Financial institutions need systems to identify, assess, and manage risks to their operations from internal and external sources. These risk management systems are critical to responding to rapid and unanticipated changes in financial markets. Risk management depends, in part, on an effective corporate governance system that addresses risk across the institution and also within specific areas of risk, including credit, market, liquidity, operational, and legal risk. The board of directors, senior management (and its designated risk-monitoring unit), the audit committee, internal auditors, and external auditors, and others have important roles to play in an effectively operating risk-management system. The different roles that each of these groups play represent critical checks and balances in the overall risk-management system. Since 1991, the Congress has passed several laws that emphasize the importance of internal controls including risk management at financial institutions and the Committee of Sponsoring Organizations of the Treadway Commission (COSO) has issued guidance that management of financial institutions could use to assess and evaluate its internal controls and enterprisewide risk management. Following the savings and loan crisis in the 1980s, the Federal Deposit Insurance Corporation Improvement Act of 1991 (FDICIA) strengthened corporate governance in large U.S. banks and thrifts. FDICIA required management to annually assess its system of internal control over financial reporting and the external auditors to attest to management’s assertions. The corporate governance model established under FDICIA emphasized strong internal control systems, proactive boards of directors, and independent, knowledgeable audit committees. During 1992, and with a subsequent revision in 1994 COSO issued its Internal Control – Integrated Framework. The COSO Framework set out criteria for establishing key elements of corporate governance, especially the “tone at the top.” The framework also set forth the five components of an effective system of internal control: control environment, risk assessment, control activities, information and communication, and monitoring. With the failures of Enron and WorldCom, Congress passed the Sarbanes- Oxley Act of 2002 (SOX) which required managements of public companies to assess their systems of internal control with external auditor attestations, though the implementation for smaller public companies has been gradual and is not yet complete. Under section 404 of SOX, the SEC required that management identify what framework it used to assess the system of internal control over financial reporting. Though it did not mandate any particular framework, the SEC recognized that the COSO Framework satisfied the SEC’s own criteria and allowed its use as an evaluation framework. In 2004, COSO issued Enterprise Risk Management – Integrated Framework (ERM Framework), though it is not a binding framework for any particular entity or industry. The ERM Framework, which encompasses the previous internal control framework, establishes best practices and expands the criteria and tools that management can use to assess whether it has an effective risk management system. The framework encourages the board of directors and senior management, in their corporate governance roles, to set the risk appetite of the entity, which is the amount of risk the entity is willing to accept in its overall strategy. Management further sets risk objectives to achieve the entity’s goals and sets risk tolerances to ensure that the risk appetite is not exceeded. Regulators also have a role in assessing risk management at financial institutions. In particular, oversight of risk management at large financial institutions is divided among a number of regulatory agencies. The Federal Reserve oversees risk management at bank holding companies and state member banks that are members of the Federal Reserve System; OTS oversees thrift holding companies and thrifts; SEC and FINRA oversee risk management at SEC-registered U.S. broker-dealers; and OCC oversees risk management at national banks. The Federal Reserve and OTS have long had authority to supervise holding companies. The Federal Reserve’s authority is set forth primarily in the Bank Holding Company Act of 1956, which contains the supervisory framework for holding companies that control commercial banks. OTS’s supervisory authority over thrift holding companies is set forth in the Home Owners Loan Act. In the Gramm-Leach-Bliley Act of 1999 (GLBA), Congress expanded the range of permissible holding company activities and affiliations and also set forth restrictions and guidance on how those companies should be supervised. However, Congress did not clearly express the aims of holding company supervision. GLBA authorizes the Federal Reserve and OTS to examine the holding company and each subsidiary in order to: (a) inform the regulator of “the nature of the operations and financial condition” of the holding company and its subsidiaries; and (b) inform the regulator of the financial and operational risks within the holding company system that may threaten the safety and soundness of the holding company’s bank subsidiaries and the systems for monitoring and controlling such risks; and (c) monitor compliance with applicable federal laws. On the other hand, GLBA specifies that the focus and scope of examinations of holding companies and any of their subsidiaries shall “to the fullest extent possible” be limited