In September 1995, Daiwa Bank, one of the largest multinational banks in the world, reported to the Federal Reserve that it had incurred losses exceeding $1 billion from illegal securities trading activities that had occurred at one of its New York branches over an 11-year period. Weaknesses in the branch’s internal controls, including inadequate segregation of duties in trading and lack of security or access restrictions in electronic funds transfer (EFT) activities, had enabled an employee to trade illegally and to hide the activities and resulting losses. The Chairman of the Federal Reserve Board said that before the losses were reported, the Federal Reserve had noted, but had not fully appreciated, the seriousness of some of the branch’s weaknesses in internal control. One reason for this, according to the Federal Reserve, was that those weaknesses did not appear to be extraordinary in comparison to those found at other U.S. offices of foreign banking organizations (FBO). In response to concern about possible risks to the U.S. financial system, the Chairwoman and the Ranking Minority Member, Subcommittee on Financial Institutions and Consumer Credit, House Committee on Banking and Financial Services, requested that we review the supervision of the U.S. operations of FBOs and determine the extent of serious weaknesses in their internal controls and audits. This report is the final of three reports that respond to that request. The objectives of this report are to (1) identify U.S. supervisors’ expectations for adequate internal controls and audits in U.S. branches and agencies of FBOs (FBO branches), (2) determine the extent of serious weaknesses in FBO branches’ internal controls and audit reported by U.S. supervisors, and (3) describe U.S. supervisors’ efforts to address these weaknesses. In our two prior reports, we provided the results of our reviews of the Federal Reserve’s implementation of the Foreign Bank Supervision Enhancement Act of 1991 and the implementation of the Federal Reserve’s Foreign Banking Organization Supervision Program (FBO Program). Congressional concern about the adequacy of internal controls and audits of FBO branches in the United States was raised in part by the illegal activities that occurred at a New York branch office of Daiwa Bank, which is headquartered in Japan. In September 1995, senior officials of Daiwa Bank informed the Federal Reserve Bank of New York that one of Daiwa Bank’s New York branches had incurred losses of $1.1 billion from trading activities undertaken by a senior branch official, Mr. Toshihide Iguchi, over a period of 11 years, from 1984 to 1995. The Federal Reserve later found that these losses, which should have been reflected in the bank’s books, records, and financial statements, were concealed from federal and state banking supervisors through liquidations of securities held in the bank’s custodian accounts and falsification of its custody records. Not only was Mr. Iguchi able to conceal massive losses over an extended period, but the Federal Reserve found that senior management of Daiwa Bank also took steps to conceal the losses from U.S. supervisory authorities. Senior management of Daiwa Bank said they had learned about the trading losses 2 months before informing Federal Reserve officials. They also directed Mr. Iguchi to continue transactions during the 2-month period to avoid the disclosure of the losses. In October 1995, the New York Superintendent of Banks and the Federal Deposit Insurance Corporation (FDIC), together with the Federal Reserve, issued cease-and-desist orders against Daiwa Bank, requiring a virtual cessation of trading activities in the United States. In November 1995, Daiwa Bank was indicted on federal criminal charges. At the same time, the Federal Reserve, FDIC, the New York State Banking Superintendent, and a number of other state banking authorities jointly issued a series of orders that terminated Daiwa Bank’s U.S. banking operations. In February 1996, Daiwa Bank pled guilty to numerous criminal offenses related to its scheme to cover up trading losses from U.S. bank supervisors and law enforcement authorities. The guilty plea resolved all outstanding criminal proceedings against Daiwa Bank, and it paid a criminal fine of $340 million. Mr. Iguchi and the former General Manager of Daiwa Bank’s New York branch also pled guilty to criminal offenses associated with misconduct at the branch office. Federal Reserve officials and staff who reviewed 1992, 1993, and 1994 examination records for the Daiwa Bank’s New York branch office found that certain conditions had been identified at the branch that proved to be instrumental in the conduct of illegal activities. However, U.S. supervisors did not recognize all of the potential dangers associated with these conditions at the time of identification. According to Federal Reserve officials, U.S. supervisors first became aware in November 1993 that Mr. Iguchi was responsible for both some securities-related activities, possibly including trading, and custody operations as well as some related back-office settlement functions at the branch. The supervisors were concerned that Mr. Iguchi could use his position as overseer of the custody account, including his ability to gather information on the volume and nature of customer trades, to gain an improper advantage in carrying out the bank’s trading activities. After finding no evidence of improper advantage, supervisors requested and received written confirmation that the identified dual capacities had been split. This confirmation was later determined to be false and misleading. Supervisors also noted weaknesses in security and access restrictions in EFT activities, which can enable unauthorized transfer of funds out of an FBO branch. While supervisors recognized that Mr. Iguchi’s dual capacities were a potential problem, Federal Reserve staff said they did not recognize them as a potential opportunity for misappropriation of customer and bank funds. Prudent policy dictates that certain operations within an FBO branch be executed by different individuals to limit the possibility for any person to both perpetrate and conceal errors or irregularities in the normal course of his or her duties. As evidenced by Daiwa Bank and other cases, a lack of separation of trading and back-office settlement activities can have very adverse consequences. This lack of separation of duties was a weakness in internal control at Daiwa Bank. According to a report prepared by Federal Reserve Board staff, a number of factors contributed to the fact that supervisors did not perceive Mr. Iguchi’s functions as a more serious problem when they were identified. One of the factors mentioned in the report was that the internal control problems of Daiwa Bank’s New York branch during 1992 to 1993 did not appear to be extraordinary in comparison to those that supervisors were finding in their examinations of other U.S. offices of foreign banks. Chapter 3 of this report provides our analysis of internal control problems at certain FBO branches from January 1993 to June 1996. FBO branches are the most common types of FBO banking offices in the United States. As of December 31, 1996, they accounted for about 76 percent of FBO banking assets in the United States and 51 percent of all FBO assets—banking and nonbanking—in the United States. As of that date, 498 FBO branches were operating in the United States, holding total assets of $821 billion. As legal and operational extensions of their parent foreign banks, FBO branches have no capital of their own. FBO branches serve primarily their home country and U.S. corporate customers and engage in lending, money market services, trading, trade financing, and other activities with banks and other financial institutions. The FBO branches can access the U.S. payments system through the Federal Reserve and obtain other Federal Reserve services. Over the last decade, the globalization of markets, the increase in transaction volume and volatility, and the introduction of complex trading strategies have led capital markets and trading activities to take on an increasingly important role at financial institutions, including FBO branches. Before enactment of the International Banking Act of 1978 (IBA), only states licensed, supervised, and regulated the operations of FBO branches. Under this system, FBO branches enjoyed many regulatory advantages compared with U.S. banks, but the FBO branches also were restricted in varying ways, depending upon the laws of the states in which they were licensed. The IBA sought to “level the playing field” between branches and U.S. domestic banks by introducing the FBOs to the dual-bank regulatory system that is in effect for domestic banks. This policy of “national treatment” allowed FBO branches to obtain a state charter or a federal charter from the Office of the Comptroller of the Currency (OCC) and served as the basis for provisions in the IBA that eliminated certain advantages and disadvantages of state-only regulation. The regulatory regime established by the IBA did not fully account for certain safety and soundness and other concerns, however. In 1991, Congress passed the Foreign Bank Supervision Enhancement Act (FBSEA). This act, which amended the IBA, authorized federal oversight of all foreign bank operations in the United States and vested this responsibility with the Federal Reserve. FBSEA also established uniform standards for the combined U.S. operations of foreign banks, generally requiring them to meet financial, management, and operational standards equivalent to those required of U.S. banking organizations. Finally, FBSEA prohibited foreign branches from accepting retail deposits (deposits of $100,000 or less that are insured by FDIC), although it grandfathered the branches that already offered insured deposits. Under FBSEA, the Federal Reserve’s supervisory and regulatory powers over FBOs include (1) approving all FBOs seeking to establish U.S. offices, whether these offices are licensed by federal or state authorities, in accordance with standards set forth in the act; (2) terminating the activities of a state-licensed FBO branch or recommending that OCC terminate the license of a federally