Risk-Focused Bank Examinations: Regulators of Large Banking Organizations
Face Challenges (Chapter Report, 01/24/2000, GAO/GGD-00-48).
Pursuant to a congressional request, GAO provided information on the
risk-focused approaches used by the Federal Reserve and Office of the
Comptroller of the Currency (OCC), focusing on: (1) the general
characteristics of the regulators' risk-focused approach to examinations
of large, complex banks, explaining how they differ from past
examination practices; (2) comparing the implementation of the Federal
Reserve's and OCC's risk-focused examination approaches; and (3) the
challenges faced by both agencies as they continue to implement their
examination programs for large, complex banks.
GAO noted that: (1) the Federal Reserve and OCC's risk-focused
approaches to supervising large, complex banking organizations are
evolving with changes intended to strengthen oversight of these
entities; (2) their effectiveness will depend on the expertise and
independence of examiners, and the regulators' ability to maintain an
awareness of industrywide risk in an institution-specific examination
program; (3) transaction review and testing under the risk-focused
approach is intended to validate the use and effectiveness of internal
control and other risk-management systems; (4) examination activities
now focus on risk assessments along business lines, which often cross
bank charters, and the processes used to manage and control the
attendant risks; (5) under a risk-focused approach, activities judged to
pose the highest risk to an institution receive the most scrutiny by
examiners; (6) this approach relies on examiner judgment and results in
certain bank operations receiving less scrutiny than others; (7)
examiners monitor and assess a bank's financial condition and
risk-management systems through the review of a variety of management
reports and meetings with key bank officials, documenting the areas they
select for review and including their rationale for selecting those
areas; (8) examiners conduct examinations to assess a bank's internal
control and risk-management systems; (9) the Federal Reserve and the OCC
differ in how they implement their risk-focused examinations programs
for large, complex banks; (10) OCC's large bank supervision program is
centrally managed from its headquarters and has achieved a degree of
uniformity in its use of examiners who are located at the bank
throughout the year and conduct ongoing monitoring and examinations, and
report to one of three deputy comptrollers located in Washington D.C.;
(11) the Federal Reserve's program is implemented through a less
centralized system of Reserve Banks and has less uniformity in its
ongoing monitoring and examinations, with sometimes differing staffing
arrangements in place for each bank; and (12) regulators face a number
of challenges in implementing examination programs for large, complex
banks, including: (a) identifying the aspects of bank operations where
examiner's attention should be concentrated; (b) maintaining an
awareness of industrywide risk in an institution-specific examination
program; (c) ensuring risk assessments are not overly influenced by the
bank's risk-management systems on which they must rely; and (d)
maintaining sufficient staffing numbers and expertise.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: GGD-00-48
TITLE: Risk-Focused Bank Examinations: Regulators of Large
Banking Organizations Face Challenges
DATE: 01/24/2000
SUBJECT: Regulatory agencies
Banking regulation
Internal controls
Risk management
Bank examination
Lending institutions
IDENTIFIER: Federal Reserve Network
Long Term Capital Management Fund
Federal Reserve Banking Organization National Desktop
OCC Supervisory Monitoring System
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO report. Delineations within the text indicating chapter **
** titles, headings, and bullets are preserved. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
** A printed copy of this report may be obtained from the GAO **
** Document Distribution Center. For further details, please **
** send an e-mail message to: **
** **
** **
** **
** with the message 'info' in the body. **
******************************************************************
United States General Accounting Office
GAO
Report to Congressional Requesters
January 2000
GAO/GGD-00-48
RISK-FOCUSED BANK EXAMINATIONS
Regulators of Large Banking Organizations Face
Challenges
Ordering Information
The first copy of each GAO report and testimony
is free. Additional copies are $2 each. Orders
should be sent to the following address,
accompanied by a check or money order made out
to the Superintendent of Documents, when
necessary. VISA and MasterCard credit cards are
accepted, also. Orders for 100 or more copies to
be mailed to a single address are discounted 25
percent.
Order by mail:
U.S. General Accounting Office
P.O. Box 37050
Washington, DC 20013
or visit:
Room 1100
700 4th St. NW (corner of 4th and G Sts. NW)
U.S. General Accounting Office
Washington, DC
Orders may also be placed by calling (202) 512-
6000 or by using fax number (202) 512-6061, or
TDD (202) 512-2537.
Each day, GAO issues a list of newly available
reports and testimony. To receive facsimile
copies of the daily list or any list from the
past 30 days, please call (202) 512-6000 using a
touch-tone phone. A recorded menu will provide
information on how to obtain these lists.
For information on how to access GAO reports on
the INTERNET, send e-mail message with "info" in
the body to:
[email protected]
or visit GAO's World Wide Web Home Page at:
http://www.gao.gov
United States
General Accounting Office
Washington, D.C. 20548-0001
Official Business
Penalty for Private Use $300
Address Correction Requested
Bulk Rate
Postage & Fees Paid
GAO
Permit No. G100
(233599)
Contents
Page 101GAO/GGD-00-48 Risk-Focused Bank Examinations
Executive Summary 2
Chapter 1 12
Introduction
Background 12
The Banking Industry Is Changing Its 14
Product Focus and Rapidly
Consolidating
Guidance for Examination Programs for 15
Large, Complex Banks and for Small
Banks Differ
The Federal Reserve and OCC Risk- 16
Focused Examinations Share Common
Characteristics
Objectives, Scope, and Methodology 21
Chapter 2 24
Current Risk-Focused
Approach Represents an
Evolution From Earlier
Examination Practices
Risk-Focused Approach Differs in 26
Perspective Provided by Examinations
Risk-Focused Approach Differs From 28
Past Approaches in Organizational
Scope of Examinations
Other Differences Between Risk-Focused 30
and Earlier Approach to Examinations
Chapter 3 33
The Federal Reserve and
OCC Approaches Are
Generally Consistent but
There Are Differences in
Strategy
The Federal Reserve's Decentralized 33
Management Differs From OCC's
Centralized Structure
The Federal Reserve and OCC Use a 37
Different Method to Maintain
Continuous Oversight
The Federal Reserve is Moving to 39
Ongoing Examinations, Rather Than
Point-In-Time Examinations
Chapter 4 40
Examination of Large
Banking Organizations
Poses Challenges for
Federal Reserve and OCC
A Risk-Focused Approach Cannot Assess 40
All Bank Risks
Using Bank-Generated Information and 41
Analysis to Make Risk Assessments
Creates Heavy Reliance on Bank's Risk-
Management Systems
Examinations May Not Identify and 42
Assess Industrywide Risks
Decentralized Organizational 44
Structures of Large Banks Can Impede
Supervision
Examination Activities May Be Halted 46
in the Event of Bank Mergers and
Business Plan Changes
Federal Reserve and OCC Are Challenged 47
to Maintain Supervisory Expertise and
Examiner Resources
Appendixes Appendix I: Comments From the Federal 50
Reserve Board
Appendix II: Comments From the Office 54
of the Comptroller of the Currency
Appendix III: GAO Contacts and Staff 56
Acknowledgments
Tables Table 1.1: Federal Reserve 18
Definitions of Risks
Table 1.2: OCC Definitions of Risks 19
Table 2.1: A Comparison of the Risk- 25
Focused Approach to Examination of
Large, Complex Banks and a Former,
Point-In-Time Approach to Bank
Examinations
Abbreviations
CPC Central Point of Contact
EIC examiner-in-charge
FBO foreign banking organization
FDIC Federal Deposit Insurance Corporation
FDICIA Federal Deposit Insurance Corporation
Improvement Act
LTCM Long-Term Capital Management
OCC Office of the Comptroller of the
Currency
OTS Office of Thrift Supervision
SEC Securities and Exchange Commission
SMS Supervisory Monitoring System
Page 1 GAO/GGD-00-48 Risk-Focused Bank Examinations
B-282682
January 24, 2000
The Honorable Marge Roukema
Chairwoman
The Honorable Bruce F. Vento
Ranking Minority Member
Subcommittee on Financial Institutions
and Consumer Credit
Committee on Banking and Financial Services
House of Representatives
This report responds to your request that we review the risk-
focused examination approaches to large complex banking
organizations done by the Federal Reserve and Office of the
Comptroller of the Currency. It describes differences
between the regulators' risk-focused approaches to large,
complex banking organizations and past approaches; compares
the Federal Reserve's and OCC's programs for examining large
complex banks; and discusses challenges the regulators face
as they continue to implement their programs.
We are sending copies of this report to Representatives Jim
Leach, Chairman, and John J. LaFalce, Ranking Minority Member,
House Committee on Banking and Financial Services; Senators
Phil Gramm, Chairman, and Paul S. Sarbanes, Ranking Minority
Member, Senate Committee on Banking and Urban Affairs; the
Chairman of the Federal Reserve Board; the Comptroller of the
Currency; the Chairman of the Federal Deposit Insurance
Corporation; and other interested parties. We also will make
copies available to others on request.
Key contributors to this report are listed in appendix III.
If you have any questions, please call me at (202) 512-8678.
Thomas J. McCool,
Director, Financial Institutions
and Markets Issues
Executive Summary
Page 8GAO/GGD-00-48 Risk-Focused Bank Examinations
Purpose
Examinations by federal banking regulators
are intended to assess the safety and soundness of
banks and identify conditions that may require
prompt corrective action to remedy unsafe and
unsound banking practices. In recent years,
banking regulators have changed their examination
techniques by placing emphasis on an institution's
internal control systems and on the way it manages
and controls its risks, rather than determining
whether a bank was operating in a safe and sound
manner at a specific point in time. This evolution
to a risk-focused approach is in response to rapid
changes in the banking industry and the speed in
which an institution's risk profile can change.
This approach is particularly important since, in
recent years, major consolidations have resulted
in a number of large, complex banking
organizations with diverse risks and sophisticated
risk-management systems. This trend can be
expected to continue in light of the recent
passage of the Gramm-Leach-Bliley Act of 1999 that
allows banks, securities firms, and insurance
companies to acquire one another.
The Federal Reserve1 and the Office of the
Comptroller of the Currency (OCC), regulators of
the largest banks in the United States at the
federal level, have developed examination programs
specifically for these institutions, in addition
to risk-based programs for smaller banks.
The Chairwoman and Ranking Minority Member,
Subcommittee on Financial Institutions and
Consumer Credit, House Committee on Banking and
Financial Services, asked that GAO study the risk-
focused approaches used by the Federal Reserve and
OCC. The objectives of this report are to (1)
describe the general characteristics of the
regulators' risk-focused approach to examinations
of large, complex banks, explaining how they
differ from past examination practices; (2)
compare the implementation of the Federal
Reserve's and OCC's risk-focused examination
approaches; and (3) identify the challenges faced
by both agencies as they continue to implement
their examination programs for large, complex
banks. GAO addressed these objectives, in part, by
analyzing examination reports and supporting
documents prepared by the examiners at seven
selected banks (four of these were OCC
examinations, three were Federal Reserve).
Results in Brief
The Federal Reserve and OCC's risk-focused
approaches to supervising large, complex banking
organizations are evolving with changes in the
industry and are intended to strengthen oversight
of these entities. The effectiveness of these
approaches will depend, at least in part, on the
expertise and independence of examiners and the
regulators' ability to maintain an awareness of
industrywide risk in an institution-specific
examination program.
The Federal Reserve and OCC have developed
and refined risk-focused examination policies and
procedures for large, complex banks. In the past,
examinations involved detailed review of
individual transactions and accounts to evaluate
the quality of the assets in the bank's portfolio
and thus to validate its balance sheet.
Examinations also largely focused on one entity or
bank charter at a time, as opposed to focusing on
lines of business, such as retail banking, that
cross organizational boundaries within the banking
organization. In contrast, transaction review and
testing under the risk-focused approach is
intended to validate the use and effectiveness of
internal control and other risk-management
systems, rather than to validate a bank's balance
sheet. Examination activities now focus on risk
assessments along business lines, which often
cross bank charters, and the processes used to
manage and control the attendant risks.
Under a risk-focused approach, those
activities judged to pose the highest risk to an
institution are to receive the most scrutiny by
examiners. Such an approach necessarily relies on
examiner judgment in identifying sources of
greatest risk to a bank and results in certain
bank operations receiving less scrutiny than
others. Some bank operations may not receive any
scrutiny during an examination beyond reviewing
internal audit or other management reports. Under
the risk-focused approach, examiners are to
continually monitor and assess a bank's financial
condition and risk-management systems through the
review of a variety of management reports and
frequent meetings with key bank officials,
documenting the areas they select for review,
including their rationale for selecting those
areas. Examiners are to conduct examinations to
assess a bank's internal control and risk-
management systems.
