The measurement exercise in the preceding graphic is a continuous process. If a covered institution’s total assets fall below the applicable threshold in a subsequent period, the covered institution remains subject to FDICIA requirements until its next measurement period (i.e., next fiscal year-end call report date).
Modifying and expanding upon the previous example, if the covered institution’s total assets had fallen below $1 billion as of March 31, 20X2, and remained under $1 billion as of Dec. 31, 20X2, then it would not be subject to requirements for the 20X3 audit. However, it would still be subject to requirements for 20X2 because the threshold was met as of Dec. 31, 20X1.
This example would also apply when a covered institution is approaching the $5 billion threshold, which would trigger the additional requirements under Part 363.
Create an FDCIA roadmap and detailed project plan
Once the institution determines that it is approaching or has already met the asset thresholds for FDICIA, management should work to create a detailed FDICIA roadmap and project plan. Starting with the end date in mind (e.g., the first annual audit for which the FDICIA reporting package must be submitted or the first period in which an ICFR audit is required), the institution should work backward to determine key milestones.
From this roadmap, it should then create a detailed project plan that incorporates various stakeholders—including management, operational leaders, the audit committee, the board of directors and the internal audit function—to address all elements of compliance.
For the internal audit function, specifically, a one-to-two-year plan to perform additional risk assessment, identify key controls for FDICIA purposes, ensure compliance with the Committee of Sponsoring Organization’s (COSO) 2013 framework (or other acceptable framework), and either develop a testing plan or integrate existing testing with the FDICIA requirements is integral to FDICIA readiness.
The covered institution should consider a one-year or two-year dry run for the internal control evaluation to allow time to confirm and/or update controls, identify and remediate any existing control deficiencies, and properly train personnel. It may be helpful to start with less complex areas such as cash and deposits and then move on to higher risk sections such as the allowance for loan losses.
Ensure auditor independence and review nonaudit services
The independent public accountant must comply with the independence standards of the AICPA, the Securities and Exchange Commission and the PCAOB for all covered institutions, regardless of whether the covered institution is a public company.
SEC and PCAOB standards are generally more restrictive than AICPA standards with respect to permissible nonaudit services. Thus, as your covered institution nears the $1 billion total asset threshold, it is important to inventory the services performed by the independent public accountant and to determine whether those services remain permissible under the SEC and PCAOB independence standards.
Common nonaudit services that are permissible under AICPA standards, but not under SEC and PCAOB standards, include but are not limited to:
- Preparation of financial statements, including rolling forward report templates, preparation of or substantial assistance with the statements and footnotes, and report processing functions such as typing, printing, copying and binding.
- Appraisal or valuation services or fairness opinions.
- Internal audit services, including outsourced loan review.
- Tax services relating to marketing, planning or opining in favor of the tax treatment of a transaction that is a confidential transaction under U.S. Treasury regulations or that is based on an aggressive interpretation of applicable tax laws and regulations. Tax compliance services generally present little or no threat to auditor independence and are permissible.
- Tax services to a person in a financial reporting oversight role or an immediate family member (spouse, spousal equivalent or dependent).
Once a covered institution meets the $1 billion threshold in total assets, any permitted nonaudit services should be discussed with and preapproved by the audit committee prior to commencing such services under SEC independence rules. Refer to Rule 2-01 of Regulation S-X and PCAOB Rules 3524−3526 for further details relating to the audit committee’s role in the approval of permitted nonaudit services.
Gain an understanding of COSO 2013
COSO’s Internal Control – Integrated Framework includes five components of internal control (control environment, risk assessment, control activities, information and communication, and monitoring), 17 internal control principles, and 81 points of focus considered necessary for an effective internal control environment. While other frameworks may be acceptable, COSO 2013 is the most prevalent.
Evaluate and educate the audit committee
As the institution approaches the applicable asset thresholds, it should also consider the existing makeup of its board of directors and, if applicable, its audit committee.
Once an institution reaches $1 billion in total assets, it is required to have an independent audit committee. Because one of the primary responsibilities of the audit committee is to appoint the independent public accountant, the institution should ensure it has an appropriate audit committee in place prior to reaching this threshold and before engaging the independent public accountant for its initial FDICIA audit.
