk on an industrywide basis. One area in which some information is shared is the interagency Shared National Credit program, which is designed to assess the risk posed by large syndicated loans. However, the program does not evaluate other risks, and it is an activity done primarily to assist examiners in assessing asset quality at banks that participate in large syndicated loans rather than to identify industrywide trends in asset quality. The agencies have several initiatives to improve the scope and quality of information that is provided to examiners to help them understand banking activities and the risks that banks undertake. These initiatives, some formal and others informal, are intended to facilitate comparative assessments across banks, provide a framework for identifying industry trends, foster more consistent supervision of institutions with similar businesses and risk profiles, and promote the sharing of best supervisory practices within the supervisory community. For example, both agencies have encouraged communication of industry issues among examiners with similar disciplines. Sometimes this is done formally, through regularly scheduled meetings in which examiners can exchange information on the types of problems that they are seeing in the banks they examine. In addition, both OCC and the Federal Reserve staff participate in annual conferences held within those agencies that are also used to communicate industrywide risks. To identify emerging trends among large banks, both the Federal Reserve and OCC sometimes conduct reviews of specific issues across these large banks to assess the risk associated with a specific business line, activity, or functional area. This is done both formally and informally. Federal Reserve officials said that the Federal Reserve also evaluates information that it regularly compiles across banks to identify emerging trends. OCC and the Federal Reserve occasionally issue regulatory guidance to examiners, alerting them to emerging issues in the financial services industry. For example, both the Federal Reserve and OCC issued guidance on lending to highly leveraged institutions in response to problems observed in the aftermath of the near collapse of LTCM. They also issued warnings when it appeared that underwriting standards were slipping due to increased competition along with the recent continued economic prosperity. This guidance sometimes results from the reviews of issues across banks described earlier. The Federal Reserve and OCC both also have research staffs who work to identify and communicate industry risk trends to examiners. For example, the Federal Reserve said it regularly does peer group analyses on the top 50 banking organizations. However, efforts by the Federal Reserve and OCC to communicate industrywide risk trends are only intended to assist examiners in identifying risks at institutions. Neither the Federal Reserve nor OCC have procedures to aggregate the risks that examiners have identified during examinations. Such aggregation might have proven useful in the case of LTCM, where regulators identified individual credit exposures to the large hedge fund but did not identify the threat posed by LTCM, primarily because they looked for problems involving the largest credit exposures of the individual banks. LTCM was not among the largest exposures of any of these banks and the overall industry exposure to LTCM and the potential for market disruption was not realized until after its near collapse. Both OCC and the Federal Reserve have attempted to develop management information systems designed to store, and make readily available, industrywide risk information. The Supervisory Monitoring System (SMS) is OCC’s primary internal source of information about the condition of individual national banks. OCC uses the system to record the current condition, strategy, and supervisory concerns for each bank. Examiners are also to use the system to document follow-up actions, board meeting discussions, commitments for corrective action, progress in correcting identified problems, and subsequent events. Other bank regulators also have access to SMS as well. However, OCC large bank examination staff in both headquarters and in the banks we visited said that the SMS system does not fit their needs and that they generally do not use it. OCC has initiatives under way to develop a system more suited to large banks, however, these efforts are in their early stages. The Federal Reserve is developing the Banking Organization National Desktop (BOND), to provide examiners with the information-sharing and ongoing collaboration it believes is necessary to support the risk-focused supervision of the largest, most complex banking organizations. BOND is intended to expand the capabilities of the National Examination Database, an automated platform for sharing supervisory information that has been in existence for a number of years. When implemented, BOND is expected to provide immediate, user-friendly access to a full range of information and to foster collaboration among Federal Reserve staff and other bank supervisors. However, BOND’s implementation has been delayed until April 2000. A decentralized management structure can impede the examination of a large, complex bank. The risk-focused examination approach for both the Federal Reserve and OCC is based on the expectation that large banks generally align their risk-management processes in a centralized manner along lines of