Although the principles of their respective
approaches are similar, the Federal Reserve and
OCC differ in how they implement their risk-
focused examination programs for large, complex
banks. OCC's large bank supervision program, which
was formally established in 1995, is centrally
managed from its headquarters. It has achieved a
degree of uniformity in its use of examiners who
are located at the bank throughout the year and
who conduct ongoing monitoring and examinations
and report to one of three deputy comptrollers
located in Washington D.C. In contrast, the
Federal Reserve's large bank supervision program,
which was formally established in 1997, is
implemented through a less centralized system of
Reserve Banks and has developed less uniformity in
its ongoing monitoring and examinations, with
sometimes differing staffing arrangements in place
for each bank. This is consistent with the Federal
Reserve Board's delegation of supervision and
regulation authority to the district Reserve
Banks. Federal Reserve Board staff noted that they
are at an earlier stage of implementing their
large bank program than OCC, and they anticipate
more uniformity in the Reserve Banks' approaches
as implementation of the program continues.
Regulators face a number of challenges as they
continue to implement their examination programs
for large, complex banks. One key challenge,
inherent in the design of the risk-based program,
is how to identify the aspects of bank operations
where examiner's attention should be concentrated.
A second challenge is maintaining an awareness of
industrywide risk in an institution-specific
examination program. Another is ensuring that
examiners' risk assessments are not overly
influenced by the bank's risk-management systems
on which they must rely. Finally, both the Federal
Reserve and OCC recognize that maintaining
sufficient staffing numbers and expertise to
examine increasingly large, complex banks
continues to be a major challenge.
Background
Recent consolidation in the banking industry
has resulted in a growing number of large, complex
banking organizations that engage in a wide
variety of activities. Such institutions typically
have significant on- and off-balance-sheet risk
exposures, offer a broad range of products and
services at the domestic and international levels,
are subject to multiple supervisors in the United
States and abroad, and participate extensively in
large-value payment and settlement systems.
Generally, these organizations comprise multiple
legal entities.
Banking resources are now concentrated in
these large banking organizations. According to
the Federal Deposit Insurance Corporation, at year-
end 1998, the 25 largest banking organizations
held approximately 54 percent of industry assets
compared to about 22 percent at year-end 1990. As
of September 30, 1999, the Federal Reserve's and
OCC's large bank programs each included
approximately 30 institutions.
Federal Reserve and OCC procedures for
overseeing large, complex banks have evolved over
time to their current risk-focused approaches. As
implemented by the Federal Reserve and OCC, risk-
focused supervision has the following objectives:
� to determine the condition of the bank and
the risks associated with current and planned
activities, including risks originating in
relevant subsidiaries and affiliates;
� to be more flexible and responsive to
changing conditions at the bank in planning
examinations, rather than reacting to prior
events;
� to use examiner and bank resources more
efficiently.
Although these institutions often comprise a
holding company and several different banking
charters, the term "bank" is used to refer to
them. GAO focused its work on the examination of
the lead bank. However, as explained later in this
report, when examining the lead bank of such an
organization, examiners generally consider the
impact of the operations of other holding company
subsidiaries, or other subsidiaries and
affiliates, on the safety and soundness of the
lead bank.
Principal Findings
Risk-Focused Approach Differs From Past Approach
With the development of new types of financial
products and technology that allow banks to
complete transactions and change their risk
profiles very rapidly, risk-focused examinations
are intended to be more forward looking, focusing
on banks' management practices and controls to
manage current and future risks. Prior to the
adoption of a risk-focused approach, examinations
were more retrospective. Examiners assessed a
bank's overall safety and soundness by testing
transactions that were based on past decisions and
past management practices. Risk-focused
examinations are based on the belief that a large,
complex bank's risk profile changes too rapidly to
expend extensive resources testing transactions
that may offer little insight to the bank's
current condition.
Large banks have increasingly begun managing their
key activities and risk-management systems along
business lines on a centralized basis, with
minimal regard to the presence of the different
legal charters that make up the overall
organization. In response, the regulators' risk
assessments and examination activities have been
structured in a similar way. In the past,
examinations largely focused on the individual
charters that constitute a banking organization
because that is how those institutions generally
managed their risks. Other ways in which the
Federal Reserve's and OCC's current examination
approaches differ from past procedures include the
areas of planning, resource allocation, ongoing
monitoring, and communication of examination
results.
The current risk-focused approach emphasizes a
supervisory plan that is to be tailored to the
institution's risk profile and organizational
structure, documenting examination activities and
rationales for selecting areas to be examined.
Instead of conducting checklist type examinations,
examiners have greater discretion in identifying
areas that require their attention and allocating
their time accordingly. They may employ the
assistance of specialists with skills tailored to
the activities of the institution. In addition,
the risk-focused approach emphasizes ongoing
analysis of bank data and communication with key
bank personnel rather than contact on an
examination cycle basis only. Finally, examiners
communicate examination findings and conclusions
to bank management in several ways, in addition to
the traditional annual examination report.
Federal Reserve and OCC Differ in Implementing
Risk-Focused Approaches
Although the approaches taken by the Federal
Reserve and OCC are similar in many respects, they
differ in the way the agencies manage their
programs, maintain ongoing oversight, and carry
out examination activities. OCC's large bank
supervision program, which was formally
established in 1995, is centrally managed from its
headquarters. It has achieved a degree of
uniformity in its use of examiners who are located
at the bank throughout the year and who conduct
ongoing monitoring and examinations and report to
one of three deputy comptrollers located in
Washington D.C. In contrast, the Federal Reserve's
large bank supervision program, which was formally
established in 1997, is implemented through a less
centralized system of Reserve Banks and has
developed less uniformity in its ongoing
monitoring and examinations, with sometimes
differing staffing arrangements in place for each
bank. This is consistent with the Federal Reserve
Board's delegation of supervision and regulation
authority to the district Reserve Banks.
The Federal Reserve and OCC also differ in
their use of resident examiners. OCC assigns a
staff of full-time examiners, who work on site, to
each of the largest national banks. Each of the
four OCC examinations GAO reviewed was done in
this way. The Federal Reserve has established a
program in which a senior supervisor serves as the
Central Point of Contact (CPC) for supervising the
bank and is assisted by a team of technical
experts. Depending on the Reserve Bank, some or
all of the examiners may also have responsibility
for other banks.
OCC examined each of the four national banks
whose examinations GAO reviewed by conducting
examinations of specific business activities
throughout the supervision cycle. Each of the
three Federal Reserve examinations GAO reviewed
was done using a point-in-time approach,
supplemented with ongoing monitoring. Federal
Reserve officials said that some Reserve Banks
have now started to examine large banks throughout
the supervision cycle like OCC.
Regulators Face Challenges in Oversight of Large,
Complex Banks
Regulators face a number of challenges in
supervising and examining large, complex banks.
Since a risk-focused approach requires that
examiners make judgments that may result in some
bank operations receiving minimal scrutiny, the
possibility exists that some risks may not be
appropriately identified. Because risk-focused
examinations are institution-specific, regulators
face challenges in ensuring that their assessments
of risk are sufficiently independent of the bank's
risk-management systems and are mindful of
industrywide risk trends. Both the Federal Reserve
and OCC have made efforts to provide an improved
framework for discerning industry trends, and the
tools being developed to assist examiners in
pooling and sharing examination findings could
allow regulators to establish the extent of
problems industrywide.
The continued consolidation of the banking
industry presents another challenge. After a bank
merger or acquisition, examiners may interrupt or
postpone planned examination activities to shift
examination resources to monitor the consolidation
or reorganization of the resulting bank rather
than to risk examining activities that may soon be
discontinued or reorganized. In these situations,
regulators are challenged to find a balance
between supervising existing bank activities and
monitoring the development of new bank business.
Because examiners generally tailor their
supervisory strategies to mirror the bank's
business lines and risk management structure, the
risk-focused approach may be most effective when
banks centralize their operating and management
structures. Regulatory officials said that when
banks have managed themselves in a decentralized
manner, more examiners have been needed to examine
the bank, complicating their examination efforts.
Finally, the Federal Reserve and OCC will likely
continue to be challenged by the need to ensure
that their examiners possess sufficient expertise
to assess the risk of increasingly complex
organizations. Banking activities have become
increasingly complex and the employment market for
banking knowledge and skills is becoming more
competitive. Federal Reserve and OCC officials
said that maintaining the knowledge and skills
necessary for examining large banks continues to
be one of the major challenges facing their
agencies.
Recommendations
GAO is not making recommendations in this
report.
Agency Comments
The Federal Reserve and OCC provided written
comments on a draft of this report. Their comments
are discussed in chapter 1. Both the Federal
Reserve and OCC commented that this report
presented an accurate description of their risk-
focused programs for supervising large banks. The
Federal Reserve and OCC also both commented that
their programs will continue to develop in
response to changes in the industry. One such
development noted by OCC is the recent passage of
the Gramm-Leach-Bliley Act, which will probably
lead to larger, more complex institutions,
presenting ever-greater challenges to the
agencies' examination programs.
_______________________________
1 In this report, GAO uses the term "Federal
Reserve" to refer to both the Board of Governors
of the Federal Reserve System and the 12 Federal
Reserve Banks, unless otherwise noted.
Chapter 1
Introduction
Page 23GAO/GGD-00-48 Risk-Focused Bank Examination
s
Examinations by federal banking regulators are
intended to assess the safety and soundness of
banks and identify conditions that may require
prompt corrective action to remedy unsafe and
unsound banking practices. In recent years,
banking regulators have changed their examination
techniques by placing increased emphasis on an
institution's internal control systems and on the
way it manages and controls its risks. This
evolution to a risk-focused approach is in
response to rapid changes in the banking industry
and the speed with which an institution's risk
profile can change. This approach is particularly
important since, in recent years, major
consolidations have resulted in a number of large,
complex banking organizations with diverse risks
and sophisticated risk management systems. This
trend can be expected to continue in light of the
recent enactment of the Gramm-Leach-Bliley Act of
1999 that allows banks, securities firms, and
insurance companies to acquire one another.
The Federal Reserve and Office of the Comptroller
of the Currency (OCC) have developed similar
examination programs specifically for large,
complex banks; but the two agencies differ in
their implementation of the programs.
Because of the growing number of large, complex
banking organizations, the Chairwoman and Ranking
Minority Member, Subcommittee on Financial
Institutions and Consumer Credit, House Committee
on Banking and Financial Services asked that we
study the risk-focused approaches used by the
Federal Reserve and OCC to examine these
institutions. The objectives of this report are to
(1) describe the general characteristics of the
regulators' risk-focused approach to examinations
of large, complex banks, explaining how they
differ from past examination practices; (2)
compare the implementation of the Federal
Reserve's and OCC's risk-focused examination
approaches; and (3) identify the challenges faced
by both agencies as they continue to implement
their examination programs for large, complex
banks.
Background
Section 111 of the Federal Deposit Insurance
Corporation Improvement Act of 1991 (FDICIA)
generally requires that each appropriate federal
banking and thrift agency conduct a full-scope, on-
site examination of federally insured depository
institutions under its jurisdiction at least once
during each 12-month period. The primary
objectives of bank examinations done by the
federal bank regulators are (1) to provide an
objective evaluation of the bank's safety and
soundness, ensuring that it maintains capital
commensurate with its risk, (2) to appraise the
quality and overall effectiveness of management
systems, and (3) to identify and follow up in
those areas where corrective action is required to
strengthen the bank's performance and compliance
with laws and regulations. The bank examination
assesses six components of a bank's performance -
capital adequacy, asset quality, management,
earnings, liquidity, and sensitivity to market
risk. These components combine to form the CAMELS
rating system, which includes a rating for each
component and an overall composite CAMELS rating.
Each CAMELS element and the composite is rated on
a five-point scale. This rating is to be updated
annually.
Commercial banks in the United States are
supervised by three different federal agencies,
depending on their type of charter.1 The OCC
supervises nationally chartered banks. The Federal
Reserve Board supervises state chartered banks
that are members of the Federal Reserve System.
The Federal Reserve Board has delegated its
examination authority to the 12 Federal Reserve
district banks. The Federal Deposit Insurance
Corporation (FDIC) supervises state banks that are
not members of the Federal Reserve System.
