2019-20822. Supervisory Committee Audits and Verifications

AGENCY:

National Credit Union Administration (NCUA).

ACTION:

Final rule.

SUMMARY:

The NCUA Board (Board) is amending its regulations governing the responsibilities of a federally insured credit union (FICU) to obtain an annual supervisory committee audit of the credit union. The final rule implements recommendations outlined in the agency's Regulatory Reform Task Force's Regulatory Reform Agenda (Agenda) and will provide additional flexibility to FICUs. Specifically, the Board is: Replacing the Supervisory Committee Guide with a simplified appendix to the part; eliminating two audit types that FICUs seldom use; and eliminating a specific deadline for outside, compensated persons to deliver written audit reports to FICUs.

DATES:

The final rule takes effect January 6, 2020.

FOR FURTHER INFORMATION CONTACT:

Technical information: Alison Clark, Chief Accountant, Office of Examination and Insurance, at the above address or telephone [phone]; or Legal information: Marvin Shaw, Staff Attorney, Office of General Counsel, at the above address or telephone [phone].

SUPPLEMENTARY INFORMATION:

I. Background and Legal Authority

A. NCUA Regulatory Reform Task Force

In August 2017, the Board published and sought comment on the Regulatory Reform Agenda.^[1] The Agenda identifies those regulations the Board intends to amend or repeal because they are outdated, ineffective, or excessively burdensome.^[2]

The Agenda addresses the NCUA's regulations on Supervisory Committee Audits. As discussed more fully below, the Agenda recommends removing from § 715.7 of the NCUA's regulations the reference to the “NCUA's Supervisory Committee Guide” and amending the requirement related to the timing for delivery of written audit reports issued by outside, compensated persons in § 715.9 of the NCUA's regulations.

B. Federal Credit Union Act Audit Requirements

Sections 115 and 202(a)(6) of the Federal Credit Union Act (FCU Act) set forth provisions addressing auditing and accounting requirements.^[3] Section 115 of the FCU Act requires a federal credit union's (FCU's) supervisory committee to make an annual audit and submit a report of that audit to the FCU's board of directors and a summary of that report to the FCU's members at the next annual meeting.^[4] Further, the supervisory committee is required to make supplemental reports as it deems necessary.

Section 202(a)(6)(A) of the FCU Act is a general grant of authority to the Board to prescribe audit standards that require an outside, independent audit by a certified public accountant for any fiscal year for which a FICU has not conducted an annual supervisory committee audit, has not received a complete and satisfactory supervisory committee audit, or during which the FICU has experienced persistent or serious record keeping deficiencies.

Section 202(a)(6)(C) of the FCU Act generally requires FICUs having assets of $10 million or more to use accounting principles consistent with generally accepted accounting principles (GAAP) in all reports or statements required to be filed with the Board.^[5] The Board, and state credit union supervisors under applicable state law, may require credit unions having less than $10 million in assets to follow GAAP.^[6]

Section 202(a)(6)(D) of the FCU Act imposes audit requirements for larger FICUs. Specifically, a FICU having assets of $500 million or more is required to obtain an annual independent audit of its financial statements performed in accordance with generally accepted auditing standards, hereafter referred to as a “financial statement audit.” That audit must be performed by an independent certified public accountant or public accountant licensed to do so by an appropriate state or jurisdiction.^[7]

Additionally, if an FCU having total assets of less than $500 million but more than $10 million elects to obtain a financial statement audit, the audit must be performed consistent with the accountancy laws of the appropriate state or jurisdiction.^[8]

