Federal banking regulators release updated internal audit policy statement, guidance on corporate governance, audits and reporting requirements.

The federal banking agencies recently issued a revised internal audit policy statement to update guidance on the independence of an accountant who provides both external and internal audit services to an institution so that it is consistent with the requirements of the Sarbanes-Oxley Act. This policy impacts public institutions as well as those with assets over $500 million that are subject to the reporting requirements of FDICIA. The policy statement also encourages but does not require nonpublic institutions with assets of less than $500 million, and not subject to FDICIA, to follow the Sarbanes-Oxley Act's internal audit outsourcing prohibition.

However, if such an institution decides to use the same firm for both internal and external audit work, the audit committee should document both that it has pre-approved the internal audit outsourcing to its external auditor and has considered the independence issues associated with this arrangement. The agencies also revised the policy statement's discussion of the responsibilities of the board of directors and senior management with respect to the internal audit function and its placement within an organization, its management and staffing, and the communication of concerns and weaknesses in accounting and internal control.

Expanded guidance has been provided on the use of independent reviews of significant internal controls by small institutions that do not have a formal internal audit manager or staff. The policy statement also includes guidance for examiners on addressing concerns about the adequacy of the internal audit function.

The FDIC has also issued guidance to insured depository institutions about selected provisions of the Sarbanes-Oxley Act related to corporate governance, audits and reporting requirements. That guidance (Financial Institutions Letter 17-2003) is intended to answer questions about the applicability of these portions of Sarbanes-Oxley to insured depository institutions supervised by the FDIC, based on whether they are public companies or subsidiaries of public companies, non-public companies with $500 million or more in total assets (subject to the reporting requirements of FDICIA) or non-public FDIC-supervised banks with less than $500 million in total assets.

Of particular note is an attachment to the FIL that presents a detailed summary of selected provisions of the Sarbanes-Oxley Act that the FDIC believes are of relevance to FDIC-supervised banks with less than $500 million in total assets that are not public companies. These sound corporate governance practices are not mandatory for smaller, non-public institutions; however, the FDIC recommends that each institution consider implementing them to the extent feasible given its size, complexity and risk profile.