Most banks are owned or controlled by a bank
holding company. Holding companies may consist of
one or more bank subsidiaries, nonbank
subsidiaries, and even other holding companies.
The largest bank subsidiary in a holding company
is typically referred to as the lead bank and
often holds most of the company's assets. The
Federal Reserve is responsible for supervising all
bank holding companies while OCC, FDIC, or the
Federal Reserve may be the supervisor for the lead
bank. Our focus for this report is on the
examination of the lead bank of large, complex
banking organizations. However, as is discussed
further below, when examining large, complex
banks, examiners are to consider the operation of
the organization's other subsidiaries because
their risk can affect the risk profile of the lead
bank. For the purposes of this report, we use the
term "bank" to refer to the lead bank in a large
banking organization. Either the Federal Reserve
or OCC supervises the largest most complex banks
operating in the United States. Therefore, in our
discussion, we discuss those two agencies.
The Banking Industry Is Changing Its Product Focus
and Rapidly Consolidating
Technological advances and financial product
innovation, combined with regulatory and
legislative changes, have expanded the type and
scope of activities undertaken by banks. Since the
1970s, significant changes have been occurring in
the financial services industry due to a number of
market shocks, combined with advances in and
application of financial theory and information
technology. The interaction of these factors has
led to significant expansion of such financial
products as derivatives and asset-backed
securities, improved methods of measuring and
managing risks, increased competition in financial
services, and mergers of financial firms within
and across financial sectors.
The creation and growth in derivatives, large
increases in other trading activities, including
the development of new secondary markets, along
with the creation of asset-backed securities, have
changed the financial landscape. Advances in
information technology and financial theory have
helped reduce various barriers to competition. The
increased speed and lower costs in communicating
and transmitting data over large geographic
distances has reduced such distance as an obstacle
to competition. Moreover, new financial theories
and faster computers helped financial firms handle
large amounts of data at low cost and analyze the
risks and returns created by new financial
products. Swaps, options, and other derivatives,
which have been growing rapidly, are examples of
such technology- and theory-dependent products.
The Regulators also have acted in ways to expand
the activities in which banks may engage. For
example, the Federal Reserve Board has approved
several additional financial products that banks
are permitted to offer, including providing
investment advice, underwriting insurance related
to the extension of credit, tax planning and
preparation, data processing, and operating a
credit bureau or collection agency. The Federal
Reserve Board also approved bond and stock
underwriting powers for Section 20 subsidiaries of
bank holding companies. Effective in March 1997,
the Federal Reserve Board enhanced these powers
when it increased from 10 to 25 percent, the share
of total revenues a bank holding company's Section
20 subsidiary may derive from corporate equity and
debt underwriting. On the basis of these
decisions, banks have increasingly acquired or
created securities broker-dealer affiliates or
subsidiaries. OCC has amended its regulations to
permit subsidiaries of national banks to engage in
activities that OCC determines, on a case-by-case
application basis, to be "part of or incidental to
the business of banking."
Consolidation in the banking industry in recent
years has resulted in a growing number of large,
complex banking organizations. Banking resources
are now concentrated in fewer and larger banking
organizations. According to FDIC, at year-end
1998, the 25 largest banking organizations held
approximately 54 percent of industry assets
compared with about 22 percent at year-end 1990.
These developments have resulted in a number of
large complex banking organizations with risk
profiles that include traditional banking along
with differing amounts of trading and other
activities. Not only are some of the profiles
different, but they are subject to a rapid change.
Many of these companies have aligned their risk-
management processes along lines of business like
commercial lending. In some cases, the alignment
of risk management along lines of business results
in operations being managed in a unified manner,
where possible, without regard to charter. Such
institutions are also subject to oversight by more
than one regulator. For example, a bank could
include several bank charters, some of which
engage in securities activities. To keep pace with
the changes occurring in the risk profile of such
institutions, examinations must focus on
management's ability to control rapidly changing
risks. Examining such banks requires that the
primary regulators coordinate with other
regulators in assessing the entire risk profile of
the institution.
Guidance for Examination Programs for Large,
Complex Banks and for Small Banks Differ
With the continued consolidation of the banking
industry, both the Federal Reserve and OCC have
developed separate examination programs for
community banks and large, complex banking
organizations. The development of separate
programs is in recognition of differences in the
supervisory requirements for small community banks
and large, complex banks. These differences
include the complexity of financial products,
sophistication of risk-management systems,
management structure, geographic dispersion of
operations, and the importance of coordinating
with other supervisory agencies who have
supervisory responsibility for various parts of
the complex organization. In December 1995, OCC
issued a revised Comptroller's Handbook for large
bank supervision, which became the cornerstone of
its new supervision by risk approach to bank
examination. This handbook was revised in April
1996 and July 1998. In August 1997, the Federal
Reserve issued its handbook entitled "Framework
for Risk-Focused Supervision of Large Complex
Institutions." More recently, the Federal Reserve
issued a supervisory letter entitled, "Risk-
Focused Supervision of Large Complex Banking
Organizations."
Large, complex banks are defined by both the
Federal Reserve and OCC as those that generally
have a functional management structure; a broad
array of products, services, and activities;
operations that span multiple supervisory
jurisdictions; and consolidated assets of $1
billion or more. OCC has further designated the
largest most complex banks, with assets of $25
billion or more, for supervision by one of three
deputy comptrollers in Washington, D.C. The
Federal Reserve has also identified certain large
banks as being the largest and most complex and
therefore subjects these institutions to
heightened scrutiny, assigning a Federal Reserve
Board analyst, in addition to staff from the
Federal Reserve district bank. We selected banks
from these groups for our review.
Each of the agencies' programs includes similar
elements, such as continuous monitoring of the
bank and frequent contact with the bank's top
management. OCC's program covers the largest
national banks operating in the United States.
Because the Federal Reserve has responsibility for
bank holding companies as well as state banks that
are members of the Federal Reserve System, many of
the institutions included in its program include
bank holding companies for the national banks that
fall under OCC's program. The Federal Reserve has
overall supervisory authority for foreign banking
organizations (FBO) operating in the United
States, and the largest of these are included in
the Federal Reserve's large, complex bank list as
well. As of September 30, 1999, the Federal
Reserve's and OCC's large bank programs each
included approximately 30 institutions.
In this report, we use the term "risk-focused
supervision" to describe both the Federal
Reserve's risk-focused supervision program and
OCC's supervision by risk.
The Federal Reserve and OCC Risk-Focused
Examinations Share Common Characteristics
The Federal Reserve and OCC risk-focused
examination programs for large banks have similar
goals and techniques for achieving them. Although
the agencies did not formally coordinate the
development of their programs, they did develop
their programs in the same environment, with
informal communication between the agencies
regarding their programs. Both agencies have
developed specific terminology for the purpose of
shaping their risk analyses and communicating the
results of those analyses to bank management. Both
agencies develop supervisory strategies through
ongoing monitoring of the bank and engage in
ongoing communication with bank management. The
structures of the banks covered by their programs
require that they coordinate their examinations
with other regulators and that both agencies
employ specialists to understand and assess the
increasingly complex operations of large banks.
Although the principles of their respective
approaches are similar, the Federal Reserve and
OCC differ in the way they implement their
programs. Chapter 3 discusses differences between
the two agencies' programs.
The Federal Reserve's risk-focused supervision and
OCC's supervision by risk have several common
goals:
� to determine the condition of the bank and
the risks associated with current and planned
activities, including risks originating in
relevant subsidiaries and affiliates;
� to be more flexible and responsive to
changing conditions at the bank in planning
examinations, rather than reacting to prior
events;
� to use examiner and bank resources more
efficiently.
Risk-focused supervision does not replace the
CAMELS rating system. Examiners use the CAMELS
rating to report their conclusions about a bank's
current condition. Under risk-focused supervision,
examiners focus their attention on areas of
current and emerging risk to judge the bank's
condition, which is summarized and reported using
a CAMELS rating.
The risk assessment is a key phase of the
examination planning process. It is intended to
identify both the strengths and vulnerabilities of
an institution and provide a foundation from which
to determine the procedures to be completed during
the examination. Examination staffs for OCC and
the Federal Reserve said that they do not have
sufficient resources to do an in-depth examination
of every risk at a bank. The risk assessment is
therefore necessary to focus examiner resources on
those risks with the largest potential impact on
the safety and soundness of the bank. Risk
assessments entail
� the identification of the financial
activities in which the banking organization has
engaged;
� the determination of the types and quantities
of risks to which these activities expose the
institution; and
� the consideration of the quality of the
management and control of these risks.
In performing the risk assessment, examiners are
to make and record judgments regarding risk
exposure and the ability of a bank to manage that
exposure, and to determine the anticipated future
direction of risk at the bank for the coming year.
The risk assessment is to form the basis for a
supervisory strategy for the organization. The
evaluation of the risk management process for each
activity or business line also assists in
determining the extent of transaction testing that
should be planned for each area.
Assessing risk at large, complex banks often
requires that examiners consider risks posed by
subsidiaries that are regulated by other
regulatory agencies. Therefore, examiners must
coordinate their examination activities with
examiners from those agencies, including bank and
securities regulators. Because the Federal Reserve
examines state banks, it is necessary for Federal
Reserve examiners to coordinate their activities
with examiners from state banking agencies. Such
coordination and avoidance of unnecessary
duplication are essential to effective supervision
of large, complex banks. Both the Federal Reserve
and OCC encourage their examiners, as appropriate,
to incorporate the findings and conclusions of
other supervisors into their overall assessment of
the consolidated banking organization. The Federal
Reserve and OCC have agreements in place to guide
their coordination with the Securities and
Exchange Commission (SEC), other bank regulators,
and each other.
Risk-Focused Approaches Use Standard Terminology
and Risk Definitions
Under risk-focused supervision, both the Federal
Reserve and OCC have developed sets of risk
definitions for use in communications between
examiners and bank management and to serve as a
basis for examination strategies that are
customized to the risks of each bank. As presented
in table 1.1 and 1.2, the Federal Reserve has six
risk categories and OCC has nine.
Table 1.1: Federal Reserve Definitions of Risks
Risk Definition
Credit Risk Arises from the potential that a borrower or counterparty
will fail to perform on an obligation.
Market Risk The risk to a financial institution's condition resulting
from adverse movements in market rates or prices, such as
interest rates, foreign exchange rates, or equity prices.
Liquidity Risk Arises from the potential that an institution will be
unable to meet its obligations as they come due because of
an inability to liquidate assets or obtain adequate funding
(referred to as "funding liquidity risk") or that it cannot
easily unwind or offset specific exposures without
significantly lowering market prices because of inadequate
market depth or market disruptions ("market liquidity
risk").
Operational Risk Arises from the potential that inadequate information
systems, operational problems, breaches in internal
controls, fraud, or unforeseen catastrophes will result in
unexpected losses.
Legal Risk Arises from the potential that unenforceable contracts,
lawsuits, or adverse judgments can disrupt or otherwise
negatively affect the operations or condition of a banking
organization.
Reputational Arises from the potential that negative publicity regarding
Risk an institution's business practices, whether true or not,
will cause a decline in the customer base, costly
litigation, or revenue reductions.
Source: SR Letter 95-51 (SUP) "Rating the Adequacy
of Risk Management Processes and Internal Controls
at State Member Banks and Bank Holding Companies,"
Division of Banking Supervision and Regulation,
Board of Governors of the Federal Reserve System,
May 24, 1996.
Table 1.2: OCC Definitions of Risks
Risk Definition
Credit Risk The current and prospective risk to
earnings or capital arising from an
obligor's failure to meet the term of
any contract with the bank or
otherwise perform as agreed. Credit
risk is found in all activities where
success depends on counterparty,
issuer, or borrower performance.
Interest Rate Risk The current and prospective risk to
earnings or capital arising from
movements in interest rates. Interest
rate risk arises from differences
between the timing of rate changes
and the timing of cash flows
(repricing risk); from changing rate
relationships among different yield
curves affecting bank activities
(basis risk); from changing rate
relationships across the spectrum of
maturities (yield curve risk); and
from interest-related options
embedded in bank products (options
risk).
Liquidity Risk The current and prospective risk to
earnings or capital arising from a
bank's inability to meet its
obligations when they come due
without incurring unacceptable
losses. Liquidity risk includes the
inability to manage unplanned
decreases or changes in funding
sources. Liquidity risk also arises
from the failure to recognize or
address changes in market conditions
that affect the ability to liquidate
assets quickly and with minimal loss
in value.