C. The NCUA's Supervisory Committee Audit Regulations

Currently, §§ 715.5 and 715.6 of the NCUA's regulations specify: (1) The minimum type of annual audit a FICU is required to obtain according to its charter type and asset size; (2) the licensing requirements of persons performing certain audits; and (3) the auditing principles that apply to certain audits.^[9] These provisions were last updated in July 1999.^[10] The July 1999 rulemaking adopted § 715.7 of the NCUA's regulations, which outlines the options for a FICU to comply with the annual audit requirement, if it has elected not to voluntarily obtain a financial statement audit. The options currently permitted include a FICU obtaining: (1) A Balance Sheet Audit; (2) a Report on Examination of Internal Controls over Call Reporting; or (3) an Audit per the Supervisory Committee Guide. The first two options are analogous to options that the Federal Financial Institutions Examination Council adopted in 1999 for other federally insured financial institutions. Regarding the third option, the NCUA amended the Supervisory Committee Guide in 1999 to detail the minimum scope and procedures for engaging outside, compensated professionals in the audit process and to clearly distinguish a Supervisory Committee Guide audit from a financial statement audit. The Supervisory Committee Guide is not included in the NCUA's regulations and instead is available on the agency's website.

II. Proposed Amendments

In February 2019 (84 FR 5957), the Board issued a notice of proposed rulemaking (proposal) amending part 715 to: (1) Eliminate the Report on Examination of Internal Controls over Call Reporting option in § 715.7(b); (2) remove reference to the NCUA's Supervisory Committee Guide in § 715.7(c) and replace it with minimum requirements set forth in a new appendix A to part 715; (3) eliminate the Balance Sheet Audit option in § 715.7(a); and (4) amend § 715.9(c)(6) applicable to engagement letters with outside auditors to eliminate a specific 120-day timing requirement.

The proposal also sought comments on whether to include additional topics in the new proposed appendix A. Specifically, under the proposed appendix A, the supervisory committee, internal auditor, or other qualified person would be required to perform and document the following areas of review:

• Test and confirm material asset and liability accounts, including, at a minimum, loans, cash, investments, shares and borrowings;
• test material equity, income and expense accounts;
• review key internal controls, including, at a minimum, bank reconciliation procedures, cash controls, dormant account controls, wire and ACH transfer controls, loan approval and disbursement procedures, and controls over insider ^[11] accounts;

• test the mathematical accuracy of the allowance for loan and lease loss accounts and ensure the methodology is properly applied; and
• test loan delinquency and charge-offs.

As reflected in the text of the proposed appendix A, the supervisory committee or other person conducting the audit would be expected to determine whether to supplement the minimum procedures in light of a particular FICU's circumstances.

In the proposal, the Board noted that in selecting these areas of review for inclusion in appendix A, NCUA staff borrowed substantially from the Supervisory Committee Guide, reviewed and adopted procedures established by the American Institute of Certified Public Accountants, and consulted with accounting professionals. The goal of the proposal was to make the requirements more understandable to FICUs, rather than change the areas of review the Board considers important. Nevertheless, the Board requested comment on whether other areas of review should be included in appendix A, and listed the following examples: Loans to insiders, pay and benefits to employees and board members, regulatory compliance, and compliance with the Bank Secrecy Act.

In the proposal, the Board noted its plan to decommission the outdated Supervisory Committee Guide, stating that the NCUA would issue reference materials on how to conduct procedures that would meet the minimum requirements of appendix A. This reference material could be used by supervisory committees and the third parties hired to develop agreed upon procedures. Alternatively, supervisory committees and hired third parties could elect to incorporate other agreed upon procedures, so long as the testing meets the minimum requirements.

III. Comments

The Board received 22 comments from credit unions, credit union trade associations, credit union leagues, an association of state regulators, and accountants and accounting firms. Commenters generally supported the proposed rule and the Board's objectives. The consensus was that the proposal would provide FICUs with assets less than $500 million with additional flexibility, reduce compliance burdens, and simplify the Supervisory Committee Audit, while still providing useful information about the financial health and stability of FICUs. Nevertheless, some commenters objected to specific provisions or proposals, while others provided additional suggestions that they believed would improve the proposal and avoid adversely affecting small FICUs. Specifically, a few commenters cautioned that some provisions might increase cost and burden for smaller FICUs and thus run counter to the intent of the proposal. Substantive comments supporting or opposing each specific proposal and advocating alternatives or modifications are discussed below. As discussed in detail below, the Board is adopting the proposal with a few minor modifications.

