2024-27657. Internal Control Over Financial Reporting

Document Headings

Document headings vary by document type but may contain the following:

1. the agency or agencies that issued and signed a document
2. the number of the CFR title and the number of each part the document amends, proposes to amend, or is directly related to
3. the agency docket number / agency internal file number
4. the RIN which identifies each regulatory action listed in the Unified Agenda of Federal Regulatory and Deregulatory Actions

See the Document Drafting Handbook for more details.

Farm Credit Administration

1. 12 CFR Parts 620 and 630
2. RIN 3052-AD56

AGENCY:

Farm Credit Administration.

ACTION:

Proposed rule.

SUMMARY:

The Farm Credit Administration (FCA, we, or Agency) is seeking comments on this proposed rule to amend the reporting regulations to require Farm Credit System (System) associations that meet certain asset thresholds or conditions, as well as all System banks, to obtain annual attestation reports from their external auditors that express an opinion on the effectiveness of internal control over financial reporting (ICFR), are made in accordance with generally accepted auditing standards (GAAS) as promulgated by the American Institute for Certified Public Accountants (“AICPA”) or the Public Company Accounting Oversight Board's (“PCAOB”) auditing standards, and accompany management's assessment and be included with the System Institution's annual report (these attestation reports are hereinafter referred to as “Attestation Reports”). The proposed rule would also require Attestation Reports obtained by the Federal Farm Credit Banks Funding Corporation (Funding Corporation) be made in accordance with GAAS.

DATES:

Comments on this proposed rule must be submitted on or before January 28, 2025.

ADDRESSES:

For accuracy and efficiency, please submit comments by email or through FCA's website. We do not accept comments submitted by fax because faxes are difficult to process. Also, please do not submit comments multiple times; submit your comment only once, using one of the following methods:

• Send an email [e-mail].
• Use the public comment form on our website:

1. Go to https://www.fca.gov.

2. Click inside the “I want to. . .” field near the top of the page.

3. Select “comment on a pending regulation” from the dropdown menu.

4. Click “Go.” This takes you to the comment form.

• Send the comment by mail to the following: Autumn R. Agans, Deputy Director, Office of Regulatory Policy, Farm Credit Administration, 1501 Farm Credit Drive, McLean, VA 22102-5090.

We post all comments on the FCA website. We will show your comments as submitted, including any supporting information; however, for technical reasons, we may omit items such as logos and special characters. Personal information that you provide, such as phone numbers and addresses, will be publicly available. However, we will attempt to remove email addresses to help reduce internet spam.

To review comments on our website, go to https://www.fca.gov and follow these steps:

1. Click inside the “I want to. . .” field near the top of the page.

2. Select “find comments on a pending regulation” from the dropdown menu.

3. Click “Go.” This will take you to a list of regulatory projects.

4. Select the project in which you're interested. If we have received comments on that project, you will see a list of links to the individual comments.

You may also review comments at the FCA office in McLean, Virginia. Please call us at [phone] or email us at [e-mail] to make an appointment.

FOR FURTHER INFORMATION CONTACT:

Technical information: Aaron M. Livernois, Senior Policy Accountant, Office of Regulatory Policy, Farm Credit Administration, McLean, VA 22102-5090, [phone], TTY [phone].

Legal information: Andra Grossman, Attorney Advisor, Office of General Counsel, Farm Credit Administration, McLean, VA 22102-5090, [phone], TTY [phone].

SUPPLEMENTARY INFORMATION:

I. Summary of Proposed Objectives and Amendments

The objective of this proposed rule is to strengthen the safety and soundness of the System's ICFR by requiring Attestation Reports from certain institutions. As further discussed in section II, complexity and concentration of System banks and their affiliated associations have changed dramatically since 2006 (the fiscal year before § 630.5 was last amended), leading to an increased risk that an internal control weakness or failure, such as an undetected management error, negligence, or fraud event at one association could affect the safety and soundness of the entire System. By requiring certain associations to obtain an Integrated Audit, FCA's proposed rule would help reduce undetected and evolving financial reporting risks in the System.

