Foreign Banks: Internal Control and Audit Weaknesses in U.S. Branches
(Chapter Report, 09/29/97, GAO/GGD-97-181).
Pursuant to a congressional request, GAO: (1) identified U.S.
supervisors' expectations for adequate internal controls and audits in
foreign banking organization (FBO) branches; (2) determined the the
extent of serious weaknesses in FBO branches' internal controls and
audits reported by U.S. supervisors during examinations; and (3)
described U.S. supervisors' efforts to address these weaknesses.
GAO noted that: (1) U.S. supervisors expect each U.S. FBO branch to
have: (a) a system of internal controls that is consistent with the size
and complexity of its operation and (b) an internal audit function of
adequate scope and frequency or an adequate system of head office or
external audits; (2) although few FBO branches' deposits are insured by
the Federal Deposit Insurance Corporation (FDIC), U.S. supervisors have
an interest in the activities of FBO branches because the supervisors
wish to preserve standards that help ensure the efficiency of and
confidence in U.S. markets; (3) a guiding principle for U.S. supervisors
in assessing internal controls is that good internal control exists when
employees are not in a position to make significant errors or perpetrate
significant irregularities without timely detection; (4) in evaluating a
FBO branch's overall system of internal control, U.S. supervisors are to
consider the adequacy of controls and the level of adherence to them;
(5) a significant number of the 254 FBO branches U.S. supervisors rated
fair or lower had 1 or more of the weaknesses in internal control that
U.S. supervisors identified as being among the most serious, and a
majority of the FBO branches had 1 or more of the weaknesses in audit
function identified as being among the most serious; (6) 67 percent of
the 254 FBO branches whose examination reports GAO reviewed were
reported to have had audits of inadequate scope; 41 percent were
reported to have had audits of inadequate frequency; and 28 percent were
reported to have had inadequate management response to audit criticisms;
(7) according to U.S. supervisors, these audit weaknesses represent
serious problems in managements' oversight of internal controls and
could slow or limit improvement of internal controls at some FBO
branches; (8) GAO found that U.S. supervisors are undertaking numerous
efforts intended to address internal control and audit weaknesses at FBO
branches; (9) the objectives of these efforts include helping to ensure:
(a) detection of losses that have occurred as the result of an FBO
branch's internal control and audit weaknesses; (b) timely correction by
FBO branches of serious weaknesses in control procedures and audit
functions; (c) increased understanding among multinational banks of the
importance of adequate internal controls and audits; and (d)
preparedness of supervisors to conduct effective assessments of internal
controls; and (10) prompt attention to the development of a strategy for
evaluating the results of these initiatives is now needed to determine
whether progress is being made in improving the condition of internal
controls at FBO branches.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: GGD-97-181
TITLE: Foreign Banks: Internal Control and Audit Weaknesses in
U.S. Branches
DATE: 09/29/97
SUBJECT: Internal controls
Auditing standards
Bank examination
Banking regulation
Reporting requirements
Audits
Fines (penalties)
International economic relations
Foreign corporations
Federal reserve banks
IDENTIFIER: Foreign Banking Organization Supervision Program
Federal Reserve Uniform Financial Institutions Rating System
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO report. Delineations within the text indicating chapter **
** titles, headings, and bullets are preserved. Major **
** divisions and subdivisions of the text, such as Chapters, **
** Sections, and Appendixes, are identified by double and **
** single lines. The numbers on the right end of these lines **
** indicate the position of each of the subsections in the **
** document outline. These numbers do NOT correspond with the **
** page numbers of the printed product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
** A printed copy of this report may be obtained from the GAO **
** Document Distribution Center. For further details, please **
** send an e-mail message to: **
** **
** **
** **
** with the message 'info' in the body. **
******************************************************************
Cover
================================================================ COVER
Report to the Subcommittee on Financial Institutions and Consumer
Credit, Committee on Banking and Financial Services, House of
Representatives
September 1997
FOREIGN BANKS - INTERNAL CONTROL
AND AUDIT WEAKNESSES IN U.S.
BRANCHES
GAO/GGD-97-181
Internal Control and Audit Weaknesses
(233507)
Abbreviations
=============================================================== ABBREV
DCI - Data Collection Instrument
EFT - Electronic Funds Transfer
FBO - Foreign Banking Organization
FBSEA - Foreign Bank Supervision Enhancement Act
FDIC - Federal Deposit Insurance Corporation
IBA - International Banking Act of 1978
OCC - Office of the Comptroller of the Currency
SOSA - Source of Strength Assessment
Letter
=============================================================== LETTER
B-275223
September 29, 1997
The Honorable Marge Roukema
Chairwoman
The Honorable Bruce F. Vento
Ranking Minority Member
Subcommittee on Financial Institutions
and Consumer Credit
Committee on Banking and Financial Services
House of Representatives
This report responds to your request for information on internal
control and audit weaknesses at U.S. branches and agencies of
foreign banks. It discusses U.S. supervisors' expectations for
internal controls and audits, the number of such weaknesses found by
U.S. supervisors at fair or lower rated U.S. branches and agencies,
and the U.S. supervisors' efforts to improve internal controls and
audits at these institutions.
We are sending copies of this report to the Chairmen and Ranking
Minority Members of the House Committee on Banking and Financial
Services and the Senate Committee on Banking and Urban Affairs, the
Chairman of the Federal Reserve Board, the Chairman of the Federal
Deposit Insurance Corporation, the Comptroller of the Currency, and
other interested parties. We will also make copies available to
others on request.
Major contributors to this report are listed in appendix III. If you
have any questions, please call me at (202) 512-8678.
Thomas J. McCool,
Director, Financial
Institutions and Markets
Issues
EXECUTIVE SUMMARY
============================================================ Chapter 0
PURPOSE
---------------------------------------------------------- Chapter 0:1
In September 1995, Daiwa Bank, one of the largest multinational banks
in the world, reported to the Federal Reserve\1 that it had incurred
losses exceeding $1 billion from illegal securities trading
activities that had occurred at one of its New York branches over an
11-year period. Weaknesses in the branch's internal controls,
including inadequate segregation of duties in trading and electronic
funds transfer activities, had enabled an employee to trade illegally
and to hide the activities and resulting losses. The Chairman of the
Federal Reserve Board said that before the losses were reported, the
Federal Reserve had noted, but had not fully appreciated, the
seriousness of some of the branch's weaknesses in internal control.
One reason for this, according to the Federal Reserve Board Chairman,
was that those weaknesses did not appear to be extraordinary in
comparison to those found at other U.S. branches and agencies of
foreign banking organizations (FBO branches).\2
In response to concern about possible risks to the U.S. financial
system, the Chairwoman and the Ranking Minority Member, Subcommittee
on Financial Institutions and Consumer Credit, House Committee on
Banking and Financial Services, requested that GAO (1) identify U.S.
supervisors' expectations for adequate internal controls and audits\3
in FBO branches, (2) determine the extent of serious weaknesses in
FBO branches' internal controls and audits reported by U.S.
supervisors during examinations, and (3) describe U.S. supervisors'
efforts to address these weaknesses.
--------------------
\1 In this report, GAO uses the term "Federal Reserve" to refer to
both the Board of Governors of the Federal Reserve System and the 12
Federal Reserve Banks, unless further specificity is required.
\2 Branches are legal and operational extensions of foreign banks,
and they have broad banking powers, including accepting uninsured
deposits, lending, money market services, trade financing, and other
activities related to the service of foreign and U.S. clients.
Agencies have similar powers but may not accept deposits from U.S.
citizens or residents. Because FBO branches and agencies perform
similar banking functions, they are often discussed together using
the term "branches." This report follows this convention.
\3 The term "audit" in this report generally refers to the internal
audit, unless otherwise noted.
BACKGROUND
---------------------------------------------------------- Chapter 0:2
FBOs operate today in the United States most frequently by
establishing FBO branches. These FBO branches serve primarily their
home country and U.S. corporate customers and can generally engage
in lending, money market services, trade financing, trading,\4 and
other activities with banks and other financial institutions. FBO
branches can also access the U.S. payments system through the
Federal Reserve and obtain other Federal Reserve services. As of
December 1996, there were 498 FBO branches in the United States, with
total assets of $821 billion.\5 As legal and operational extensions
of foreign banks, these FBO branches have no capital of their own.
The Federal Reserve is responsible for overseeing the combined U.S.
operations\6 of FBOs and for ensuring that FBOs operating in the
United States meet financial, managerial, and operational standards
similar to those of U.S. banking organizations. In addition, FBO
branches may be either state-licensed and, therefore, regulated and
supervised by the respective state banking department or federally
licensed and, therefore, regulated and supervised by the Office of
the Comptroller of the Currency. Some branches are also insured by
the Federal Deposit Insurance Corporation (FDIC) and, therefore,
subject to additional supervision by FDIC.\7
While good internal controls do not necessarily guarantee that an
entity's business objectives will be met, an entity's board of
directors, management, and/or other personnel use internal controls
to obtain reasonable assurance that they are achieving their
objectives relating to operations, financial reporting, and
compliance with applicable laws and regulations. Internal controls
in banking institutions include segregation of duties,\8
proper authorization of transactions and activities, design and use
of adequate documents and records to help ensure the proper recording
of transactions and events, safeguards over access to and use of
assets and records, and independent checks on performance and proper
valuation of recorded amounts.
The performance of internal controls can be monitored and
strengthened by management, as needed, through internal and/or
external audits. Internal auditing is a management function that is
to independently evaluate the adequacy and effectiveness of internal
controls and the quality of ongoing operations. External financial
auditing generally provides an independent assessment of the
reliability of an entity's financial statements and may provide
management with useful information for monitoring and improving
internal controls.
To establish a list of serious internal control and audit weaknesses,
GAO compiled a list of the specific weaknesses described in all 99
enforcement actions taken by U.S. supervisors against FBO branches
for internal control and/or audit weaknesses from January 1993 to
June 1996. To determine the extent of serious internal control and
audit weaknesses, GAO then collected data on these weaknesses from
425 examination reports of 254 FBO branches (see app. I). The 254
branches included all FBO branches with an overall examination rating
of fair or lower or a rating of fair or lower in an examination
component substantively affected by internal control and audit
weaknesses from January 1993 to June 1996. The percentage of FBO
branches whose examination reports GAO reviewed varied from a high of
about 30 percent of all FBO branches in 1993 to about 20 percent in
1996.
To determine the most serious weaknesses, GAO discussed the data with
experienced federal and state supervisors. Internal control
weaknesses U.S. supervisors identified as among the most serious
were: inadequate segregation of duties in trading and/or electronic
funds transfer activities, lack of dual control and independent
verification in trading and/or electronic funds transfer activities,
lack of security and access restrictions in electronic funds
transfers, employee(s) in sensitive positions were not absent for a
minimum number of consecutive days to allow another employee to
detect improper actions,\9 inadequate safekeeping and/or
documentation in trading activities, and inadequate security and
access restrictions for accounting system software. Audit weaknesses
U.S. supervisors identified as among the most serious were:
inadequate scope of audit coverage, inadequate frequency of audits,
inadequate response to audit criticisms, inadequate audit
independence, inadequate workpapers or documentation, and lack of
head office supervision. GAO did not verify the information
contained in the examination reports.
--------------------
\4 FBO branches engage in a variety of different trading activities,
including foreign exchange, derivatives, and securities trading.
\5 For purposes of comparison, the total assets of U.S. domestic
banks, not including the assets of subsidiary banks of FBOs, were
about $4.4 trillion as of December 31, 1996.
\6 The "combined U.S. operations" of an FBO refers to all of its
activities, banking or otherwise, in the United States.
\7 The Foreign Bank Supervision Enhancement Act of 1991, among other
things, in effect prohibited FBO branches from accepting insured
deposits. Public Law 102-242, Title II, Subtitle A, section 214 (a).
Those FBO branches that already had deposit insurance were allowed to
retain it. As of December 31, 1996, 31 FBO branches were
FDIC-insured.
\8 Segregation of duties is an internal control procedure that
assigns different people the responsibilities of authorizing
transactions, recording transactions, and maintaining custody of
assets and thus helps reduce opportunities for any person to be in a
position to both perpetrate and conceal errors or irregularities in
the normal course of his/her duties.
\9 The absence of employees in sensitive positions for a minimum
number of consecutive days, generally a 2-week period, is an
important internal control because it provides an independent check
on employees' performances. During their absences, employees' duties
would have to be done by other employees and any unauthorized
activities would probably surface during that time.
RESULTS IN BRIEF
---------------------------------------------------------- Chapter 0:3
U.S. supervisors expect each U.S. FBO branch to have (1) a system
of internal controls that is consistent with the size and complexity
of its operation and (2) an internal audit function of adequate scope
and frequency and/or an adequate system of head office\10 or external
audits. Although few FBO branches' deposits are insured by FDIC,
U.S. supervisors have an interest in the activities of FBO branches
because the supervisors wish to preserve standards that help ensure
the efficiency of and confidence in U.S. markets.
A guiding principle for U.S. supervisors in assessing internal
controls is that good internal control exists when employees are not
in a position to make significant errors or perpetrate significant
irregularities without timely detection. In evaluating an FBO
branch's overall system of internal control, U.S. supervisors are to
consider the adequacy of controls and the level of adherence to them.