licensed FBO branch; and (3) ensuring that FBO operations in the United States are examined in a comprehensive and coordinated manner. To enhance their supervision of foreign banking operations in the United States, the Federal Reserve began to implement its interagency FBO Program in March 1995. Federal Reserve staff told us that the program was scheduled to be implemented over a 3- to 5-year period, but that they hoped to have it fully operational by 1998. The FBO Program was designed to provide U.S. supervisors with a collective mechanism for supervising the U.S. operations of FBOs in a coordinated, thorough, and efficient manner, according to the Federal Reserve. The FBO Program is expected to provide a mechanism to obtain comprehensive supervisory information about the U.S. operations of FBOs, including information relevant to assessments of FBO branches’ internal controls and audits. The FBO Program is also intended to provide supervisors with an understanding of FBOs’ ability to provide their U.S. operations with the necessary financial and managerial support. The FBO Program calls for the development and distribution of five new supervisory products that have separate requirements regarding what they are to contain, when they are to be prepared, and how they are to be used. Each of the products is designed to assist in supervising FBOs. The products include a Summary of Condition and Combined Rating, Comprehensive Examination Plan, Review of Home Country Financial System, Review of Significant Home Country Accounting Policies and Practices, and Strength of Support Assessment. These products and how they are designed to assist in the oversight of branch internal controls and audits are described in more detail in chapter 4. In 1994, federal and state bank supervisors began phasing in a new, uniform examination rating system for U.S. branches of FBOs that heightened the priority of the effectiveness of a branch’s risk management processes and operational controls. This rating system, which is commonly referred to as the ROCA system, focuses on: Risk management, Operational controls, Compliance with U.S. laws and regulations, and Asset quality. (The previous rating system, which was known as the AIM system, focused on Assets, Internal controls, and Management.) The first three ROCA system components are to evaluate the major activities or processes of an FBO branch that may raise supervisory concerns. The fourth component of the rating system is to provide for a specific rating of the quality of the FBO branch’s stock of assets as of the examination date. The ROCA system is intended to direct attention to the types of weaknesses in front- and back-office duties that allowed unauthorized activities to continue undetected in Daiwa Bank. Table 1.1 describes each component of the ROCA rating system. Each component is evaluated on a scale of one to five, where one represents the least supervisory concern and five represents the greatest concern. Chapter 4 describes the supervisors’ shift from an AIM to a ROCA rating system in more detail. The overall composite ROCA rating is to indicate whether, in the aggregate, the operations of the FBO branch may present supervisory concerns and the extent of these concerns. The composite rating is based on a scale of one through five, with one representing the least supervisory concern and five representing the greatest concern. The five composite ratings are defined in table 1.2. Internal control is the process by which an entity’s board of directors, management, and/or other personnel obtain reasonable assurance that the objectives in the three following categories will be achieved: Operations—relating to effective and efficient use of the entity’s resources. Financial reporting—relating to preparation of reliable financial reports. Compliance—relating to the entity’s compliance with applicable laws and regulations. Although good internal control can provide reasonable assurance that an entity can achieve the three objectives, it has limitations. Internal control can only help ensure an entity’s business success, since shifts in external conditions—such as competitors’ actions or economic conditions—can be beyond the control of management. Likewise, internal control can only help ensure the reliability of financial reporting and compliance with laws and regulations because judgments in decisionmaking can be faulty and breakdowns can occur due to simple error or mistake. In addition, controls can be circumvented by the collusion of two or more people, and management has the ability to override the system. Another limiting factor is that the design of an internal control system must reflect that resource constraints exist, and the benefits of controls must be considered relative to their costs. Internal auditing is a management function that is intended to independently evaluate the adequacy and effectiveness of the control systems within an organization and the quality of ongoing operations. Internal auditors are to directly examine the adequacy and effectiveness of internal control components and recommend improvements in such controls. Internal auditors should contribute to the ongoing effectiveness of the internal control system, but they do not have primary responsibility for establishing or maintaining the system. According to the Examination Manual for U.S. Branches and Agencies of Foreign Banking Organizations (examination manual), internal auditors should be independent of the activities they audit. External audits are performed to provide an independent assessment of the reliability of an entity’s financial statements and may provide management with useful information for conducting internal control responsibilities. The external auditor is to give an opinion on the financial statements. The extent of attention that the external auditor gives to internal control varies from audit to audit, but the external auditor is rarely, if ever, in a position to identify all internal control weaknesses that might exist in an entity. The specific objectives of this report are to (1) identify U.S. supervisors’ expectations for adequate internal controls and audits in FBO branches, (2) determine the extent of serious weaknesses in FBO branches’ internal controls and audit reported by U.S. supervisors, and (3) describe U.S. supervisors’ efforts to address these weaknesses. To describe the criteria that U.S. supervisors use to assess branches’ internal controls and audits, we reviewed the examination manual developed by federal and state supervisors for examining FBO branches. We also reviewed other related supervisory guidance and interviewed some state supervisory staff and Federal Reserve staff from the New York, San Francisco, Chicago, and Atlanta Federal Reserve districts. To determine the extent of serious weaknesses reported in FBO branches’ internal controls and audits, we reviewed all 99 enforcement actions taken by federal and state supervisors against FBO branches for internal control and/or audit weaknesses from January 1993 to June 1996, and we compiled a list of serious internal control and audit weaknesses by noting the specific weaknesses described in the enforcement actions. We classified these weaknesses by type of weakness, such as inadequate segregation of duties, and by type of operation at the branch where the weakness occurred, such as trading operations. We then developed a data collection instrument (DCI) that we used to categorize serious internal control and audit weaknesses as reported by U.S. supervisors in examination reports. We received and incorporated comments on our preliminary DCI from Federal Reserve staff. Using the DCI, we quantified the types of weaknesses cited in 425 examination reports for 254 FBO branches that were examined from January 1993 to June 1996. Of the 425 examinations, 267 resulted in FBO branches receiving AIM or ROCA composite ratings of 3, 4, or 5. The remaining 158 examinations resulted in FBO branches receiving a higher composite rating but a 3, 4, or 5 in the “I” component of the AIM rating or the “R” or “O” components of the ROCA rating. These components are heavily affected by internal control and audit weaknesses. The percentage of FBO branches whose examination reports we reviewed varied from a high of about 30 percent of all FBO branches in 1993 to about 20 percent in 1996. This methodology provided data on the extent of serious internal control weaknesses that were included in enforcement actions in low-rated FBO branches. It was not designed to provide the extent of all types of internal control weaknesses. We reviewed examination reports and enforcement actions from six Federal Reserve districts: New York, San Francisco, Chicago, Atlanta, Boston, and Philadelphia. We did not independently verify the information contained in the examination reports. We discussed our DCI results with Federal Reserve and New York State Banking Department staff who identified those weaknesses they considered to be among the most serious. To provide perspective to the number of weaknesses cited in branches of foreign banks, we also reviewed 190 examination reports from a sample of similarly low-rated domestically chartered banks using the same DCI. The domestically chartered banks were examined by the Federal Reserve or jointly examined by the Federal Reserve and the appropriate state supervisor. These banks were located in the New York, San Francisco, Chicago, and Atlanta Federal Reserve districts. To describe the concerns of U.S. supervisors that were raised by FBO branches’ internal control and audit weaknesses and the efforts by U.S. supervisors and others to address these concerns, we interviewed staff from federal and state supervisory agencies to obtain their views on the seriousness of the weaknesses reported, the risks posed by these weaknesses, and the efforts of federal and state supervisors to address them. We also reviewed supervisory guidance detailing efforts to improve oversight of FBO branches. We conducted our work in Washington, D.C.; New York; Chicago; Atlanta; San Francisco; and Miami between July 1996 and June 1997 in accordance with generally accepted government auditing standards. We requested comments on a draft