Price Risk The risk to earnings or capital
arising from changes in the value of
traded portfolios of financial
instruments. This risk arises from
market-making, dealing, and position-
taking in interest rate, foreign
exchange, equity, and commodities
markets.
Foreign Currency Translation Risk The current and prospective risk to
capital or earnings arising from the
conversion of a bank's financial
statements from one currency into
another. It refers to the variability
in accounting values for a bank's
equity accounts that result from
variations in exchange rates that are
used in translating carrying values
and income streams in foreign
currencies to U.S. dollars. (Market-
making and position-taking in foreign
currencies are to be captured under
price risk.)
Transaction Risk The current and prospective risk to
earnings and capital arising from
fraud, error, and the inability to
deliver products or services,
maintain a competitive position, and
manage information. Risk is inherent
in efforts to gain strategic
advantage, and in the failure to keep
pace with changes in the financial
service marketplace. Transaction risk
is evident in each product and
service offered. Transaction risk
encompasses: product development and
delivery, transaction processing,
systems development, computing
systems, complexity of products and
services, and the internal control
environment.
Compliance Risk The current and prospective risk to
earnings or capital arising from
violations of, or nonconformance
with, laws, rules, regulations,
prescribed practices, internal
policies and procedures, or ethical
standards. Compliance risk also
arises in situations where the laws
or rules governing certain bank
products or activities of bank's
clients may be ambiguous or untested.
This risk exposes the institution to
fines, civil money penalties, payment
of damages, and the voiding of
contracts. Compliance risk can lead
to diminished reputation, reduced
franchise value, limited business
opportunities, reduced expansion
potential, and lack of contract
enforceability.
Strategic Risk The current and prospective impact on
earnings or capital arising from
adverse business decisions, improper
implementation of decisions, or lack
of responsiveness to industry
changes. This risk is a function of
the compatibility of an
organization's strategic goals, the
business strategies developed to
achieve those goals, the resources
deployed against those goals, and the
quality of implementation. The
resources needed to carry out
business strategies are both tangible
and intangible. They include
communication channels, operating
systems, delivery networks, and
managerial capacities and
capabilities. The organization's
internal characteristics must be
evaluated against the impact of
economic, technological, competitive,
regulatory, and other environmental
changes.
Reputation Risk The current and prospective impact on
earnings and capital arising from
negative public opinion. This affects
the institution's ability to
establish new relationships or
services or continue servicing
existing relationships. This risk may
expose the institution to litigation,
financial loss, or a decline in its
customer base. Reputation risk
exposure is present throughout the
organization and includes the
responsibility to exercise an
abundance of caution in dealing with
customers and the community.
Source: Large Bank Supervision, Bank Supervision
and Examination Process, Comptroller's Handbook,
Washington, D.C., July 1998.
Along with their own common risk terminologies,
OCC and the Federal Reserve have issued risk
assessment guidelines intended to assist examiners
to make consistent risk assessments across
geographic lines and products, regardless of the
diversity or complexity of the financial
institution. These guidelines present factors that
examiners should consider to quantify risks as
low, moderate, or high and to assess the
management of those risks as weak, acceptable, or
strong.
The Risk-Focused Approach Relies on Ongoing
Monitoring and Examination of the Bank
Under the risk-focused approach of both the
Federal Reserve and OCC, examiners are to engage
in ongoing monitoring and communication to keep
abreast of the current financial condition and
business strategies of a bank. Ongoing monitoring
includes a formal quarterly update of a bank's
risk assessment. This periodic assessment is
based, in part, on internal management reports,
internal and external audit reports, and publicly
available information. Information for ongoing
monitoring is also collected through frequent
contact with key bank officials.
As described in more detail in chapter 3,
examination activities may be conducted during
targeted examinations done throughout the year.
Prior to the adoption of risk-focused supervision,
examiners conducted out-of-cycle targeted
examinations in addition to annual examinations
when regulators identified specific areas of
immediate supervisory concern. Targeted
examinations are now considered routine and are
used to focus examination activities on a specific
activity or line of business at the bank. For
example, targets can include the examination of a
bank's internal audit function; a review of a
particular lending activity such as energy
lending; or an assessment of the bank's management
of derivatives activities in a specific market. A
targeted examination will generally result in a
letter to bank management describing the results
of the targeted examination. Depending on the
examination findings and bank management's
reaction to them, the results of the targeted
examination may or may not be included in the
annual report of examination for the bank.
Under the risk-focused approach, the Federal
Reserve and OCC continue to produce an annual
report of examination. However, examination
reports for both agencies are generally a summary
of events that occurred over the course of a year.
However, they may not mention supervisory issues
that were raised by examiners to management and
resolved since the last examination report.
Regulators told us that issues that were not
remedied during the year would be included in the
examination report . To raise issues as early as
possible and before they further adversely affect
the bank, examiners employ various communication
vehicles to communicate with bank management and
the bank's board of directors throughout the year.
Objectives, Scope, and Methodology
The Chairwoman and Ranking Minority Member of the
Subcommittee on Financial Institutions and
Consumer Credit, House Banking Committee asked us
to provide information on banking regulators' risk-
focused approaches to large domestic bank
examinations. Our objectives were to (1) describe
the general characteristics of the regulators'
risk-focused approach to examinations of large,
complex banks, explaining how they differ from
past examination practices; (2) compare the
implementation of the Federal Reserve's and OCC's
risk-focused examination approaches; and (3)
identify the challenges faced by both agencies as
they continue to implement their examination
programs for large, complex banks.
Large, complex banks are defined by both the
Federal Reserve and OCC as those that generally
have a functional management structure; a broad
array of products, services, and activities;
operations that span multiple supervisory
jurisdictions; and consolidated assets of $1
billion or more. OCC has further designated the
largest most complex banks, with assets of $20
billion or more, for supervision by one of three
deputy comptrollers in Washington, D.C. The
Federal Reserve has also identified certain large
banks as being the largest and most complex and
therefore subjects these institutions to
heightened scrutiny, assigning a Federal Reserve
Board analyst in addition to staff from the
Federal Reserve district bank. We selected banks
from these groups for our review. The largest
banks chartered in the United States are either
national banks or state member banks of the
Federal Reserve whose primary federal regulators
are either OCC or the Federal Reserve,
respectively. Accordingly, this report does not
address the efforts of the Federal Deposit
Insurance Corporation (FDIC) and the Office of
Thrift Supervision (OTS) to shift to risk-focused
safety and soundness examinations.
To gather information on the structure and
rationale for implementing a risk-focused approach
as well as the key differences between past and
present examination approaches, we conducted
interviews with supervisory officials from the
Federal Reserve and OCC. We also reviewed various
documents from the agencies, including bank
examination handbooks, guidance to examiners and
banking industry officials on risk-focused
examinations, and supervisory officials'
testimonies and speeches related to this subject
matter.
To further enable us to describe the risk-focused
approach, we reviewed each agency's implementation
of their approach at seven large, complex banks.
We selected three large, complex banks supervised
by the Federal Reserve and four by OCC. Our
selection was based on the criteria that the banks
be included on the agencies' list of large,
complex institutions; that the institutions
selected would spread across several Federal
Reserve and OCC districts; and that the
institutions were primarily engaged in commercial
banking activities. The results of this work are
not projectible to the rest of the large, complex
banks examined by the Federal Reserve and OCC.
In preparation for our interviews with the
examination staff, we reviewed the supervisory
strategies and risk-assessment documents prepared
for those seven banks. Using a structured
interview guide, we interviewed examination staff
assigned to these banks on their overall planning
and scoping of examination activities. In
addition, using a data collection instrument, we
reviewed examination work papers for two bank
activities that were examined at each of the seven
banks. We attempted to select similar areas in
each of the bank examinations; but because of the
diversity in the scope of the examinations, we
were not always able to do this. We were, however,
able to identify and review a credit and internal
audit related examination activity for most of the
banks.
To identify the challenges faced by both agencies
as they continue to implement their examination
programs for large, complex banks, we spoke to
Federal Reserve and OCC officials and examination
staff as well as staff from OCC's Quality
Assurance Division. In addition, we reviewed
various studies that analyzed bank examinations in
the 1980s and early 1990s. This report also draws
upon work that we have done this year on the near
failure of the Long-Term Capital Management hedge
fund.2
We did our work in accordance with generally
accepted government auditing standards, between
May 1999 and November 1999 in Washington, D.C.,
and other cities where Federal Reserve and OCC
examination staff for the large, complex banks
included in our review were located.
We obtained written comments on a draft of this
report from the Federal Reserve and OCC. Their
comments are reprinted in appendixes I and II.
Both the Federal Reserve and OCC commented that
this report presented an accurate description of
their risk-focused programs for supervising large
banks. In addition, both the Federal Reserve and
OCC expanded on a number of points made in the
draft pertaining to their large bank examination
programs and provided clarifying and technical
comments that were incorporated where appropriate.
The Federal Reserve and OCC also both commented
that their programs will continue to develop in
response to changes in the industry, such as the
recent passage of the Gramm-Leach-Bliley Act.
_______________________________
1 Banking institutions have a choice of three
chartering authorities: (1) state banking
authorities, which charter state banks and thrifts
and license state branches and agencies of foreign
banks; (2) OTS, which charters national thrifts;
and (3) OCC, which charters national banks and
licenses federal branches and agencies of foreign
banks. The Federal Reserve and FDIC have no
chartering authority, However, according to FDIC,
all deposit-taking institutions are required to
apply to FDIC for federal deposit insurance before
they are chartered.
2 Long-Term Capital Management: Regulators Need to
Focus Greater Attention on Systemic Risk (GAO/GGD-
00-3, Oct. 29, 1999).
Chapter 2
Current Risk-Focused Approach Represents an
Evolution From Earlier Examination Practices
Page 32GAO/GGD-00-48 Risk-Focused Bank Examination
s
As implemented by the Federal Reserve and OCC, the
risk-focused examination procedures for large,
complex banks differ from earlier procedures in
several important ways, as outlined in table 2.1.
First, the risk-focused procedures provide a
perspective for supervisory assessments of banks'
safety and soundness that differs from the
perspective of earlier examination procedures. In
the past, examinations were aimed at determining a
bank's safety and soundness at a specific point in
time, along with the bank's compliance with
banking laws. Although examiners were to review a
bank's risk-management, the earlier procedures
emphasized transaction testing to verify the
existence and value of bank assets and provide an
assurance that the bank operated at a specific
point in time, in a safe and sound manner. Risk-
focused examinations are based on the belief that
a large, complex bank's risk profile changes too
rapidly to expend extensive resources testing
transactions that may offer little insight to the
bank's current condition. Therefore, risk-focused
examination procedures are designed to be more
forward looking; they emphasize proactively
assessing a bank's actions to manage risks.
Examiners are to focus on individual bank's risk-
management practices and controls, using
transaction testing to validate the findings from
these process reviews. Under the risk-based
approach, transaction testing may be less
extensive and may require fewer resources from
supervisory agencies and banks, compared with
resource requirements of the earlier approach.
A second key difference between the two approaches
is the organizational scope of the examination.
Under previous approaches, examinations focused on
bank operations defined by their charters or legal
entities. However, as more large banking
organizations have begun managing their key
activities along business lines and centralized
risk-management systems that cross legal entities,
the Federal Reserve and OCC have focused their
examination activities in the same way.
Consequently, the risk-focused approach generally
incorporates risk assessments and examination
procedures that are organized by lines of
business.
Finally, other differences between risk-focused
examinations and the earlier approach are
differences in the planning of examinations,
allocation of examiner resources, ongoing
monitoring of bank operations, and communication
of examination findings.
Table 2.1: A Comparison of the Risk-Focused
Approach to Examination of Large, Complex Banks
and a Former, Point-In-Time Approach to Bank
Examinations
Risk-Focused Approach Former, Point In Time
Approach
General goal of To assess the safety and To assess the safety
supervisory program soundness of banks and and soundness of banks
identify conditions that and identify conditions
may require prompt that may require prompt
corrective action to corrective action to
remedy unsafe and unsound remedy unsafe and
banking practices. unsound banking
practices.
Perspective of Forward looking. Retrospective.
examination procedures Transaction testing is to Transaction testing was
be employed to validate employed to determine
the findings of reviews of the existence and value
processes to manage of bank assets and
current and future risk. provide an assurance
that the bank operated
in a safe and sound
manner at a specific
point in time.
Organizational scope Examination activities are Examinations were to be
to focus on the banking largely focused on
organization's key charters or legal
activities and risk- entities reflecting
management systems along risk-management
business lines and on a practices.
centralized basis.