For example, controls are to be carried out by competent people who
have no incompatible duties. In addition, U.S. supervisors are to
consider the frequency, scope, and adequacy of the FBO branch's
internal and external audits.
A significant number of the 254 FBO branches U.S. supervisors rated
fair or lower had 1 or more of the weaknesses in internal control
that U.S. supervisors identified as being among the most serious,
and a majority of the FBO branches had 1 or more of the weaknesses in
audit function identified as being among the most serious. For
example, 28 percent of the 254 FBO branches were reported to lack
adequate segregation of duties in trading and/or electronic funds
transfer activities. U.S. supervisors told GAO that a lack of
adequate segregation of duties in these areas is among the most
serious internal control weaknesses because such a weakness can be,
and has been, associated with big losses.
Sixty-seven percent of the 254 FBO branches whose examination reports
GAO reviewed were reported to have had audits of inadequate scope; 41
percent were reported to have had audits of inadequate frequency; and
28 percent were reported to have had inadequate management response
to audit criticisms. According to U.S. supervisors, these audit
weaknesses represent serious problems in managements' oversight of
internal controls and could slow or limit improvement of internal
controls at some FBO branches.
GAO found that U.S. supervisors are undertaking numerous efforts
intended to address internal control and audit weaknesses at FBO
branches. The objectives of these efforts include helping to ensure
(1) the detection of losses that have occurred as the result of an
FBO branch's internal control and audit weaknesses, (2) the timely
correction by FBO branches of serious weaknesses in control
procedures and audit functions, (3) an increased understanding among
multinational banks of the importance of adequate internal controls
and audits, and (4) the preparedness of supervisors to conduct
effective assessments of internal controls. Prompt attention to the
development of a strategy for evaluating the results of these
initiatives is now needed to determine whether progress is being made
in improving the condition of internal controls at FBO branches. The
results of such a strategy could be useful in determining whether
additional initiatives may be needed and in communicating with FBO
branch officials and home country supervisors about the importance of
sound bank management practices.
--------------------
\10 The head office is the headquarters of the FBO.
PRINCIPAL FINDINGS
---------------------------------------------------------- Chapter 0:4
U.S. SUPERVISORS EXPECT FBO
BRANCHES' INTERNAL CONTROLS
TO ENABLE TIMELY DETECTION
OF SIGNIFICANT ERRORS OR
IRREGULARITIES
-------------------------------------------------------- Chapter 0:4.1
U.S. supervisors' expectations for internal control are based on the
premise that standards that help ensure the efficiency of and
confidence in U.S. markets must be preserved. An FBO branch's
system of internal controls is to ensure that its operations are
conducted in accordance with internal guidelines and supervisory
policies, that all reports and analyses provided to the head office
and senior branch management are timely and accurate, and that the
controls provide protection against losses and ensure accurate
financial reporting. In assessing the adequacy of the scope of
internal audits, supervisors are to consider whether all important
FBO branch functions and services are included and whether the audit
program includes the procedures necessary to reasonably ensure
compliance with applicable U.S. laws and regulations. Supervisors
are also to assess the adequacy of internal audits that are based on
an evaluation of the risk associated with each area of audit
interest. In evaluating the work of both internal and external
auditors, supervisors are to consider the independence of the
auditors.
MANY OF THE FAIR OR LOWER
RATED FBO BRANCHES WERE
REPORTED TO HAVE ONE OR MORE
OF THE WEAKNESSES U.S.
SUPERVISORS IDENTIFIED AS
BEING AMONG THE MOST SERIOUS
-------------------------------------------------------- Chapter 0:4.2
Twenty-eight percent of the 254 FBO branches rated fair or lower were
reported to lack adequate segregation of duties in trading and/or
electronic funds transfer activities. Additional weaknesses
supervisors identified as being among the most serious included: a
lack of dual control and verification in trading and/or electronic
funds transfer was reported in 21 percent of the FBO branches; a lack
of security and access restrictions in electronic funds transfer, in
22 percent; and employees in sensitive positions not being absent for
a minimum number of consecutive days so that another employee could
detect improper actions, in 22 percent. Some FBO branches were found
to have two additional weaknesses that supervisors identified as
being among the most serious: inadequate safekeeping and/or
documentation in trading activities (15 percent) and inadequate
security and access restrictions for accounting system software (6
percent). Inadequate safekeeping and/or documentation in trading
activities increases the risk that a transaction will not be
accurately recorded in the FBO branch's books.
GAO found that of the FBO branches rated fair or lower, those with
certain characteristics had higher numbers of internal control
weaknesses. These characteristics included being engaged in trading
as a major line of business, having a comparatively high number of
lines of business, having a comparatively high number of staff, and
having serious weaknesses in audit functions.
Management at many of the FBO branches rated fair or lower had not
corrected audit weaknesses in response to supervisory examinations.
For example, 53 percent of the 171 FBO branches with audits of
inadequate scope, which were examined more than once in the study
period, were found to have audits of inadequate scope at subsequent
examinations.
To better understand the meaning of the FBO branch findings, GAO
compared them with findings for a sample of U.S. domestic banks
rated fair or lower. The comparison, which was limited in that the
U.S. domestic banks tended to be smaller in asset size and engage in
less complicated activities, showed that these domestic banks tended
to have fewer serious internal control and audit weaknesses, such as
inadequate segregation of duties and scope of audits, than FBO
branches.
SUPERVISORS ARE TAKING
ACTIONS IN AN EFFORT TO
IMPROVE INTERNAL CONTROLS
AND AUDITS AT CERTAIN FBO
BRANCHES
-------------------------------------------------------- Chapter 0:4.3
To help ensure the detection of losses that have occurred as the
result of an FBO branch's identified internal control weaknesses, the
Federal Reserve has established a policy requiring the use of special
audits for institutions with less-than-satisfactory overall ratings.
Depending upon specific case circumstances, these audits may be
performed by regional, head office, or external auditors. These
auditors are to perform direct verification of accounts in areas
identified by supervisors as having significant control weaknesses
and are to determine the accuracy of reports by the FBO branch to the
supervisors.
Supervisory efforts to help ensure the timely correction by FBO
branches of weaknesses in control procedures and audit functions
include the use of formal and informal enforcement actions to require
remedies for specific weaknesses. From January 1993 to June 1996,
U.S. supervisors took 99 enforcement actions against FBO branches
for the primary reason of inadequate internal controls or inadequate
audit. Furthermore, efforts by the Federal Reserve to communicate
more effectively with FBO officials have resulted in quicker and
better compliance by FBOs, according to Federal Reserve officials.
Supervisory actions to help ensure increased understanding of the
importance of adequate internal controls and audits include the
Federal Reserve's training programs or meetings with foreign
supervisory officials to discuss the importance of developing
adequate internal controls. Also, U.S. and foreign supervisors,
working through the Basle Committee on Banking Supervision, have
developed core principles for effective banking supervision that
include basic standards for internal controls and audits.
Examples of efforts to help ensure the preparedness of supervisors to
conduct effective assessments of internal control systems and audit
functions include the following:
-- the development, in 1995, and ongoing implementation of the FBO
Supervision Program,\11 which is expected to provide, among
other things, comprehensive information relevant to assessments
of control procedures and audit functions as well as an analysis
and a ranking to reflect the U.S. banking supervisors' judgment
about the FBOs' ability to provide their U.S. operations with
the necessary financial and managerial support;
-- the implementation, beginning in 1994, of an FBO branch rating
system that emphasizes risk management and operational controls;
-- the use, beginning in 1995, of the Examination Manual for U.S.
Branches and Agencies of Foreign Banking Organizations, which is
intended to provide uniform guidance to all federal and state
supervisors with responsibility for FBO branch oversight, and,
in 1994, of the Trading Activities Manual; and
-- the initiation of examiner training programs covering internal
controls in 1995 and appropriate supervisory strategies for the
U.S. operations of FBOs in 1996.
Although the Federal Reserve told GAO that the Federal Reserve's
initiatives have already resulted in improved internal controls and
audits at fair or lower rated FBO branches, improvements in these FBO
branches have not been systematically measured.
--------------------
\11 See Foreign Banks: Opportunities Exist to Enhance Supervision
Program (GAO/GGD-97-80, May 9, 1997).
RECOMMENDATION
---------------------------------------------------------- Chapter 0:5
U.S. supervisors have recognized that serious weaknesses in internal
controls and audits at certain FBO branches are significant and must
be addressed if losses are to be avoided and confidence maintained in
the integrity and efficiency of financial markets. To that end, they
have developed and implemented several initiatives in the past 2 to 3
years to improve the supervision of FBO branches and educate home
country supervisors about the importance of resolving internal
control and audit weaknesses. However, U.S. supervisors have not
yet developed a strategy for evaluating the results of these
initiatives, including whether those results satisfactorily address
the weaknesses identified or whether additional initiatives may be
needed. Such a strategy could, for example, determine whether there
are appropriate linkages between examination results and training and
education efforts. For information to be available to monitor the
impact of the initiatives when they are fully implemented, it is
important that the U.S. supervisors promptly identify the data that
are needed and ensure that the systems necessary to gather and
maintain those data are in place and operating.
GAO recommends that the Federal Reserve develop a strategy, including
objective measures, for assessing the progress it is making through
its efforts to improve internal controls and audits at FBO branches
and ensure that the procedures and systems necessary to collect the
data relevant to those measures are in place and operating. Results
from such objective evaluation of efforts to improve internal
controls and audits should be useful in determining whether
additional initiatives may be needed and in communicating with FBO
branch officials and home country supervisors about the importance of
sound bank management practices.
AGENCY COMMENTS
---------------------------------------------------------- Chapter 0:6
GAO requested comments on a draft of this report from the Federal
Reserve Board, which provided written comments that are discussed at
the end of chapter 4. In addition, Federal Reserve staff also
provided technical comments, which GAO incorporated in this report
where appropriate.
The Federal Reserve Board commented that GAO's recommendation was
useful and said that it will take steps to (1) evaluate in a more
systematic fashion the results of its initiatives to improve the
supervision of the U.S. operations of FBOs and (2) identify and
address internal control and audit weaknesses in those operations.
The Board also said that several rough measures currently indicate
some degree of improvement in those areas. As an example of such
measures, the Board noted a decline, since 1993, in the number of FBO
branches with fair or lower overall examination ratings or component
ratings that are substantively affected by internal control and audit
weaknesses.
INTRODUCTION
============================================================ Chapter 1
In September 1995, Daiwa Bank, one of the largest multinational banks
in the world, reported to the Federal Reserve\1 that it had incurred
losses exceeding $1 billion from illegal securities trading
activities that had occurred at one of its New York branches over an
11-year period. Weaknesses in the branch's internal controls,
including inadequate segregation of duties in trading and lack of
security or access restrictions in electronic funds transfer (EFT)
activities, had enabled an employee to trade illegally and to hide
the activities and resulting losses. The Chairman of the Federal
Reserve Board said that before the losses were reported, the Federal
Reserve had noted, but had not fully appreciated, the seriousness of
some of the branch's weaknesses in internal control. One reason for
this, according to the Federal Reserve, was that those weaknesses did
not appear to be extraordinary in comparison to those found at other
U.S. offices of foreign banking organizations (FBO).
In response to concern about possible risks to the U.S. financial
system, the Chairwoman and the Ranking Minority Member, Subcommittee
on Financial Institutions and Consumer Credit, House Committee on
Banking and Financial Services, requested that we review the
supervision of the U.S. operations of FBOs and determine the extent
of serious weaknesses in their internal controls\2 and audits.\3
This report is the final of three reports that respond to that
request. The objectives of this report are to (1) identify U.S.
supervisors' expectations for adequate internal controls and audits
in U.S. branches and agencies of FBOs (FBO branches),\4 (2)
determine the extent of serious weaknesses in FBO branches' internal
controls and audit reported by U.S. supervisors, and (3) describe
U.S. supervisors' efforts to address these weaknesses. In our two
prior reports, we provided the results of our reviews of the Federal
Reserve's implementation of the Foreign Bank Supervision Enhancement
Act of 1991 and the implementation of the Federal Reserve's Foreign
Banking Organization Supervision Program (FBO Program).\5
--------------------
\1 In this report, we use the term "Federal Reserve" to refer to both
the Board of Governors of the Federal Reserve System and the 12
Federal Reserve Banks, unless further specificity is required.
\2 As discussed later in this chapter, internal control is the
process by which an entity's board of directors, management, and/or
other personnel obtain reasonable assurance as to the achievement of
specified objectives.
\3 The term "audit" in this report generally refers to the internal
audit, unless otherwise noted.
\4 Because they perform similar functions, branches and agencies are
often discussed together. In this report, we follow this convention.
Branches are legal and operational extensions of foreign banks and
have broad banking powers, including accepting uninsured deposits,
lending, money market activities, trading financing, and other
activities related to the service of foreign and U.S. clients.
Agencies have similar powers but may not accept deposits from U.S.
citizens or residents.
\5 See Foreign Banks: Implementation of the Foreign Bank Supervision
Enhancement Act of 1991 (GAO/GGD-96-187, Sept. 30, 1996) and Foreign
Banks: Opportunities Exist to Enhance Supervision Program
(GAO/GGD-97-80, May 9, 1997).