of this report from the Federal Reserve Board, which provided written comments. A discussion of these comments appears at the end of chapter 4. The Federal Reserve Board’s comments are reproduced in appendix II. In addition, Federal Reserve staff provided technical comments, which we incorporated in this report where appropriate. According to the examination manual, supervisory agencies in the United States expect each U.S. FBO branch to have internal controls consistent with the size and complexity of its operations as well as an independent internal audit function and/or adequate audit coverage by the head officeor external auditors. The examination manual states that an underlying objective of this supervisory policy is to preserve the “high standards, efficiency, and confidence in U.S. markets.” Supervisors told us that if this policy was not applied to FBO branches, the integrity of business practices within the market could be undermined. These officials said that such a result was a greater concern than the potential for systemic risk associated with losses from unauthorized or illegal activity at an FBO branch. From a supervisory perspective, good internal control exists when no one at an FBO branch is in a position to make significant errors or perpetuate significant irregularities without timely detection. In assessing an FBO branch’s internal controls, supervisors are to consider (1) the adequacy of these controls and the level of adherence to them; (2) the frequency, scope, and adequacy of the branch’s internal and external audit function; (3) the number and severity of internal control and audit exceptions; (4) whether internal control and audit exceptions are effectively tracked and resolved in a timely manner; (5) the adequacy and accuracy of management information reports; and (6) whether the system of controls is regularly reviewed to keep pace with changes in the FBO branch’s business plan and laws and regulations. In addition, supervisors are to evaluate whether an FBO branch’s internal controls for regulatory reporting help ensure that all required reports are submitted on time and are accurate. According to the Federal Reserve Board Chairman, the U.S. financial system is strong and vibrant, in large part because the United States demands that financial institutions participating in its markets operate with integrity and that any information made available to depositors and investors be accurate. When confidence in the integrity of a financial institution is shaken or its commitment to the honest conduct of business is in doubt, public trust erodes and the entire system is weakened. Within this context, the Chairman said that termination of the Daiwa Bank’s U.S. operations was necessary because such behavior by a financial institution could cause significant damage to the integrity of the U.S. financial system. The Chairman also stated that what is true for the financial system in general is also particularly true for the supervision of financial institutions. The whole system of supervision proceeds upon the basis of trust, whether in terms of the representations or reports filed by management or in terms of transparency with regard to any material developments affecting the financial condition of the institutions. Supervisors need to trust the ability of bank management to carry out their duties in a responsible and honest manner with adherence to systems and internal controls designed to ensure the safe and sound conduct of business. Supervisory officials reiterated this theme to us in explaining the importance of internal controls and explaining their concerns about weaknesses in the internal control and audit functions. The officials said that FBO branches must be held to the same standards as their U.S. competitors or an erosion of the integrity of business practices within the market could occur. They also said that allowing FBO branches to operate under weaker requirements than domestic banks could undermine the policy of national treatment. The potential for erosion of the integrity, confidence, and efficiency in U.S. financial markets was a greater concern to the supervisors than the potential for systemic risk associated with losses from unauthorized or illegal activity at an FBO branch. Although the officials acknowledged the potential for systemic risk should a foreign bank with substantial obligations to U.S. institutions fail because of losses incurred by one of its U.S. FBO branches, they believed the risk was minimal. In conducting examinations of FBO branches, supervisors are guided in part by the examination manual, which was prepared under the direction of the Federal Reserve. According to the examination manual, the key objectives in examining FBO branches are to determine the adequacy of the system of internal control and of FBO branch policies, practices, and procedures; evaluate the scope and adequacy of the internal control environment and determine compliance with laws, regulations, and rulings; and evaluate adherence with internal policies and procedures. In general, good internal control exists when no one is in a position to make significant errors or perpetrate significant irregularities without timely detection, according to the examination manual. The examination manual contains control procedures that are to help ensure that no one is in a position to make significant errors or perpetrate significant irregularities without timely detection. These procedures fall into the following five categories: Proper authorization of transactions and activities. Segregation of duties, which reduces opportunity for any person to both perpetrate and conceal errors or irregularities in the normal course of his or her duties. Segregation of duties often means assigning different people the responsibilities of authorizing transactions, recording transactions, and maintaining custody of assets. Design and use of adequate documents and records to help ensure the proper recording of transactions and events. Adequate safeguards over access to and use of assets and records, such as secured facilities and authorization for access to computer programs and data files. Independent checks on performance and proper valuation of recorded amounts, such as clerical checks, reconciliations, comparison of assets with recorded accountability, computer programmed controls, management review of reports that summarize the detail of account balances, and user review of computer-generated reports. One method of ensuring an independent check on performance is requiring that employees in sensitive positions be absent from their duties for a minimum number of consecutive days (often 2 weeks). Employees in sensitive positions include those with financial responsibilities that can influence the accuracy of the accounting and financial records or those with access to assets. In assessing the internal controls of an FBO branch, supervisors seek to determine not only that the FBO branch has established the necessary control policies and procedures but also that these controls are carried out by competent people who do not have incompatible duties. An example of incompatible duties in control procedures related to credit activities would be the maintenance of records of charged-off loans by a person who also has custody of the notes or receives payment. To make their assessments, supervisors are to review the duties of key employees and evaluate their ability to perform their duties by reviewing their educational experiences and job performances. U.S. supervisors expect FBO branches to have an independent internal audit function and/or adequate audit coverage by the head office or external auditors. Internal audits should ensure that operations are conducted in accordance with internal guidelines and supervisory policies and that all reports and analyses provided to the head office, FBO branch senior management, and supervisors are timely and accurate. Internal auditors are responsible for assessing the soundness and adequacy of an FBO branch’s controls to ensure that they promptly and accurately record transactions and properly safeguard assets against loss. The examination manual states that the scope of the program of internal audit must be sufficient to attain the audit objectives. In assessing the scope of the audit, supervisors are to consider whether all important FBO branch functions and services are included in the audit scope and whether the audit program includes procedures that are necessary to reasonably ensure compliance with applicable U.S. law and regulations. The frequency with which the audit procedures are performed is to be based on an evaluation of the risk associated with each area of audit interest. Among the factors that the auditor should consider in assessing risk are the following: the nature of the specific operation of the specific assets and liabilities under review, the existence of appropriate policies and internal control standards, the effectiveness of operating procedures and internal controls, and the potential materiality of errors or irregularities associated with the specific operation. In reviewing and evaluating the internal audit function, U.S. supervisors are to consider, among other things, the independence of the internal auditors. The ability of the internal audit function to achieve its audit objectives depends, in large part, on the extent of such independence. According to the examination manual, the independence of internal auditors can frequently be determined by the reporting lines within the organization and to whom or at what level audit results are reported. In most circumstances, the internal audit function at the FBO branch is to be under the ultimate direction of the FBO’s chief internal auditor and/or executive management or a committee thereof. The examination manual states that to be considered independent, the internal auditor should be given the authority to perform the job, including free access to any records necessary for the proper conduct of the audit. Furthermore, internal auditors generally should not have responsibility for supervising the accounting system, other aspects of the FBO branch’s accounting function, or any operational function. In