The amendments in the proposed rule include changes to financial reporting requirements set forth in 12 CFR 620.3 and 630.5 that:

• Revise § 620.3 to mandate all System banks obtain an Attestation Report from their external auditors.
• Revise § 620.3 to mandate all System associations that meet the following thresholds or conditions obtain an Attestation Report from their external auditors:

○ The association's total assets were one percent or more of total System assets as of December 31 of the previous fiscal year; or

○ The association's direct note payable to its bank was 15 percent or more of the bank's direct loans to associations as of December 31 of the previous fiscal year; or

○ FCA staff determines that a material weakness exists in the association's ICFR, or other developments have occurred or are expected to occur that could adversely impact, or result in significant changes to, the association's ICFR that impacts the safety and soundness of the association.

• Revise § 630.5(d)(2), to correspond with the proposed language in § 620.3(d)(2) and (3) that an Attestation Report be made in accordance with GAAS. Refer to section II for additional information.

FCA believes requiring associations to obtain an Attestation Report when their assets equal or exceed one percent of total System assets is appropriate because this threshold captures the associations that pose a systemic risk to the System. FCA also believes requiring associations to obtain an Attestation ( print page 94616) Report when their direct note payable to their bank equals or exceeds 15 percent of the bank's direct loans to associations is appropriate because these associations hold a large concentration of their bank's direct loans and may pose a systemic risk to the safety and soundness of their bank without meeting the one percent of total System assets. This requirement ensures associations that hold a large concentration of bank direct loans also obtain an Attestation Report.

An association would generally have three fiscal years to obtain its Attestation Report. Additionally, the proposed rule also details how and when merging associations are to obtain Attestation Reports.

All System banks currently obtain an Integrated Audit, as required by the Funding Corporation. FCA now proposes to formalize this requirement in this regulation.

II. Background

A. Law and Regulation

The Farm Credit Amendments Act of 1985 ^[1] revised the Farm Credit Act of 1971, as amended (Act),^[2] to require FCA regulate the disclosure and reporting practices of System institutions and require each System institution to prepare and publish annual financial reports to shareholders. Section 5.19(b) of the Act requires financial statements be prepared in accordance with generally accepted accounting principles (GAAP) and be audited by an independent public accountant.

In December 2006, FCA issued a final rule at 12 CFR 630.5(d) (71 FR 76111) that, in part, requires the Funding Corporation to require its external auditor to express an opinion on the Funding Corporation's effectiveness of ICFR in preparing disclosures to investors in System-wide and consolidated bank debt obligations. When proposed, FCA stated that a System-wide opinion at the Funding Corporation level on ICFR would accomplish many of the same objectives as requiring an opinion on ICFR at the bank and association levels.^[3]

Additionally, 12 CFR 620.3(d) of FCA regulations requires all System institutions with over $1 billion in total assets at the end of the prior fiscal year include in their annual reports a report by management assessing the effectiveness of ICFR. These institutions must also report to their board of directors and disclose in their quarterly and annual reports any material changes in ICFR during the reporting period. Associations with assets of less than $1 billion in total assets do not have reporting requirements.

As discussed below, the complexity and concentration of System banks and associations have changed dramatically, leading to an increased risk that an internal control weakness or failure at one institution could affect the safety and soundness of the entire System, due to the System's cooperative structure. This proposed rule, if adopted, would decrease risks related to the detection and reporting of internal control weakness or failure. FCA believes an Integrated Audit will strengthen the safety and soundness of the System.

B. Definitions Used in the Preamble

Internal Control over Financial Reporting. ICFR is a process consisting of policies and procedures designed to assess financial statement risk and provide reasonable assurance that an institution prepares reliable financial statements.^[4]

Audit of ICFR. An audit of ICFR is an audit of the design and operating effectiveness of an entity's ICFR.^[5]

Integrated Audit. An Integrated Audit is an audit of ICFR that is integrated with an audit of financial statements.^[6] An Integrated Audit also considers financial reporting systems related to ICFR. The auditor provides an opinion, known as an Attestation Report, on both the financial statements and ICFR in the annual financial statements. Attestation Report and Integrated Audit are used interchangeably in this preamble.