BACKGROUND
---------------------------------------------------------- Chapter 1:1
Congressional concern about the adequacy of internal controls and
audits of FBO branches in the United States was raised in part by the
illegal activities that occurred at a New York branch office of Daiwa
Bank, which is headquartered in Japan. In September 1995, senior
officials of Daiwa Bank informed the Federal Reserve Bank of New York
that one of Daiwa Bank's New York branches had incurred losses of
$1.1 billion from trading activities undertaken by a senior branch
official, Mr. Toshihide Iguchi, over a period of 11 years, from 1984
to 1995.\6 The Federal Reserve later found that these losses, which
should have been reflected in the bank's books, records, and
financial statements, were concealed from federal and state banking
supervisors through liquidations of securities held in the bank's
custodian accounts and falsification of its custody records.\7
Not only was Mr. Iguchi able to conceal massive losses over an
extended period, but the Federal Reserve found that senior management
of Daiwa Bank also took steps to conceal the losses from U.S.
supervisory authorities. Senior management of Daiwa Bank said they
had learned about the trading losses 2 months before informing
Federal Reserve officials. They also directed Mr. Iguchi to
continue transactions during the 2-month period to avoid the
disclosure of the losses.
In October 1995, the New York Superintendent of Banks and the Federal
Deposit Insurance Corporation (FDIC), together with the Federal
Reserve, issued cease-and-desist orders against Daiwa Bank, requiring
a virtual cessation of trading activities in the United States. In
November 1995, Daiwa Bank was indicted on federal criminal charges.
At the same time, the Federal Reserve, FDIC, the New York State
Banking Superintendent, and a number of other state banking
authorities jointly issued a series of orders that terminated Daiwa
Bank's U.S. banking operations. In February 1996, Daiwa Bank pled
guilty to numerous criminal offenses related to its scheme to cover
up trading losses from U.S. bank supervisors and law enforcement
authorities. The guilty plea resolved all outstanding criminal
proceedings against Daiwa Bank, and it paid a criminal fine of $340
million. Mr. Iguchi and the former General Manager of Daiwa Bank's
New York branch also pled guilty to criminal offenses associated with
misconduct at the branch office.
--------------------
\6 As discussed later in this chapter, the Federal Reserve is
responsible for overseeing the combined U.S. operations of foreign
banks.
\7 FBO branches may act as custodians for customers' investments,
such as stocks, bonds, or gold. This is a customer service activity
that normally does not result in assets and liabilities subject to
entry on the general ledger.
U.S. SUPERVISORS IDENTIFIED
CONDITIONS THAT AIDED
ILLEGAL ACTIVITIES AT DAIWA
BANK BUT DID NOT APPRECIATE
THE SERIOUSNESS OF THOSE
CONDITIONS
-------------------------------------------------------- Chapter 1:1.1
Federal Reserve officials and staff who reviewed 1992, 1993, and 1994
examination records for the Daiwa Bank's New York branch office found
that certain conditions had been identified at the branch that proved
to be instrumental in the conduct of illegal activities. However,
U.S. supervisors did not recognize all of the potential dangers
associated with these conditions at the time of identification.
According to Federal Reserve officials, U.S. supervisors first
became aware in November 1993 that Mr. Iguchi was responsible for
both some securities-related activities, possibly including trading,
and custody operations as well as some related back-office settlement
functions at the branch.\8 The supervisors were concerned that Mr.
Iguchi could use his position as overseer of the custody account,
including his ability to gather information on the volume and nature
of customer trades, to gain an improper advantage in carrying out the
bank's trading activities. After finding no evidence of improper
advantage, supervisors requested and received written confirmation
that the identified dual capacities had been split. This
confirmation was later determined to be false and misleading.
Supervisors also noted weaknesses in security and access restrictions
in EFT activities, which can enable unauthorized transfer of funds
out of an FBO branch.
While supervisors recognized that Mr. Iguchi's dual capacities were
a potential problem, Federal Reserve staff said they did not
recognize them as a potential opportunity for misappropriation of
customer and bank funds. Prudent policy dictates that certain
operations within an FBO branch be executed by different individuals
to limit the possibility for any person to both perpetrate and
conceal errors or irregularities in the normal course of his or her
duties. As evidenced by Daiwa Bank and other cases, a lack of
separation of trading and back-office settlement activities can have
very adverse consequences.\9 This lack of separation of duties was a
weakness in internal control at Daiwa Bank.
According to a report prepared by Federal Reserve Board staff, a
number of factors contributed to the fact that supervisors did not
perceive Mr. Iguchi's functions as a more serious problem when they
were identified. One of the factors mentioned in the report was that
the internal control problems of Daiwa Bank's New York branch during
1992 to 1993 did not appear to be extraordinary in comparison to
those that supervisors were finding in their examinations of other
U.S. offices of foreign banks. Chapter 3 of this report provides
our analysis of internal control problems at certain FBO branches
from January 1993 to June 1996.
--------------------
\8 In banking, settlement refers to the process of recording the
debit and credit positions of two parties in a transfer of funds.
Also, settlement refers to the delivery of securities by a seller and
the payment by the buyer.
\9 Adverse consequences of a lack of segregation of duties in trading
activities were also evident in cases involving Barings PLC and
Sumitomo Corporation, which both suffered large losses as a result of
unauthorized trading.
FOREIGN BANK OPERATIONS IN THE
UNITED STATES
---------------------------------------------------------- Chapter 1:2
FBO branches are the most common types of FBO banking offices in the
United States. As of December 31, 1996, they accounted for about 76
percent of FBO banking assets in the United States and 51 percent of
all FBO assets--banking and nonbanking--in the United States.\10 As
of that date, 498 FBO branches were operating in the United States,
holding total assets of $821 billion.\11 As legal and operational
extensions of their parent foreign banks, FBO branches have no
capital of their own. FBO branches serve primarily their home
country and U.S. corporate customers and engage in lending, money
market services, trading,\12 trade financing, and other activities
with banks and other financial institutions. The FBO branches can
access the U.S. payments system through the Federal Reserve and
obtain other Federal Reserve services. Over the last decade, the
globalization of markets, the increase in transaction volume and
volatility, and the introduction of complex trading strategies have
led capital markets and trading activities to take on an increasingly
important role at financial institutions, including FBO branches.
--------------------
\10 FBO banking assets include the assets of branches, agencies,
subsidiary banks, Edge Act and Agreement Corporations, and other
deposit-taking entities. FBO nonbanking assets include the assets of
securities subsidiaries that underwrite or deal in certain securities
and other subsidiaries.
\11 For purposes of comparison, the total assets of insured U.S.
domestic banks were about $4.4 trillion on December 31, 1996,
excluding the assets of subsidiary banks of FBOs.
\12 FBO branches engage in a variety of different trading activities
including foreign exchange, derivatives, and securities trading.
THE FEDERAL RESERVE IS
RESPONSIBLE FOR OVERSIGHT OF
THE COMBINED U.S.
OPERATIONS OF FBOS
-------------------------------------------------------- Chapter 1:2.1
Before enactment of the International Banking Act of 1978 (IBA),\13
only states licensed, supervised, and regulated the operations of FBO
branches. Under this system, FBO branches enjoyed many regulatory
advantages compared with U.S. banks, but the FBO branches also were
restricted in varying ways, depending upon the laws of the states in
which they were licensed. The IBA sought to "level the playing
field" between branches and U.S. domestic banks by introducing the
FBOs to the dual-bank regulatory system that is in effect for
domestic banks. This policy of "national treatment" allowed FBO
branches to obtain a state charter or a federal charter from the
Office of the Comptroller of the Currency (OCC) and served as the
basis for provisions in the IBA that eliminated certain advantages
and disadvantages of state-only regulation.
The regulatory regime established by the IBA did not fully account
for certain safety and soundness and other concerns, however. In
1991, Congress passed the Foreign Bank Supervision Enhancement Act
(FBSEA). This act, which amended the IBA, authorized federal
oversight of all foreign bank operations in the United States and
vested this responsibility with the Federal Reserve. FBSEA also
established uniform standards for the combined U.S. operations of
foreign banks,\14 generally requiring them to meet financial,
management, and operational standards equivalent to those required of
U.S. banking organizations. Finally, FBSEA prohibited foreign
branches from accepting retail deposits (deposits of $100,000 or less
that are insured by FDIC),\15 although it grandfathered the branches
that already offered insured deposits.\16
Under FBSEA, the Federal Reserve's supervisory and regulatory powers
over FBOs include (1) approving all FBOs seeking to establish U.S.
offices, whether these offices are licensed by federal or state
authorities, in accordance with standards set forth in the act; (2)
terminating the activities of a state-licensed FBO branch or
recommending that OCC terminate the license of a federally licensed
FBO branch; and (3) ensuring that FBO operations in the United States
are examined in a comprehensive and coordinated manner.
--------------------
\13 Public Law 95-369, 12 U.S.C. 3101 et seq., as amended.
\14 The "combined U.S. operations" of an FBO refers to all of its
activities, banking or otherwise, in the United States.
\15 FDIC and OCC have defined a nonretail deposit as, in general, an
initial deposit of $100,000 or more. However, FDIC and OCC
regulations permit uninsured foreign branches to accept some deposits
of $100,000 or less. These deposits include those from any foreign
or "large United States" business (a U.S. business with more than $1
million in gross revenues or having its securities registered on a
national securities exchange or quoted on the NASDAQ); any
governmental unit or international organization; and any individual
who is a noncitizen or nonresident at the time the initial deposit is
made. In addition, any other depositor may establish an uninsured
deposit account under $100,000, but only if the total amount of such
deposits does not exceed 1 percent of the branch's average deposits.
The branch cannot solicit these deposits. See 12 C.F.R. Parts 28
and 346.
\16 As of December 1996, 31 branches were FDIC-insured and subject to
additional supervision by FDIC.
FOREIGN BANKING ORGANIZATION
SUPERVISION PROGRAM
-------------------------------------------------------- Chapter 1:2.2
To enhance their supervision of foreign banking operations in the
United States, the Federal Reserve began to implement its interagency
FBO Program in March 1995. Federal Reserve staff told us that the
program was scheduled to be implemented over a 3- to 5-year period,
but that they hoped to have it fully operational by 1998. The FBO
Program was designed to provide U.S. supervisors with a collective
mechanism for supervising the U.S. operations of FBOs in a
coordinated, thorough, and efficient manner, according to the Federal
Reserve. The FBO Program is expected to provide a mechanism to
obtain comprehensive supervisory information about the U.S.
operations of FBOs, including information relevant to assessments of
FBO branches' internal controls and audits. The FBO Program is also
intended to provide supervisors with an understanding of FBOs'
ability to provide their U.S. operations with the necessary
financial and managerial support.
The FBO Program calls for the development and distribution of five
new supervisory products that have separate requirements regarding
what they are to contain, when they are to be prepared, and how they
are to be used. Each of the products is designed to assist in
supervising FBOs. The products include a Summary of Condition and
Combined Rating, Comprehensive Examination Plan, Review of Home
Country Financial System, Review of Significant Home Country
Accounting Policies and Practices, and Strength of Support
Assessment. These products and how they are designed to assist in
the oversight of branch internal controls and audits are described in
more detail in chapter 4.
NEW EXAMINATION RATING
SYSTEM HEIGHTENED THE
PRIORITY OF THE
EFFECTIVENESS OF RISK
MANAGEMENT AND INTERNAL
CONTROLS
-------------------------------------------------------- Chapter 1:2.3
In 1994, federal and state bank supervisors began phasing in a new,
uniform examination rating system for U.S. branches of FBOs that
heightened the priority of the effectiveness of a branch's risk
management processes and operational controls. This rating system,
which is commonly referred to as the ROCA system, focuses on: Risk
management, Operational controls, Compliance with U.S. laws and
regulations, and Asset quality.\17 (The previous rating system, which
was known as the AIM system, focused on Assets, Internal controls,
and Management.) The first three ROCA system components are to
evaluate the major activities or processes of an FBO branch that may
raise supervisory concerns. The fourth component of the rating
system is to provide for a specific rating of the quality of the FBO
branch's stock of assets as of the examination date. The ROCA system
is intended to direct attention to the types of weaknesses in front-
and back-office duties that allowed unauthorized activities to
continue undetected in Daiwa Bank. Table 1.1 describes each
component of the ROCA rating system. Each component is evaluated on
a scale of one to five, where one represents the least supervisory
concern and five represents the greatest concern. Chapter 4
describes the supervisors' shift from an AIM to a ROCA rating system
in more detail.
Table 1.1
Components of the ROCA Rating System
Component Description
------------------ --------------------------------------------------
R Examiners are to determine the extent to which
risk management techniques are adequate to (1)
control risk exposures that result from the
branch's activities and (2) ensure adequate
oversight by branch and head office management
and, thereby, promote a safe and sound banking
environment. The primary components that examiners
look for in a sound risk management system are a
comprehensive risk assessment approach; a detailed
structure of limits, guidelines, and other
parameters used to govern risk-taking; and a
strong management information system for
monitoring and reporting risks.
O Examiners are to assess the effectiveness of the
branch's operational or internal controls,
including accounting and financial controls. This
assessment is to be based on the expectation that
branches should have an independent internal audit
function and/or an adequate system of head office
or external audits as well as a system of internal
controls consistent with the size and complexity
of their operations. In this regard, internal
audit and control procedures should ensure that
operations are conducted in accordance with
internal guidelines and regulatory policies and
that all reports and analyses provided to the head
office and branch senior management are timely and
accurate.