reviewing and evaluating the internal audit function, U.S. supervisors are also to assess the effectiveness of the internal audit program. In addition to considering the scope and frequency of the work performed, supervisors are to consider the following two factors, among others, in assessments for effectiveness: Documentation of the work performed. Work programs should be written and individual audit procedures should be presented in a logical manner. Each program should provide a clear, concise description of the audit work required, analyses that clearly indicate the procedures performed, the extent of testing, and the basis for conclusions reached. Management’s response to the findings. A measurement of the program’s effectiveness is a prompt and effective management response to the auditor’s recommendations. According to the examination manual, head office management of the FBO should require that FBO branch management respond formally to audit findings and take appropriate corrective action. Management is expected to respond to all internal and external audits and supervisory examinations. Management responses should be timely and address all findings in the reports, unless specifically noted in the audit report that a response is not necessary. Responses should include concrete solutions that have already been put in place or that will be implemented in a timely manner. Management is to immediately respond to repeat problems noted in the audit report. According to the examination manual, external audits enhance the probability that financial statements and reports to regulatory authorities and other financial statement users will be accurate and help detect conditions that could adversely affect banking organizations or the public. The independent audit process also subjects the internal controls and the accounting policies, procedures, and records of each banking organization to periodic review. The objective of an external financial audit is different from the objectives of an internal audit or an FBO branch examination. Therefore, the supervisor is interested in the work performed by external auditors for three principal reasons. First, supervisors may find that internal audit work is not being performed or that such work is deemed to be of limited or no value to the supervisor. Second, the work performed by external auditors may affect the amount of testing that the supervisor must perform. Third, audits and other reports rendered by external auditors may provide the supervisor with information that is pertinent to the examination of the FBO branch. According to the examination manual, the major factors that should be considered in evaluating the work of external auditors are similar to those factors that are applicable to internal auditors, that is, the competence and independence of the auditors and the adequacy of the audit program. Federal Reserve officials we interviewed said internal auditors can play an important role in the external audit. That is, if an FBO branch has a good internal audit, the external auditor can limit the amount of testing it has to do, thereby decreasing its volume of work and allowing it to concentrate on other areas. The examination manual states that an FBO branch’s internal control program for supervisory reports is to ensure that all required reports are submitted on time and are accurate. U.S. supervisors rely on the timely and accurate filing of supervisory reports by domestic and foreign financial institutions. Data collected from supervisory reports are to (1) facilitate early identification of problem situations that can threaten the safety and soundness of reporting institutions, (2) ensure timely implementation of the prompt corrective action provisions of banking legislation, and (3) serve other legitimate supervisory purposes. In addition, accurate regulatory reports allow supervisors to better target examination resources. Supervisors are required to discuss in the examination reports of FBO branches any material errors or the filing of late regulatory reports. According to the examination manual, Reserve Bank staff are also to be notified of any regulatory report filing that is considered misleading. A misleading report could involve some degree of knowing or reckless behavior on the part of the filer and the intentional or negligent submission of inaccurate information to the Federal Reserve. On the other hand, a false report could involve the submission of mathematically incorrect data, such as addition errors or transpositions, the submission of call reports (Report of Assets and Liabilities) without appropriate schedules, or the inadvertent filing of inaccurate information. The results of our analysis of examination reports of the 254 FBO branches rated fair, marginal, and unsatisfactory (i.e., 3, 4, or 5) from January 1993 to June 1996 indicate that a significant number of these FBO branches were reported to have serious weaknesses in internal controls, and that a majority of the FBO branches had at least 1 serious audit weakness. Generally, FBO branches engaged in trading as a major line of business had a greater number of internal control and audit weaknesses than nontrading FBO branches. Twenty-eight percent of the FBO branches in our study were reported to have inadequate segregation of duties in trading and/or EFT activities—which are weaknesses that supervisors we interviewed identified as among the most serious weaknesses in control procedures. These weaknesses can heighten risk of losses due to misconduct, including unauthorized trading and misappropriation of funds, as occurred at Daiwa Bank. Other serious internal control weaknesses cited in the examination reports included lack of dual control and independent verification in trading and/or EFT, lack of security and access restrictions in EFT, and failure to ensure that employees in sensitive positions were absent for a minimum number of consecutive days to allow another employee the opportunity to detect improper actions. Ideally, FBO branch management learns of control weaknesses through appropriately designed audits and other means, then strengthens controls, and finally conducts periodic audits to verify that the controls are operating as designed. However, 69 percent of the FBO branches in our study were reported to have audits of inadequate scope, indicating that the audit did not cover all of the FBO branch’s activities that supervisors believed should have been covered. Other serious audit weaknesses included inadequate frequency of audits, inadequate response to audit criticisms, and inadequate audit independence. Subsequent examinations showed that FBO branch management did not correct audit weaknesses in response to supervisory examinations at many FBO branches. For example, 53 percent of the 171 FBO branches with audits of inadequate scope that were examined more than once in our study period were found to have audits of inadequate scope in subsequent examinations. To better understand the seriousness of our findings of internal control weakness at the FBO branches, we compared the FBO branch findings with examination findings for a sample of U.S. domestic banks. The comparison was limited because the FBO branches had usually engaged in a greater variety of major business activities than the U.S. domestic banks, and more than one-half of the FBO branches had engaged in trading activities while only one of the U.S. domestic banks had. The comparison showed that domestic banks tended to have fewer identified internal control weaknesses than FBO branches. To determine the extent of weaknesses in internal controls at FBO branches in the United States, we identified weaknesses that, because of their seriousness, prompted supervisory action. We developed a DCI that was designed to collect, from supervisory examination reports, the extent of serious internal control weaknesses and other FBO branch-specific information, such as assigned ratings, major lines of business, and asset size. We discussed our preliminary findings with supervisory staff from the Federal Reserve and New York state, who then helped us further narrow our focus to those weaknesses they considered to be among the most serious as we continued our analysis. Those weaknesses, which were cited in a significant number of FBO branches, included inadequate segregation of duties, lack of dual control and independent verification in trading activity and EFT, lack of security and/or access restrictions in EFTs, inadequate safekeeping and/or documentation in trading activities, and the failure to ensure that employees in sensitive positions were absent for a minimum number of consecutive days. The number of FBO branches rated fair or lower that were reported to have these weaknesses is summarized in table 3.1. As summarized in table 3.1, the results of our analysis of examination reports of the 254 FBO branches rated fair, marginal, or unsatisfactory from January 1993 to June 1996 indicate that 28 percent (72) of the 254 FBO branches were reported to lack adequate segregation of duties in trading and/or EFT activities. Inadequate segregation of duties in these activities is among the most serious internal control weaknesses because it heightens risk of losses due to misconduct, including unauthorized trading and misappropriation of customer and bank funds, and has been recognized as a factor in serious financial losses, such as those suffered by Daiwa Bank and Barings PLC. Federal Reserve officials we interviewed said that a lack of segregation of duties is particularly important in trading and EFT activities because these activities involve the movement of potentially large sums of money. One examination report we reviewed described a segregation of duties weakness involving trading as follows: “Segregation of duties between back office and trading remains a serious concern. The lack of a completely independent back office prevents FBO branch and head office management from ensuring compliance with policies and procedures, and effectively monitoring and controlling trading risk.” Another examination report described the weakness for electronic funds transfers as follows: “Segregation of duties and controls over the systems security