IV. Final Rule

As detailed below, in this final rule, the Board is amending part 715, Supervisory Committee Audits and Verifications, by adopting the proposal with a few minor modifications. The final rule updates outdated provisions and provides added flexibility to FICUs with assets less than $500 million while continuing to ensure appropriate financial oversight. The final rule includes the following modifications to part 715: (1) Eliminating the Report on Examination of Internal Controls Over Call Reporting in § 715.7(b); (2) removing the Supervisory Committee Guide Audit Alternative to a Financial Statement Audit in § 715.7 and replacing it with an appendix; ^[12] (3) eliminating the Balance Sheet Audit option in § 715.7(a); and (4) removing the 120-day report delivery deadline in § 715.9(c)(6) from the required terms for audit engagement letters with outside, compensated persons. The Board is also making conforming amendments to part 715 to reflect the replacement of the Supervisory Committee Guide with the appendix.

A. Eliminate Report on Examination of Internal Controls Over Call Reporting in § 715.7(b)

The Board proposed eliminating the option for FICUs with assets less than $500 million to obtain a Report on Examination of Internal Controls Over Call Reporting as one of the alternatives to a financial statement audit. The proposal noted that less than one percent of FICUs use this option to fulfill their audit requirement.

Commenters generally agreed with the proposal because of this option's limited use and lack of review of a FICU's income statement. One commenter favored retaining this option to maintain flexibility for smaller FICUs. As proposed, the Board is eliminating this option because it advances the purpose of eliminating outdated and ineffective regulations. This audit option is seldom used and provides limited insight into a FICU's financial condition.

B. Eliminate the Supervisory Committee Guide Audit Alternative to a Financial Statement Audit in § 715.7 and Replace It With an Appendix

The Board proposed removing reference to the NCUA's Supervisory Committee Guide in § 715.7(c) and replacing it with a new appendix covering minimum supervisory committee audit requirements. The Board described the 350-page Supervisory Committee Guide as outdated. In lieu of this option, the Board proposed adding an appendix to part 715 to set forth minimum areas of review in a clear, concise manner.

Comments on this part of the proposal addressed two areas: (1) Replacing the Supervisory Committee Guide with the appendix generally; and (2) the specific areas of review set forth in the appendix. The Board discusses these areas separately, below.

i. General Comments on Replacing the Supervisory Committee Guide

Although a few commenters supported retaining the Supervisory Committee Guide, most supported replacing it with the appendix. The commenters supporting the change stated that it would clarify and simplify audits for FICUs with assets less than $500 million, increase flexibility, save time and resources, and replace the outdated Supervisory Committee Guide, among other advantages. These commenters also stated that the appendix would increase flexibility and allow FICUs to focus on major risk areas.

The few commenters that opposed adopting the appendix opined that it would create additional costs and unintended consequences, such as increased audit work and associated fees for FICUs that hire outside auditors. These commenters stated that costs would increase significantly, but they did not attempt to quantify the claimed increase in costs. One commenter made several suggested edits to the appendix to alleviate the negative economic impact that the commenter asserted the appendix would cause.

After reviewing and analyzing the comments, the Board has determined that it is appropriate to remove the Supervisory Committee Guide alternative to a financial statement audit in § 715.7 and replace it with an appendix. As stated in the proposal, the Board finds the Supervisory Committee Guide outdated and that the minimum areas of review should be incorporated into the regulation. The NCUA will replace the Supervisory Committee Guide with reference materials on audit procedures to aid in performing the areas of review in the appendix. Replacing the Supervisory Committee Guide with new reference materials on audit procedures will provide an up-to-date resource and greater flexibility for FICUs. The Board finds that the appendix will provide specific areas of review while covering an appropriate range of financial matters. Adding prescriptive provisions to the appendix would run counter to the Board's intention to simplify the requirements and afford flexibility to FICUs. In recognition of the concerns that a few commenters raised, the agency will monitor the implementation of the appendix and may issue informal guidance to address questions that arise. In addition, as the Board stated in the proposal, the agency will consult with representatives of the accounting profession and publish reference materials on audit procedures to aid FICUs and others in conducting audits under the appendix. The Board believes that these measures will effectively address any initial questions or concerns that may arise during the transition from the Supervisory Committee Guide to the appendix.

