2019-03164. Supervisory Committee Audits and Verifications

AGENCY:

National Credit Union Administration (NCUA).

ACTION:

Notice of proposed rulemaking and request for comment.

SUMMARY:

The NCUA Board (Board) proposes to amend its regulations governing the responsibilities of a federally insured credit union (FICU) to obtain an annual supervisory committee audit of the credit union. The proposal implements recommendations outlined in the agency's Regulatory Reform Task Force's Regulatory Reform Agenda (Agenda) and will provide additional flexibility to FICUs.

DATES:

Comments must be received on or before April 26, 2019.

ADDRESSES:

You may submit comments by any of the following methods, but please send comments by one method only:

• Federal eRulemaking Portal: http://www.regulations.gov. Follow the instructions for submitting comments.
• NCUA Website: http://www.ncua.gov/​RegulationsOpinionsLaws/​proposed_​regs/​proposed_​regs.html. Follow the instructions for submitting comments.
• Email: Address to [e-mail]. Include “[Your name]—Comments on Proposed Rule—Supervisory Committee Audits and Verifications” in the email subject line.
• Fax: [phone]. Use the subject line described above for email.
• Mail: Address to Gerard Poliquin, Secretary of the Board, National Credit Union Administration, 1775 Duke Street, Alexandria, Virginia 22314-3428.
• Hand Delivery/Courier: Same as mail address.

FOR FURTHER INFORMATION CONTACT:

Technical information: Alison Clark, Chief Accountant, Office of Examination and Insurance, at the above address or telephone [phone]; or Legal information: Marvin Shaw, Staff Attorney, Office of General Counsel, at the above address or telephone [phone].

SUPPLEMENTARY INFORMATION:

I. Background and Legal Authority

A. NCUA Regulatory Reform Task Force

In August 2017, the Board published and sought comment on the Agenda.^[1] The Agenda identifies those regulations the Board intends to amend or repeal because they are outdated, ineffective, or excessively burdensome.^[2]

The Agenda addresses the NCUA's regulations on Supervisory Committee Audits. As discussed more fully below in the Proposed Amendments section, the Agenda recommends removing from § 715.7 of the NCUA's regulations the reference to the “NCUA's Supervisory Committee Guide” and amending in § 715.9 of the NCUA's regulations the requirement related to the timing for delivery of written reports.

B. Federal Credit Union Act Audit Requirements

Sections 115 and 202(a)(6) of the Federal Credit Union Act (FCU Act) set forth provisions addressing auditing and accounting requirements.^[3] Section 115 of the FCU Act requires an FCU's supervisory committee to make an annual audit and submit a report of that audit to the FCU's Board of Directors and a summary of that report to the FCU's members at the next annual meeting.^[4] Further, the supervisory committee is required to make supplemental reports as they deem necessary.

Section 202(a)(6)(A) of the FCU Act is a general grant of authority to the Board to prescribe audit standards that require an outside, independent audit by a certified public accountant for any fiscal year for which a credit union has not conducted an annual supervisory committee audit, has not received a complete and satisfactory supervisory committee audit, or during which the credit union has experienced persistent or serious record keeping deficiencies.

Section 202(a)(6)(C) of the FCU Act generally requires FICUs having assets of $10 million or more to use accounting principles consistent with GAAP in all reports or statements required to be filed with the Board.^[5] The Board, and state credit union supervisors under applicable state law, may require credit unions having less than $10 million in assets to follow GAAP.^[6]

Section 202(a)(6)(D) of the FCU Act imposes audit requirements for larger FICUs. Specifically, a FICU having assets of $500 million or more is required to obtain an annual independent audit of its financial statements performed in accordance with generally accepted auditing standards (GAAS), hereafter referred to as a “financial statement audit.” That audit must be performed by an independent certified public accountant or public accountant licensed to do so by an appropriate state or jurisdiction.^[7]

Additionally, if an FCU having total assets of less than $500 million but more than $10 million elects to obtain a financial statement audit, the audit must be performed consistent with the accountancy laws of the appropriate state or jurisdiction.^[8]

C. The NCUA's Supervisory Committee Audit Regulations

Sections 715.5 and 715.6 of the NCUA's regulations specify: (1) The minimum type of annual audit a FICU is required to obtain according to its charter type and asset size; (2) the licensing requirements of persons performing certain audits; and (3) the auditing principles that apply to certain audits.^[9] These provisions were last updated in July 1999.^[10]

The July 1999 rulemaking also adopted § 715.7 of the NCUA's regulations outlining the options for a FICU to comply with the annual audit requirement if it has elected not to voluntarily obtain a financial statement audit. The options permitted include a FICU obtaining: (1) A Balance Sheet Audit; (2) a Report on Examination of Internal Controls over Call Reporting; or (3) an Audit per the Supervisory Committee Guide. The first two options are analogous to options adopted in 1999 by the Federal Financial Institutions Examination Council for other federally insured financial institutions. Regarding the third option, the NCUA amended the Supervisory Committee Guide in 1999 to detail the minimum scope and procedures for engaging outside compensated professionals in the audit process and to clearly distinguish a Supervisory Committee Guide audit from a financial statement audit.