administration of the wire transfer and treasury operations are unsatisfactory and compromise the safety and soundness of the FBO branch.” Another report stated the following: “An absence of segregation of duties was identified in the agency’s payment order operation. Both the agency’s teller and manager of operations can independently input, verify, release, amend, and cancel wire transfers. This situation exposes the agency to undue risk of fraud or misappropriation of customer funds.” Of the 72 FBO branches found to lack adequate segregation of duties, 43 were reported to have weaknesses in segregation of duties in EFT activities, and 39 were reported to have weaknesses in trading activities. Ten of these FBO branches had both weaknesses during the study period. We found that 21 percent (53) of the FBO branches rated fair or lower were reported to lack dual control and independent verification in trading and/or EFT activities. Dual control is an internal control procedure that is intended to provide an independent check on performance or proper valuation of recorded amounts. For example, some functions, such as electronically transferring (wiring) funds out of the institution, may be permitted only if done by two individuals simultaneously. In other cases, it might be appropriate for a single individual to carry out a specific function, with another person independently verifying that the function was done properly. Inadequate independent verification in an FBO branch’s trading activities was described as follows in an examination report we reviewed: “All trades are recorded on audio tape. However, the foreign exchange trader has access to the tapes. The tapes should be controlled independently of the foreign exchange trader.” Another examination report described the proper storage of test keys, which are used to verify wire transfer orders, as follows: “Test keys for the wire transfer area should be stored in an area physically separate from the rest of branch operations. Test keys should be secured when not in use and should not be accessible to employees not directly involved in the testing of incoming messages or payment orders.” The results of our analysis showed that 22 percent (57) of the FBO branches were reported to lack security and/or access restrictions in EFTs. This type of internal control requires security, usually in the form of physical or electronic restrictions, on access to information or machinery that could potentially be used to do financial harm to individuals or the institution. Like dual control/independent verification in EFTs, security and/or access restrictions in EFTs help mitigate the risk of losses due to unauthorized transfers of bank or customer funds. One examination report we reviewed instructed FBO branch management that “Access controls for the wire transfer terminals remain inadequate. Management should ensure that access to these terminals is properly restricted.” We found that 22 percent (56) of the FBO branches were reported as failing to ensure that employees in sensitive positions were absent for a minimum number of consecutive days. This is a control procedure that was found lacking in Daiwa Bank before disclosure of its losses. As previously mentioned in chapter 2, this policy is a way of ensuring an independent check on performance, since the employee’s absence would subject his or her activities to scrutiny by others. Employees in sensitive positions are those that have financial responsibilities that can influence the accuracy of the accounting and financial records or have access to assets. We found that 15 percent (39) of the FBO branches were reported to have inadequate safekeeping and/or documentation in trading activities. Supervisors identified safekeeping and/or documentation in trading activities as important in mitigating legal risk in trading activities in the United States. Supervisory officials we interviewed said that problems with documentation and safekeeping could present a legal risk in the event of litigation. They said that foreign banks often do not understand this risk. Customers in some countries, the officials said, would never consider suing a bank, but in the United States, this is a very real risk. We found that 6 percent (16) of the FBO branches were reported to lack adequate security and/or access restrictions for accounting system software. This type of internal control requires security, usually in the form of physical or electronic restrictions, on access to information or machinery that could potentially be used to do financial harm to individuals or the FBO branch. Security and access restrictions for accounting system software can help prevent manipulation of accounting records to conceal misconduct. As discussed in chapter 2, audits help management ensure that all operations are conducted in accordance with internal guidelines and supervisory policies, and that all reports and analyses provided to the FBO head office and branch senior management are timely and accurate. The role that audits play in helping to ensure effective control procedures was confirmed by our statistical analysis of the examination reports of 254 FBO branches rated fair or lower. The analysis showed that reports of audit weaknesses generally indicated larger numbers of internal control weaknesses. FBO branches with one or more audit weaknesses tended to have more internal control weaknesses than FBO branches that had no audit weaknesses. Federal Reserve staff we interviewed said that it was no surprise to them that FBO branches that do not adequately police themselves would have more internal control weaknesses. They said that strong audits are important to help ensure safety and soundness, in part, because it will never be possible for supervisors to pick up everything in an examination. As summarized in table 3.2, a majority of the 254 FBO branches rated fair or lower had at least 1 serious audit weakness. Sixty-seven percent of the FBO branches in the study were reported to have audits of inadequate scope; 41 percent had inadequate frequency of audits, 28 percent had inadequate response to audit criticisms, 26 percent had inadequate audit independence, 24 percent had inadequate workpapers/documentation, and 9 percent had a lack of adequate supervision by the head office. The results of our analysis indicated that 67 percent (171) of the FBO branches rated fair or lower were reported to have inadequate scope of audit coverage. This audit weakness compromises the ability of management to ensure that all operations are conducted in accordance with internal guidelines and supervisory policies, and that all reports and analyses provided to the head office and FBO branch senior management are timely and accurate. In assessing this aspect of an audit, supervisors seek to determine if all important FBO branch functions and services are included in the audit scope and whether the audit program includes procedures necessary to reasonably ensure compliance with applicable U.S. laws and regulations. Supervisory officials we interviewed agreed that inadequate scope of audit coverage and other audit weaknesses we discuss in this section of the report are among the most serious weaknesses in the internal controls of FBO branches. We also found that inadequate scope of audit coverage was the most frequently reported recurring weakness. Of the 171 FBO branches that were reported to have inadequate scope of audit coverage, 116 were examined more than once from January 1993 to June 1996. Over one-half (61) of these 116 FBO branches had recurring reports of inadequate scope of audit coverage. This may be explained in part—as suggested by supervisory officials we interviewed—by the increasing complexity in the industry and the fast rate of change in the banking system, which requires institutions to continually reassess their risks and the appropriate audit coverage. We found that 41 percent (103) of the FBO branches rated fair or lower were found by supervisors to have audits of inadequate frequency. As discussed in chapter 2, the frequency with which the audit procedures are performed should be based on an evaluation of the risk associated with each area of audit interest. Of the 116 FBO branches that were examined more than once from January 1993 to June 1996, 19 were cited for inadequate frequency of audits more than once. This weakness was described in an examination report as follows: “The agency does not employ an independent auditor to conduct internal control reviews, and head office audits are infrequent. There is no assurance that annual audits are to be performed in the future.” The results of our analysis indicated that 28 percent (71) of the 254 FBO branches rated fair or lower, were reported to have inadequate response to audit criticisms. Supervisory staff we interviewed agreed that inadequate response to audit criticisms is among the most serious of audit weaknesses and could be indicative of poor management. This weakness also compromises the ability of management to ensure that all operations are conducted in accordance with internal guidelines and supervisory policies, and that all reports and analyses provided to the head office and FBO branch senior management are timely and accurate. We found that 26 percent (67) of FBO branches rated fair or lower were reported to have inadequate audit independence, which can compromise the objectivity of auditors and thus the reliability of audit work. Supervisory staff we interviewed said that inadequate audit independence is also among the most serious of weaknesses. An examination report described one instance of this as follows: “Audit findings were submitted to the general manager of the FBO branch instead of directly to the senior internal auditor at the regional office in contravention of bank policy.” We found that 24 percent (62) of the FBO branches rated fair or lower were reported to have inadequate audit workpapers or documentation. This audit weakness is a serious internal control weakness because without such paperwork, supervisors cannot assess the adequacy and the effectiveness of the internal audit program. We found that 9 percent (23) of the FBO branches were reported to lack adequate supervision