The audit committee should also be educated on the independence rules and knowledgeable about the nonaudit services, if any, performed by the independent public accountant. Any required preapprovals of nonaudit services should be scheduled and completed.
Refer to RSM’s Audit Committee Guide for Financial Institutions for further information on audit committee responsibilities, including its role in evaluating the control environment and in risk assessment, as well as specific FDICIA-related considerations.
Discuss oversight responsibilities with the board of directors
Beyond discussing the basic provisions and requirements of FDICIA, the board of directors should also understand its responsibilities for oversight.
Specifically, Part 363 requires that the board of directors determine whether each existing or potential audit committee member meets the requirements to be an outside director and, as applicable based on the asset threshold of the covered institution, is independent of management. The minutes of the board of directors’ meetings should include the procedures performed, the basis for determinations and the results of these assessments.
The board of directors should also consider the management team’s experience and expertise to determine whether the most appropriate people are in place once the FDICIA requirements apply. Management needs the ability to make the assessments included in its report, including by having a deep understanding of the entity and its control environment and sufficient oversight of the operations of the institution.
Additional members of management may be needed to supplement the knowledge and experience of existing managers, particularly with respect to internal controls and risk assessment.
Assess and/or implement an internal audit function
With the requirement that management establish and maintain an adequate internal control structure, there is generally a need for a formal, sophisticated internal audit function at the institution. Depending on the current state of the internal audit function, it may be necessary to supplement personnel, restructure reporting lines and enhance procedures performed throughout the year.
Generally, the organization should have established processes in place for tasks such as risk assessment, personnel education, evaluation of control design, testing of operating effectiveness, reporting of results and monitoring.
Additionally, these processes should be performed and overseen by competent individuals with requisite experience. Whether the internal audit work is to be performed internally or externally, the responsibility still rests with management for implementing and monitoring a sound control environment at both the entity and transaction levels.
Remember the IT function
To ensure the effectiveness of internal controls as a whole for the covered institution, the IT environment and related controls must be considered. A formal internal audit plan may need to be developed or an existing plan may need to be expanded to meet FDICIA requirements.
For the entire entity and for each in-scope IT application identified, the institution should evaluate logical security, security administration, operations, change management, business continuity and disaster recovery, cybersecurity and vendor management.
Remediate any identified material weaknesses in ICFR
A material weakness is defined as a deficiency, or a combination of deficiencies, in ICFR that results in a reasonable possibility that a material misstatement of the financial statements will not be prevented, or detected and corrected, in a timely manner.
Pursuant to Part 363, management and the independent public accountant are precluded from concluding that ICFR is effective if one or more material weaknesses exist. Thus, the institution should work to correct any known material weaknesses in ICFR and develop safeguards in the control environment to reduce the risk that material weaknesses will arise.
Consider the need for entity-wide training
Often, those responsible for executing many of the controls on a regular basis (commonly referred to as control operators) may not understand the implications of these procedures from a regulatory standpoint. A sound internal control environment requires an appropriate level of awareness and commitment from various levels within the organization.
It may be beneficial to host training sessions for employees throughout the organization on topics such as the COSO framework, FDICIA, the internal and external audit processes, and the importance of employees’ role as control operators in ensuring that controls are properly designed, operating effectively and adequately documented.
How can RSM help?
RSM has assisted numerous banks in sorting through the complexities of FDICIA compliance, including helping institutions as they cross over the $1 billion and $5 billion total asset thresholds.
For banks that are not audit clients: We can provide assistance in initial FDICIA compliance efforts or in optimizing the existing internal control environment and compliance program. We can also provide certain outsourcing, co-sourcing or loaned staff services.
For banks that are audit clients: We can provide limited assistance in the assessment of enterprise risk management activities and in certain regulatory compliance matters.
RSM’s depth of experience and industry specialization are what set us apart. Our professionals bring insights gained as former bank executives, regulators, internal auditors, IT specialists and accounting professionals. This knowledge allows us to anticipate challenges and deliver practical solutions tailored to your institution’s size, structure and growth trajectory.
We combine technical knowledge with a collaborative approach. Our team works closely with management and audit committees to strengthen governance, improve internal controls and prepare the institution for regulatory examinations. By leveraging proven methodologies and technology-enabled tools, we help institutions achieve compliance efficiently while enhancing operational resilience.