Separately, despite supporting adoption of the appendix, a few commenters stated that it would be worthwhile to retain the Supervisory Committee Guide as a guidance document on the NCUA website for smaller FICUs. These commenters suggested adding a disclaimer to the document to note that its procedures would no longer satisfy part 715.

The Board has determined that it is appropriate to retain the Supervisory Committee Guide for historical reference on the NCUA website, with the appropriate disclaimers. However, because the Supervisory Committee Guide is outdated, FICUs should not rely on the Guide as a means to comply with part 715.

ii. Comments Addressing the Appendix

The appendix sets forth specific areas of review, as discussed above. The appendix also provides that parties conducting audits may need to perform additional procedures based on the circumstances of a particular FICU, and that the supervisory committee must apply its judgment in determining the procedures necessary to meet audit requirements.

The Board requested comments on whether the proposed minimum procedures and topics in the appendix are appropriate, and whether there are any additional topics that should be included. To this end, the Board listed several specific topics that it was considering adding to the appendix.

One commenter expressed concern that the objectives of the supervisory audit would not be met by the proposed appendix. This commenter suggested incorporating several procedures into the appendix that the commenter believed would result in assurance that the balance sheet accounts are fairly stated, including reconciliations, verifications, and a review of board minutes.

The Board has determined that the minimum areas of review set forth in the proposed appendix are appropriate. These areas of review are intended to reflect common industry practices for auditing accounts and controls over financial institution financial statements. Incorporating extensive additional detail into the appendix would run counter to the Board's goal of clarifying and simplifying audit procedures for FICUs with assets less than $500 million. The Board further notes that NCUA is considering recommendations received on the audit procedures for incorporation into the reference materials that the agency will make available after this final rule goes into effect, as the Board stated in the proposal.

As noted above, the Board also requested comments on whether the topics in the appendix are appropriate and whether there are any additional topics that should be included. The Board specifically requested comment on including the following additional topics in the appendix: loans to insiders; pay and benefits to employees and board members; regulatory compliance; and compliance with the Bank Secrecy Act.

Most commenters agreed with the list of topics expressly set forth in the appendix, stating that the proposed areas of review in the appendix sufficiently ensure that a proper audit would be conducted. However, several commenters recommended not including the additional topics on which the Board sought comments. As detailed below, the Board has decided to adopt the text of the appendix as proposed, with the addition of reviewing board minutes and testing for unrecorded liabilities. The Board has decided to not add any other topics.

Several commenters objected to including employee and board compensation as an audit topic in the appendix. They stated generally that this topic does not fit the intent of a supervisory committee audit and instead is within the purview of the board of directors. Some commenters also objected because they perceived no clear safety and soundness basis to include this topic. The Board notes that while it is not an express provision in the appendix, the supervisory committee audit must test employee and board compensation when it is a significant component of a FICU's expenses—as the regulation requires the audit to include a test of “material equity, income, and expense accounts.” However, the Board emphasizes that the purpose of the supervisory committee audit is to reconcile the mathematical computations related to compensation, and whether they are consistent with authorized compensation plans, but not to judge the appropriateness of the level of compensation. Confirming the accuracy of these figures and flagging any irregularities will serve the goal of ensuring safety and soundness.

Several commenters stated that the appendix should not require testing for Bank Secrecy Act and Anti-Money Laundering as part of the audit engagement, noting that it would be redundant of part 748, which requires annual testing in this area.^[13] The Board agrees with these commenters and has decided not to include this topic in the appendix.