of audits by the FBO branch’s head office. Supervisors said that this weakness is a serious concern because it could suggest generally inadequate oversight of the FBO branch by the head office. One examination report presented this weakness as follows: “ . . . Equally as disturbing is the failure of the senior internal auditor to forward all audit reports to the head office. It appears that head office has taken little action with regard to this lack of response.” Appendix I contains the summary results of our overall data collection effort. As illustrated in figure 3.1, we found that FBO branches rated fair or lower that engaged in trading as a major line of business tended to have a higher number of serious internal control weaknesses than nontrading FBO branches. In addition, FBO branches that engaged in trading as a major line of business were more likely than nontrading FBO branches to have specific types of serious internal control weaknesses, including inadequate segregation of duties and audit weaknesses, such as inadequate scope and frequency of audits. Federal Reserve staff we interviewed told us that they expect trading FBO branches to have more internal control weaknesses because trading is a complex, high-speed activity that requires sophisticated internal controls and a certain number of staff to adequately implement them. In addition, depending on the size of an FBO branch’s operations, its back office, where it tracks and records trades, could be thinly staffed. That is, smaller FBO branches might engage in trading but may not have sufficient support staff because of the costs of hiring them. An examination report we reviewed illustrated the importance of adequate internal controls over an FBO branch’s trading operations. It stated as follows: “Lack of controls led to an environment where agency management was able to conduct unauthorized trading that resulted in $22.3 million in losses.” As illustrated in figure 3.2, we also found that FBO branches rated fair or lower that had more lines of business tended to have a higher number of serious internal control weaknesses. Among FBO branches rated fair or lower that engaged in a large number of business activities (i.e., four or more), those with smaller staffs had more internal control weaknesses than those with larger staffs. Federal Reserve staff suggested that this may be because smaller staffs that are stretched thin to accommodate a greater variety of activities are generally more susceptible to internal control weaknesses. To provide some perspective to our findings of the extent of internal control weaknesses in FBO branches, we also reviewed examination reports from a sample of fair-to-unsatisfactory-rated U.S. domestic banks. The U.S. domestic banks were all examined independently by the Federal Reserve or jointly by the Federal Reserve and the appropriate state supervisor, and they were located in the New York, Chicago, San Francisco, and Atlanta Federal Reserve districts. We did this to try to remove differences introduced by the agency conducting the examination. The domestic banks differed from FBO branches in several respects. The U.S. domestic banks tended to engage in a smaller variety of businesses, primarily lending, while only one in the sample did trading on behalf of customers. In addition, the U.S. domestic banks generally were smaller, as measured by asset size. U.S. domestic banks from our sample had an average of 7.5 separate internal control weaknesses reported, while FBO branches had an average of 10.1. Domestic banks had an average of 1.2 audit weaknesses reported, while FBO branches had an average of 2.5. Most of the weaknesses reported for domestic banks involved their credit-related operations. Thirty-one percent of domestic banks were reported to have an inadequate segregation of duties in at least one activity, compared to 48 percent of FBO branches. While 67 percent of FBO branches were reported to have audits of inadequate scope, 40 percent of domestic banks were reported to have the same problem. The results of our analysis of examination reports of the 254 FBO branches rated fair or lower examined from January 1993 to June 1996 indicate that a significant number of the FBO branches were reported to have serious internal weaknesses, and a majority of them had at least 1 serious audit weakness. In our opinion, the numbers and types of internal control and audit weaknesses found by supervisors heighten the importance of recent supervisory attention to the adequacy of internal control and audit processes at FBO branches, as discussed in chapter 4. The Federal Reserve and other banking supervisors told us they are taking steps to promote effective internal controls and audits in FBO branches. According to the Federal Reserve, its policies on addressing control weaknesses within FBO branches are consistent with the supervisory policies it applies to all of the institutions it supervises. These policies, according to the Federal Reserve, are also intended to reduce the risk of losses due to misconduct or fraud in FBO branches and to promote prompt correction of situations that can lead to an unsafe and unsound banking environment. In assessing the operational controls of FBO branches, the U.S. supervisors’ primary goal is to ensure that participation of the branches in U.S. financial markets neither raises the level of systemic risk nor undermines standards that help ensure the efficiency of and confidence in U.S. markets. As weaknesses in internal controls and audits of FBOs in the United States have been highlighted by losses experienced by Daiwa Bank and other multinational banks and trading houses, U.S. supervisors are undertaking a variety of efforts consistent with meeting that goal. The objectives of these efforts include helping to ensure (1) the detection of losses that have occurred as the result of a branch’s weaknesses in internal controls and audits, (2) the timely correction by branches of serious weaknesses in internal controls and audits, (3) an increased understanding among multinational banks of the importance of adequate internal controls and audits, and (4) the preparedness of supervisors to conduct effective assessments of internal controls. To reduce the risk of losses due to misconduct or fraud in the U.S. operations of FBOs and to promote prompt corrections of situations that can cause an unsafe and unsound banking environment, the Federal Reserve, in November 1996, released policy guidelines on special audit procedures that are to be implemented in situations where significant internal control weaknesses are detected in branches. According to Federal Reserve guidance, a primary objective of special audits is to determine whether internal control weaknesses have led to unreported losses and the extent of any such losses. The new guidance requires that auditors perform direct verification of those areas identified by supervisors as having significant internal control weaknesses along with some verification of key accounts in other areas of the FBO branch that may have been affected by those weaknesses. The guidance requires auditors to determine the accuracy of reports filed by the FBO branch with U.S. supervisors. Another objective of special audits is to identify the degree of internal control deficiencies and the risks posed to the FBO branch so that management can implement the appropriate corrective action on both an interim and long-term basis. Auditors are required to report on the type, nature, and extent of any significant internal control weaknesses found during the audit. The audit is to concentrate on the areas specifically criticized by supervisors; however, there is also to be some review of internal controls in other significant FBO branch operations. The engagement letter for the audit is to contain target dates for interim and final reports. The coordinating Federal Reserve Bank is to monitor the general progress of the audit, obtain a copy of the final report, discuss with the Federal Reserve Board staff any additional steps that should be taken, and prepare a brief report of actions taken. Federal Reserve guidance requires special audit procedures when both the “O” rating and the composite ROCA rating are three or worse, because such ratings indicate (1) that the overall condition of the FBO branch is less than satisfactory and (2) that, at least in part, the problems are due to internal control weaknesses. In some cases, internal audit staff of the FBO branch may perform the audit. However, if the adequacy of the internal audit at a particular FBO branch is among the reasons why internal controls are considered to be less than satisfactory, the procedures must be conducted by regional or head office internal audit staff or by external auditors. Additionally, external auditors are required to be used (1) if there are extremely serious deficiencies in internal controls, as reflected in an “O” rating of four or worse, and the composite rating is also four or worse; (2) in cases where internal auditors had performed special audit procedures and the current examination indicates the FBO branch continues to be in less than satisfactory condition (i.e., “O” and composite rating of three or worse); or (3) in other situations, if determined necessary after consultations with Federal Reserve, other federal and state supervisory authorities, and the home country supervisor. Federal Reserve supervisors we interviewed told us they had recently begun to require special audits when FBO branches have what they consider to be significant internal control weaknesses. The supervisors said they believe this special audit requirement will be a valuable tool to help them detect potential unreported losses and correct internal control weaknesses. However, the supervisors said it was too early to provide specific examples of improvements. According to the examination manual, supervisors are to seek timely correction of serious internal control and audit weaknesses through the use of enforcement actions. Federal and state supervisors have used their enforcement authority to direct FBO branches to correct weaknesses in their internal controls and audits. Such actions include cease-and-desist orders, memorandums