Examination planning Examiners are to identify Examinations were to be
an individual bank's key planned, but the plans
risk areas and tailor were often not
examination activities to institutionally unique.
the bank's unique risk Rather, they were often
profile. based on checklists
from examination
manuals.
Allocation of examiner Examiner resources are to Examinations were
resources be allocated to provide a planned and staffed by
stable team of examiners examiners who often
with appropriate expertise were not required to
and institutional possess specific
knowledge at each large, knowledge of the
complex banking banking organization.
organization.
Monitoring of bank Monitoring and assessment Monitoring based
operations are to be done on an largely on quarterly
ongoing basis, including Call Reportsa and
reviews of management examinations conducted
reports and frequent on an annual basis.
meetings with key bank
officials. Targeted
examinations are to be
done as needed throughout
the year to assess
internal control and risk-
management systems.
Communication of examiner Examiners are to Communication outside
findings communicate frequently of the examination
with bank management on a cycle or in a form
formal and informal basis, other than the annual
in meetings, through examination report was
letters, and the annual often considered
examination report. pejorative.
aCall Reports are to be prepared by bank
management and submitted to the primary regulator
on a quarterly basis. The reports consist of a
balance sheet, income statement, and various
supporting detailed analyses of balances and
related activities.
Source: GAO analysis using data from the Federal
Reserve and OCC.
Risk-Focused Approach Differs in Perspective
Provided by Examinations
One way in which the current risk-focused approach
differs from the previous approach is that it is
more forward looking. While past examination
procedures included reviews of risk-management
processes, they primarily tested a bank's records
of its transactions to validate the bank's
valuation of its assets and thus judge whether the
bank is being safely and soundly managed. In
contrast, the risk-focused approach is designed to
stress reviews of ongoing management practices,
internal controls, and internal audit activities.
Transaction testing remains important but is
intended to validate examiners' judgment on the
reliability of an institution's controls.
Risk-Focused Examination Moves Away From
Transaction Testing to Assessment of Risk-
Management Processes
Past examination procedures provided a
historic picture of a bank and were largely a
retrospective look at how risks were managed.
According to Federal Reserve officials, in the
past 10 years, bank examinations placed
significant reliance on transaction testing
procedures to determine a bank's condition at a
point in time. Transaction testing is defined to
include examination of underlying support for
transactions and the reconciliation of internal
accounting records to financial reports (to
evaluate the accuracy of account balances), the
comparison of day-to-day practices to the
requirements of policies and procedures (to assess
compliance with internal systems), and all other
supervisory testing procedures, such as the review
of the quality of individual loans and
investments. For example, examiners determined the
risk posed by a loan portfolio through a
transaction-by-transaction review of a sample of
loans. To evaluate the credit administration
process, the quality of loans, and the allowance
for loan and lease losses (ALLL), examiners
reviewed a high percentage of the loan files for
commercial and industrial (C&I) loans and for
commercial real estate loans.
In contrast, Federal Reserve and OCC
officials said that the risk-focused approach is
an attempt to look forward and to provide a
proactive assessment of a bank's actions to manage
risks. Rather than focusing on the results of
practices based on past decisions, examiners are
to communicate with bank management to understand
and strengthen their risk-management strategies.
Examinations now place a greater emphasis on
evaluating the appropriateness of risk-management
processes and have moved away from a high degree
of transaction testing.
Our review of two examination segments from
each of the seven examinations found that the
examiners evaluated the soundness of management
policies and practices and used transaction
testing to validate these process reviews. In one
examination that assessed a bank's credit asset
review function, the examiners traveled to offices
of the banking organization that conducted
significant numbers of credit reviews to determine
review procedures. The examiners discussed the
procedures with key managers and working level
staff and reviewed randomly selected credit files
to validate their discussions. This process review
determined that asset appraisals were not being
obtained in a timely manner and resulted in a
clarification of the bank's policies on obtaining
appraisals.
Our review of work papers from the 14 bank
examination segments indicated that, in the
instances where transaction testing was performed,
examiners tested transactions to support their
assessments of risk-management rather than to
verify the bank's valuation of its assets. As an
example, the workpapers for a bank's credit
administration examination indicated that the
examiners reviewed a sample covering 59 percent of
the bank's commercial loan portfolio. However,
using their discretion, the examiners did not
specifically target commercial real estate loans
from this sample. The workpapers noted several
reasons for that decision:
� The prior year's examination, which covered a
70 percent statistical sample of real estate
credits over $25 million, as well as a 20 percent
statistical sample of those credits below this
amount, did not note major discrepancies between
the examiner's and the bank's internal credit risk
ratings.
� The bank had historically maintained very
conservative classification guidelines and
management was quick to downgrade credits
internally when warranted.
� The bank's internal audit review of the
overall quality of the loan portfolio, which
included 61 percent of real estate loans, did not
find any systemic or trend weaknesses evident in
the bank's total loan portfolio.
Instead of relying as extensively on transaction
testing, risk-focused examinations may use the
results of the banks' internal audit and loan
review functions, provided that examiners find
those results reliable. Both Federal Reserve and
OCC officials said that risk-focused examination
plans often involve some test of the internal
audit or loan review function in a bank to
determine whether these functions yield useful
self-assessments. We found this to be true in the
supervisory plans we reviewed. The Federal Reserve
and OCC sought to "leverage" the work of these
functions by using the results of the banks'
findings if the examiners found them to be
reliable. Of the 14 examination segments we
selected, 7 included a review of one of these
functions.
Risk-Focused Approach Differs From Past Approaches
in Organizational Scope of Examinations
Another way in which the approach has changed is
the departure from the traditional alignment of
examinations with legal entities. As chapter 1
notes, large, complex banking organizations
generally contain several banks, sometimes with
different bank charters and management teams, as
well as other businesses providing financial
services, such as leasing or residential
mortgages. Most large, complex banking
organizations have centralized their operations
and shifted to a centralized functional management
approach for business lines that cross legal
banking charters. In response to such changes,
examination strategies have shifted as well.
Rather than examining each entity in a banking
organization separately, examiners are
centralizing examination activities to assess the
risks generated by each line of business. Federal
Reserve inspections of bank holding companies have
often involved institutions with different bank
charters. The risk-focused approach to bank
examinations is designed to recognize that risks
at the lead bank may be mitigated or increased by
the entire banking organization as a whole.
In the past, examinations were largely undertaken
on the basis of legal entities. If entities within
a banking organization were chartered by different
agencies, regulators from those respective
agencies generally supervised them. While
regulators still must be cognizant of legal
entities, Federal Reserve and OCC are also
interested in how banking organizations are
actually managed. Many large, complex banks manage
their key bank activities on a business line basis
(for example, lending, treasury, or retail
banking) that crosses the legal structure of the
organization, including different banking charters
and entities conducting nontraditional banking
activities. Accordingly, the bank may not maintain
certain information or manage risk according to
which subsidiary, branch, or department "books" a
transaction. Risk management and bank information
is commonly organized by type of activity, for
example whether it is a trading or credit
function, and the risk posed by the activity.
A key implication of this shift in management
structure is that much of the information and
insight gathered on examinations of individual
legal entities can only be fully understood in the
context of examination findings of other related
legal entities or centralized functions.
Consequently, under the risk-focused approach,
examiners are to focus on how business lines and
activities that cut across legal entities are
managed and controlled and how they affect the
overall risk profile of the organization.
Examination staff said that given the structure of
their assigned financial institutions, their
examinations have focused on business lines and
the management practices that support the business
lines across the various corporate entities. As an
example, one examination we reviewed was an
evaluation of the quality of credit risk-
management as it related to the bank's trading
credit. This bank had a centralized trading credit
review function that supported its foreign
exchange and derivatives trading activities.
Instead of evaluating the quality of credit risk-
management during each examination of foreign
exchange and derivative products, the examiners
conducted their evaluation of trading credit
review by examining the centralized function as a
separate examination activity.
In another examination, the examiners grouped the
bank's operations into related business lines and
organized their examinations along these lines:
� retail banking, which encompassed retail
deposit gathering and retail secured and unsecured
consumer lending products;
� commercial lending, which encompassed
commercial and industrial loans;
� mortgage banking, which encompassed
residential first mortgages and the bank's
servicing and investment portfolios; and
� fiduciary activities, which encompassed
personal trust accounts, employee benefit
accounts, and corporate trust and agency
activities.
To ensure that all of the risks inherent in a
particular line of business are properly
addressed, examiners may need to cross legal
boundaries within organizations to trace
information flows and control mechanisms. This may
involve banking operations that are organized as
subsidiaries of national banks (under OCC
supervision) or those organized as subsidiaries of
the bank holding company (under Federal Reserve
supervision). In some cases, this can mean that
OCC is interested in the risk-management practices
of the bank holding company. OCC officials said
that they are interested in business activities
that can materially affect the safety and
soundness of the national bank for which they are
responsible, but not other entities or activities
that do not affect the condition of the national
bank.
For example, one of the national banks in our
sample had a large portion of its assets located
overseas. Based on the legal organization of the
national bank and its bank holding company, most
of that bank's international operations were
conducted in the national bank or its subsidiaries
and thus fell under OCC's supervision. However,
some important operations were conducted in other
subsidiaries of the bank holding company and thus
fell under Federal Reserve supervision. According
to the examination staff, however, the lead bank
managed the risk of these operations centrally.
Our review of OCC's supervisory strategies for
this bank noted that, in assessing credit risk
associated with international operations, OCC
examiners included all international operations
(including those outside the bank) in their risk
assessments and examination activities as well.
In another example, the supervisory strategy for
one of the three Federal Reserve member banks
whose examination we reviewed said that the bank
had over half of its credit exposure in consumer
credit. The majority of the consumer credit
portfolios were located in the bank's holding
company's national bank subsidiaries, which were
supervised by OCC. The strategy said that to fully
assess that bank's credit risk, Federal Reserve
examiners had to coordinate with OCC examiners to
jointly examine certain operations of that bank.
Further, in cases where the bank holding company
contained banks with OCC charters, the Federal
Reserve and OCC coordinated reviews of the banks'
operations, sometimes doing them jointly. These
reviews included audit and control systems as well
as the bank's efforts to address potential Year
2000 computer problems.
Other Differences Between Risk-Focused and Earlier
Approach to Examinations
Other differences between OCC's and the
Federal Reserve's risk-focused approach to
examinations of large, complex banks and earlier
procedures include differences in the planning of
examinations, allocation of examiner resources,
ongoing monitoring of bank operations, and
communication of the results of the examination to
a bank's management and board of directors.
Examination Planning
Compared with past examination practices, present-
day risk-focused supervision adopts a more formal
examination planning process. In the planning
process, examiners are to identify an individual
bank's key risk areas and tailor examination
activities to the bank's unique risk profile. This
results in certain bank operations receiving less
scrutiny than others. Such an approach necessarily
relies on examiner judgement in identifying
sources of greatest risk to a bank. Previously,
examinations were planned, but plans were seldom
institutionally unique.
We reviewed the supervisory plans for all the
banking organizations that we selected for our
analysis. Although we did not independently verify
any of the information upon which decisions were
based, we found that examiners considered the
size, activities, and organizational structure of
the institution in developing the plan. Generally,
the plans we reviewed described the areas
examiners would review throughout the course of
the year, established priorities for examinations,
and considered resource needs and coordination
with other supervisors.
Some of the banks whose examinations we reviewed
were undergoing major mergers. In these cases, we
observed that the risk assessments and supervisory
strategies in the plans were modified to reflect
changes in resources and examination requirements.
At one bank, examination staff said that the plan
and examination scope was altered when bank
management informed them of a decision to
eliminate a business function. In some cases where
merger-related reorganizations were under way, we
noted in our review that some planned activities
were delayed until the reorganization was
completed.
Allocation of Examination Resources
The risk-focused approach is intended, in part, to
optimize the use of examiner resources and provide
the most useful and relevant examination results
by concentrating on the riskiest areas.
Traditionally, examinations were planned and
staffed by examiners who often did not possess
specific knowledge of the banking organization.
This required examiners to spend more time at the
onset of the examination learning about the bank's
policies and procedures, and use procedures and
checklists designed to ensure that they covered as
many of the bank activities as possible. In
contrast, the risk-focused approach is designed to
institute a team of examiners at each large,
complex banking organization. While the Federal
Reserve and OCC differ in their implementation
strategy, as explained in chapter 3, both agencies
are making a conscious effort to ensure that the
examiners remain a part of a bank's examination
team long enough to develop expertise and
institutional knowledge. This approach also more
explicitly incorporates examiner judgment to
identify and apply appropriate examination
procedures, compared to prior approaches.