C. Risks in the System Structure and Related ICFR Considerations

The cooperative structure of the System creates a unique environment in which an adverse event at one institution could impact the entire System and affect the Funding Corporation's ability to issue System-wide disclosures on a timely, well-controlled basis as required in § 630.3. Moreover, debt securities are the joint and several obligations of the System banks and are not obligations of or guaranteed by the United States government. As such, any material weakness or other development, such as an undetected management error, negligence, fraud event, or failure, that have occurred, or are expected to occur, could adversely impact, or result in significant changes to ICFR at a bank or one or more of the associations that could impact investor confidence and public trust in the entire System.

While the System has implemented standards, created workgroups, and employed other practices mentioned below, risks arise from inconsistencies in the design and implementation of ICFR at different institutions. Only the Funding Corporation, System banks, and one association (as a condition of merger) ^[7] obtain Integrated Audits, which exacerbates this risk of inconsistency.

D. Risks Have Increased With Farm Credit System Growth and Consolidation

When FCA issued 12 CFR 630.5(d) in December 2006, there were five System banks and 95 associations with $162.9 billion in total System assets ^[8] with associations holding $100.7 billion.^[9] Since then, as of December 31, 2023, there are four System Banks (20 percent decrease) and 56 associations (41 percent decrease). System assets totaled $507.8 billion (212 percent increase) and association assets totaled $308.4 billion (206 percent increase).

The average and median total asset size for associations has also increased markedly. As of December 31, 2006, associations averaged $1.1 billion in total assets and the median total asset size was $462 million. As of December 31, 2023, associations averaged $5.5 billion in total assets (420 percent increase), and the median total asset size was $1.8 billion (285 percent increase).

When comparing associations as of December 31, 2006, to associations as of December 31, 2023, asset sizes and concentrations for the associations that held either one percent of total System assets or 15 percent of their bank's direct loans have also increased.

As of December 31, 2006, 14 associations held one percent or more of total System assets, with these associations holding a combined $57.6 billion in total assets. As of December 31, 2023, 12 associations held one percent or more of total System assets, with these associations holding a ( print page 94617) combined $236.1 billion in total assets (310 percent increase). As of December 31, 2006, the 14 associations cited above held 35 percent of total System assets. As of December 31, 2023, the 12 associations cited above held 46 percent of total System assets (31 percent increase).

System bank direct loans to associations have also become more concentrated. As of December 31, 2006, eight associations held 15 percent or more of their bank's direct loans to associations (eight percent of associations). As of December 31, 2023, seven associations held 15 percent or more of their bank's direct note. While the number of associations holding 15 percent or more of their bank's direct note decreased, the percentage of associations holding 15 percent or more of their bank's direct loans increased (13 percent of associations). As of December 31, 2006, those eight associations held approximately 42 percent of all System bank direct notes to associations. As of December 31, 2023, the seven associations held approximately 60 percent of all System bank direct notes to associations (42 percent increase).

As associations become more complex, and the System has fewer overall associations, an ICFR weakness at one association can become significant to the association's bank and the entire System. As associations become more complex, the effectiveness of ICFR becomes more important to the association, as well as to its bank and the System, more broadly.

Additionally, the Farm Credit System Insurance Corporation (FCSIC), views concentration risk as an increasing concern. The association concentration mentioned above has significantly increased direct loan concentration for System banks, which in turn has impacted FCSIC's risks of insuring System banks. Concentrated associations pose significant inherent risks to their banks and FCSIC's Insurance Fund. FCA consulted with FCSIC on the proposed rule and FCSIC stated that it believes that an Integrated Audit requirement would provide further assurances on the integrity of financial and accounting information at the affected associations, as well as help mitigate large losses to the Insurance Fund that could result from undetected management errors, negligence, a fraud event, or failure.