C Examiners are to determine whether branches
demonstrate compliance with all applicable federal
and state laws and regulations, including
reporting and special supervisory requirements.
A Generally, asset quality is to be evaluated to
determine whether a financial entity has
sufficient capital to absorb prospective losses,
and ultimately, whether it can maintain its
viability as an ongoing entity. The evaluation of
asset quality in a branch does not have the same
result because a branch is not a separately
capitalized entity. Instead, the ability of a
branch to honor its liability ultimately is to be
based on the condition and level of support from
the FBO. Therefore, if the FBO is presumed to be
able to support the branch with sufficient
resources on a consolidated basis, the assessment
of asset quality would not in and of itself be a
predominant factor if existing risk management
techniques are considered to be satisfactory.
However, if support from the FBO is questionable,
the evaluation of asset quality is to be carefully
considered in determining whether supervisory
actions are needed to improve the branch's ability
to meet its obligations on a stand-alone basis.
----------------------------------------------------------------------
Source: Enhanced Framework for Supervising the U.S. Operations of
Foreign Banking Organizations, Board of Governors of the Federal
Reserve System, March 31, 1995 (SR95-22, Attachment III).
The overall composite ROCA rating is to indicate whether, in the
aggregate, the operations of the FBO branch may present supervisory
concerns and the extent of these concerns. The composite rating is
based on a scale of one through five, with one representing the least
supervisory concern and five representing the greatest concern. The
five composite ratings are defined in table 1.2.
Table 1.2
Composite ROCA Rating Definitions and
the Required Supervisory Response
Definition of Required
branch supervisory
Rating characteristic response
------------------------------ ------------------ ------------------
1 Strong condition Only normal
in every respect. supervisory
attention is
required.
2 Satisfactory Generally, only
condition but may normal supervisory
have modest attention is
weaknesses that required.
can be corrected
by branch
management in the
normal course of
business.
3 Fair condition due Generally,
to a combination branches in this
of weaknesses in category raise
risk management, supervisory
operational concern and
controls, and require more than
compliance or normal supervisory
asset quality attention to
problems that, in address their
combination with weaknesses.
the condition of
the FBO or other
factors, cause
supervisory
concern.
4 Marginal condition Branches in this
due to serious category require
weaknesses as close supervisory
reflected in the attention and
assessments of the surveillance
individual monitoring and a
components. definitive plan
Serious problems for corrective
or unsafe and action by branch
unsound banking and head office
practices or management.
operations exist
that have not been
satisfactorily
addressed or
resolved by branch
and/or head office
management.
5 Unsatisfactory Branches in this
condition due to a category require
high level of urgent
severe weaknesses restructuring of
or unsafe and operations by
unsound branch and head
conditions. office management.
----------------------------------------------------------------------
Source: Enhanced Framework for Supervising the U.S. Operations of
Foreign Banking Organizations, Board of Governors of the Federal
Reserve System, March 31, 1995 (SR95-22, Attachment III).
--------------------
\17 This report treats the terms "operational controls" and "internal
controls" as synonyms.
INTERNAL CONTROL IS TO PROVIDE
DIRECTORS AND MANAGEMENT WITH
REASONABLE ASSURANCE THAT
OBJECTIVES WILL BE ACHIEVED
---------------------------------------------------------- Chapter 1:3
Internal control is the process by which an entity's board of
directors, management, and/or other personnel obtain reasonable
assurance that the objectives in the three following categories will
be achieved:
-- Operations--relating to effective and efficient use of the
entity's resources.
-- Financial reporting--relating to preparation of reliable
financial reports.
-- Compliance--relating to the entity's compliance with applicable
laws and regulations.
Although good internal control can provide reasonable assurance that
an entity can achieve the three objectives, it has limitations.
Internal control can only help ensure an entity's business success,
since shifts in external conditions--such as competitors' actions or
economic conditions--can be beyond the control of management.
Likewise, internal control can only help ensure the reliability of
financial reporting and compliance with laws and regulations because
judgments in decisionmaking can be faulty and breakdowns can occur
due to simple error or mistake. In addition, controls can be
circumvented by the collusion of two or more people, and management
has the ability to override the system. Another limiting factor is
that the design of an internal control system must reflect that
resource constraints exist, and the benefits of controls must be
considered relative to their costs.
Internal auditing is a management function that is intended to
independently evaluate the adequacy and effectiveness of the control
systems within an organization and the quality of ongoing operations.
Internal auditors are to directly examine the adequacy and
effectiveness of internal control components and recommend
improvements in such controls. Internal auditors should contribute
to the ongoing effectiveness of the internal control system, but they
do not have primary responsibility for establishing or maintaining
the system. According to the Examination Manual for U.S. Branches
and Agencies of Foreign Banking Organizations (examination manual),
internal auditors should be independent of the activities they audit.
External audits are performed to provide an independent assessment of
the reliability of an entity's financial statements and may provide
management with useful information for conducting internal control
responsibilities. The external auditor is to give an opinion on the
financial statements. The extent of attention that the external
auditor gives to internal control varies from audit to audit, but the
external auditor is rarely, if ever, in a position to identify all
internal control weaknesses that might exist in an entity.
OBJECTIVES, SCOPE, AND
METHODOLOGY
---------------------------------------------------------- Chapter 1:4
The specific objectives of this report are to (1) identify U.S.
supervisors' expectations for adequate internal controls and audits
in FBO branches, (2) determine the extent of serious weaknesses in
FBO branches' internal controls and audit reported by U.S.
supervisors, and (3) describe U.S. supervisors' efforts to address
these weaknesses.
To describe the criteria that U.S. supervisors use to assess
branches' internal controls and audits, we reviewed the examination
manual developed by federal and state supervisors for examining FBO
branches. We also reviewed other related supervisory guidance and
interviewed some state supervisory staff and Federal Reserve staff
from the New York, San Francisco, Chicago, and Atlanta Federal
Reserve districts.
To determine the extent of serious weaknesses reported in FBO
branches' internal controls and audits, we reviewed all 99
enforcement actions taken by federal and state supervisors against
FBO branches for internal control and/or audit weaknesses from
January 1993 to June 1996, and we compiled a list of serious internal
control and audit weaknesses by noting the specific weaknesses
described in the enforcement actions. We classified these weaknesses
by type of weakness, such as inadequate segregation of duties, and by
type of operation at the branch where the weakness occurred, such as
trading operations. We then developed a data collection instrument
(DCI) that we used to categorize serious internal control and audit
weaknesses as reported by U.S. supervisors in examination reports.
We received and incorporated comments on our preliminary DCI from
Federal Reserve staff.
Using the DCI, we quantified the types of weaknesses cited in 425
examination reports for 254 FBO branches that were examined from
January 1993 to June 1996. Of the 425 examinations, 267 resulted in
FBO branches receiving AIM or ROCA composite ratings of 3, 4, or 5.
The remaining 158 examinations resulted in FBO branches receiving a
higher composite rating but a 3, 4, or 5 in the "I" component of the
AIM rating or the "R" or "O" components of the ROCA rating. These
components are heavily affected by internal control and audit
weaknesses. The percentage of FBO branches whose examination reports
we reviewed varied from a high of about 30 percent of all FBO
branches in 1993 to about 20 percent in 1996.
This methodology provided data on the extent of serious internal
control weaknesses that were included in enforcement actions in
low-rated FBO branches. It was not designed to provide the extent of
all types of internal control weaknesses. We reviewed examination
reports and enforcement actions from six Federal Reserve districts:
New York, San Francisco, Chicago, Atlanta, Boston, and Philadelphia.
We did not independently verify the information contained in the
examination reports.
We discussed our DCI results with Federal Reserve and New York State
Banking Department staff who identified those weaknesses they
considered to be among the most serious.
To provide perspective to the number of weaknesses cited in branches
of foreign banks, we also reviewed 190 examination reports from a
sample of similarly low-rated domestically chartered banks using the
same DCI. The domestically chartered banks were examined by the
Federal Reserve or jointly examined by the Federal Reserve and the
appropriate state supervisor. These banks were located in the New
York, San Francisco, Chicago, and Atlanta Federal Reserve districts.
To describe the concerns of U.S. supervisors that were raised by FBO
branches' internal control and audit weaknesses and the efforts by
U.S. supervisors and others to address these concerns, we
interviewed staff from federal and state supervisory agencies to
obtain their views on the seriousness of the weaknesses reported, the
risks posed by these weaknesses, and the efforts of federal and state
supervisors to address them. We also reviewed supervisory guidance
detailing efforts to improve oversight of FBO branches.
We conducted our work in Washington, D.C.; New York; Chicago;
Atlanta; San Francisco; and Miami between July 1996 and June 1997 in
accordance with generally accepted government auditing standards.
We requested comments on a draft of this report from the Federal
Reserve Board, which provided written comments. A discussion of
these comments appears at the end of chapter 4. The Federal Reserve
Board's comments are reproduced in appendix II. In addition, Federal
Reserve staff provided technical comments, which we incorporated in
this report where appropriate.
U.S. BANK SUPERVISORS EXPECT
INTERNAL CONTROLS THAT ENABLE
TIMELY DETECTION OF ANY
SIGNIFICANT ERRORS OR
IRREGULARITIES
============================================================ Chapter 2
According to the examination manual, supervisory agencies in the
United States expect each U.S. FBO branch to have internal controls
consistent with the size and complexity of its operations as well as
an independent internal audit function and/or adequate audit coverage
by the head office\1 or external auditors. The examination manual
states that an underlying objective of this supervisory policy is to
preserve the "high standards, efficiency, and confidence in U.S.
markets." Supervisors told us that if this policy was not applied to
FBO branches, the integrity of business practices within the market
could be undermined. These officials said that such a result was a
greater concern than the potential for systemic risk associated with
losses from unauthorized or illegal activity at an FBO branch.\2
From a supervisory perspective, good internal control exists when no
one at an FBO branch is in a position to make significant errors or
perpetuate significant irregularities without timely detection. In
assessing an FBO branch's internal controls, supervisors are to
consider (1) the adequacy of these controls and the level of
adherence to them; (2) the frequency, scope, and adequacy of the
branch's internal and external audit function; (3) the number and
severity of internal control and audit exceptions; (4) whether
internal control and audit exceptions are effectively tracked and
resolved in a timely manner; (5) the adequacy and accuracy of
management information reports; and (6) whether the system of
controls is regularly reviewed to keep pace with changes in the FBO
branch's business plan and laws and regulations. In addition,
supervisors are to evaluate whether an FBO branch's internal controls
for regulatory reporting help ensure that all required reports are
submitted on time and are accurate.
--------------------
\1 The head office is the headquarters of the FBO.
\2 Systemic risk is the possibility that failure of one or more
financial organizations will trigger a chain reaction and cause the
collapse of other financial organizations. A chain reaction of
failures could take place because of linkages between and among
markets and due to participation by the same institutions in several
markets. Systemic risk is the risk that a disturbance could severely
impair the workings of the financial system and, at the extreme,
cause a complete breakdown. A breakdown in capital markets could
disrupt the process of savings and investment, undermine the
long-term confidence of private investors, and cause turmoil in the
normal course of economic transactions.
EFFECTIVE INTERNAL CONTROLS AND
AUDITS ARE ESSENTIAL TO
PRESERVING THE INTEGRITY OF THE
U.S. FINANCIAL SYSTEM
---------------------------------------------------------- Chapter 2:1
According to the Federal Reserve Board Chairman, the U.S. financial
system is strong and vibrant, in large part because the United States
demands that financial institutions participating in its markets
operate with integrity and that any information made available to
depositors and investors be accurate. When confidence in the
integrity of a financial institution is shaken or its commitment to
the honest conduct of business is in doubt, public trust erodes and
the entire system is weakened. Within this context, the Chairman
said that termination of the Daiwa Bank's U.S. operations was
necessary because such behavior by a financial institution could
cause significant damage to the integrity of the U.S. financial
system.
The Chairman also stated that what is true for the financial system
in general is also particularly true for the supervision of financial
institutions. The whole system of supervision proceeds upon the
basis of trust, whether in terms of the representations or reports
filed by management or in terms of transparency with regard to any
material developments affecting the financial condition of the
institutions. Supervisors need to trust the ability of bank
management to carry out their duties in a responsible and honest
manner with adherence to systems and internal controls designed to
ensure the safe and sound conduct of business.
Supervisory officials reiterated this theme to us in explaining the
importance of internal controls and explaining their concerns about
weaknesses in the internal control and audit functions. The
officials said that FBO branches must be held to the same standards
as their U.S. competitors or an erosion of the integrity of business
practices within the market could occur. They also said that
allowing FBO branches to operate under weaker requirements than
domestic banks could undermine the policy of national treatment.
The potential for erosion of the integrity, confidence, and
efficiency in U.S. financial markets was a greater concern to the
supervisors than the potential for systemic risk associated with
losses from unauthorized or illegal activity at an FBO branch.
Although the officials acknowledged the potential for systemic risk
should a foreign bank with substantial obligations to U.S.
institutions fail because of losses incurred by one of its U.S. FBO
branches, they believed the risk was minimal.
