FDIC Adopts Final Rule Changes to Annual Independent Audit Requirements

By W. Bernard Mason

The FDIC has adopted final amendments to its Part 363 (Annual Audit and Reporting Requirements) largely as originally proposed in a notice published on November 2, 2007. The rule will apply to all institutions with consolidated assets of $500 million or more at the beginning of its fiscal year.

Previously, institutions that were holding company subsidiaries could comply with the provisions of Part 363 by relying upon the audit and reporting activities of its parent. The FDIC has determined that, where insured institutions do not comprise a substantial portion of the holding company's consolidated total assets, the holding company's consolidated statements and accompanying notes do not provide sufficient information on the position and operations of the insured entity. Therefore, the FDIC has concluded that, in order for an institution to be eligible to comply with the audit and reporting requirements in Part 363 by looking to the holding company, the consolidated assets of the insured institution(s) must comprise 75 percent or more of the assets of the holding company. Compliance will be required for fiscal years ending on or after June 15, 2010.

The final rule amends the proposal by requiring that, in determining auditor independence, the independent public accountant must look to the AICPA, the SEC, and the PCAOB and comply with whatever standard would be most restrictive. The FDIC has decided not to include in the final rule a proposed requirement that insured institutions file with the FDIC copies of audit engagement letters, but cautions that including "limitations of liability" clauses in such letters could result in supervisory and disciplinary action. The FDIC has also amended some of the proposed guidelines for determining the independence of an outside director.

The final rule will be effective 30 days from the date of publication in the Federal Register. The original proposed rule is available at the here.

________________
W. Bernard Mason is the Regulatory Relations Liaison for The Risk Management Association. He may be contacted at bmason@rmahq.org.