II. Proposed Amendments

A. Section 715.7 Supervisory Committee Audit Alternatives to a Financial Statement Audit

The Board proposes to remove the reference to the NCUA's Supervisory Committee Guide in § 715.7(c). Section 715.7 outlines the alternatives a credit union that is not required to obtain a financial statement audit may elect to utilize in lieu of obtaining a financial statement audit to fulfill its supervisory committee responsibilities. One such option is to conduct an audit per the Supervisory Committee Guide, which is published by the NCUA. The Board is proposing to replace this option with the option to conduct the audit so as to meet certain minimum requirements, which would be incorporated into a proposed new Appendix A to Part 715. The minimum procedures outlined in Appendix A reflect common industry practices for testing accounts and controls over financial institution financial statements.

The Board believes that providing a targeted list of minimum procedures to be included in an audit would clarify and simplify the audit process. Under this framework, credit unions and outside parties hired to conduct audits for credit unions would only need to refer to the streamlined Appendix A to determine the minimum audit requirements, rather than needing to refer to the current Supervisory Committee Guide, which, at over 350 pages, is overly specific, burdensome, and outdated.

Under the proposed Appendix A, the supervisory committee, internal auditor, or other qualified person would be required to perform and document the following areas of review:

• Test and confirm material asset and liability accounts, including, at a minimum, loans, cash, investments, shares and borrowings.
• Test material equity, income and expense accounts.
• Review key internal controls, at a minimum, bank reconciliation procedures, cash controls, dormant account controls, wire and ACH transfer controls, loan approval and disbursement procedures, and inside account controls.
• Test the mathematical accuracy of the allowance for loan and lease loss accounts and ensure the methodology is properly applied.
• Test loan delinquency and charge-offs.

In selecting these areas of review for inclusion in Appendix A, NCUA staff has borrowed substantially from the Supervisory Committee Guide, reviewed and adopted procedures established by the American Institute of Certified Public Accountants, and consulted with accounting professionals. This proposed amendment is intended to make it easier for a credit union to understand what it needs to include in its audits, not necessarily to change the areas of review the Board considers important. Nevertheless, the Board requests comment on if there are other areas of review that should be included in Appendix A, including, for example, loans to insiders, pay and benefits to employees and board members, regulatory compliance, compliance with the Bank Secrecy Act, and other topics.

Appendix A further directs the supervisory committee, internal auditor, or other qualified persons to determine if additional procedures are needed to supplement the minimum procedures that are subject to the audit.

The Board requests comments on other areas that might be included in Appendix A, including loans to insiders, pay and benefits to employees and board members, regulatory compliance, compliance with the Bank Secrecy Act, and other topics.

The Board plans to decommission the outdated Supervisory Committee Guide. The NCUA would issue reference material on how to conduct procedures that would meet the minimum requirements of Appendix A. This reference material could be used by Supervisory Committees and the third parties hired to develop agreed upon procedures. Alternatively, Supervisory Committees and hired third parties could elect to incorporate other agreed upon procedures, as long as the testing resulted in the minimum requirements being met.

B. Section 715.9 Assistance From Outside, Compensated Person

The Board proposes to amend § 715.9(c)(6) of the NCUA's regulations. This section, among other things, addresses engagement letters a credit union may use to hire a compensated auditor to perform audit functions. The current regulation requires that an engagement letter specify a target date of delivery of written reports “not to exceed 120 days from the date of calendar or fiscal year-end under audit (period covered).” The proposed amended provision would eliminate the 120-day time frame in favor of language that provides enhanced flexibility free of any deadline articulated in a specific number of days. The new standard would only require a credit union to specify in the engagement letter a target delivery date that enables the credit union to timely meet its annual audit requirements as articulated in § 715.4 of the NCUA's regulations.

This proposed change provides a credit union with the ability to better negotiate the target date for delivery of written reports with the person or firm it contracts with, and still meet the audit requirements. Additionally, this will eliminate the need for a Supervisory Committee to obtain a waiver from the appropriate NCUA Regional Director, if delivery of the written report will exceed the 120-day period.

