Bank Examination Quality: FRB Examinations and Inspections Do Not Fully Assess Bank Safety and Soundness

FRB finalized internal control review procedures for examinations of state member banks and developed an examination module for examiners to follow in documenting their review. The approach provides for an assessment of the bank's internal and external audit function. Based on the risk assessment and identified control weaknesses, examiners will determine the depth of necessary related tests of the bank's high-risk activities. The amount of testing necessary to evaluate an activity depends on the bank's ability to identify, measure, monitor, and control its risks. Once the integrity of the bank's risk management system is verified through testing, examiners may rely on management's assessment of risks rather than performing more extensive tests. If examiners have concerns with the bank's system, they will conduct more extensive testing to more fully evaluate the bank's risk exposure for high-risk activities. Full implementation of this supervision framework is scheduled for late 1997.

In January 1994 FRB issued SR 94-3 that provides supervisory guidance on the implementation of section 112 of the FDIC Improvement Act. SR 94-3 provides detailed instructions for a preliminary review of management and auditor reports by reserve bank personnel. The purpose of this preliminary review is to check for reporting compliance and to identify emerging internal control weaknesses. After completion of the preliminary review, all relevant information is to be forwarded to the appropriate supervisory officer for each reporting institution. Guidance for specific review of the FDICIA internal control assessments by management and auditors of the institution is provided in the Commercial Bank Examination Work Documentation program. GAO believes this guidance provides a sufficient basis for evaluation of these internal control assessments and integration into the examination process.

Rather than provide separate policies and procedures for examiners to use in reviewing internal controls depending on the size of the bank, FRB intends for its examiners to follow an internal control review approach now being developed for application at all banks. That approach calls for a risk-based control assessment and, where applicable, provides for reliance on a member bank's internal audit function after FRB examiners assess its adequacy. Based on the control risk assessment and the nature of control weaknesses identified, the examiners are expected to complete specific internal control questionnaires and related test procedures for high-risk bank activities and functions and to document their work using standard procedures. Full implementation of these policies and procedures is scheduled for late 1997.

The FRB responded that it had recently signed a cooperative agreement with the Conference of State Bank Supervisors. Reserve banks must determine that a state has the capability to carry out responsibilities under the cooperative arrangements. This determination will be based primarily on the adequacy of the state's funding. However, FRB stated that its prior reliance on informal evaluations of state programs had served it well and that it believed that to establish a more rigid or elaborate evaluation program would be counterproductive.

In June 1994, FRB, along with OCC, FDIC, and OTS, issued the "Interagency Policy Statement on the Allowance for Loan and Lease Losses." This document establishes uniform interagency guidance for review of loan loss reserves and was analyzed in connection with the recent review of bank and thrift loan loss reserve methodologies. While GAO has some significant reservations about the policy statement, it is at least partially responsive to the recommendation.

The interagency policy statement provides guidance to institutions on maintaining an adequate loan loss reserve. However, because GAO has significant reservations about this guidance, it does not view it as being fully responsive to the recommendations on loan loss reserves.

In 1994, FRB developed the Federal Reserve System Commercial Bank Examination Work Documentation Program, which includes standardized workpaper requirements for bank examinations. The new standards require a clear accounting of work procedures to be performed, cross-referencing to supporting documentation, reasons for not reviewing or selecting an area to be reviewed, documentation of examiner conclusions and recommendations, and the initials of the examiner and sign-off of the reviewer. The program has been required for almost 2 years. During this 2-year period, field examiner comments were received and the program was revised. The final draft of the program has been completed. The official manual should be released before the end of the year.

This recommendation was made primarily in connection with establishing a sound methodology for assessment of loan loss reserves. A joint interagency policy statement on loan loss reserves was issued in June 1994.

FRB issued a policy directive in April 1993 which establishes: (1) the requirement for a written assessment of all nonbank activities of bank holding companies; (2) criteria for required on-site inspections of nonbank subsidiaries; and (3) standards for off-site review of nonbank activities. The directive also states that for credit-extending nonbank subsidiaries that meet the on-site review criteria, examiners are to review sufficient credit files to assess the adequacy and accuracy of the internal risk identification systems.

In October 1996, FRB began pilot testing a risk-focused supervision framework for inspection of bank holding companies. To accompany the risk-focused supervision framework, FRB has been developing examination and inspection modules for complex institutions, which will replace the work documentation program. The modules define review objectives, establish inspection procedures, and assist in documentation. Further, the modules provide a tiered approach to reviewing an institution's activities, which allows the examiner to focus on high-risk activities. Four modules are ready for field testing: loan portfolio analysis, treasury activities, trading and capital markets activities, and internal controls and audit. Additional modules are scheduled to be developed and will be field tested. Full implementation is expected in mid-1998. The modules are being automated so that examiners will be able to maintain their work on laptop computers while onsite at the institution.