Also, several commenters stated that the topics should not include “regulatory compliance.” They noted that regulatory compliance issues are beyond the scope of a supervisory committee audit, which focuses on financial and accounting issues. The Board agrees with commenters that it would likely be duplicative of other legal and regulatory requirements to incorporate regulatory compliance in the appendix. Accordingly, the Board has decided not to add this topic to the appendix.

In addition, a few commenters recommended adding to the list of topics. The suggested areas included testing for unrecorded and/or unstated liabilities that would not otherwise be subject to testing based on the materiality definition described in the proposal. Another commenter recommended that the appendix include these topics: disaster recovery and business continuity plans, information security, and vendor management.

The Board agrees that the areas of review should include testing for unrecorded liabilities. However, the Board declines to add the other recommended topics because they are not customarily part of a supervisory committee audit and would be covered by separate engagements. Specifically, the Board has determined not to add disaster recovery and business continuity plans, information security, and vendor management.

In sum, the Board is adopting the appendix as proposed, with the addition of reviewing board minutes and testing for unrecorded liabilities.

C. Eliminate the Balance Sheet Audit Option in § 715.7(a)

The proposal sought comments on whether to eliminate the Balance Sheet Audit option for FICUs with assets less than $500 million. This audit does not cover a FICU's income statement.

Several commenters stated that this option provides no benefit because the balance sheet does not reflect the current value of assets. Commenters also noted that the other audit alternatives provide better indicators of a FICU's financial health.

A few commenters favored retaining this option, despite acknowledging its limitations. For example, some commenters suggested that this option may be effective in the limited circumstance when a credit union is transitioning from a supervisory committee audit to a financial statement audit. Another commenter stated that this option provides reasonable assurance that the balance sheet complies with GAAP and is a viable, lower-cost option than a financial statement audit.

The Board has determined that the balance sheet audit does not provide sufficient information to allow a FICU's board of directors to assess the FICU's financial health. Because a supervisory committee audit provides greater insight at reasonable costs, the Board has decided to eliminate the Balance Sheet Audit as a means to comply with part 715.

D. Assistance From Outside, Compensated Person—Timing Requirement

The Board also proposed amending § 715.9(c)(6) to eliminate a prescriptive timing requirement for completion of audits by an outside, compensated person. This section, among other things, addresses engagement letters a FICU may use to hire a compensated auditor. The current regulation requires that an engagement letter specify a target date of delivery of written audit reports “not to exceed 120 days from the date of calendar or fiscal year-end under audit (period covered).” ^[14] The Board proposed to eliminate this requirement and replace it with a flexible standard that would require only that the target delivery date allows the FICU to meet its requirement to obtain an audit each calendar year.^[15]

Most commenters agreed with this proposed amendment because it provides FICUs with additional flexibility. Further, these commenters believed the amendment enhances a FICU's ability to better negotiate the target date for delivery of written reports. Commenters further stated that the proposal eliminates burden associated with seeking waivers of the deadline from the NCUA. One commenter opposed the proposal, stating the 120-day requirement may ensure uniformity throughout the industry.

The Board has determined that it is appropriate to adopt this change as proposed. The Board believes that this amendment will provide enhanced flexibility and potential cost savings, without any adverse impact to the auditing process. Although audit due dates may now vary across the industry, the regulation will continue to require annual audits, which provides substantial uniformity.

E. Applicability of Part 715

A few commenters addressed how part 715 should apply to FICUs, both in terms of asset size and chartering authority. Because the Board did not propose any changes in these areas, it declines to adopt the commenters' recommendations, as discussed below.

The Board received two comments suggesting a lower asset-size threshold for a financial statement audit. Because the FCU Act establishes this threshold, as discussed above, and this matter is beyond the scope of the proposal, the Board will not adopt this change.