ADEQUACY AND ADHERENCE TO
INTERNAL CONTROL REQUIREMENTS
IS AN IMPORTANT FOCUS OF
EXAMINATION GUIDANCE
---------------------------------------------------------- Chapter 2:2
In conducting examinations of FBO branches, supervisors are guided in
part by the examination manual, which was prepared under the
direction of the Federal Reserve.\3 According to the examination
manual, the key objectives in examining FBO branches are to
-- determine the adequacy of the system of internal control and of
FBO branch policies, practices, and procedures;
-- evaluate the scope and adequacy of the internal control
environment and audit function;
-- determine compliance with laws, regulations, and rulings; and
-- evaluate adherence with internal policies and procedures.
In general, good internal control exists when no one is in a position
to make significant errors or perpetrate significant irregularities
without timely detection, according to the examination manual. The
examination manual contains control procedures that are to help
ensure that no one is in a position to make significant errors or
perpetrate significant irregularities without timely detection.
These procedures fall into the following five categories:
-- Proper authorization of transactions and activities.
-- Segregation of duties, which reduces opportunity for any person
to both perpetrate and conceal errors or irregularities in the
normal course of his or her duties. Segregation of duties often
means assigning different people the responsibilities of
authorizing transactions, recording transactions, and
maintaining custody of assets.
-- Design and use of adequate documents and records to help ensure
the proper recording of transactions and events.
-- Adequate safeguards over access to and use of assets and
records, such as secured facilities and authorization for access
to computer programs and data files.
-- Independent checks on performance and proper valuation of
recorded amounts, such as clerical checks, reconciliations,
comparison of assets with recorded accountability, computer
programmed controls, management review of reports that summarize
the detail of account balances, and user review of
computer-generated reports. One method of ensuring an
independent check on performance is requiring that employees in
sensitive positions be absent from their duties for a minimum
number of consecutive days (often 2 weeks). Employees in
sensitive positions include those with financial
responsibilities that can influence the accuracy of the
accounting and financial records or those with access to assets.
In assessing the internal controls of an FBO branch, supervisors seek
to determine not only that the FBO branch has established the
necessary control policies and procedures but also that these
controls are carried out by competent people who do not have
incompatible duties. An example of incompatible duties in control
procedures related to credit activities would be the maintenance of
records of charged-off loans by a person who also has custody of the
notes or receives payment. To make their assessments, supervisors
are to review the duties of key employees and evaluate their ability
to perform their duties by reviewing their educational experiences
and job performances.
--------------------
\3 The examination manual is to be followed by federal and state
supervisors when conducting examinations of FBO branches. The
examination manual is divided into sections dealing with particular
banking activities and each section generally includes subsections
providing overviews, examination objectives, examination procedures,
internal control questionnaires, and audit guidelines.
FBO BRANCHES ARE EXPECTED TO
HAVE INDEPENDENT INTERNAL
AUDITS AND/OR ADEQUATE HEAD
OFFICE OR EXTERNAL AUDITS
---------------------------------------------------------- Chapter 2:3
U.S. supervisors expect FBO branches to have an independent internal
audit function and/or adequate audit coverage by the head office or
external auditors. Internal audits should ensure that operations are
conducted in accordance with internal guidelines and supervisory
policies and that all reports and analyses provided to the head
office, FBO branch senior management, and supervisors are timely and
accurate. Internal auditors are responsible for assessing the
soundness and adequacy of an FBO branch's controls to ensure that
they promptly and accurately record transactions and properly
safeguard assets against loss.
SCOPE AND FREQUENCY OF
INTERNAL AUDITS
-------------------------------------------------------- Chapter 2:3.1
The examination manual states that the scope of the program of
internal audit must be sufficient to attain the audit objectives. In
assessing the scope of the audit, supervisors are to consider whether
all important FBO branch functions and services are included in the
audit scope and whether the audit program includes procedures that
are necessary to reasonably ensure compliance with applicable U.S.
law and regulations. The frequency with which the audit procedures
are performed is to be based on an evaluation of the risk associated
with each area of audit interest. Among the factors that the auditor
should consider in assessing risk are the following:
-- the nature of the specific operation of the specific assets and
liabilities under review,
-- the existence of appropriate policies and internal control
standards,
-- the effectiveness of operating procedures and internal controls,
and
-- the potential materiality of errors or irregularities associated
with the specific operation.
INDEPENDENCE OF INTERNAL
AUDITORS
-------------------------------------------------------- Chapter 2:3.2
In reviewing and evaluating the internal audit function, U.S.
supervisors are to consider, among other things, the independence of
the internal auditors. The ability of the internal audit function to
achieve its audit objectives depends, in large part, on the extent of
such independence. According to the examination manual, the
independence of internal auditors can frequently be determined by the
reporting lines within the organization and to whom or at what level
audit results are reported. In most circumstances, the internal
audit function at the FBO branch is to be under the ultimate
direction of the FBO's chief internal auditor and/or executive
management or a committee thereof. The examination manual states
that to be considered independent, the internal auditor should be
given the authority to perform the job, including free access to any
records necessary for the proper conduct of the audit. Furthermore,
internal auditors generally should not have responsibility for
supervising the accounting system, other aspects of the FBO branch's
accounting function, or any operational function.
EFFECTIVENESS OF THE
INTERNAL AUDIT PROGRAM
-------------------------------------------------------- Chapter 2:3.3
In reviewing and evaluating the internal audit function, U.S.
supervisors are also to assess the effectiveness of the internal
audit program. In addition to considering the scope and frequency of
the work performed, supervisors are to consider the following two
factors, among others, in assessments for effectiveness:
-- Documentation of the work performed. Work programs should be
written and individual audit procedures should be presented in a
logical manner. Each program should provide a clear, concise
description of the audit work required, analyses that clearly
indicate the procedures performed, the extent of testing, and
the basis for conclusions reached.
-- Management's response to the findings. A measurement of the
program's effectiveness is a prompt and effective management
response to the auditor's recommendations.
According to the examination manual, head office management of the
FBO should require that FBO branch management respond formally to
audit findings and take appropriate corrective action. Management is
expected to respond to all internal and external audits and
supervisory examinations. Management responses should be timely and
address all findings in the reports, unless specifically noted in the
audit report that a response is not necessary. Responses should
include concrete solutions that have already been put in place or
that will be implemented in a timely manner. Management is to
immediately respond to repeat problems noted in the audit report.
EXTERNAL AUDITS HELP ENSURE
ACCURACY OF FINANCIAL
STATEMENTS AND HELP DETECT
CONDITIONS THAT COULD
ADVERSELY AFFECT BANKING
ORGANIZATIONS OR THE PUBLIC
-------------------------------------------------------- Chapter 2:3.4
According to the examination manual, external audits enhance the
probability that financial statements and reports to regulatory
authorities and other financial statement users will be accurate and
help detect conditions that could adversely affect banking
organizations or the public. The independent audit process also
subjects the internal controls and the accounting policies,
procedures, and records of each banking organization to periodic
review.
The objective of an external financial audit is different from the
objectives of an internal audit or an FBO branch examination.
Therefore, the supervisor is interested in the work performed by
external auditors for three principal reasons. First, supervisors
may find that internal audit work is not being performed or that such
work is deemed to be of limited or no value to the supervisor.
Second, the work performed by external auditors may affect the amount
of testing that the supervisor must perform. Third, audits and other
reports rendered by external auditors may provide the supervisor with
information that is pertinent to the examination of the FBO branch.
According to the examination manual, the major factors that should be
considered in evaluating the work of external auditors are similar to
those factors that are applicable to internal auditors, that is, the
competence and independence of the auditors and the adequacy of the
audit program.
Federal Reserve officials we interviewed said internal auditors can
play an important role in the external audit. That is, if an FBO
branch has a good internal audit, the external auditor can limit the
amount of testing it has to do, thereby decreasing its volume of work
and allowing it to concentrate on other areas.
SUPERVISORS EXPECT INTERNAL
CONTROLS TO HELP ENSURE
TIMELY AND ACCURATE
REGULATORY REPORTS
-------------------------------------------------------- Chapter 2:3.5
The examination manual states that an FBO branch's internal control
program for supervisory reports is to ensure that all required
reports are submitted on time and are accurate. U.S. supervisors
rely on the timely and accurate filing of supervisory reports by
domestic and foreign financial institutions. Data collected from
supervisory reports are to (1) facilitate early identification of
problem situations that can threaten the safety and soundness of
reporting institutions, (2) ensure timely implementation of the
prompt corrective action provisions of banking legislation, and (3)
serve other legitimate supervisory purposes. In addition, accurate
regulatory reports allow supervisors to better target examination
resources.
Supervisors are required to discuss in the examination reports of FBO
branches any material errors or the filing of late regulatory
reports. According to the examination manual, Reserve Bank staff are
also to be notified of any regulatory report filing that is
considered misleading. A misleading report could involve some degree
of knowing or reckless behavior on the part of the filer and the
intentional or negligent submission of inaccurate information to the
Federal Reserve. On the other hand, a false report could involve the
submission of mathematically incorrect data, such as addition errors
or transpositions, the submission of call reports (Report of Assets
and Liabilities) without appropriate schedules, or the inadvertent
filing of inaccurate information.
A SIGNIFICANT NUMBER OF FBO
BRANCHES RATED FAIR OR LOWER HAD
SERIOUS INTERNAL CONTROL AND AUDIT
WEAKNESSES
============================================================ Chapter 3
The results of our analysis of examination reports of the 254 FBO
branches rated fair, marginal, and unsatisfactory (i.e., 3, 4, or 5)
from January 1993 to June 1996 indicate that a significant number of
these FBO branches were reported to have serious weaknesses in
internal controls, and that a majority of the FBO branches had at
least 1 serious audit weakness. Generally, FBO branches engaged in
trading as a major line of business had a greater number of internal
control and audit weaknesses than nontrading FBO branches.
Twenty-eight percent of the FBO branches in our study were reported
to have inadequate segregation of duties in trading and/or EFT
activities--which are weaknesses that supervisors we interviewed
identified as among the most serious weaknesses in control
procedures. These weaknesses can heighten risk of losses due to
misconduct, including unauthorized trading and misappropriation of
funds, as occurred at Daiwa Bank. Other serious internal control
weaknesses cited in the examination reports included lack of dual
control and independent verification in trading and/or EFT, lack of
security and access restrictions in EFT, and failure to ensure that
employees in sensitive positions were absent for a minimum number of
consecutive days to allow another employee the opportunity to detect
improper actions.\1
Ideally, FBO branch management learns of control weaknesses through
appropriately designed audits and other means, then strengthens
controls, and finally conducts periodic audits to verify that the
controls are operating as designed. However, 69 percent of the FBO
branches in our study were reported to have audits of inadequate
scope, indicating that the audit did not cover all of the FBO
branch's activities that supervisors believed should have been
covered. Other serious audit weaknesses included inadequate
frequency of audits, inadequate response to audit criticisms, and
inadequate audit independence.
Subsequent examinations showed that FBO branch management did not
correct audit weaknesses in response to supervisory examinations at
many FBO branches. For example, 53 percent of the 171 FBO branches
with audits of inadequate scope that were examined more than once in
our study period were found to have audits of inadequate scope in
subsequent examinations.
To better understand the seriousness of our findings of internal
control weakness at the FBO branches, we compared the FBO branch
findings with examination findings for a sample of U.S. domestic
banks. The comparison was limited because the FBO branches had
usually engaged in a greater variety of major business activities
than the U.S. domestic banks, and more than one-half of the FBO
branches had engaged in trading activities while only one of the U.S.
domestic banks had. The comparison showed that domestic banks tended
to have fewer identified internal control weaknesses than FBO
branches.
--------------------
\1 The Federal Reserve generally recommends that employees be absent
for 2 consecutive weeks.
SERIOUS INTERNAL CONTROL
WEAKNESSES EXPOSED A
SIGNIFICANT NUMBER OF FBO
BRANCHES TO RISK OF LOSSES FROM
MISCONDUCT
---------------------------------------------------------- Chapter 3:1
To determine the extent of weaknesses in internal controls at FBO
branches in the United States, we identified weaknesses that, because
of their seriousness, prompted supervisory action. We developed a
DCI that was designed to collect, from supervisory examination
reports, the extent of serious internal control weaknesses and other
FBO branch-specific information, such as assigned ratings, major
lines of business, and asset size. We discussed our preliminary
findings with supervisory staff from the Federal Reserve and New York
state, who then helped us further narrow our focus to those
weaknesses they considered to be among the most serious as we
continued our analysis.
Those weaknesses, which were cited in a significant number of FBO
branches, included inadequate segregation of duties, lack of dual
control and independent verification in trading activity and EFT,
lack of security and/or access restrictions in EFTs, inadequate
safekeeping and/or documentation in trading activities, and the
failure to ensure that employees in sensitive positions were absent
for a minimum number of consecutive days. The number of FBO branches
rated fair or lower that were reported to have these weaknesses is
summarized in table 3.1.
Table 3.1
Internal Control Weaknesses U.S.