C. Miscellaneous

The Board also proposes to amend § 715.9(c)(3), § 715.9(d), and § 715.9(e) to remove references to the Supervisory Committee Guide and replace them with references to the minimum requirements of proposed new Appendix A, consistent with the proposed changes to § 715.7(c).

In addition, the proposed rule amends § 715.7 by removing one of the alternatives a Supervisory Committee has in lieu of obtaining a financial statement audit, namely, the option to obtain a report on examination of internal controls over call reporting. The NCUA believes this option has limited value in serving as an audit of the credit union's financial reports of condition as it does not necessarily involve any review of balances reported. As of September 30, 2018, less than 1 percent of FICUs used this option to fulfill the annual audit requirement.

III. Request for Comment

The Board seeks comment on all aspects of this proposal. Further, in addition to removing the alternative of obtaining “a report on examination of internal controls over call reporting,” as proposed above, the Board seeks comment on if it should also remove the “balance sheet audit” alternative. It has been the NCUA's experience that the balance sheet audit alternative is utilized only by a small number of credit unions (approximately 2.5 percent) and provides limited value, as it does not include an audit of a credit union's income statement.

IV. Regulatory Procedures

A. Regulatory Flexibility Act

The Regulatory Flexibility Act requires NCUA to prepare an analysis of any significant economic impact a regulation may have on a substantial number of small entities (those with less than $100 million in assets).^[11] This proposed rule will provide relief to small credit unions by clarifying and simplifying requirements related to supervisory committee audits. Accordingly, NCUA certifies the proposed rule will not have a significant economic impact on a substantial number of small credit unions.

B. Paperwork Reduction Act

The Paperwork Reduction Act of 1995 (PRA) applies to rulemakings in which an agency creates a new paperwork burden or increases an existing burden.^[12] For purposes of the PRA, a paperwork burden may take the form of a reporting or recordkeeping requirement, both referred to as information collections. The information collection requirements under the current rule are covered under OMB #3133-0059. This proposed rule does not contain any additional information collection requirements that require approval by OMB under the Paperwork Reduction Act.^[13]

C. Executive Order 13132

Executive Order 13132 encourages independent regulatory agencies to consider the impact of their actions on state and local interests. NCUA, an independent regulatory agency as defined in 44 U.S.C. 3502(5), voluntarily complies with the executive order to adhere to fundamental federalism principles. The proposed rule does not have substantial direct effects on the states, on the relationship between the national government and the states, or on the distribution of power and responsibilities among the various levels of government. NCUA has, therefore, determined that this proposal does not constitute a policy that has federalism implications for purposes of the executive order.

D. Assessment of Federal Regulations and Policies on Families

NCUA has determined that this proposed rule will not affect family well-being within the meaning of § 654 of the Treasury and General Government Appropriations Act, 1999, Public Law 105-277, 112 Stat. 2681 (1998).

List of Subjects in 12 CFR Part 715

• Credit unions
• Reporting and recordkeeping requirements

By the National Credit Union Administration Board on February 19, 2019.

Gerard Poliquin,

Secretary of the Board.

For the reasons discussed above, the National Credit Union Administration Board proposes to amend 12 CFR part 715 as follows:

PART 715—SUPERVISORY COMMITTEE AUDITS AND VERIFICATIONS

1. The authority citation for part 715 continues to read as follows:

Authority: 12 U.S.C. 1761(b), 1761d, and 1782(a)(6).

2. Revise § 715.7 to read as follows:

§ 715.7

Supervisory Committee audit alternatives to a financial statement audit.

A credit union which is not required to obtain a financial statement audit may fulfill its supervisory committee responsibility by one of the following engagements:

(a) Balance sheet audit. A balance sheet audit, as defined in § 715.2(a), performed by a person who is licensed to do so by the State or jurisdiction in which the credit union is principally located; or

(b) Other Supervisory Committee Audit. An audit performed by the supervisory committee, its internal auditor, or any other qualified person (such as a certified public accountant, public accountant, league auditor, credit union auditor consultant, retired financial institutions examiner, etc.) that satisfies the minimum requirements in Appendix A of this part. Qualified persons who are not State-licensed cannot provide assurance services under this subsection.

3. In § 715.9 revise paragraphs (c)(3), (6), (d), and (e) to read as follows:

§ 715.9

Assistance from outside, compensated person.

* * * * *

(c) * * *

(3) If an Other Supervisory Committee Audit, include an appendix setting forth the procedures to be performed.