Ongoing Monitoring
A concept common to both the past and present risk-
focused supervision process is ongoing monitoring.
In the past, however, monitoring generally did not
target anticipated risks but tracked past
performance and sometimes acted as a stopgap
measure for postponed on-site examination
activity. Under a risk-focused approach, examiners
are to maintain ongoing monitoring and
communication to keep abreast of the current
financial condition and business strategies of a
bank and use this information to update their
supervisory strategies. They are to do this
through the review of a variety of management
reports and frequent meetings with key bank
officials. Examination staff said that they have
been able to identify anomalies or changes in risk
profiles that warrant further examination. For
example, after examiners identified a large loss
at one bank's trading operations through review of
bank data, they decided to examine that operation
more closely. Similarly, through discussions with
another bank's management, examiners learned of
that bank's plans to acquire an investment entity.
Therefore, the examiners planned to complete an
examination of the risk-management processes for
the new entity.
Communication of Examination Results
Formerly, communication outside of the examination
cycle or in a form other than the annual
examination report was often considered
pejorative. Under the current risk-focused
approach, examination staff are to communicate
with bank management frequently, and both formally
and informally. Examination staff told us that
they communicate with bank management formally
through the quarterly risk assessments and the
annual report of examination. They also issue less
formal letters to a bank's management on issues
that do not require top management or board of
director attention. In addition, some examiners
told us they often have informal meetings with
bank management.
Chapter 3
The Federal Reserve and OCC Approaches Are
Generally Consistent but There Are Differences in
Strategy
Page 39GAO/GGD-00-48 Risk-Focused Bank Examination
s
In the 1990s, the Federal Reserve and OCC
developed and refined risk-focused approaches to
supervise and examine large, complex banks.
According to both agencies, the process has been
and will continue to be one of continuous
evolution to adapt to the growing complexity of
these organizations. The Federal Reserve and OCC
programs are generally similar in their increased
focus on planning, continuous monitoring, risk-
focused examinations, and communication with the
banking organizations' management as described in
chapter 2. There are some differences, however, in
the way they manage their programs, with a
decentralized Federal Reserve System and a more
centralized OCC.
Although both agencies maintain continuous
oversight of a bank's operations and management,
they do so in different ways, with OCC depending
on a continuous on-site presence while the Federal
Reserve continues to do much of its oversight off
site. The Federal Reserve also continues to focus
most of its on-site examination activities on a
single point in time during the year, while OCC
conducts continuous examination activities on a
year-round basis. OCC strives for continuity in
its examinations by maintaining examiner staffs
full time at a single large bank. While the
Federal Reserve strives to maintain a measure of
continuity in its examinations, it does not
maintain a continuous examiner presence at large
banks. Board officials have stated that they are
at an earlier stage of implementing their large
bank program than OCC and some elements of their
risk-based program, including examination staffing
and timing, may change over time to a model more
closely resembling that currently employed by OCC.
The Federal Reserve's Decentralized Management
Differs From OCC's Centralized Structure
Because of the structure of the Federal Reserve
System, the Federal Reserve operates its large
bank program using a decentralized structure that
combines local control exercised by each reserve
bank, with broad oversight from the Board of
Governors. Meanwhile, OCC manages its program
centrally from its headquarters. Centralized
control of the program by three deputy
comptrollers and reviews by a Quality Assurance
Division are key features of the program designed
to ensure consistency across examinations of large
banks.
The Federal Reserve Has a Decentralized Management
Structure
Federal supervision of state-chartered banks that
are members of the Federal Reserve System,
including large, complex banks, is designed to be
a coordinated effort among the Federal Reserve
Board of Governors (Board), located in Washington,
D.C., and the 12 Reserve Banks located throughout
the United States. The Reserve Banks, under
delegated authority from the Board of Governors,
conduct the day-to-day supervisory activities of
the Federal Reserve, including safety and
soundness examinations. The Board of Governors
reviews examination reports prepared by the
Reserve Banks and conducts special studies of
issues related to supervision. The Board also
issues guidance on examination policy and
procedure through its Division of Banking
Supervision and Regulation. The Board first issued
formal guidance on risk-focused supervision of
large, complex banking organizations in October
1997.
On June 23, 1999, the Federal Reserve issued
additional guidance to its supervisory staff,
specifically tailored for the largest of these
banking organizations- -those whose "growth and
consolidation have reached a scale and diversity
that would threaten the stability of financial
markets around the world in the event of their
failure." The guidance reemphasized the importance
of assessing an organization's key risk-management
processes and ongoing monitoring on the
organization's risk profile. The guidance also
provided for the designation of a senior
supervisor as the "Central Point of Contact."
While the Reserve Banks do not have a staff of
examiners assigned continuously to specific large
banks, the guidance does call for the assignment
of a defined, stable supervisory team composed of
reserve bank staff who possess skills to
understand and evaluate the business lines and
risk profile of large, complex banks. For example,
teams may comprise examiners who have concentrated
training and experience in the trust function,
information systems, capital markets, and
securities activities. However, reserve bank
officials said they attempt to maintain some
degree of continuity from year to year by
assigning examiners who have participated in a
previous examination at the bank or who have
reviewed a similar activity at another bank.
Under the Federal Reserve program, the Board
provides overall program direction, oversight, and
coordination of reserve bank supervision
activities to foster consistency, quality, and
compliance with Board policies and procedures. The
individual Reserve Banks are responsible for
managing the Central Point of Contact and the
supervisory teams. In addition, the Reserve Banks
are responsible for providing the examiner
resources necessary to carry out the supervisory
strategy planned for an institution. This is
consistent with the Board's delegation of
supervisory authority to the district Reserve
Banks. Because of the autonomy of the Reserve
Banks, there is variation in the way the banks are
structured to manage the large bank program. For
example, the Federal Reserve Bank of New York has
organized its banks into four clusters. Each
cluster has a similar portfolio with a money
center bank, a foreign banking organization, and a
large regional bank as well as several smaller
institutions. Both the money centers and foreign
banking organizations may be included in the
large, complex banking organization program.1
However, the Federal Reserve Bank of Chicago
supervises large, complex banks under its "Global
Supervision" group. This group supervises the
largest financial institutions and branches of
foreign banks in that district. Federal Reserve
officials view this structural variation as a
healthy situation that promotes experimentation
and innovation as well as the sharing of best
practices.
One way in which the Board maintains oversight of
the process is the assignment of Board analysts to
work with the supervisory teams and participate in
the development and execution of supervisory plans
and programs. The analysts may also participate in
examinations and other supervisory reviews. While
some analysts are responsible for a single
organization, others are assigned more than one,
depending on the size and complexity of the
organizations. Federal Reserve officials said that
the analysts meet frequently to exchange
information and share perspectives on supervisory
activities or other relevant topics related to
their assigned institutions.
Supervisory strategies and plans are approved in
the Reserve Banks, but Board staff also has the
opportunity to provide comment and input.
According to Federal Reserve officials, the
assignment of dedicated analysts and possible
Board staff involvement in the planning process
are relatively new aspects of the program. In
addition, as previously discussed, the Board has
defined a framework of processes and products to
facilitate consistency, communication, and
coordination within the system.
According to Federal Reserve officials, it is
unlikely that the Board would move toward more
centralized management of the program. However,
these officials said they recognize a need to
better define and develop supervisory teams in
terms of matching available resources with an
institution's risk profile. Even though
individuals with appropriate skills are not always
available where they are needed within the Reserve
Banks, examination staff at the Federal Reserve
Bank of New York said that they have drawn
resources from other districts in staffing their
examinations. For example, examiners from the
Federal Reserve Bank of Philadelphia who were
specialists in capital market risks participated
in an examination of a New York bank. In another
examination, examiners also from the Philadelphia
district conducted a review of that bank's fund
transfer business located in the Philadelphia
district. Under such circumstances, maintaining
consistent treatment of similar activities across
banks becomes an increasing challenge.
In October 1999, the Federal Reserve established a
senior staff level position for coordinating
supervisory staff resources on behalf of Reserve
Banks for whom maintaining a large bank
examination staff is not efficient because there
are fewer large, complex banking organizations in
their districts. The goal of this new position is
to ensure an efficient allocation and deployment
of expert resources across the Federal Reserve
System. The new senior level officer is to work
with existing Board and Reserve Bank managers to
optimize the use of existing resources and develop
and implement strategies to address any gaps in
skills or expertise. This senior level officer is
to work closely with supervising officials at the
Board and New York Reserve Bank, whose district
contains the largest number of large, complex
banks.
OCC's Program is Centrally Managed
OCC's large bank supervision program, which was
formally established in 1995, previously was
directed out of its district offices but now is
centrally managed by the Bank Supervision
Operations group located in its Washington, D.C.
headquarters. As part of an agencywide
reorganization in January 1997, OCC consolidated
oversight of large bank supervision in its
headquarters and structured its district
operations to focus on community and mid-sized
national banks. According to OCC, the
reorganization reflected the continuing
consolidation of the banking industry and took
into account the basic distinction in supervisory
needs between large banks and mid-sized/community
banks.
All banks in the large bank supervision program
have a resident examiner- in-charge (EIC) and
dedicated team of examiners and specialists. The
EICs report directly to one of three deputy
comptrollers in Bank Supervision Operations that
are each assigned a portfolio of the banks
included in the large bank program. The deputy
comptrollers approve all supervisory plans and
strategies. OCC also established a parallel
structure of four geographic teams to provide
administrative support to the large bank EICs.
Each team has a resource coordinator who is to
work with the EIC to ensure that examination
activities are staffed and to provide examiners
opportunities to enhance their skills and work
experiences.
OCC has also established a quality assurance
program for its large bank supervision program.2
The goal of the program is to help ensure that the
objectives of bank supervision are being achieved.
The program is administered by OCC's Quality
Assurance Division and includes several processes
and initiatives that are designed to assess OCC's
supervision processes before and after the fact.
Among them are (1) EIC self-assessments about the
supervisory processes they employ at their
assigned banks; (2) collaborative sessions with
EIC's assigned to companies with similar product
lines, risks, or business strategies to share
views before supervisory activities are performed;
(3) special focus reviews to assess individual
institutions for which questions have been raised
about whether the supervision is effective; and
(4) surveys to obtain feedback from OCC employees,
bank management, and others about how well OCC
supervision is working.
The Quality Assurance Division conducts
supervisory program reviews and supervisory
process studies. Supervisory program reviews are
intended to determine whether the EIC had
completed the supervisory program designed for the
bank. According to Quality Assurance staff, they
have generally been able to complete supervisory
program reviews for three examinations annually.
Supervisory process studies are horizontal reviews
that assess whether the overall objectives of the
large bank program are being met across a
population of banks. Quality Assurance staff said
that in 1999 they selected the supervision of
internal audit function for the horizontal review.
They studied how examiners supervised the internal
audit function across 22 large and midsize banks,
whether they had adhered to the core assessment,
and whether they had conducted the necessary
amount of transaction testing. We did not review
the results of this study because the report was
not completed at the time of completion of our
review.
The Federal Reserve and OCC Use a Different Method
to Maintain Continuous Oversight
The Federal Reserve and OCC place emphasis on
continuous monitoring of the activities of the
institutions in their programs to develop and
maintain an understanding of the institutions'
operations and risk profiles. Both agencies
accomplish this, in part, through a combination of
ongoing planning and monitoring activities and
maintaining continuity in staff. Reserve banks do
not maintain an on-site presence at the
institutions in their program, while OCC conducts
its oversight activities through the use of on-
site, resident examiners. While Federal Reserve
officials said they are transitioning to a
continuous on-site presence in its large
institutions similar to OCC, they do have concerns
that such a presence could undermine examiner
independence. Board officials said that a
continuous on-site presence may ultimately be
desirable, however, some reserve bank staff
suggested that it would compromise independence.
Reserve bank staff said that they do not maintain
an on-site presence primarily to maintain
independence from the day-to-day activities of the
institutions but also because such a presence
could be intrusive to bank management and
personnel. Although they see the advantages, they
also are concerned about independence and said
there was not a need for resident examiners
because (1) the banks are located near their
offices, and (2) they have ready access to the
information and bank personnel they need to
maintain an ongoing understanding of the banks'
activities and risk profile.