Supervisors Identified as Among the Most
Serious Reported in FBO Branches in the
United States, Rated Fair, Marginal, or
Unsatisfactory During January 1993 to
June 1996
Percentage of
FBO branches
Internal control weaknesses supervisors Number of FBO rated fair or
identified as among the most serious branches lower
---------------------------------------- ------------- -------------
Inadequate segregation of duties 72 28%
in trading and/or EFT
activities
Lack of dual control and 53 21
independent verification in
trading and/or EFT activities
Lack of security and access 57 22
restrictions in EFTs
Employee(s) in sensitive 56 22
positions were not absent for
a minimum number of consecutive
days
Inadequate safekeeping and/or 39 15
documentation in trading
activities
Inadequate security and access 16 6
restrictions for accounting
system software
----------------------------------------------------------------------
Note: We reviewed the examination reports for all FBO branches
assigned a composite AIM or ROCA rating of three, four, or five from
January 1993 to June 1996 as well as FBO branches with higher
composite ratings that had ratings of three, four, or five in
components that are heavily affected by internal control and audit
weaknesses. The percentage of FBO branches whose examination reports
we reviewed varied from a high of about 30 percent of all FBO
branches in 1993 to about 20 percent in 1996. The total number of
FBO branches included in our analysis over the 3-1/2 year period was
254.
Source: GAO analysis of U.S. supervisory examination reports.
TWENTY-EIGHT PERCENT OF THE
FBO BRANCHES WERE REPORTED
TO LACK ADEQUATE SEGREGATION
OF DUTIES IN TRADING AND/OR
EFT ACTIVITIES
-------------------------------------------------------- Chapter 3:1.1
As summarized in table 3.1, the results of our analysis of
examination reports of the 254 FBO branches rated fair, marginal, or
unsatisfactory from January 1993 to June 1996 indicate that 28
percent (72) of the 254 FBO branches were reported to lack adequate
segregation of duties in trading and/or EFT activities. Inadequate
segregation of duties in these activities is among the most serious
internal control weaknesses because it heightens risk of losses due
to misconduct, including unauthorized trading and misappropriation of
customer and bank funds, and has been recognized as a factor in
serious financial losses, such as those suffered by Daiwa Bank and
Barings PLC. Federal Reserve officials we interviewed said that a
lack of segregation of duties is particularly important in trading
and EFT activities because these activities involve the movement of
potentially large sums of money.
One examination report we reviewed described a segregation of duties
weakness involving trading as follows: "Segregation of duties
between back office and trading remains a serious concern. The lack
of a completely independent back office prevents FBO branch and head
office management from ensuring compliance with policies and
procedures, and effectively monitoring and controlling trading risk."
Another examination report described the weakness for electronic
funds transfers as follows: "Segregation of duties and controls over
the systems security administration of the wire transfer and treasury
operations are unsatisfactory and compromise the safety and soundness
of the FBO branch." Another report stated the following: "An absence
of segregation of duties was identified in the agency's payment order
operation. Both the agency's teller and manager of operations can
independently input, verify, release, amend, and cancel wire
transfers. This situation exposes the agency to undue risk of fraud
or misappropriation of customer funds."
Of the 72 FBO branches found to lack adequate segregation of duties,
43 were reported to have weaknesses in segregation of duties in EFT
activities, and 39 were reported to have weaknesses in trading
activities. Ten of these FBO branches had both weaknesses during the
study period.
TWENTY-ONE PERCENT OF THE
FBO BRANCHES WERE REPORTED
TO LACK DUAL
CONTROL/INDEPENDENT
VERIFICATION IN TRADING
AND/OR EFT ACTIVITIES
-------------------------------------------------------- Chapter 3:1.2
We found that 21 percent (53) of the FBO branches rated fair or lower
were reported to lack dual control and independent verification in
trading and/or EFT activities. Dual control is an internal control
procedure that is intended to provide an independent check on
performance or proper valuation of recorded amounts. For example,
some functions, such as electronically transferring (wiring) funds
out of the institution, may be permitted only if done by two
individuals simultaneously. In other cases, it might be appropriate
for a single individual to carry out a specific function, with
another person independently verifying that the function was done
properly.
Inadequate independent verification in an FBO branch's trading
activities was described as follows in an examination report we
reviewed: "All trades are recorded on audio tape. However, the
foreign exchange trader has access to the tapes. The tapes should be
controlled independently of the foreign exchange trader." Another
examination report described the proper storage of test keys, which
are used to verify wire transfer orders, as follows: "Test keys for
the wire transfer area should be stored in an area physically
separate from the rest of branch operations. Test keys should be
secured when not in use and should not be accessible to employees not
directly involved in the testing of incoming messages or payment
orders."
TWENTY-TWO PERCENT OF THE
FBO BRANCHES WERE REPORTED
TO LACK SECURITY AND/OR
ACCESS RESTRICTIONS IN EFTS
-------------------------------------------------------- Chapter 3:1.3
The results of our analysis showed that 22 percent (57) of the FBO
branches were reported to lack security and/or access restrictions in
EFTs. This type of internal control requires security, usually in
the form of physical or electronic restrictions, on access to
information or machinery that could potentially be used to do
financial harm to individuals or the institution. Like dual
control/independent verification in EFTs, security and/or access
restrictions in EFTs help mitigate the risk of losses due to
unauthorized transfers of bank or customer funds. One examination
report we reviewed instructed FBO branch management that "Access
controls for the wire transfer terminals remain inadequate.
Management should ensure that access to these terminals is properly
restricted."
TWENTY-TWO PERCENT OF FBO
BRANCHES WERE REPORTED AS
FAILING TO ENSURE THAT
EMPLOYEES IN SENSITIVE
POSITIONS WERE ABSENT FOR A
MINIMUM NUMBER OF
CONSECUTIVE DAYS
-------------------------------------------------------- Chapter 3:1.4
We found that 22 percent (56) of the FBO branches were reported as
failing to ensure that employees in sensitive positions were absent
for a minimum number of consecutive days. This is a control
procedure that was found lacking in Daiwa Bank before disclosure of
its losses. As previously mentioned in chapter 2, this policy is a
way of ensuring an independent check on performance, since the
employee's absence would subject his or her activities to scrutiny by
others. Employees in sensitive positions are those that have
financial responsibilities that can influence the accuracy of the
accounting and financial records or have access to assets.
FIFTEEN PERCENT OF THE FBO
BRANCHES WERE REPORTED TO
HAVE INADEQUATE SAFEKEEPING
AND/OR DOCUMENTATION IN
TRADING ACTIVITIES
-------------------------------------------------------- Chapter 3:1.5
We found that 15 percent (39) of the FBO branches were reported to
have inadequate safekeeping and/or documentation in trading
activities. Supervisors identified safekeeping and/or documentation
in trading activities as important in mitigating legal risk in
trading activities in the United States. Supervisory officials we
interviewed said that problems with documentation and safekeeping
could present a legal risk in the event of litigation. They said
that foreign banks often do not understand this risk. Customers in
some countries, the officials said, would never consider suing a
bank, but in the United States, this is a very real risk.
SIX PERCENT OF FBO BRANCHES
WERE REPORTED TO HAVE
INADEQUATE SECURITY AND
ACCESS RESTRICTIONS FOR
ACCOUNTING SYSTEM SOFTWARE
-------------------------------------------------------- Chapter 3:1.6
We found that 6 percent (16) of the FBO branches were reported to
lack adequate security and/or access restrictions for accounting
system software. This type of internal control requires security,
usually in the form of physical or electronic restrictions, on access
to information or machinery that could potentially be used to do
financial harm to individuals or the FBO branch. Security and access
restrictions for accounting system software can help prevent
manipulation of accounting records to conceal misconduct.
A SUBSTANTIAL NUMBER OF FBO
BRANCHES HAD SERIOUS AUDIT
WEAKNESSES
---------------------------------------------------------- Chapter 3:2
As discussed in chapter 2, audits help management ensure that all
operations are conducted in accordance with internal guidelines and
supervisory policies, and that all reports and analyses provided to
the FBO head office and branch senior management are timely and
accurate. The role that audits play in helping to ensure effective
control procedures was confirmed by our statistical analysis of the
examination reports of 254 FBO branches rated fair or lower. The
analysis showed that reports of audit weaknesses generally indicated
larger numbers of internal control weaknesses. FBO branches with one
or more audit weaknesses tended to have more internal control
weaknesses than FBO branches that had no audit weaknesses. Federal
Reserve staff we interviewed said that it was no surprise to them
that FBO branches that do not adequately police themselves would have
more internal control weaknesses. They said that strong audits are
important to help ensure safety and soundness, in part, because it
will never be possible for supervisors to pick up everything in an
examination.
As summarized in table 3.2, a majority of the 254 FBO branches rated
fair or lower had at least 1 serious audit weakness. Sixty-seven
percent of the FBO branches in the study were reported to have audits
of inadequate scope; 41 percent had inadequate frequency of audits,
28 percent had inadequate response to audit criticisms, 26 percent
had inadequate audit independence, 24 percent had inadequate
workpapers/documentation, and 9 percent had a lack of adequate
supervision by the head office.
Table 3.2
Audit Weaknesses U.S. Supervisors
Identified as Among the Most Serious
Reported in FBO Branches in the United
States, Rated Fair, Marginal, or
Unsatisfactory During January 1993 to
June 1996
Audit weaknesses U.S. Percentage of FBO
supervisors identified as Number of FBO branches rated
among the most serious branches fair or lower
------------------------------ ------------------ ------------------
Inadequate scope of 171 67%
audit coverage
Inadequate 103 41
frequency of
audits
Inadequate response 71 28
to audit
criticisms
Inadequate audit 67 26
independence
Inadequate 62 24
workpapers or
documentation
Lack of head office 23 9
supervision
----------------------------------------------------------------------
Note: We reviewed the examination reports for all FBO branches and
agencies assigned a composite AIM or ROCA rating of three, four, or
five from January 1993 to June 1996 as well as FBO branches with
higher composite ratings that had fair to low ratings in components
that are heavily affected by internal control and audit weaknesses.
The percentage of FBO branches whose examination reports we reviewed
varied from a high of about 30 percent of all FBO branches in 1993 to
about 20 percent in 1996. The total number of FBO branches rated
fair or lower included in our analysis over the 3-1/2 year period was
254.
Source: GAO analysis of U.S. supervisory examination reports.
SIXTY-SEVEN PERCENT OF THE
FBO BRANCHES WERE REPORTED
TO HAVE INADEQUATE SCOPE OF
AUDIT COVERAGE
-------------------------------------------------------- Chapter 3:2.1
The results of our analysis indicated that 67 percent (171) of the
FBO branches rated fair or lower were reported to have inadequate
scope of audit coverage. This audit weakness compromises the ability
of management to ensure that all operations are conducted in
accordance with internal guidelines and supervisory policies, and
that all reports and analyses provided to the head office and FBO
branch senior management are timely and accurate. In assessing this
aspect of an audit, supervisors seek to determine if all important
FBO branch functions and services are included in the audit scope and
whether the audit program includes procedures necessary to reasonably
ensure compliance with applicable U.S. laws and regulations.
Supervisory officials we interviewed agreed that inadequate scope of
audit coverage and other audit weaknesses we discuss in this section
of the report are among the most serious weaknesses in the internal
controls of FBO branches.
We also found that inadequate scope of audit coverage was the most
frequently reported recurring weakness. Of the 171 FBO branches that
were reported to have inadequate scope of audit coverage, 116 were
examined more than once from January 1993 to June 1996. Over
one-half (61) of these 116 FBO branches had recurring reports of
inadequate scope of audit coverage. This may be explained in
part--as suggested by supervisory officials we interviewed--by the
increasing complexity in the industry and the fast rate of change in
the banking system, which requires institutions to continually
reassess their risks and the appropriate audit coverage.
FORTY-ONE PERCENT OF THE FBO
BRANCHES WERE REPORTED TO
HAVE INADEQUATE FREQUENCY OF
AUDITS
-------------------------------------------------------- Chapter 3:2.2
We found that 41 percent (103) of the FBO branches rated fair or
lower were found by supervisors to have audits of inadequate
frequency. As discussed in chapter 2, the frequency with which the
audit procedures are performed should be based on an evaluation of
the risk associated with each area of audit interest. Of the 116 FBO
branches that were examined more than once from January 1993 to June
1996, 19 were cited for inadequate frequency of audits more than
once. This weakness was described in an examination report as
follows: "The agency does not employ an independent auditor to
conduct internal control reviews, and head office audits are
infrequent. There is no assurance that annual audits are to be
performed in the future."
TWENTY-EIGHT PERCENT OF THE
FBO BRANCHES WERE REPORTED
TO HAVE INADEQUATE RESPONSE
TO AUDIT CRITICISMS
-------------------------------------------------------- Chapter 3:2.3
The results of our analysis indicated that 28 percent (71) of the 254
FBO branches rated fair or lower, were reported to have inadequate
response to audit criticisms. Supervisory staff we interviewed
agreed that inadequate response to audit criticisms is among the most
serious of audit weaknesses and could be indicative of poor
management. This weakness also compromises the ability of management
to ensure that all operations are conducted in accordance with
internal guidelines and supervisory policies, and that all reports
and analyses provided to the head office and FBO branch senior
management are timely and accurate.