business rather than legal charters. The agencies’ examination processes strive to assess the risk profile of a bank using information provided by the bank’s management and management information systems. Therefore, a bank with centralized bank management and management information systems lends itself to a more efficient examination process. However, when a banking organization has its information systems and key personnel disbursed throughout the organization, it is more difficult for the Federal Reserve and OCC to identify the risks and to appropriately plan an examination strategy for that decentralized bank structure. In such instances, an examination approach focusing on the risk-management of the consolidated organization rather than on the operations of the legal charters that make up an organization faces inherent limitations. Many large, complex banking organizations have centralized their operations, including either reducing the number of legal banking charters for their subsidiaries or ignoring those charters in the management of the consolidated banking organization. In such structures, the banks maintain and make available consolidated information on their risk profile to their principal decision makers. It is also likely that there are relatively few key decision makers that oversee the bank’s operations in a few physical locations. In such circumstances, examiners can assess the risk posed by various bank operations by reviewing consolidated management reports and contacting a small number of bank personnel. Some large banks, however, have business strategies that rely on substantially more decentralized risk-management. Federal Reserve and OCC examination staff said that taking a risk-based examination approach is more difficult when large banks have decentralized risk-management structures and information systems because they require more examiner resources. When key risk-management information is not centrally maintained, examiners must review information from a larger variety of sources in order to assess the entire organization’s risk profile. They said when key decision making processes involve more bank staff, more examination resources are required to maintain contact with them. Some banks maintain geographically dispersed subsidiaries that operate under numerous bank charters. They said in these cases, more examiners have been needed to conduct examination activities because it was necessary to travel to those locations to gain access to the appropriate staff and information. Examiners said that they are challenged by such management structures but said that it is not their role to insist on particular management approaches. They said that while they can and do comment on any management issue at the bank that may cause supervisory concern, they do not attempt to influence banks’ business strategies. In addition, banks should not be expected to structure their management systems for the convenience of examiners. In some cases, a decentralized management structure may represent a business strategy rather than a management quality issue. The continued consolidation of the banking industry, in the form of mergers and acquisitions, has had the effect of limiting the level of targeted examination activity at large, complex banks while those banks continue to take on and manage risk. As described earlier in this report, the banking industry has undergone major consolidation in recent years through mergers and acquisitions. This trend is expected to continue. When two banks are merged, or in the event of a major acquisition, it is necessary for the management of the resulting institution to determine how it will manage various lines of business. This determination can include deciding the physical location of certain management activities when the merger involves geographically dispersed institutions. During periods when those decisions are being made or implemented, planned examination activities may be put on hold, awaiting an opportunity to examine the new bank structure and management systems. A major consideration for the management of the post-merger bank is the information system to be used in tracking the bank’s operations. Both banks involved in a merger will have separate information systems in place for tracking their operations. A merger generally requires that these systems be combined or that one is chosen over the other. Examiners we interviewed said that they must wait for such decisions to be made before they can adequately plan their examination activities. In the meantime, they are primarily faced with monitoring the merger while engaging in fewer targeted examinations. The management of merging banks must make several other decisions regarding the resulting bank, including the internal audit approach, internal loan rating systems, risk appetites, and a host of others. Making these decisions can take time. In a merger of equals, elements of both merging banks may be incorporated into the management structure of the resulting bank. In these situations, regulators are challenged to find a balance between supervising existing bank activities and monitoring the development of new ones. After a bank merger or acquisition, examiners may interrupt or postpone planned examination activities to shift resources to monitor the consolidation or reorganization of the resulting bank rather than to examine activities that may soon be discontinued or reorganized. Examination staff said that