OCC officials also expressed such concerns and
said they take a number of steps to preserve
independence, such as moving staff among banks,
and through the Quality Assurance process.
However, officials of both agencies said that,
whether continuous monitoring is done on site or
off site, it is critical to have staff move
periodically not only to allay concerns about
independence, but also to have frequent injection
of different perspectives.
Reserve banks monitor an institution through off-
site review of information from various sources,
such as publicly available information, internal
management reports, regulatory reports,
information from internal and external auditors,
and information from other supervisors. For two of
the banks in our review, reserve bank staffs had
on-line access to the banks' information systems,
including key audit and management reports and
senior management and board committee minutes.
OCC conducts its supervision and examination
activities through the use of on-site, resident
examiners at each of the banks in its large bank
program. According to OCC officials, having
resident staff improves their access to bank
management and staff and their ability to
understand a bank's risk-management processes and
to redirect work quickly in response to changes in
a bank's risk profile or management. OCC officials
said that examiner independence is a major concern
and they attempt to foster independence in several
ways. One method is through periodic rotation of
EICs and examiners. Also, they said examiners are
routinely assigned to work on examinations of
other banks, which not only helps preserve
independence but also provides them with a better
perspective in doing work at their primary banks
and opportunities to enhance their skills. In
addition, they said the EICs and assigned staff
regularly receive input from headquarters'
management and technical support staff. For
example, the three deputy comptrollers in OCC
headquarters are to review and approve all
supervisory strategies for large, complex banks.
OCC also can assign technical experts, based in
headquarters, to assist in assessing the large
banks' risk models.
The Federal Reserve is Moving to Ongoing
Examinations, Rather Than Point-In-Time
Examinations
Both the Federal Reserve and OCC guidance on
large bank supervision require that examiners
perform work and analyses necessary to satisfy the
requirements of a full scope examination (i.e.,
the nature and scope of their supervisory
activities must be sufficient to support safety
and soundness determinations and the assignment of
supervisory ratings). For the institutions
included in our review, Reserve Banks conducted on-
site, point-in-time examinations supplemented by
off-site monitoring while OCC conducted
examinations and on-site monitoring activities
throughout the supervision cycle. Federal Reserve
officials said they are in transition from the use
of annual, point-in-time examinations to a
continuous, targeted examination approach, similar
to that of OCC's. Some Reserve Banks have begun to
do targeted examinations throughout the
examination cycle, but most are conducting full
scope, point-in-time examinations. Federal Reserve
officials said that one reason for this is that
state supervisors, with whom the Federal Reserve
shares supervisory responsibility for state banks
that are members of the Federal Reserve System,
have not all adopted the risk-based approach with
its use of targeted examinations throughout the
examination cycle. In this respect, the Federal
Reserve wants to avoid a situation where states
are doing full-scope, point-in-time examinations
while Reserve Banks perform examinations
throughout the year. The officials said this would
result in an unreasonable burden on banks.
Both agencies still issue annual reports of
examination to the banks. OCC views the reports as
summaries of events that occurred during the year
and does not detail all examination findings
because examiners communicate those findings and
recommendations, in writing or meetings,
throughout the year with a bank's management and
board of directors. The Federal Reserve views the
report as a major method to communicate and
emphasize matters of supervisory concern to
management and the board of directors. The Reserve
Banks issue less formal letters to a bank's
management on matters that do not require top
management or board of director attention.
_______________________________
1 Federal Reserve regulatory guidance says that
because U.S. supervisory authorities are host
country rather than home-country supervisors for
most of the U.S. operations of foreign banking
organizations the supervisory focus and objectives
are somewhat different for U.S. operations of
foreign banking organizations and are presented
separately in the Federal Reserve's foreign
banking organization supervision program. However,
the desired result of a risk-focused examination
process should be the same.
2 OCC also has a similar program for the community
bank supervision program.
Chapter 4
Examination of Large Banking Organizations Poses
Challenges for Federal Reserve and OCC
Page 42GAO/GGD-00-48 Risk-Focused Bank Examination
s
The Federal Reserve and OCC face a number of
challenges as they continue to implement their
examination programs for large, complex banks.
While some of these challenges existed under
previous examination approaches, others are
affected by, or attributable to, the risk-focused
approach and the presence of an increasing number
of large, complex banks. Recent passage of the
Gramm-Leach-Bliley Act of 1999, which removed many
of the legal barriers between banks, security
firms, and insurance companies will likely
increase the number of large, complex banks and
the complexity of their operations.
One key challenge, inherent in the design of the
risk-based program, is how to identify the aspects
of bank operations where examiner attention should
be concentrated. A second challenge is maintaining
an awareness of industrywide risk in an
institution-specific examination program. Another
is to ensure that examiners' assessments of risk
are sufficiently independent of the bank's risk-
management systems. The Federal Reserve and OCC
have both stated that it is a challenge to apply
their programs to banks with decentralized
operations. The continued consolidation of the
banking industry in the form of bank mergers or
acquisitions presents another challenge because it
can interrupt or postpone planned examination
activities by disrupting the management structure
of the bank and therefore planned examinations of
various parts of that structure. Finally, the
Federal Reserve and OCC will likely continue to be
challenged by the need to ensure that their
examiners possess sufficient expertise to assess
the risk of increasingly complex organizations.
This is particularly important because a risk-
focused approach requires that examiners make
judgments that may result in some bank operations
receiving minimal scrutiny.
A Risk-Focused Approach Cannot Assess All Bank
Risks
Because a risk-focused examination is intended to
focus examiner resources on the greatest risks
facing a bank, its success is dependent on the
examination staff's ability to accurately identify
and measure the risks posed by a bank's
operations. Federal Reserve and OCC examiners
attempt to identify, review, and understand all
sources of information on the risk posed by bank
operations. However, under the best of
circumstances, examiners cannot know all
information relevant to the risk posed by a
particular line of business. For example,
examiners cannot anticipate unexpected future
events that could cause major disruptions in a
particular sector of the economy. They also cannot
know information about counterparties that was not
provided to the bank and is not available from
other sources to which examiners have access.
Although this was true prior to the adoption of
risk-focused examinations, its importance is
enhanced because risk-focused examinations attempt
to focus resources on the areas of bank operations
that pose the greatest risk. Because of this
uncertainty with regard to future events and other
information, examiners may make incorrect initial
assessments of the risks posed by particular lines
of business. This could result in those areas not
receiving the appropriate level of examiner
scrutiny.
Recent events have highlighted the limitations in
examiners' abilities to identify all risks
threatening a bank. As discussed below, examiners
did not fully evaluate the risks posed by Long-
Term Capital Management (LTCM) because they were
not fully aware of the risks posed by the large
hedge fund, and they presumed that the fund's
creditors had employed appropriate risk-management
practices. Recent events have also illustrated the
limitations of bank examinations in uncovering
carefully conceived and executed cases of fraud at
banks. Both OCC and Federal Reserve officials said
that, although they would pursue any indication of
fraud detected during a bank examination, bank
examinations are based on an assumption of honesty
on the part of bank staff, records, and financial
statements and are not designed to uncover fraud.
While these concerns have always existed with bank
examinations, they are highlighted in risk-focused
examinations because of examiners' efforts to
focus primarily on operations that pose the
greatest risks while leaving other operations to
the bank's own internal audit and review
processes.
Using Bank-Generated Information and Analysis to
Make Risk Assessments Creates Heavy Reliance on
Bank's Risk-Management Systems
Examiners are challenged to avoid being overly
influenced by banks' risk-management systems while
relying on those systems and other data furnished
by the bank to make their assessments. Under risk-
focused supervision, examiners assess a bank's
risk-management and internal controls. To do so,
they must rely on the bank's information systems
and risk models in hopes of validating the bank's
risk-management processes.
A key challenge is that assessments based on the
different risk-management systems at different
banks yield sufficiently comparable information to
ensure that banks with similar risk profiles
receive similar treatment. Making independent
assessments of banks' risk models is complicated
by the fact that banks use models that may reflect
their unique risk characteristics, including the
particular risk factors the bank faces. Thus, even
when supervisors attempt to apply objective
criteria or specify the use of common procedures
for developing internal models, banks' models
differ because each firm designs its model to
measure what it sees as its own risk profile.
Because a bank's model is designed for use with a
specific risk profile, another bank's model
applied to the same profile might produce a
different risk estimate. This difference in how
the banks assess their own risk makes it difficult
for the regulators, who rely on the bank
assessments, to treat similar risks in a similar
manner. Moreover, both the consistency and the
accuracy of these models depend on the quality of
the raw data used. Examiners are challenged to
make an objective assessment of processes that are
often unique to the institution.
For example, differences between supervisors' and
banks' estimates of the risks that the banks have
and how this affects the level of capital that the
banks should hold provide an illustration of this.
As we noted in a 1998 report,1 while both
financial services firms, including banks, and
regulators agree that capital serves as a buffer
against unexpected losses, regulators set minimum
capital requirements to serve the public interest
while the firms set capital levels to maximize
their market value. Some firms noted that, with
increasingly sophisticated models, they see a
divergence between their internal estimates of
risk and the capital needed to support certain
activities and the regulatory capital requirements
for those activities. Although they may hold more
total capital than the regulatory minimums, some
of the firms said that the regulatory requirements
for some activities are higher than levels they
believe to be appropriate. Regulators, however,
noted that these models had not been tested over
sufficient time to assess their reliability in
periods of extreme stress-precisely when losses
may be unexpectedly high.
Examinations May Not Identify and Assess
Industrywide Risks
OCC and the Federal Reserve do not formally
aggregate examination findings for the purpose of
identifying industrywide risk issues. OCC and the
Federal Reserve try to ensure that their examiners
are aware of larger issues affecting the banking
industry so those examiners are aware of what type
of problems could arise with banks they are
examining. However, their examinations are
intended to assess the safety and soundness of
individual institutions; and they do not attempt
to assess risk on an industrywide basis.
One area in which some information is shared is
the interagency Shared National Credit program,
which is designed to assess the risk posed by
large syndicated loans. However, the program does
not evaluate other risks, and it is an activity
done primarily to assist examiners in assessing
asset quality at banks that participate in large
syndicated loans rather than to identify
industrywide trends in asset quality.
The agencies have several initiatives to
improve the scope and quality of information that
is provided to examiners to help them understand
banking activities and the risks that banks
undertake. These initiatives, some formal and
others informal, are intended to facilitate
comparative assessments across banks, provide a
framework for identifying industry trends, foster
more consistent supervision of institutions with
similar businesses and risk profiles, and promote
the sharing of best supervisory practices within
the supervisory community. For example, both
agencies have encouraged communication of industry
issues among examiners with similar disciplines.
Sometimes this is done formally, through regularly
scheduled meetings in which examiners can exchange
information on the types of problems that they are
seeing in the banks they examine. In addition,
both OCC and the Federal Reserve staff participate
in annual conferences held within those agencies
that are also used to communicate industrywide
risks.
To identify emerging trends among large
banks, both the Federal Reserve and OCC sometimes
conduct reviews of specific issues across these
large banks to assess the risk associated with a
specific business line, activity, or functional
area. This is done both formally and informally.
Federal Reserve officials said that the Federal
Reserve also evaluates information that it
regularly compiles across banks to identify
emerging trends.
OCC and the Federal Reserve occasionally
issue regulatory guidance to examiners, alerting
them to emerging issues in the financial services
industry. For example, both the Federal Reserve
and OCC issued guidance on lending to highly
leveraged institutions in response to problems
observed in the aftermath of the near collapse of
LTCM. They also issued warnings when it appeared
that underwriting standards were slipping due to
increased competition along with the recent
continued economic prosperity. This guidance
sometimes results from the reviews of issues
across banks described earlier. The Federal
Reserve and OCC both also have research staffs who
work to identify and communicate industry risk
trends to examiners. For example, the Federal
Reserve said it regularly does peer group analyses
on the top 50 banking organizations.
However, efforts by the Federal Reserve and
OCC to communicate industrywide risk trends are
only intended to assist examiners in identifying
risks at institutions. Neither the Federal Reserve
nor OCC have procedures to aggregate the risks
that examiners have identified during
examinations. Such aggregation might have proven
useful in the case of LTCM, where regulators
identified individual credit exposures to the
large hedge fund but did not identify the threat
posed by LTCM, primarily because they looked for
problems involving the largest credit exposures of
the individual banks. LTCM was not among the
largest exposures of any of these banks and the
overall industry exposure to LTCM and the
potential for market disruption was not realized
until after its near collapse.