One commenter stated that the NCUA should clarify part 715's applicability to federally insured, state chartered credit unions (FISCUs), observing that not all FISCUs have supervisory committees. The commenter suggested re-organizing part 715 or amending Part 741 to more clearly identify which requirements apply to FISCUs generally, and in particular to those without supervisory committees. Because the Board proposed no changes on this subject, it will not amend part 715 or 741 in this manner in this final rule. However, the Board notes that the definition of “supervisory committee” in § 715.2(l) expressly addresses this issue as follows: “Supervisory committee refers to a supervisory committee as defined by section 111(b) of the Federal Credit Union Act, 12 U.S.C. 1761(b). For some FISCUs, the `audit committee' designated by state statute or regulation is the equivalent of a supervisory committee.” ^[16] If state law or regulation does not require FISCUs chartered in the state to have a supervisory committee or an audit committee, then the credit union's board of directors is responsible for the requirements attributed to the supervisory committee in this regulation.

F. Conforming Amendments

As proposed, the Board is amending § 715.9(c)(3), (d), and (e) to replace references to the Supervisory Committee Guide with references to the appendix.

V. Regulatory Procedures

A. Regulatory Flexibility Act

The Regulatory Flexibility Act requires NCUA to prepare an analysis of any significant economic impact a regulation may have on a substantial number of small entities (those with less than $100 million in assets).^[17] This rule will provide relief to small credit unions by clarifying and simplifying requirements related to supervisory committee audits. Accordingly, NCUA certifies the rule will not have a significant economic impact on a substantial number of small credit unions.

B. Paperwork Reduction Act

The Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501 et seq.) requires that the Office of Management and Budget (OMB) approve of all collections of information by a Federal agency from the public before they can be implemented. Respondents are not required to respond to any collection of information unless it displays a current, valid OMB control number.

The information collection burden previously associated with the internal controls and balance sheet audit options are now collected as a single information collection associated with amended § 715.7. This change will be reflected in an upcoming renewal.

The information collection requirements under the current rule are covered under OMB #3133-0059. This final rule does not contain any additional information collection requirements under the Paperwork Reduction Act.^[18]

C. Executive Order 13132

Executive Order 13132 encourages independent regulatory agencies to consider the impact of their actions on state and local interests. NCUA, an independent regulatory agency as defined in 44 U.S.C. 3502(5), voluntarily complies with the executive order to adhere to fundamental federalism principles. The final rule does not have substantial direct effects on the states, on the relationship between the national government and the states, or on the distribution of power and responsibilities among the various levels of government. NCUA has, therefore, determined that this rule does not constitute a policy that has federalism implications for purposes of the executive order.

D. Assessment of Federal Regulations and Policies on Families

NCUA has determined that this rule will not affect family well-being within the meaning of § 654 of the Treasury and General Government Appropriations Act, 1999, Public Law 105-277, 112 Stat. 2681 (1998).

E. Small Business Regulatory Enforcement Fairness Act

The Small Business Regulatory Enforcement Fairness Act of 1996 (Pub. L. 104-121) (SBREFA) generally provides for congressional review of agency rules.^[19] A reporting requirement is triggered in instances where the NCUA issues a final rule as defined by Section 551 of the Administrative Procedure Act.^[20] An agency rule, in addition to being subject to congressional oversight, may also be subject to a delayed effective date if the rule is a “major rule.” ^[21] The NCUA does not believe this rule is a “major rule” within the meaning of the relevant sections of SBREFA. As required by SBREFA, the NCUA submitted this final rule to OMB for it to determine if the final rule is a “major rule” for purposes of SBREFA. OMB determined that the final rule is not major. The NCUA also will file appropriate reports with Congress and the Government Accountability Office so this rule may be reviewed.

List of Subjects in 12 CFR Part 715

• Credit unions
• Reporting and recordkeeping requirements

By the National Credit Union Administration Board on September 19, 2019.

Gerard Poliquin,

Secretary of the Board.