monitoring the consolidation is necessary to understand the operating structure of the bank that will result from the merger. They said that it also makes sense because the agencies do not want to expend scarce examination resources gaining familiarity with something that will not continue. Finally, some mergers involve banks with significantly different management philosophies. For example, as discussed earlier, some banks manage themselves in a centralized manner, with all major management decisions originating from a single office. Other banks prefer a less centralized structure with important decisions being made locally out of smaller offices. Because both the Federal Reserve and OCC attempt to tailor their examination staffs and approaches to the management structure and style of the bank, such differences among merging institutions can significantly complicate their efforts to adapt the examination to the bank. This is because, during the consolidation of the two merging entities, there may be internal inconsistencies in how different parts of the bank are managed. As banking activities have become more varied and complex, bank examinations have required examiners who possess increasingly varied technical skills, knowledge, and expertise to make the judgments necessary in a risk-focused examination approach. To meet this requirement, both the Federal Reserve and OCC have sought to build and maintain the expertise needed for supervising complex banking organizations and the activities in which they engage. Federal Reserve and OCC officials said they currently employ specialists, such as economists with technical expertise in the quantitative methods and economic models underlying bank’s risk-management systems as well as specialists in electronic banking, bank information systems, capital markets, fiduciary activities, asset management, mortgage banking, and capital markets. Both Federal Reserve and OCC officials said they shift examiners with specific skills, knowledge, or expertise among large banks to complete specific segments of the examinations of those institutions. Further, the agencies have a number of initiatives to improve the scope and quality of information that is provided to examiners to help them understand banking activities and the risks that banks undertake. Federal Reserve staff acknowledge the challenge presented by the increasing complexity of large bank operations. Federal Reserve staff said that one way they respond to the challenge is to assign their best, most seasoned, examiners to large, complex banks. For particularly technical examination segments, examiners with specific expertise or skill sets are assigned. In some cases, examiners from one Federal Reserve district have been assigned to examinations being done by another in recognition that some Reserve Banks possess specific expertise in certain areas. This task is complicated for the Federal Reserve System due to the nature of the system, with its 12 independent Reserve Banks. Federal Reserve Board staff said that a major challenge for the system is to build a national pool of large bank examiners from a group of independent organizations with defined geographic jurisdictions where skills and demands for skills based on banks are not aligned. In October 1999, a work group comprising Federal Reserve Board Governors and Reserve Bank presidents initiated a series of initiatives designed to ensure that the Federal Reserve System will have the necessary supervisory skills to keep pace with present and projected changes in the financial services industry. The first of these initiatives involves better utilizing supervisory resources systemwide to ensure an efficient allocation and deployment of expert resources across the Federal Reserve System. As discussed in Chapter 3, this effort includes the establishment of a new senior staff level position to coordinate these efforts. A second initiative focuses on enhancing expertise and skill levels through the establishment of a continuing professional development program and the development of job rotation and systemwide employment programs. Another initiative involves the use of consultants from nonsupervisory areas of the Federal Reserve and the possible use of external consultants to expand the Federal Reserve’s supervisory resource base. Federal Reserve officials said that the Reserve Banks have taken initiatives to train existing staff and hire new staff. The Reserve Banks said they are trying to keep their staffs’ skills current, but it is difficult in the present employment market because they often cannot match the pay offered by firms competing for skills possessed by top examiners. Therefore, staff attrition remains a concern. Federal Reserve staff have said their most critical losses are among experienced examiners whose skills and expertise are of even greater value under a program of risk-focused supervision. OCC officials said they also count the maintenance of adequate examiner resources as one of the most important challenges facing the agency. Like the Federal Reserve, OCC officials said they assign the most experienced examiners to the large bank program. To maintain sufficient expertise, OCC encourages all of its examiners to carry outside certifications, such as a Certified Public Accountant, Chartered Financial Analyst, and Certified Information Systems Auditor. In addition, OCC officials said they have recently developed their Examiner Development Initiative