Both OCC and the Federal Reserve have
attempted to develop management information
systems designed to store, and make readily
available, industrywide risk information. The
Supervisory Monitoring System (SMS) is OCC's
primary internal source of information about the
condition of individual national banks. OCC uses
the system to record the current condition,
strategy, and supervisory concerns for each bank.
Examiners are also to use the system to document
follow-up actions, board meeting discussions,
commitments for corrective action, progress in
correcting identified problems, and subsequent
events. Other bank regulators also have access to
SMS as well. However, OCC large bank examination
staff in both headquarters and in the banks we
visited said that the SMS system does not fit
their needs and that they generally do not use it.
OCC has initiatives under way to develop a system
more suited to large banks, however, these efforts
are in their early stages.
The Federal Reserve is developing the Banking
Organization National Desktop (BOND), to provide
examiners with the information-sharing and ongoing
collaboration it believes is necessary to support
the risk-focused supervision of the largest, most
complex banking organizations. BOND is intended to
expand the capabilities of the National
Examination Database, an automated platform for
sharing supervisory information that has been in
existence for a number of years. When implemented,
BOND is expected to provide immediate, user-
friendly access to a full range of information and
to foster collaboration among Federal Reserve
staff and other bank supervisors. However, BOND's
implementation has been delayed until April 2000.
Decentralized Organizational Structures of Large
Banks Can Impede Supervision
A decentralized management structure can impede
the examination of a large, complex bank. The risk-
focused examination approach for both the Federal
Reserve and OCC is based on the expectation that
large banks generally align their risk-management
processes in a centralized manner along lines of
business rather than legal charters. The agencies'
examination processes strive to assess the risk
profile of a bank using information provided by
the bank's management and management information
systems. Therefore, a bank with centralized bank
management and management information systems
lends itself to a more efficient examination
process. However, when a banking organization has
its information systems and key personnel
disbursed throughout the organization, it is more
difficult for the Federal Reserve and OCC to
identify the risks and to appropriately plan an
examination strategy for that decentralized bank
structure. In such instances, an examination
approach focusing on the risk-management of the
consolidated organization rather than on the
operations of the legal charters that make up an
organization faces inherent limitations.
Many large, complex banking organizations have
centralized their operations, including either
reducing the number of legal banking charters for
their subsidiaries or ignoring those charters in
the management of the consolidated banking
organization. In such structures, the banks
maintain and make available consolidated
information on their risk profile to their
principal decision makers. It is also likely that
there are relatively few key decision makers that
oversee the bank's operations in a few physical
locations. In such circumstances, examiners can
assess the risk posed by various bank operations
by reviewing consolidated management reports and
contacting a small number of bank personnel.
Some large banks, however, have business
strategies that rely on substantially more
decentralized risk-management. Federal Reserve and
OCC examination staff said that taking a risk-
based examination approach is more difficult when
large banks have decentralized risk-management
structures and information systems because they
require more examiner resources. When key risk-
management information is not centrally
maintained, examiners must review information from
a larger variety of sources in order to assess the
entire organization's risk profile. They said when
key decision making processes involve more bank
staff, more examination resources are required to
maintain contact with them. Some banks maintain
geographically dispersed subsidiaries that operate
under numerous bank charters. They said in these
cases, more examiners have been needed to conduct
examination activities because it was necessary to
travel to those locations to gain access to the
appropriate staff and information.
Examiners said that they are challenged by such
management structures but said that it is not
their role to insist on particular management
approaches. They said that while they can and do
comment on any management issue at the bank that
may cause supervisory concern, they do not attempt
to influence banks' business strategies. In
addition, banks should not be expected to
structure their management systems for the
convenience of examiners. In some cases, a
decentralized management structure may represent a
business strategy rather than a management quality
issue.
Examination Activities May Be Halted in the Event
of Bank Mergers and Business Plan Changes
The continued consolidation of the banking
industry, in the form of mergers and acquisitions,
has had the effect of limiting the level of
targeted examination activity at large, complex
banks while those banks continue to take on and
manage risk. As described earlier in this report,
the banking industry has undergone major
consolidation in recent years through mergers and
acquisitions. This trend is expected to continue.
When two banks are merged, or in the event of a
major acquisition, it is necessary for the
management of the resulting institution to
determine how it will manage various lines of
business. This determination can include deciding
the physical location of certain management
activities when the merger involves geographically
dispersed institutions. During periods when those
decisions are being made or implemented, planned
examination activities may be put on hold,
awaiting an opportunity to examine the new bank
structure and management systems.
A major consideration for the management of the
post-merger bank is the information system to be
used in tracking the bank's operations. Both banks
involved in a merger will have separate
information systems in place for tracking their
operations. A merger generally requires that these
systems be combined or that one is chosen over the
other. Examiners we interviewed said that they
must wait for such decisions to be made before
they can adequately plan their examination
activities. In the meantime, they are primarily
faced with monitoring the merger while engaging in
fewer targeted examinations.
The management of merging banks must make several
other decisions regarding the resulting bank,
including the internal audit approach, internal
loan rating systems, risk appetites, and a host of
others. Making these decisions can take time. In a
merger of equals, elements of both merging banks
may be incorporated into the management structure
of the resulting bank. In these situations,
regulators are challenged to find a balance
between supervising existing bank activities and
monitoring the development of new ones.
After a bank merger or acquisition, examiners may
interrupt or postpone planned examination
activities to shift resources to monitor the
consolidation or reorganization of the resulting
bank rather than to examine activities that may
soon be discontinued or reorganized. Examination
staff said that monitoring the consolidation is
necessary to understand the operating structure of
the bank that will result from the merger. They
said that it also makes sense because the agencies
do not want to expend scarce examination resources
gaining familiarity with something that will not
continue.
Finally, some mergers involve banks with
significantly different management philosophies.
For example, as discussed earlier, some banks
manage themselves in a centralized manner, with
all major management decisions originating from a
single office. Other banks prefer a less
centralized structure with important decisions
being made locally out of smaller offices. Because
both the Federal Reserve and OCC attempt to tailor
their examination staffs and approaches to the
management structure and style of the bank, such
differences among merging institutions can
significantly complicate their efforts to adapt
the examination to the bank. This is because,
during the consolidation of the two merging
entities, there may be internal inconsistencies in
how different parts of the bank are managed.
Federal Reserve and OCC Are Challenged to Maintain
Supervisory Expertise and Examiner Resources
As banking activities have become more varied
and complex, bank examinations have required
examiners who possess increasingly varied
technical skills, knowledge, and expertise to make
the judgments necessary in a risk-focused
examination approach. To meet this requirement,
both the Federal Reserve and OCC have sought to
build and maintain the expertise needed for
supervising complex banking organizations and the
activities in which they engage. Federal Reserve
and OCC officials said they currently employ
specialists, such as economists with technical
expertise in the quantitative methods and economic
models underlying bank's risk-management systems
as well as specialists in electronic banking, bank
information systems, capital markets, fiduciary
activities, asset management, mortgage banking,
and capital markets. Both Federal Reserve and OCC
officials said they shift examiners with specific
skills, knowledge, or expertise among large banks
to complete specific segments of the examinations
of those institutions. Further, the agencies have
a number of initiatives to improve the scope and
quality of information that is provided to
examiners to help them understand banking
activities and the risks that banks undertake.
The Federal Reserve Uses Examiner Assignments and
Training to Ensure Adequate Examiner Staffing
Federal Reserve staff acknowledge the
challenge presented by the increasing complexity
of large bank operations. Federal Reserve staff
said that one way they respond to the challenge is
to assign their best, most seasoned, examiners to
large, complex banks. For particularly technical
examination segments, examiners with specific
expertise or skill sets are assigned. In some
cases, examiners from one Federal Reserve district
have been assigned to examinations being done by
another in recognition that some Reserve Banks
possess specific expertise in certain areas. This
task is complicated for the Federal Reserve System
due to the nature of the system, with its 12
independent Reserve Banks. Federal Reserve Board
staff said that a major challenge for the system
is to build a national pool of large bank
examiners from a group of independent
organizations with defined geographic
jurisdictions where skills and demands for skills
based on banks are not aligned.
In October 1999, a work group comprising
Federal Reserve Board Governors and Reserve Bank
presidents initiated a series of initiatives
designed to ensure that the Federal Reserve System
will have the necessary supervisory skills to keep
pace with present and projected changes in the
financial services industry. The first of these
initiatives involves better utilizing supervisory
resources systemwide to ensure an efficient
allocation and deployment of expert resources
across the Federal Reserve System. As discussed in
Chapter 3, this effort includes the establishment
of a new senior staff level position to coordinate
these efforts. A second initiative focuses on
enhancing expertise and skill levels through the
establishment of a continuing professional
development program and the development of job
rotation and systemwide employment programs.
Another initiative involves the use of consultants
from nonsupervisory areas of the Federal Reserve
and the possible use of external consultants to
expand the Federal Reserve's supervisory resource
base.
Federal Reserve officials said that the
Reserve Banks have taken initiatives to train
existing staff and hire new staff. The Reserve
Banks said they are trying to keep their staffs'
skills current, but it is difficult in the present
employment market because they often cannot match
the pay offered by firms competing for skills
possessed by top examiners. Therefore, staff
attrition remains a concern. Federal Reserve staff
have said their most critical losses are among
experienced examiners whose skills and expertise
are of even greater value under a program of risk-
focused supervision.
OCC Stresses External Certifications, On-the-job
Training, and Examiner Assignments to Ensure
Sufficient Expertise
OCC officials said they also count the
maintenance of adequate examiner resources as one
of the most important challenges facing the
agency. Like the Federal Reserve, OCC officials
said they assign the most experienced examiners to
the large bank program. To maintain sufficient
expertise, OCC encourages all of its examiners to
carry outside certifications, such as a Certified
Public Accountant, Chartered Financial Analyst,
and Certified Information Systems Auditor.
In addition, OCC officials said they have
recently developed their Examiner Development
Initiative to ensure that OCC has sufficient
numbers of examiners with requisite expertise in
several specific disciplines. Under the
initiative, OCC manages the work assignments of
examiners to provide them with the on-the-job
training necessary to develop skills and expertise
in specific areas.
As described in chapter 3, OCC developed the
concept of geographically based teams of examiners
who can be rotated among banks in specific regions
of the country for the purpose of maintaining
adequate staffing, not only in terms of numbers,
but also expertise. OCC officials said that this
is also done to ensure examiner independence. This
process can enhance the availability of examiner
expertise for examinations by making certain skill
sets available to resident examiner staffs at
banks that might not otherwise possess them.
Although the availability of adequate staff has
always been important, its importance has been
enhanced with the increased need presented by
large, complex banks for examiners with adequate
experience and expertise. OCC officials explained
that because OCC does not possess the requisite
number of expert staff to provide all competencies
to all resident staffs, it uses these teams to
provide them when needed.
OCC has begun to supplement its staff for
some examinations through the use of contract
employees. OCC officials said such employees are
usually retired national bank examiners who
possess skills that may be difficult for OCC to
obtain in sufficient numbers in its current staff.
Candidates for contracts were evaluated by OCC for
past performance and experience in the areas of
general examination skills, capital markets,
market risks, credit risks, accounting, shared
national credits, bank information systems,
Community Reinvestment Act/consumer, fiduciary
activities, and bank examination instruction. In
addition to this evaluation, contractors were
subject to a security investigation, reviews by
OCC's ethics official for potential conflict of
interest situations, and the execution of a
confidentiality statement to the effect that no
privileged information or data will be disclosed
except as authorized by OCC. Senior OCC officials
said that this practice represents an opportunity
to tap a valuable source of talented examiners
that could be more extensively employed.
_______________________________
1 Risk-Based Capital: Regulatory and Industry
Approaches to Capital and Risk (GAO/GGD-98-153,
July 20, 1998).
Appendix I
Comments From the Federal Reserve Board
Page 53GAO/GGD-00-48 Risk-Focused Bank Examination
s
Appendix II
Comments From the Office of the Comptroller of the
Currency
Page 55GAO/GGD-00-48 Risk-Focused Bank Examination
s
Appendix III
GAO Contacts and Staff Acknowledgments
Page 56GAO/GGD-00-48 Risk-Focused Bank Examination
s
GAO Contact
Thomas J. McCool, (202) 512-8678
Acknowledgments
In addition to those named above, James M.
McDermott, Thomas Conahan, Bruce Engle, Jack
Strauss, Karen Tremba, and Desiree Whipple made
key contributions to this report.
*** End of Document ***