* * * * *

(6) Specify a target date of delivery of the written reports, so that such target date will enable the credit union to meet its annual audit requirements;

* * * * *

(d) Complete scope. If the engagement is to perform an Other Supervisory Committee audit intended to fully meet the requirements of § 715.7(c), the engagement letter shall certify that the audit will address at least the minimum requirements in Appendix A of this part.

(e) Exclusions from scope. If the engagement is to perform an Other Supervisory Committee audit which will exclude any of the minimum requirements in Appendix A of this part, the engagement letter shall:

(1) Identify the excluded items;

(2) State that, because of the exclusion(s), the resulting audit will not, by itself, fulfill the scope of a supervisory committee audit; and

(3) Caution that the supervisory committee will remain responsible for fulfilling the scope of a supervisory committee audit with respect to the excluded items.

4. Revise part 715 by adding Appendix A to read as follows:

Appendix A—Supervisory Committee Audit—Minimum Procedures

This Appendix presents minimum procedures which a supervisory committee, its internal auditor, or other qualified person must complete when a credit union chooses the Other Supervisory Committee Audit option for completing its annual audit requirements under § 715.7(c) of this part.

This option may not be adequate for all credit unions as it is designed for smaller, less complex credit unions. The supervisory committee, internal auditor, or other qualified person may also need to perform additional procedures to supplement these minimum procedures if the specific circumstances of a particular credit union so dictate. The supervisory committee must apply its judgment in determining the procedures necessary to meet audit requirements. The supervisory committee remains responsible to ensure that a complete set of test procedures is performed. All test procedures will be done using balances and samples for the applicable review period.

Any time the test or confirmation procedures include making a sample or selection, the supervisory committee's report, its internal auditor's report, or other qualified person's report on minimum procedures should delineate the method of selection and the number of selected items.

For purposes of this Appendix, the following definitions will apply:

• Confirm or confirmation refers to a written verification with a third-party (person or organization) pertaining to an account balance or condition. Examples of confirmation letters are bank/corporate credit union account confirmation, investment account confirmation, borrowing or line of credit confirmation, attorney letter confirmation, and member share/loan account confirmation.
• Materiality refers to a statement, fact or item, which, giving full consideration to the surrounding circumstances as they exist at the time, it is of such a nature that its disclosure, or the method of treating it, would be likely to influence or to make a difference in the judgment and conduct of a reasonable person. Materiality should take into account ending balances as well as the volume of transactions in an account. Typically, balances or transaction volume greater than 5 percent of the credit union's net worth should be considered material for purposes of this Appendix.
• Review refers to the examination of policies and procedures, and a review of a sample portion of activities, rather than all of the activities.
• Test refers to procedures applied to the individual items that compose an account balance or class of transactions. The tests involve confirmation, inspection, or observation procedures to provide evidence about the recorded amount.

The supervisory committee, internal auditor, or other qualified person must perform and document the following minimum procedures:

• Test and confirm material asset and liability accounts including, at a minimum:

○ Loans

○ Cash on deposit

○ Investments

○ Shares

○ Borrowings

• Test material equity, income, and expense accounts
• Review key internal controls including, at a minimum:

○ Bank reconciliation procedures

○ Cash controls

○ Dormant account controls

○ Wire and ACH transfer controls

○ Loan approval and disbursement procedures

○ Inside account controls

○ Other real estate owned

○ Foreclosed and repossessed assets

• Test the mathematical accuracy of the allowance for loan and lease loss account and ensure the methodology is properly applied
• Test loan delinquency and charge-offs

Footnotes

1.  82 FR 39702 (Aug. 22, 2017).

2.  This is consistent with the spirit of President Trump's regulatory reform agenda and Executive Order 13777. Although the NCUA, as an independent agency, is not required to comply with Executive Order 13777, the Board has chosen to comply with it in spirit and has reviewed all of the NCUA's regulations to that end.

3.  12 U.S.C. 1761d; 12 U.S.C. 1782.

4.  12 U.S.C. 1761d.

5.  12 U.S.C. 1782(a)(6)(C). “In lieu of GAAP, the NCUA Board may prescribe an accounting principle . . . that is no less stringent than GAAP.”

6.  Id.

7.  12 U.S.C. 1782(a)(6)(D)(i).

8.  12 U.S.C. 1782(a)(6)(D)(ii).

9.  12 CFR part 715.

10.  64 FR 41035 (July 29, 1999).

11.  5 U.S.C. 603(a).

12.  44 U.S.C. 3507(d); 5 CFR part 1320.

13.  44 U.S.C. 3501.