For the reasons discussed above, the National Credit Union Administration Board amends 12 CFR part 715 as follows:

PART 715—SUPERVISORY COMMITTEE AUDITS AND VERIFICATIONS

1. The authority citation for part 715 continues to read as follows:

Authority: 12 U.S.C. 1761(b), 1761d, and 1782(a)(6).

§ 715.2

[Amended]

2. Amend § 715.2 by removing and reserving paragraph (a) and (j).

3. Amend § 715.4 by revising paragraph (b) and the table and footnote 1 following paragraph (c) to read as follows:

§ 715.4

Audit responsibility of the Supervisory Committee.

* * * * *

(b) Financial statement audit option. Any federally-insured credit union, whether Federal or State chartered and regardless of asset size, may choose to fulfill its Supervisory Committee audit responsibility by obtaining an annual audit of its financial statements performed in accordance with GAAS by an independent person who is licensed to do so by the State or jurisdiction in which the credit union is principally located. (A “financial statement audit” is distinct from a “supervisory committee audit,” although a financial statement audit is included among the options for fulfilling the supervisory committee audit requirement in this section. Compare § 715.2(c).)

* * * * *

Table 1 to § 715.4

Type of charter	Asset size	Minimum audit required to fulfill supervisory committee audit responsibility 1	Part 715 section
Federal Charter	$500 Million or more	Financial statement audit per GAAS by independent, State-licensed person	715.5
	Less than $500 Million but greater than $10 Million	Either financial statement audit or other supervisory committee audit
	$10 Million or less	Supervisory committee audit.
State Charter	$500 Million or more	Financial statement audit per GAAS by independent, State licensed person	715.6
	Less than $500 Million	Supervisory committee audit unless audit prescribed by State law is more stringent
1 The Supervisory Committee audit responsibility under this part can always be fulfilled by obtaining a financial statement audit. See paragraph (b) of this section.

4. Revise § 715.7 to read as follows:

§ 715.7

Supervisory Committee audit alternatives to a financial statement audit.

A credit union which is not required to obtain a financial statement audit may fulfill its supervisory committee responsibility by obtaining an Other Supervisory Committee Audit. Such an audit is one that is performed by the supervisory committee, its internal auditor, or any other qualified person (such as a certified public accountant, public accountant, league auditor, credit union auditor consultant, retired financial institutions examiner, etc.) that satisfies the minimum requirements in appendix A of this part. Qualified persons who are not State-licensed cannot provide assurance services under this section.

5. Revise § 715.9(c)(3) and (6), (d), and (e) to read as follows:

§ 715.9

Assistance from outside, compensated person.

* * * * *

(c) * * *

(3) If an Other Supervisory Committee Audit, include an appendix setting forth the procedures to be performed;

* * * * *

(6) Specify a target date of delivery of the written reports, so that such target date will enable the credit union to meet its annual audit requirements in this part;

* * * * *

(d) Complete scope. If the engagement is to perform an Other Supervisory Committee Audit intended to fully meet the requirements of § 715.7, the engagement letter shall certify that the audit will address at least the minimum requirements in appendix A of this part.

(e) Exclusions from scope. If the engagement is to perform an Other Supervisory Committee Audit which will exclude any of the minimum requirements in appendix A of this part, the engagement letter shall:

(1) Identify the excluded items;

(2) State that, because of the exclusion(s), the resulting audit will not, by itself, fulfill the scope of a supervisory committee audit; and

(3) Caution that the supervisory committee will remain responsible for fulfilling the scope of a supervisory committee audit with respect to the excluded items.

6. Add appendix A to part 715 to read as follows:

Appendix A to Part 715—Supervisory Committee Audit—Minimum Procedures

This appendix presents minimum procedures which a supervisory committee, its internal auditor, or other qualified person must complete when a credit union chooses the Other Supervisory Committee Audit option for completing its annual audit requirements under § 715.7.