E. FCA Regulations Should Require Certain System Associations To Obtain an Attestation Report To Reduce Systemic Risk

FCA regulatory requirements for ICFR audits are limited. As required by § 630.5(d)(2), the Funding Corporation must obtain an Integrated Audit of the combined System-wide financial statements. However, there is no equivalent regulation at the association or Bank level.

FCA believes requiring associations to obtain an Attestation Report when their assets equal or exceed one percent of total System assets is appropriate because this threshold captures the associations that pose a systemic risk to the System. FCA also believes requiring associations to obtain an Attestation Report when their direct note payable to their bank equals or exceeds 15 percent of the bank's direct loans to associations is appropriate because these associations hold a large concentration of their bank's direct loans and may pose a systemic risk to the safety and soundness of their bank without meeting the one percent of total System assets. This requirement ensures associations that hold a large concentration of bank direct loans also obtain an Attestation Report.

F. Attestation Report Opinion for Individual Associations

FCA acknowledges that System associations have an ICFR review performed by their System bank. System banks may impose monetary penalties, i.e., increased funding costs due to increased risks, if associations do not maintain adequate ICFR. Additionally, the external auditor of all significant associations (one percent or more of total System assets) performs additional ICFR reviews yearly and at all other associations on a three-year rotation.

The System has also implemented practices related to ICFR. In order to express an opinion on ICFR at the Funding Corporation, all associations must establish a system of internal controls. System associations must make quarterly assertions related to ICFR to the Funding Corporation. The System has also established an ICFR workgroup. This workgroup provides tools and training to System institutions on how to establish and maintain their ICFR environment.

However, these additional ICFR reviews and practices are designed to support the ICFR opinion at the Funding Corporation and System Bank level and not the individual association level. FCA believes that the scope of such work is not adequate for an external auditor to express an opinion on the effectiveness of the individual association's ICFR. Thus, FCA believes a regulation requiring an Attestation Report will provide an independent review of an association's ICFR environment and reduce the probability and magnitude of an internal control weakness or failure. Additionally, an Attestation Report would examine different controls and in different detail than current requirements for management assessments.

G. Benefits of Integrated Audits and Reduction of System Risks Justify Cost

Integrated Audits are more robust than financial statement audits. The objective of a financial statement audit is to determine if the financial statements are presented fairly, in all material respects. As part of a financial statement audit, auditors obtain an understanding of a System Institution's ICFR. Although a financial statement audit assesses factors that affect the risks of material misstatement on ICFR, the scope of work and level of testing is less than an Integrated Audit. An Integrated Audit is structured to achieve the same objectives as a financial statement audit and additionally tests the design and operating effectiveness of all ICFR controls that can have a material effect on the financial statements and provides an opinion on the controls.

The Securities and Exchange Commission (SEC), has considered various studies when promulgating audit requirements for regulated entities that show Integrated Audits offer two benefits compared to financial statement audits:

• Integrated Audits have been found to provide information to investors about the reliability of the financial statements. For example, a 2011 SEC Staff Study ^[10] highlighted evidence that Attestation Reports generally resulted in the identification and disclosure of material weaknesses that were not previously identified or whose severity was misclassified when identified by management in its assessment of ICFR.

• The reliability of the financial statements can be enhanced through the execution of Integrated Audits. Studies considered in SEC Release No. 34-88365,Amendments to the Accelerated and Large Accelerated Filer Definitions, documented a significant correlation between audits of ICFR and the maintenance of better internal controls, thereby improving reliability of financial statements. The SEC also found that a failure to maintain effective ICFR has been associated with a higher rate of future restatements and lower earnings quality and a higher rate of future fraud revelations (among other things). ( print page 94618)

The SEC Release No. 34-88365 noted the following:

• Risks of fraud and financial statement restatements or misstatements were found to be greater for registrants that would not be subject to a requirement to obtain Attestation Reports. From 2003 to 2020, non-accelerated U.S. filers (which did not obtain Attestation Reports) accounted for 62 percent of the total U.S. financial statement restatements.
• Registrants not subject to a requirement to obtain Attestation Reports were found to have higher levels of ineffective ICFR compared with issuers subject to that requirement. Over 40 percent of non-accelerated filers (not required to obtain Auditor Attestations) had ineffective ICFR, compared to less than approximately nine and five percent of accelerated and large accelerated filers, respectively (accelerated filers were subject to Integrated Audit requirements).