of understanding, commitment letters, and supervisory letters, among other actions, that direct the institution to remedy specific weaknesses. Federal Reserve staff told us that they may initially try to remedy problems at FBO branches without taking enforcement action but will take action where a weakness shows no improvement over multiple examinations. During the period of our review, U.S. supervisors took 282 enforcement actions against 185 FBO branches. The actions were of varying levels of severity and included supervisory letters, commitment letters, memorandums of understanding, written agreements, cease-and-desist orders, and civil money penalties. Most of the actions were less formal supervisory letters or commitment letters. Supervisory staff said that the seriousness of the action taken often depends on the seriousness or persistence of problems at the FBO branch, but the action taken also is influenced by the attitude displayed by FBO branch management toward improving its operations. The supervisory staff said that there is no set formula that determines whether to take an enforcement action or how severe of an action to take. Twenty-nine percent (82) of the 282 enforcement actions against FBO branches were taken for the primary reason of inadequate internal controls, and 6 percent (17) were for inadequate audits. In some cases, supervisors initially took a less serious action and then upgraded the seriousness of the action when the FBO branch failed to improve. To contrast these numbers with U.S. domestic banks, 9 percent of the enforcement actions taken by the Federal Reserve against domestic banks during the same period were for inadequate internal controls, and less than 1 percent were for inadequate audits. Of the 254 fair or lower rated FBO branches, 23 percent (59) were under enforcement actions primarily for internal control or audit weaknesses. In addition to taking enforcement actions against FBO branches, the Federal Reserve has been able to use one of its new products under the FBO Program, which U.S supervisors began to implement in 1995, to encourage FBOs to correct less serious internal control and audit weaknesses. The Summary of Condition and Combined Rating was designed to provide FBO management with an overall assessment of the FBO’s U.S. operations. This product is to highlight the aspects of the FBO’s U.S. operations that need the most attention and is to be sent directly to the foreign bank’s head office. Staff at the Federal Reserve told us that providing foreign bank management with a summary of the condition of the FBO’s U.S. operations and a combined rating has helped them communicate more effectively with foreign bank staff and has resulted in quicker and better compliance by the foreign banks. In recent years, U.S. supervisors have sought to increase the understanding among multinational banks of the importance of adequate internal controls and audits. Federal Reserve staff told us that they hold meetings with foreign bank and foreign supervisory staff to discuss the importance of developing adequate internal controls. They also conduct some training programs in which foreign supervisory officials participate. According to Federal Reserve staff, this has led to an increased awareness among the management of foreign banks, both overseas and in the United States, and among foreign supervisors of the importance of strong internal controls. Federal Reserve staff also said that through these interactions, U.S. supervisors have been able to assist both multinational banks and foreign supervisors in upgrading their understanding and standards of internal controls and audits. U.S. and foreign supervisors, working through the Basle Committee on Banking Supervision, have developed basic standards for internal controls and audits. For example, the Basle Committee’s April 1997 paper entitled Core Principles for Effective Banking Supervision states that “Banking supervisors must determine that banks have in place internal controls that are adequate for the nature and scale of their business.” The paper describes the types of internal controls that should be in place, and it also states that internal controls must be supplemented by an effective audit that independently evaluates the adequacy, operational effectiveness, and efficiency of the internal controls within an organization. Actions that U.S. supervisors have taken to help ensure the preparedness of supervisors to conduct effective assessments of internal controls include the following: the development and implementation of the FBO Program, which is expected to provide supervisors with, among other things, more comprehensive information relevant to assessments of internal controls and audits, as well as analysis and a ranking to reflect the U.S. supervisors’ judgment about the FBO’s ability to provide its U.S. operations with the necessary financial and managerial support; the development and implementation of an FBO branch rating system, ROCA, that emphasizes risk management and operational controls; the development and use of the examination manual, which provides specific and uniform guidance to all U.S. supervisors with responsibility for FBO branch oversight, and the Trading Activities Manual; and the initiation of examiner training programs covering internal controls, risk assessment, trading exposure management, and advanced derivatives products. The FBO Program is intended, in part, to help ensure the preparedness of supervisors to conduct effective assessments of FBOs’ U.S. operations. The Federal Reserve began to implement the FBO Program in March 1995, when it issued its initial guidance. Federal Reserve officials told us that the FBO Program was scheduled to be implemented over a 3- to 5-year period, but that they hoped to have it fully operational within 3 years. As discussed in chapter 1, U.S. supervisors developed five new products under the FBO Program for the use of their examiners. These products were intended, in part, to facilitate supervisors’ ability to obtain comprehensive supervisory information during examinations, including information relevant to the assessments of internal controls and audits. These products include the following: Summary of Condition and Combined Rating. This product is intended to provide U.S. supervisors with information about the overall condition of the U.S. offices, including branches, of individual FBOs, including information on control or audit weaknesses, which can then be factored into their supervision of the U.S. offices under their jurisdiction. Annual Comprehensive Examination Plan. This plan is intended to help better coordinate examinations of U.S. offices of FBOs with multiple U.S. banking operations and/or significant U.S. nonbanking operations. U.S. banking supervisors we interviewed reported many instances of increased coordination and cooperation among federal and state supervisors, which is important because problems, including internal control or audit weaknesses, identified at a particular office could manifest themselves at other offices of an FBO. Review of Home Country Financial System and Review of Significant Home Country Accounting Policies and Practices. These products are to provide information about the financial system and the supervisory and governmental policies in the FBO’s home country and information about significant accounting policies and practices in the home country. For example, these products might include information about a general lack of a rigid internal auditing system in the financial institutions of a particular country or about a country’s lack of a history of independent external auditors. This information may be useful to U.S. supervisors for overseeing the U.S. operations of an FBO from such a country. Strength-of-Support Assessment (SOSA). The SOSA is to provide an analysis and a ranking to reflect the U.S. supervisors’ judgment about the FBO’s ability to provide its U.S. operations with the necessary financial and managerial support. The SOSA ranking is to categorize all FBOs with U.S. banking operations by levels of supervisory concern, highlighting those whose U.S. operations are thought to warrant higher levels of supervisory attention. In some cases, an asterisk may be appended to a SOSA ranking when there are concerns about the ability of the FBO to maintain adequate internal controls and compliance procedures at its U.S. offices. In 1994, U.S. supervisors began phasing in the replacement of the previous asset-focused system of rating FBO branches, which was called the AIM rating system, with the new ROCA rating system. By the beginning of 1996, the ROCA rating system was fully phased in. The ROCA rating system places greater emphasis on the effectiveness of risk management processes and operational controls and was devised to better assess the condition of a branch within the context of the FBO. As we discussed in chapter 1, the ROCA rating system divides an FBO branch’s overall activities into three individual components: risk management, operational controls, and compliance. These components represent the major activities or processes of the FBO branch that may raise supervisory concern. The ROCA rating system also provides for a specific rating of the quality of the FBO branch’s stock of assets as of the examination date. Supervisory staff we interviewed said the shift from a focus on asset quality, under the AIM rating system, to a focus on risk management and operational controls, under the ROCA rating system, was an appropriate shift in emphasis. Staff said that the ROCA rating system was designed to look forward, while the AIM rating system’s focus on assets was effectively a backward-looking approach because asset quality reflects an institution’s past business decisions. Staff also said that they found that, to improve their examination rating, some foreign banks had focused on manipulating asset classification ratios and moving assets off the books of the branch to the head office or another entity in the bank. Although asset quality is still considered under the ROCA system, staff said it is not the primary emphasis. Officials representing the foreign banking industry also told us that the ROCA rating system