TWENTY-SIX PERCENT OF THE
FBO BRANCHES WERE REPORTED
TO HAVE INADEQUATE AUDIT
INDEPENDENCE
-------------------------------------------------------- Chapter 3:2.4
We found that 26 percent (67) of FBO branches rated fair or lower
were reported to have inadequate audit independence, which can
compromise the objectivity of auditors and thus the reliability of
audit work. Supervisory staff we interviewed said that inadequate
audit independence is also among the most serious of weaknesses. An
examination report described one instance of this as follows: "Audit
findings were submitted to the general manager of the FBO branch
instead of directly to the senior internal auditor at the regional
office in contravention of bank policy."
TWENTY-FOUR PERCENT OF THE
FBO BRANCHES WERE REPORTED
TO HAVE INADEQUATE AUDIT
WORKPAPERS OR DOCUMENTATION
-------------------------------------------------------- Chapter 3:2.5
We found that 24 percent (62) of the FBO branches rated fair or lower
were reported to have inadequate audit workpapers or documentation.
This audit weakness is a serious internal control weakness because
without such paperwork, supervisors cannot assess the adequacy and
the effectiveness of the internal audit program.
NINE PERCENT OF THE FBO
BRANCHES WERE REPORTED TO
LACK ADEQUATE SUPERVISION BY
HEAD OFFICE
-------------------------------------------------------- Chapter 3:2.6
We found that 9 percent (23) of the FBO branches were reported to
lack adequate supervision of audits by the FBO branch's head office.
Supervisors said that this weakness is a serious concern because it
could suggest generally inadequate oversight of the FBO branch by the
head office. One examination report presented this weakness as
follows: " . . . Equally as disturbing is the failure of the
senior internal auditor to forward all audit reports to the head
office. It appears that head office has taken little action with
regard to this lack of response."
Appendix I contains the summary results of our overall data
collection effort.
CERTAIN CHARACTERISTICS OF FAIR
OR LOWER RATED FBO BRANCHES
WERE ASSOCIATED WITH HIGHER
NUMBERS OF INTERNAL CONTROL AND
AUDIT WEAKNESSES
---------------------------------------------------------- Chapter 3:3
As illustrated in figure 3.1, we found that FBO branches rated fair
or lower that engaged in trading as a major line of business tended
to have a higher number of serious internal control weaknesses than
nontrading FBO branches. In addition, FBO branches that engaged in
trading as a major line of business were more likely than nontrading
FBO branches to have specific types of serious internal control
weaknesses, including inadequate segregation of duties and audit
weaknesses, such as inadequate scope and frequency of audits.
Figure 3.1: Trading FBO
Branches Had More Internal
Control Weaknesses Than
Nontrading FBO Branches
(See figure in printed
edition.)
Note: The number of branches does not equal 254 because we could not
determine the lines of business in 6 cases.
Source: GAO analysis of U.S. supervisory examination reports.
Federal Reserve staff we interviewed told us that they expect trading
FBO branches to have more internal control weaknesses because trading
is a complex, high-speed activity that requires sophisticated
internal controls and a certain number of staff to adequately
implement them. In addition, depending on the size of an FBO
branch's operations, its back office, where it tracks and records
trades, could be thinly staffed. That is, smaller FBO branches might
engage in trading but may not have sufficient support staff because
of the costs of hiring them.
An examination report we reviewed illustrated the importance of
adequate internal controls over an FBO branch's trading operations.
It stated as follows: "Lack of controls led to an environment where
agency management was able to conduct unauthorized trading that
resulted in $22.3 million in losses."
As illustrated in figure 3.2, we also found that FBO branches rated
fair or lower that had more lines of business tended to have a higher
number of serious internal control weaknesses.
Figure 3.2: FBO Branches With
More Lines of Business Had More
Internal Control Weaknesses
Than FBO Branches With Fewer
Lines of Business
(See figure in printed
edition.)
Note: The number of branches does not equal 254 because we could not
determine the lines of business in 6 cases.
Source: GAO analysis of supervisory examination reports.
Among FBO branches rated fair or lower that engaged in a large number
of business activities (i.e., four or more), those with smaller
staffs had more internal control weaknesses than those with larger
staffs. Federal Reserve staff suggested that this may be because
smaller staffs that are stretched thin to accommodate a greater
variety of activities are generally more susceptible to internal
control weaknesses.
A LIMITED COMPARISON OF
EXAMINATION RESULTS INDICATED
THAT CERTAIN DOMESTIC BANKS HAD
FEWER INTERNAL CONTROL
WEAKNESSES
---------------------------------------------------------- Chapter 3:4
To provide some perspective to our findings of the extent of internal
control weaknesses in FBO branches, we also reviewed examination
reports from a sample of fair-to-unsatisfactory-rated U.S. domestic
banks. The U.S. domestic banks were all examined independently by
the Federal Reserve or jointly by the Federal Reserve and the
appropriate state supervisor, and they were located in the New York,
Chicago, San Francisco, and Atlanta Federal Reserve districts. We
did this to try to remove differences introduced by the agency
conducting the examination. The domestic banks differed from FBO
branches in several respects. The U.S. domestic banks tended to
engage in a smaller variety of businesses, primarily lending, while
only one in the sample did trading on behalf of customers. In
addition, the U.S. domestic banks generally were smaller, as
measured by asset size.
U.S. domestic banks from our sample had an average of 7.5 separate
internal control weaknesses reported, while FBO branches had an
average of 10.1. Domestic banks had an average of 1.2 audit
weaknesses reported, while FBO branches had an average of 2.5. Most
of the weaknesses reported for domestic banks involved their
credit-related operations. Thirty-one percent of domestic banks were
reported to have an inadequate segregation of duties in at least one
activity, compared to 48 percent of FBO branches. While 67 percent
of FBO branches were reported to have audits of inadequate scope, 40
percent of domestic banks were reported to have the same problem.
CONCLUSIONS
---------------------------------------------------------- Chapter 3:5
The results of our analysis of examination reports of the 254 FBO
branches rated fair or lower examined from January 1993 to June 1996
indicate that a significant number of the FBO branches were reported
to have serious internal weaknesses, and a majority of them had at
least 1 serious audit weakness. In our opinion, the numbers and
types of internal control and audit weaknesses found by supervisors
heighten the importance of recent supervisory attention to the
adequacy of internal control and audit processes at FBO branches, as
discussed in chapter 4. The Federal Reserve and other banking
supervisors told us they are taking steps to promote effective
internal controls and audits in FBO branches. According to the
Federal Reserve, its policies on addressing control weaknesses within
FBO branches are consistent with the supervisory policies it applies
to all of the institutions it supervises. These policies, according
to the Federal Reserve, are also intended to reduce the risk of
losses due to misconduct or fraud in FBO branches and to promote
prompt correction of situations that can lead to an unsafe and
unsound banking environment.
U.S. SUPERVISORS ARE TAKING
ACTIONS TO IMPROVE INTERNAL
CONTROLS AND AUDITS AT CERTAIN FBO
BRANCHES
============================================================ Chapter 4
In assessing the operational controls of FBO branches, the U.S.
supervisors' primary goal is to ensure that participation of the
branches in U.S. financial markets neither raises the level of
systemic risk nor undermines standards that help ensure the
efficiency of and confidence in U.S. markets. As weaknesses in
internal controls and audits of FBOs in the United States have been
highlighted by losses experienced by Daiwa Bank and other
multinational banks and trading houses, U.S. supervisors are
undertaking a variety of efforts consistent with meeting that goal.
The objectives of these efforts include helping to ensure (1) the
detection of losses that have occurred as the result of a branch's
weaknesses in internal controls and audits, (2) the timely correction
by branches of serious weaknesses in internal controls and audits,
(3) an increased understanding among multinational banks of the
importance of adequate internal controls and audits, and (4) the
preparedness of supervisors to conduct effective assessments of
internal controls.
U.S. SUPERVISORS SEEK TO
ENSURE DETECTION OF LOSSES THAT
HAVE OCCURRED AS THE RESULT OF
WEAKNESSES IN INTERNAL CONTROLS
AND AUDITS
---------------------------------------------------------- Chapter 4:1
To reduce the risk of losses due to misconduct or fraud in the U.S.
operations of FBOs and to promote prompt corrections of situations
that can cause an unsafe and unsound banking environment, the Federal
Reserve, in November 1996, released policy guidelines on special
audit procedures that are to be implemented in situations where
significant internal control weaknesses are detected in branches.\1
According to Federal Reserve guidance, a primary objective of special
audits is to determine whether internal control weaknesses have led
to unreported losses and the extent of any such losses. The new
guidance requires that auditors perform direct verification of those
areas identified by supervisors as having significant internal
control weaknesses along with some verification of key accounts in
other areas of the FBO branch that may have been affected by those
weaknesses. The guidance requires auditors to determine the accuracy
of reports filed by the FBO branch with U.S. supervisors.
Another objective of special audits is to identify the degree of
internal control deficiencies and the risks posed to the FBO branch
so that management can implement the appropriate corrective action on
both an interim and long-term basis. Auditors are required to report
on the type, nature, and extent of any significant internal control
weaknesses found during the audit. The audit is to concentrate on
the areas specifically criticized by supervisors; however, there is
also to be some review of internal controls in other significant FBO
branch operations. The engagement letter for the audit is to contain
target dates for interim and final reports. The coordinating Federal
Reserve Bank is to monitor the general progress of the audit, obtain
a copy of the final report, discuss with the Federal Reserve Board
staff any additional steps that should be taken, and prepare a brief
report of actions taken.
Federal Reserve guidance requires special audit procedures when both
the "O" rating and the composite ROCA rating are three or worse,
because such ratings indicate (1) that the overall condition of the
FBO branch is less than satisfactory and (2) that, at least in part,
the problems are due to internal control weaknesses. In some cases,
internal audit staff of the FBO branch may perform the audit.
However, if the adequacy of the internal audit at a particular FBO
branch is among the reasons why internal controls are considered to
be less than satisfactory, the procedures must be conducted by
regional or head office internal audit staff or by external auditors.
Additionally, external auditors are required to be used (1) if there
are extremely serious deficiencies in internal controls, as reflected
in an "O" rating of four or worse, and the composite rating is also
four or worse; (2) in cases where internal auditors had performed
special audit procedures and the current examination indicates the
FBO branch continues to be in less than satisfactory condition (i.e.,
"O" and composite rating of three or worse); or (3) in other
situations, if determined necessary after consultations with Federal
Reserve, other federal and state supervisory authorities, and the
home country supervisor.
Federal Reserve supervisors we interviewed told us they had recently
begun to require special audits when FBO branches have what they
consider to be significant internal control weaknesses. The
supervisors said they believe this special audit requirement will be
a valuable tool to help them detect potential unreported losses and
correct internal control weaknesses. However, the supervisors said
it was too early to provide specific examples of improvements.
--------------------
\1 In June 1997, the New York State Banking Department also
promulgated Part 5 of its General Regulations to require special
internal or external audits of FBO branches with significant internal
control weaknesses.
U.S. SUPERVISORS SEEK TIMELY
CORRECTION OF SERIOUS
WEAKNESSES IN INTERNAL CONTROLS
AND AUDITS
---------------------------------------------------------- Chapter 4:2
According to the examination manual, supervisors are to seek timely
correction of serious internal control and audit weaknesses through
the use of enforcement actions. Federal and state supervisors have
used their enforcement authority to direct FBO branches to correct
weaknesses in their internal controls and audits. Such actions
include cease-and-desist orders, memorandums of understanding,
commitment letters, and supervisory letters, among other actions,
that direct the institution to remedy specific weaknesses. Federal
Reserve staff told us that they may initially try to remedy problems
at FBO branches without taking enforcement action but will take
action where a weakness shows no improvement over multiple
examinations.
During the period of our review, U.S. supervisors took 282
enforcement actions against 185 FBO branches. The actions were of
varying levels of severity and included supervisory letters,
commitment letters, memorandums of understanding, written agreements,
cease-and-desist orders, and civil money penalties. Most of the
actions were less formal supervisory letters or commitment letters.
Supervisory staff said that the seriousness of the action taken often
depends on the seriousness or persistence of problems at the FBO
branch, but the action taken also is influenced by the attitude
displayed by FBO branch management toward improving its operations.
The supervisory staff said that there is no set formula that
determines whether to take an enforcement action or how severe of an
action to take.
Twenty-nine percent (82) of the 282 enforcement actions against FBO
branches were taken for the primary reason of inadequate internal
controls, and 6 percent (17) were for inadequate audits. In some
cases, supervisors initially took a less serious action and then
upgraded the seriousness of the action when the FBO branch failed to
improve. To contrast these numbers with U.S. domestic banks, 9
percent of the enforcement actions taken by the Federal Reserve
against domestic banks during the same period were for inadequate
internal controls, and less than 1 percent were for inadequate
audits. Of the 254 fair or lower rated FBO branches, 23 percent (59)
were under enforcement actions primarily for internal control or
audit weaknesses.
In addition to taking enforcement actions against FBO branches, the
Federal Reserve has been able to use one of its new products under
the FBO Program, which U.S supervisors began to implement in 1995, to
encourage FBOs to correct less serious internal control and audit
weaknesses.\2 The Summary of Condition and Combined Rating was
designed to provide FBO management with an overall assessment of the
FBO's U.S. operations. This product is to highlight the aspects of
the FBO's U.S. operations that need the most attention and is to be
sent directly to the foreign bank's head office. Staff at the
Federal Reserve told us that providing foreign bank management with a
summary of the condition of the FBO's U.S. operations and a combined
rating has helped them communicate more effectively with foreign bank
staff and has resulted in quicker and better compliance by the
foreign banks.