While the referenced SEC insights pertain to public companies, FCA believes that this information provides meaningful insights into reporting risks and their reduction at System institutions. Although there are costs in obtaining an Integrated Audit for each institution, there are safety and soundness benefits to the entire System. Consequently, FCA believes requiring certain System institutions to obtain Attestation Reports will reduce financial reporting risks described above that stem from significant changes in the complexity and concentration of System banks and associations justifying the cost to require certain associations obtain Integrated Audits.

H. Integrated Audit Requirements of Similar Federal Financial Regulators

When drafting the proposed rule, FCA reviewed the audit requirements that govern publicly traded financial institutions, institutions regulated by the Federal Deposit Insurance Corporation (FDIC),^[11] and other Federal financial institution regulatory agencies.^[12] In general, other regulators have established requirements that mandate a regulated entity engage an external auditor to conduct an annual audit of its financial statements as well as, under certain circumstances, an Integrated Audit. We reviewed other regulators thresholds and determined the compliance tailored and focused requirements in this proposal are more appropriate for the Farm Credit System than the asset minimums imposed by other regulators.

I. An Integrated Audit Is Necessary at Certain Institutions, Including Certain Associations, To Strengthen the Safety and Soundness of the Entire System

As discussed, the complexity and concentration of System banks and associations have changed dramatically leading to an increased risk that an internal control weakness or failure at one institution could affect the safety and soundness of the entire System, due to the System's cooperative structure. An Integrated Audit will strengthen shareholder and investor confidence in the System's ICFR. By requiring certain associations to obtain an Integrated Audit, FCA's proposed rule would help reduce undetected and evolving financial reporting risks in the System.

J. Transitional Considerations

FCA acknowledges the effort and cost an association would bear to obtain and prepare for its first Integrated Audit. Therefore, FCA believes that the first Integrated Audit for associations should begin in the third full fiscal year after the effective date of this regulation, unless FCA determines it is appropriate to require an association to obtain an Attestation Report sooner because, as considered in § 620.3(d)(3)(i)(C), as proposed, material weaknesses in ICFR are identified or FCA has assessed that other developments have occurred, or are expected to occur, that could adversely impact, or result in significant changes to the association's ICFR that impacts the safety and soundness of the association. FCA believes that three years should provide an adequate period of time to allow affected associations to prepare for their first Integrated Audit.

All System banks currently obtain an Integrated Audit, as required by the Funding Corporation. Therefore, an Integrated Audit would be formally required for System banks upon the effective date of this regulation given that no transition period would be deemed necessary.

III. Proposed Rule

A. Amendments to § 620.3

FCA proposes an amendment to § 620.3 that would require an Integrated Audit:

• By all Farm Credit System banks;
• By associations with one percent or more of total System assets;
• By an association when the direct note payable to its System bank is 15 percent or more of the System bank's direct loans to associations; or
• when FCA's Office of Examination (referred to as FCA staff in the regulatory text) determines that a material weakness in an association's ICFR exists such that an Integrated Audit is warranted. This could be based on material weaknesses in ICFR controls or other developments which occurred, or are expected to occur, that could adversely impact, or result in significant changes to an association's ICFR that impacts the safety and soundness of the association.

An association would generally have three fiscal years to obtain its Attestation Report. Additionally, the proposed rule also details how and when merging associations will obtain Attestation Reports.^[13]

B. Amendment to 12 CFR 630.5(d)(2)

With respect to the Funding Corporation, the proposed rule would amend § 630.5(d)(2) to require that an Attestation Report be made in accordance with GAAS to correspond to proposed language in § 620.3(d)(2) and (3).