is a better measure of an FBO branch’s operations than was the AIM rating system. The officials said that the change from the AIM rating system to the ROCA rating system mirrored the way FBO branches had changed their businesses to focus on better risk management strategies and operational controls. An official from the Federal Reserve also told us that, although domestic banks are rated under a different system than FBO branches, the use of ROCA is consistent with national treatment because U.S. supervisors are still reviewing the same things that they review in domestic banks. Along with the development of the ROCA rating system, the Federal Reserve, in cooperation with other federal and state banking agencies, developed the examination manual for conducting individual examinations of FBO branches. This manual was drafted to provide a common approach among all supervisory agencies with respect to individual FBO branch examinations. The manual was initially sent out for comment to U.S. supervisors in October 1993 and became effective in January 1995. Its content was drawn in large part from commercial bank examination procedures. However, all aspects of this examination manual were drafted to specifically address the unique characteristics of FBO branch examinations. Supervisory staff we interviewed told us that this is the first examination manual to be used by both state and federal supervisors for examinations of FBO branches, and that this has resulted in more consistent examinations. According to Federal Reserve officials, the examination manual has also been widely used as a reference tool by the foreign banking community in the United States to improve its internal controls. The examination manual has also supplemented the U.S. supervisors’ efforts to inform foreign bankers and supervisors about U.S. internal control and audit standards. In 1994, the Federal Reserve also adopted a new Trading Activities Manual. Although developed primarily for U.S. commercial banks, the trading activities manual also applies to FBO branches, many of which are actively engaged in transactions involving trading activities. This manual includes detailed examination procedures for evaluating controls in trading activities; for example, it emphasizes the importance of separations of duties in a trading operation such as Daiwa Bank’s. Federal Reserve staff also told us they are in the process of developing a module for supervisors to use during examinations that is intended to help the supervisors give a more risk focused approach to their review of internal controls and audits. Federal Reserve staff told us they would begin pilot testing this module during the last quarter of 1997. The Federal Reserve has also taken steps intended to enhance examiner training. For example, Federal Reserve officials developed an Internal Controls School in 1995 that was designed initially for examiners of FBO branches and expanded to meet the needs of examiners of U.S. domestic banks. Federal Reserve officials also told us that they developed a training seminar in 1996 for examiners and in-house international supervisory staff that emphasizes ensuring the appropriate supervisory strategy for the U.S. operations of each FBO. U.S. supervisors have not yet developed a strategy for evaluating the results of their initiatives to improve internal controls and audits at FBO branches. The Federal Reserve has indicated that rough measures, such as examination ratings, currently indicate some degree of improvement. However, such rough measures do not determine whether there are appropriate linkages between examination results and the Federal Reserve’s initiatives, such as training and education. Without measures that determine the linkages between the initiatives and improved internal control practices, the Federal Reserve will not know if it has satisfactorily addressed the internal control and audit weaknesses at FBO branches. U.S. supervisors have recognized that serious weaknesses in internal controls and audits at certain FBO branches are significant and must be addressed if losses are to be avoided and confidence maintained in the integrity and efficiency of financial markets. To that end, they have developed and implemented several initiatives in the past 2 to 3 years to improve the supervision of FBO branches and educate bank officials and home country supervisors about the importance of resolving internal control and audit weaknesses. These efforts include the FBO Program, the ROCA rating system, the development of new examination manuals, education and training programs, and the new requirement for special audits. The supervisors’ efforts—as they are designed—appear to provide a basis for raising and maintaining control standards at FBO branches, and Federal Reserve supervisors told us that their efforts have already resulted in improved internal controls and audits at fair or lower rated FBO branches. However, supervisors have not yet developed a strategy for evaluating the results of these initiatives, including whether those results satisfactorily address the weaknesses identified or whether additional initiatives may be needed. Such a strategy could, for example, determine whether there are appropriate linkages between examination results and training and education efforts. For information to be available to monitor the impact of the initiatives when they are fully implemented, it is important that the supervisors promptly identify the data that are needed and ensure that the systems necessary to gather and maintain those data are in place and operating. We recommend that the Federal Reserve develop a strategy, including objective measures, for assessing the progress it is making through its efforts to improve internal controls and audits at FBO branches and ensure that the procedures and systems necessary to collect the data relevant to those measures are in place and operating. Results from such objective evaluation of efforts to improve internal controls and audits should be useful in determining whether additional initiatives may be needed and in communicating with FBO branch officials and home country supervisors about the importance of sound bank management practices. We requested comments on a draft of this report from the Federal Reserve Board, which provided written comments that are reproduced in appendix II. In addition, Federal Reserve staff provided technical comments, which we incorporated in this report where appropriate. The Federal Reserve Board commented that our recommendation was useful and said that it will take steps to (1) evaluate in a more systematic fashion the results of its initiatives to improve the supervision of the U.S. operations of FBOs and (2) identify and address internal control and audit weaknesses in those operations. The Board also said that several rough measures currently indicate some degree of improvement in those areas. As an example of such measures, the Board noted a decline, since 1993, in the number of FBO branches with fair or lower overall examination ratings or component ratings that are substantively affected by internal control and audit weaknesses.

Summary: Pursuant to a congressional request, GAO: (1) identified U.S. supervisors' expectations for adequate internal controls and audits in foreign banking organization (FBO) branches; (2) determined the extent of serious weaknesses in FBO branches' internal controls and audits reported by U.S. supervisors during examinations; and (3) described U.S. supervisors' efforts to address these weaknesses. GAO noted that: (1) U.S. supervisors expect each U.S. FBO branch to have: (a) a system of internal controls that is consistent with the size and complexity of its operation; and (b) an internal audit function of adequate scope and frequency or an adequate system of head office or external audits; (2) although few FBO branches' deposits are insured by the Federal Deposit Insurance Corporation (FDIC), U.S. supervisors have an interest in the activities of FBO branches because the supervisors wish to preserve standards that help ensure the efficiency of and confidence in U.S. markets; (3) a guiding principle for U.S. supervisors in assessing internal controls is that good internal control exists when employees are not in a position to make significant errors or perpetrate significant irregularities without timely detection; (4) in evaluating a FBO branch's overall system of internal control, U.S. supervisors are to consider the adequacy of controls and the level of adherence to them; (5) a significant number of the 254 FBO branches U.S. supervisors rated fair or lower had one or more of the weaknesses in internal control that U.S. supervisors identified as being among the most serious, and a majority of the FBO branches had one or more of the weaknesses in audit function identified as being among the most serious; (6) 67 percent of the 254 FBO branches whose examination reports GAO reviewed were reported to have had audits of inadequate scope; 41 percent were reported to have had audits of inadequate frequency; and 28 percent were reported to have had inadequate management response to audit criticisms; (7) according to U.S. supervisors, these audit weaknesses represent serious problems in management's oversight of internal controls and could slow or limit improvement of internal controls at some FBO branches; (8) GAO found that U.S. supervisors are undertaking numerous efforts intended to address internal control and audit weaknesses at FBO branches; (9) the objectives of these efforts include helping to ensure: (a) detection of losses that have occurred as the result of an FBO branch's internal control and audit weaknesses; (b) timely correction by FBO branches of serious weaknesses in control procedures and audit functions; (c) increased understanding among multinational banks of the importance of adequate internal controls and audits; and (d) preparedness of supervisors to conduct effective assessments of internal controls; and (10) prompt attention to the development of a strategy for evaluating the results of these initiatives is now needed to determine whether progress is being made in improving the condition of internal controls at FBO branches.