to ensure that OCC has sufficient numbers of examiners with requisite expertise in several specific disciplines. Under the initiative, OCC manages the work assignments of examiners to provide them with the on-the-job training necessary to develop skills and expertise in specific areas. As described in chapter 3, OCC developed the concept of geographically based teams of examiners who can be rotated among banks in specific regions of the country for the purpose of maintaining adequate staffing, not only in terms of numbers, but also expertise. OCC officials said that this is also done to ensure examiner independence. This process can enhance the availability of examiner expertise for examinations by making certain skill sets available to resident examiner staffs at banks that might not otherwise possess them. Although the availability of adequate staff has always been important, its importance has been enhanced with the increased need presented by large, complex banks for examiners with adequate experience and expertise. OCC officials explained that because OCC does not possess the requisite number of expert staff to provide all competencies to all resident staffs, it uses these teams to provide them when needed. OCC has begun to supplement its staff for some examinations through the use of contract employees. OCC officials said such employees are usually retired national bank examiners who possess skills that may be difficult for OCC to obtain in sufficient numbers in its current staff. Candidates for contracts were evaluated by OCC for past performance and experience in the areas of general examination skills, capital markets, market risks, credit risks, accounting, shared national credits, bank information systems, Community Reinvestment Act/consumer, fiduciary activities, and bank examination instruction. In addition to this evaluation, contractors were subject to a security investigation, reviews by OCC’s ethics official for potential conflict of interest situations, and the execution of a confidentiality statement to the effect that no privileged information or data will be disclosed except as authorized by OCC. Senior OCC officials said that this practice represents an opportunity to tap a valuable source of talented examiners that could be more extensively employed.

Summary: Pursuant to a congressional request, GAO provided information on the risk-focused approaches used by the Federal Reserve and Office of the Comptroller of the Currency (OCC), focusing on: (1) the general characteristics of the regulators' risk-focused approach to examinations of large, complex banks, explaining how they differ from past examination practices; (2) comparing the implementation of the Federal Reserve's and OCC's risk-focused examination approaches; and (3) the challenges faced by both agencies as they continue to implement their examination programs for large, complex banks. GAO noted that: (1) the Federal Reserve and OCC's risk-focused approaches to supervising large, complex banking organizations are evolving with changes intended to strengthen oversight of these entities; (2) their effectiveness will depend on the expertise and independence of examiners, and the regulators' ability to maintain an awareness of industrywide risk in an institution-specific examination program; (3) transaction review and testing under the risk-focused approach is intended to validate the use and effectiveness of internal control and other risk-management systems; (4) examination activities now focus on risk assessments along business lines, which often cross bank charters, and the processes used to manage and control the attendant risks; (5) under a risk-focused approach, activities judged to pose the highest risk to an institution receive the most scrutiny by examiners; (6) this approach relies on examiner judgment and results in certain bank operations receiving less scrutiny than others; (7) examiners monitor and assess a bank's financial condition and risk-management systems through the review of a variety of management reports and meetings with key bank officials, documenting the areas they select for review and including their rationale for selecting those areas; (8) examiners conduct examinations to assess a bank's internal control and risk-management systems; (9) the Federal Reserve and the OCC differ in how they implement their risk-focused examinations programs for large, complex banks; (10) OCC's large bank supervision program is centrally managed from its headquarters and has achieved a degree of uniformity in its use of examiners who are located at the bank throughout the year and conduct ongoing monitoring and examinations, and report to one of three deputy comptrollers located in Washington D.C.; (11) the Federal Reserve's program is implemented through a less centralized system of Reserve Banks and has less uniformity in its ongoing monitoring and examinations, with sometimes differing staffing arrangements in place for each bank; and (12) regulators face a number of challenges in implementing examination programs for large, complex banks, including: (a) identifying the aspects of bank operations where examiner's attention should be concentrated; (b) maintaining an awareness of industrywide risk in an institution-specific examination program; (c) ensuring risk assessments are not overly influenced by the bank's risk-management systems on which they must rely; and (d) maintaining sufficient staffing numbers and expertise.