IV. Regulatory Flexibility Act

Pursuant to section 605(b) of the Regulatory Flexibility Act (5 U.S.C. 601 et seq.), FCA hereby certifies that the proposed rule will not have a significant economic impact on a substantial number of small entities. Each of the banks in the Farm Credit System, considered together with its affiliated associations, has assets and annual income in excess of the amounts that would qualify them as small entities. Therefore, Farm Credit System institutions are not “small entities” as defined in the Regulatory Flexibility Act.

List of Subjects

12 CFR Part 620

• Accounting
• Agriculture
• Banks, banking
• Reporting and recordkeeping requirements
• Rural areas

12 CFR Part 630

• Accounting
• Agriculture
• Banks, banking
• Organization and functions (Government agencies)
• Reporting and recordkeeping requirements
• Rural areas

For the reasons stated in the preamble, the Farm Credit Administration proposes to amend 12 CFR parts 620 and 630 as follows:

( print page 94619)

PART 620—DISCLOSURES TO SHAREHOLDERS

1. The authority citation for part 620 continues to read as follows:

Authority: Secs. 4.3, 4.3A, 4.19, 5.9, 5.17, 5.19 of the Farm Credit Act (12 U.S.C. 2154, 2154a, 2207, 2243, 2252, 2254); sec. 424, Pub. L. 100-233, 101 Stat. 1568, 1656 (12 U.S.C. 2252 note); sec. 514, Pub. L. 102-552, 106 Stat. 4102, 4134.

2. Amend § 620.3 by revising paragraph (d) to read as follows:

§ 620.3

Accuracy of reports and assessment of internal control over financial reporting.

* * * * *

(d) Assessment of internal control over financial reporting. (1) Annual reports of those institutions with over $1 billion in total assets (as of the end of the prior fiscal year) must include a report by management assessing the effectiveness of the institution's internal control over financial reporting. The assessment must be conducted during the reporting period and be reported to the institution's board of directors. Quarterly and annual reports for those institutions with over $1 billion in total assets (as of the end of the prior fiscal year) must disclose any material change(s) in the internal control over financial reporting occurring during the reporting period.

(2) All System banks must require their external auditor to issue an annual attestation report, which must express an opinion on the effectiveness of internal control over financial reporting. The attestation report must be made in accordance with generally accepted auditing standards, as promulgated by the American Institute for Certified Public Accountants or the Public Company Accounting Oversight Board's auditing standards, if applicable. The resulting attestation report must accompany management's assessment of internal control over financial reporting (as required by paragraph (d)(1) of this section) and be included in the bank's annual report.

(3) Any System association that meets the criteria in paragraphs (d)(3)(i)(A) through (C) of this section must engage its external auditor to issue an annual attestation report, which must express an opinion on the effectiveness of internal control over financial reporting. The attestation report must be made in accordance with generally accepted auditing standards, as promulgated by the American Institute for Certified Public Accountants or the Public Company Accounting Oversight Board's auditing standards, if applicable. The resulting attestation report must accompany management's assessment of internal control over financial reporting (as required by paragraph (d)(1) of this section), if applicable, and be included in the association's annual report.

(i)The requirements of this section apply to associations if:

(A) The association's total assets equaled one percent or more of total System assets as of the prior fiscal year;

(B) The total direct note payable to the association's funding bank was 15 percent or more of the funding bank's total direct loans to associations as of the prior fiscal year; or

(C) FCA staff determines that a material weakness exists in the association's internal control over financial reporting, or other developments have occurred or are expected to occur that could adversely impact, or result in significant changes to the association's internal control over financial reporting that impacts the safety and soundness of the association.

(4) An association shall comply with paragraph (d)(3) of this section at the end of the third full fiscal year after the effective date of this rule, or the date on which the association meets the criteria in paragraphs (d)(3)(i)(A) through (C) of this section, whichever is later, unless FCA staff determines it appropriate to require an earlier compliance date. Associations that merge during the fiscal year shall determine the compliance date as follows:

(i) If, on the effective date of the merger, one or more of the merging associations must comply with paragraph (d) of this section, the merged association shall be required to comply with paragraph (d)(3) of this section.