This option may not be adequate for all credit unions as it is designed for smaller, less complex credit unions. The supervisory committee, internal auditor, or other qualified person may also need to perform additional procedures to supplement these minimum procedures if the specific circumstances of a particular credit union so dictate. The supervisory committee must apply its judgment in determining the procedures necessary to meet audit requirements in this part. The supervisory committee remains responsible to ensure that a complete set of test procedures is performed. All test procedures will be done using balances and samples for the applicable audit period under review.

Any time the test or confirmation procedures include making a sample or selection, the supervisory committee's report, its internal auditor's report, or other qualified person's report on minimum procedures should describe the method of selection and the number of selected items.

For purposes of this appendix, the following definitions will apply:

• Confirm or confirmation refers to a written verification with a third-party (person or organization) pertaining to an account balance or condition. Examples of confirmation letters are bank/corporate credit union account confirmation, investment account confirmation, borrowing or line of credit confirmation, attorney letter confirmation, and member share/loan account confirmation.
• Materiality refers to a statement, fact or item, which, giving full consideration to the surrounding circumstances as they exist at the time, it is of such a nature that its disclosure, or the method of treating it, would be likely to influence or to make a difference in the judgment and conduct of a reasonable person. Materiality should take into account ending balances as well as the volume of transactions in an account. Typically, balances or transaction volume greater than 5 percent of the credit union's net worth should be considered material for purposes of this appendix.
• Review refers to the examination of Board minutes, policies and procedures, and a review of a sample portion of activities, rather than all of the activities.
• Test refers to procedures applied to the individual items that compose an account balance or class of transactions. The tests involve confirmation, inspection, or observation procedures to provide evidence about the recorded amount.

The supervisory committee, internal auditor, or other qualified person must perform and document the following minimum procedures:

• Review Board of Director minutes to determine whether there are any material changes to the credit union's activities or condition that are relevant to the areas to be reviewed in the audit
• Test and confirm material asset and liability accounts including, at a minimum:

○ Loans

○ Cash on deposit

○ Investments

○ Shares

○ Borrowings

• Test material equity, income, and expense accounts
• Test for unrecorded liabilities
• Review key internal controls including, at a minimum:

○ Bank reconciliation procedures

○ Cash controls

○ Dormant account controls

○ Wire and ACH transfer controls

○ Loan approval and disbursement procedures

○ Controls over accounts of employees and officials

○ Other real estate owned

○ Foreclosed and repossessed assets

• Test the mathematical accuracy of the allowance for loan and lease loss account and ensure the methodology is properly applied
• Test loan delinquency and charge-offs

Footnotes

1.  82 FR 39702 (Aug. 22, 2017).

2.  This is consistent with the spirit of President Trump's regulatory reform agenda and Executive Order 13777. Although the NCUA, as an independent agency, is not required to comply with Executive Order 13777, the Board has chosen to comply with it in spirit and has reviewed all of the NCUA's regulations to that end.

3.  12 U.S.C. 1761d; 12 U.S.C. 1782.

4.  12 U.S.C. 1761d.

5.  12 U.S.C. 1782(a)(6)(C). In lieu of GAAP, the NCUA Board “may prescribe an accounting principle . . . that is no less stringent than [GAAP].”

6.  Id.

7.  12 U.S.C. 1782(a)(6)(D)(i).

8.  12 U.S.C. 1782(a)(6)(D)(ii).

9.  12 CFR part 715.

10.  64 FR 41035 (July 29, 1999).

11.  “Insider” refers to employees and officials of the credit union.

12.  In the final rule, the Board will no longer reference the “appendix” as “appendix A.” The reason for this modification is to avoid confusion with appendix A of the Supervisory Committee Guide.

13.  12 CFR 748.2.

14.  12 CFR 715.9(c)(6).

15.  12 CFR 715.4(a).

16.  12 CFR 715.2(l).

17.  5 U.S.C. 603(a).

18.  44 U.S.C. 3501.

19.  5 U.S.C. 801-804.

20.  5 U.S.C. 551.

21.  5 U.S.C. 804(2).