to the holding company and “any subsidiary that could have a materially adverse effect on the safety and soundness of a depository institution subsidiary” due to the size, condition or activities of the nonbank subsidiary or the nature or size of transactions between that subsidiary and the banking subsidiary. In our work over the years, we have encountered a range of perspectives on the focus of holding company examinations, some of which emphasize the health of the depository institution as the primary examination focus and some of which look more expansively to the holding company enterprise under certain conditions. In addition to the provisions generally applicable to holding company supervision, GLBA also limits the circumstances under which both holding company regulators and depository institution regulators may examine functionally regulated subsidiaries of bank holding companies, such as broker-dealers. Gramm-Leach-Bliley permits holding company regulators to examine functionally regulated subsidiaries only under certain conditions, such as where the regulator has reasonable cause to believe that the subsidiary is engaged in activities that pose a material risk to an affiliated bank or that an examination is necessary to obtain information on financial and operational risks within the holding company system that may threaten an affiliated bank’s safety and soundness. The examination authority of depository institution regulators permits the examination of bank affiliates to disclose fully an affiliate’s relations with the bank and the effect of those relations on the bank. However, with respect to functionally regulated affiliates of depository institutions, Gramm-Leach- Bliley imposes the same restraint on the use of examination authority that applies to OTS and the Federal Reserve with respect to holding companies. That is, Gramm-Leach-Bliley instructs that bank and holding company supervisors generally are to limit the focus of their examinations of functionally regulated affiliates and, to the extent possible, are to reply on the work of primary bank and functional regulators that supervise holding company subsidiaries. An example of this situation would be where a holding company has a national bank or thrift subsidiary and a broker-dealer subsidiary. Under GLBA, the holding company regulator is to rely “to the fullest extent possible” on the work of primary bank and functional regulators for information on the respective entities. Also under GLBA, bank supervisors are similarly limited with respect to affiliates of the institutions they supervise. SEC’s authority to examine U.S. broker-dealers is set forth in the Securities and Exchange Act of 1934. Under the 1934 act, SEC’s examination authority over broker-dealers does not permit SEC to require examination reports on affiliated depository institutions, and if SEC seeks non-routine information about a broker-dealer affiliate that is subject to examination by a bank regulator, SEC must notify and generally must consult with the regulator regarding the information sought. Oversight of U.S. broker-dealers is performed by SEC’s Division of Trading and Markets (Trading and Markets) and Office of Compliance, Inspections, and Examinations (OCIE). In addition, SEC delegates some of its authority to oversee U.S. broker-dealers to FINRA, a self-regulatory organization that was established in 2007 through the consolidation of NASD and the member regulation, enforcement and arbitration functions of the New York Stock Exchange. Under the alternative net capital rule for broker-dealers, from 2005-2008, SEC conducted a voluntary consolidated-supervised entity program under which five investment bank holding companies voluntarily consented to having SEC oversee them on a consolidated basis. Today, no institutions are subject to SEC oversight at the consolidated level, but several broker- dealers within bank holding companies are still subject to the alternative net capital rule on a voluntary basis. The Federal Reserve, FINRA, OCC, OTS, and SEC each identify areas of risk relating to the large, complex financial institutions they oversee and examine risk management systems at regulated institutions. However, the banking and securities regulators take different approaches. The banking regulators (Federal Reserve, OCC, and OTS) use a combination of supervisory activities, including informal tools and examination-related activities to assess the quality of institutional risk management systems and assign each institution an annual rating. SEC and FINRA aggregate information from officials and staff of the supervised institutions throughout the year to identify areas of concern across all broker-dealers. For those broker-dealers covered by the alternative net capital rule, SEC and FINRA emphasize compliance with that rule during target examinations. Under the CSE program, SEC continuously supervised and monitored the institutions in the program. Banking regulators carry out a number of supervisory activities in overseeing risk management of large, complex financial institutions. To conduct on-site continuous supervision, banking regulators often station examiners at specific institutions. This practice allows examiners to continuously analyze information provided by the financial institution, such as board meeting minutes, institution risk reports/management information system reports, and for holding company supervisors supervisory reports provided to other regulators, among other things.