(ii) If, on the effective date of the merger, paragraph (d)(4)(i) of this section does not apply, and one or more of the merging associations is within the timeframe prescribed in paragraph (d)(4) of this section, the merged association shall be required to comply with paragraph (d)(3) of this section on the earliest compliance date of the merging associations as of the day immediately preceding the effective date of the merger.

(iii) If, on the effective date of the merger, paragraphs (d)(4)(i) through (ii) of this section do not apply, but the merged association meets the criteria in paragraphs (d)(3)(i)(A) through (C) of this section, the merged association shall comply with paragraph (d)(3) of this section at the end of the third full fiscal year after the effective date of the merger.

(5) If an association no longer meets the criteria in paragraph (d)(3)(i)(A) or (B) of this section, an attestation report under paragraph (d)(3) of this section is not required.

(6) An attestation report shall no longer be required under paragraph (d)(3)(i)(C) of this section if FCA staff determines that:

(i) The association has no material weaknesses in internal control over financial reporting; or

(ii) No material event exists or is expected to exist that impacts the reliability of the association's financial disclosures; and

(iii) No other indication of material risk exists in the association's internal control over financial reporting that impacts the safety and soundness of the association.

PART 630—DISCLOSURE TO INVESTORS IN SYSTEMWIDE AND CONSOLIDATED BANK DEBT OBLIGATIONS OF THE FARM CREDIT SYSTEM

3. The authority citation for part 630 continues to read as follows:

Authority: Secs. 4.2, 4.9, 5.9, 5.17, 5.19 of the Farm Credit Act (12 U.S.C. 2153, 2160, 2243, 2252, 2254); sec. 424, Pub. L. 100-233, 101 Stat. 1568, 1656 (12 U.S.C. 2252 note); sec. 514, Pub. L. 102-552, 106 Stat. 4102, 4134.

4. Amend § 630.5 by revising the heading to paragraph (d) and paragraph (d)(2) to read as follows:

* * * * *

(d) Assessment of internal control over financial reporting.

* * * * *

(2) The Funding Corporation must require its external auditor to issue an attestation report, which must express an opinion on the effectiveness of internal control over financial reporting. The attestation report must be made in accordance with generally accepted auditing standards, as promulgated by the American Institute for Certified Public Accountants or the Public Company Accounting Oversight Board's auditing standards, if applicable. The resulting attestation report must accompany management's assessment of internal control over financial reporting (as required by paragraph (d)(1) of this section) and be included in the annual report.

Dated: November 21, 2024.

Ashley Waldron,

Secretary to the Board, Farm Credit Administration.

Footnotes

1.  Public Law 99-205, 99 Stat. 1678, Dec. 23, 1985.

2.  Public Law 92-181, 85 Stat. 583, Dec. 10, 1971.

3.  71 FR 13040, 13043 (March 14, 2006).

4.  AICPA Standard AU-C 940.05, An Audit of Internal Control over Financial Reporting that is Integrated with an Audit of the Financial Statements, section .05.

5.  Id.

6.  Id, section .01.

7.  Two additional associations (as conditions of merger) will obtain Integrated Audits beginning in 2026.

8.  These figures do not include the Federal Agricultural Mortgage Association (Farmer Mac), although it is a System institution for purposes of the Farm Credit Act and FCA oversight.

9.  Aside from total system assets, all information presented in the following paragraphs relating to 2006 and 2023 data come from FCA's Call Reporting System. Total system assets information is sourced from the Farm Credit Funding Corporation's 2006 and 2023 Annual Information Statements.

10.  SEC Study: Study and Recommendations on section 404(b) of the Sarbanes-Oxley Act of 2002 for Issuers With Public Float Between $75 and $250 Million.

11.  12 U.S.C. 363.2 requires FDIC-insured institutions with $1 billion or more in total assets to obtain an Integrated Audit, among other requirements.

12.  12 U.S.C. 704.15(b)(2) requires NCUA corporate credit unions to obtain an Integrated Audit, among other requirements.

13.  No changes are being proposed to the existing § 620.3(d). The existing regulatory language is simply being restyled as proposed § 620.3(d)(1).