--------------------
\2 For more information on the FBO Program, see GAO/GGD-97-80.
U.S. SUPERVISORS SEEK AN
INCREASED UNDERSTANDING AMONG
MULTINATIONAL BANKS OF THE
IMPORTANCE OF ADEQUATE INTERNAL
CONTROLS AND AUDITS
---------------------------------------------------------- Chapter 4:3
In recent years, U.S. supervisors have sought to increase the
understanding among multinational banks of the importance of adequate
internal controls and audits. Federal Reserve staff told us that
they hold meetings with foreign bank and foreign supervisory staff to
discuss the importance of developing adequate internal controls.
They also conduct some training programs in which foreign supervisory
officials participate. According to Federal Reserve staff, this has
led to an increased awareness among the management of foreign banks,
both overseas and in the United States, and among foreign supervisors
of the importance of strong internal controls. Federal Reserve staff
also said that through these interactions, U.S. supervisors have
been able to assist both multinational banks and foreign supervisors
in upgrading their understanding and standards of internal controls
and audits.
U.S. and foreign supervisors, working through the Basle Committee on
Banking Supervision, have developed basic standards for internal
controls and audits.\3 For example, the Basle Committee's April 1997
paper entitled Core Principles for Effective Banking Supervision
states that "Banking supervisors must determine that banks have in
place internal controls that are adequate for the nature and scale of
their business." The paper describes the types of internal controls
that should be in place, and it also states that internal controls
must be supplemented by an effective audit that independently
evaluates the adequacy, operational effectiveness, and efficiency of
the internal controls within an organization.
--------------------
\3 The Basle Committee on Banking Supervision was established in 1974
in the aftermath of serious disturbances in the international
currency and banking markets. Its members come from the central
banks and supervisory authorities in Belgium, Canada, France,
Germany, Italy, Japan, Luxembourg, the Netherlands, Sweden,
Switzerland, the United Kingdom, and the United States. The Basle
Committee provides a forum for regular cooperation between member
countries on supervisory matters; however, it does not possess any
formal supranational supervisory authority, and its conclusions do
not have legal force.
U.S. SUPERVISORS SEEK TO
ENSURE THE PREPAREDNESS OF
SUPERVISORS TO CONDUCT
EFFECTIVE ASSESSMENTS OF
INTERNAL CONTROLS
---------------------------------------------------------- Chapter 4:4
Actions that U.S. supervisors have taken to help ensure the
preparedness of supervisors to conduct effective assessments of
internal controls include the following:
-- the development and implementation of the FBO Program, which is
expected to provide supervisors with, among other things, more
comprehensive information relevant to assessments of internal
controls and audits, as well as analysis and a ranking to
reflect the U.S. supervisors' judgment about the FBO's ability
to provide its U.S. operations with the necessary financial and
managerial support;
-- the development and implementation of an FBO branch rating
system, ROCA, that emphasizes risk management and operational
controls;
-- the development and use of the examination manual, which
provides specific and uniform guidance to all U.S. supervisors
with responsibility for FBO branch oversight, and the Trading
Activities Manual; and
-- the initiation of examiner training programs covering internal
controls, risk assessment, trading exposure management, and
advanced derivatives products.
FBO PROGRAM
-------------------------------------------------------- Chapter 4:4.1
The FBO Program is intended, in part, to help ensure the preparedness
of supervisors to conduct effective assessments of FBOs' U.S.
operations. The Federal Reserve began to implement the FBO Program
in March 1995, when it issued its initial guidance. Federal Reserve
officials told us that the FBO Program was scheduled to be
implemented over a 3- to 5-year period, but that they hoped to have
it fully operational within 3 years. As discussed in chapter 1, U.S.
supervisors developed five new products under the FBO Program for the
use of their examiners. These products were intended, in part, to
facilitate supervisors' ability to obtain comprehensive supervisory
information during examinations, including information relevant to
the assessments of internal controls and audits. These products
include the following:
-- Summary of Condition and Combined Rating. This product is
intended to provide U.S. supervisors with information about the
overall condition of the U.S. offices, including branches, of
individual FBOs, including information on control or audit
weaknesses, which can then be factored into their supervision of
the U.S. offices under their jurisdiction.
-- Annual Comprehensive Examination Plan. This plan is intended to
help better coordinate examinations of U.S. offices of FBOs
with multiple U.S. banking operations and/or significant U.S.
nonbanking operations.\4 U.S. banking supervisors we
interviewed reported many instances of increased coordination
and cooperation among federal and state supervisors, which is
important because problems, including internal control or audit
weaknesses, identified at a particular office could manifest
themselves at other offices of an FBO.
-- Review of Home Country Financial System and Review of
Significant Home Country Accounting Policies and Practices.
These products are to provide information about the financial
system and the supervisory and governmental policies in the
FBO's home country and information about significant accounting
policies and practices in the home country. For example, these
products might include information about a general lack of a
rigid internal auditing system in the financial institutions of
a particular country or about a country's lack of a history of
independent external auditors. This information may be useful
to U.S. supervisors for overseeing the U.S. operations of an
FBO from such a country.
-- Strength-of-Support Assessment (SOSA). The SOSA is to provide
an analysis and a ranking to reflect the U.S. supervisors'
judgment about the FBO's ability to provide its U.S. operations
with the necessary financial and managerial support. The SOSA
ranking is to categorize all FBOs with U.S. banking operations
by levels of supervisory concern, highlighting those whose U.S.
operations are thought to warrant higher levels of supervisory
attention. In some cases, an asterisk may be appended to a SOSA
ranking when there are concerns about the ability of the FBO to
maintain adequate internal controls and compliance procedures at
its U.S. offices.
--------------------
\4 The comprehensive examination plan is to cover all U.S.
operations of an FBO with banking offices licensed by more than one
supervisory agency and/or with significant U.S. nonbanking
activities with the exception of commercial banks, which are to be
treated as domestic institutions for the purpose of examination
planning during the initial implementation of the FBO Program.
RATING SYSTEM FOR FBO
BRANCHES
-------------------------------------------------------- Chapter 4:4.2
In 1994, U.S. supervisors began phasing in the replacement of the
previous asset-focused system of rating FBO branches, which was
called the AIM rating system, with the new ROCA rating system. By
the beginning of 1996, the ROCA rating system was fully phased in.
The ROCA rating system places greater emphasis on the effectiveness
of risk management processes and operational controls and was devised
to better assess the condition of a branch within the context of the
FBO. As we discussed in chapter 1, the ROCA rating system divides an
FBO branch's overall activities into three individual components:
risk management, operational controls, and compliance. These
components represent the major activities or processes of the FBO
branch that may raise supervisory concern. The ROCA rating system
also provides for a specific rating of the quality of the FBO
branch's stock of assets as of the examination date.
Supervisory staff we interviewed said the shift from a focus on asset
quality, under the AIM rating system, to a focus on risk management
and operational controls, under the ROCA rating system, was an
appropriate shift in emphasis. Staff said that the ROCA rating
system was designed to look forward, while the AIM rating system's
focus on assets was effectively a backward-looking approach because
asset quality reflects an institution's past business decisions.
Staff also said that they found that, to improve their examination
rating, some foreign banks had focused on manipulating asset
classification ratios and moving assets off the books of the branch
to the head office or another entity in the bank. Although asset
quality is still considered under the ROCA system, staff said it is
not the primary emphasis.
Officials representing the foreign banking industry also told us that
the ROCA rating system is a better measure of an FBO branch's
operations than was the AIM rating system. The officials said that
the change from the AIM rating system to the ROCA rating system
mirrored the way FBO branches had changed their businesses to focus
on better risk management strategies and operational controls. An
official from the Federal Reserve also told us that, although
domestic banks are rated under a different system than FBO
branches,\5 the use of ROCA is consistent with national treatment
because U.S. supervisors are still reviewing the same things that
they review in domestic banks.
--------------------
\5 U.S. domestic banks are rated under the CAMELS rating system.
The components of the CAMELS system are capital, assets, management,
earnings, liquidity, and sensitivity to market risk.
NEW EXAMINATION MANUALS
-------------------------------------------------------- Chapter 4:4.3
Along with the development of the ROCA rating system, the Federal
Reserve, in cooperation with other federal and state banking
agencies, developed the examination manual for conducting individual
examinations of FBO branches. This manual was drafted to provide a
common approach among all supervisory agencies with respect to
individual FBO branch examinations. The manual was initially sent
out for comment to U.S. supervisors in October 1993 and became
effective in January 1995. Its content was drawn in large part from
commercial bank examination procedures. However, all aspects of this
examination manual were drafted to specifically address the unique
characteristics of FBO branch examinations. Supervisory staff we
interviewed told us that this is the first examination manual to be
used by both state and federal supervisors for examinations of FBO
branches, and that this has resulted in more consistent examinations.
According to Federal Reserve officials, the examination manual has
also been widely used as a reference tool by the foreign banking
community in the United States to improve its internal controls. The
examination manual has also supplemented the U.S. supervisors'
efforts to inform foreign bankers and supervisors about U.S.
internal control and audit standards.
In 1994, the Federal Reserve also adopted a new Trading Activities
Manual. Although developed primarily for U.S. commercial banks, the
trading activities manual also applies to FBO branches, many of which
are actively engaged in transactions involving trading activities.
This manual includes detailed examination procedures for evaluating
controls in trading activities; for example, it emphasizes the
importance of separations of duties in a trading operation such as
Daiwa Bank's.
Federal Reserve staff also told us they are in the process of
developing a module for supervisors to use during examinations that
is intended to help the supervisors give a more risk focused approach
to their review of internal controls and audits. Federal Reserve
staff told us they would begin pilot testing this module during the
last quarter of 1997.
EXAMINER TRAINING
-------------------------------------------------------- Chapter 4:4.4
The Federal Reserve has also taken steps intended to enhance examiner
training. For example, Federal Reserve officials developed an
Internal Controls School in 1995 that was designed initially for
examiners of FBO branches and expanded to meet the needs of examiners
of U.S. domestic banks. Federal Reserve officials also told us that
they developed a training seminar in 1996 for examiners and in-house
international supervisory staff that emphasizes ensuring the
appropriate supervisory strategy for the U.S. operations of each
FBO.
U.S. SUPERVISORS' MEASURES DO
NOT CAPTURE LINKAGES BETWEEN
INITIATIVES AND RESULTS
---------------------------------------------------------- Chapter 4:5
U.S. supervisors have not yet developed a strategy for evaluating
the results of their initiatives to improve internal controls and
audits at FBO branches. The Federal Reserve has indicated that rough
measures, such as examination ratings, currently indicate some degree
of improvement. However, such rough measures do not determine
whether there are appropriate linkages between examination results
and the Federal Reserve's initiatives, such as training and
education. Without measures that determine the linkages between the
initiatives and improved internal control practices, the Federal
Reserve will not know if it has satisfactorily addressed the internal
control and audit weaknesses at FBO branches.
CONCLUSIONS
---------------------------------------------------------- Chapter 4:6
U.S. supervisors have recognized that serious weaknesses in internal
controls and audits at certain FBO branches are significant and must
be addressed if losses are to be avoided and confidence maintained in
the integrity and efficiency of financial markets. To that end, they
have developed and implemented several initiatives in the past 2 to 3
years to improve the supervision of FBO branches and educate bank
officials and home country supervisors about the importance of
resolving internal control and audit weaknesses. These efforts
include the FBO Program, the ROCA rating system, the development of
new examination manuals, education and training programs, and the new
requirement for special audits.
The supervisors' efforts--as they are designed--appear to provide a
basis for raising and maintaining control standards at FBO branches,
and Federal Reserve supervisors told us that their efforts have
already resulted in improved internal controls and audits at fair or
lower rated FBO branches. However, supervisors have not yet
developed a strategy for evaluating the results of these initiatives,
including whether those results satisfactorily address the weaknesses
identified or whether additional initiatives may be needed. Such a
strategy could, for example, determine whether there are appropriate
linkages between examination results and training and education
efforts. For information to be available to monitor the impact of
the initiatives when they are fully implemented, it is important that
the supervisors promptly identify the data that are needed and ensure
that the systems necessary to gather and maintain those data are in
place and operating.
RECOMMENDATION
---------------------------------------------------------- Chapter 4:7
We recommend that the Federal Reserve develop a strategy, including
objective measures, for assessing the progress it is making through
its efforts to improve internal controls and audits at FBO branches
and ensure that the procedures and systems necessary to collect the
data relevant to those measures are in place and operating. Results
from such objective evaluation of efforts to improve internal
controls and audits should be useful in determining whether
additional initiatives may be needed and in communicating with FBO
branch officials and home country supervisors about the importance of
sound bank management practices.
AGENCY COMMENTS
---------------------------------------------------------- Chapter 4:8
We requested comments on a draft of this report from the Federal
Reserve Board, which provided written comments that are reproduced in
appendix II. In addition, Federal Reserve staff provided technical
comments, which we incorporated in this report where appropriate.
The Federal Reserve Board commented that our recommendation was
useful and said that it will take steps to (1) evaluate in a more
systematic fashion the results of its initiatives to improve the
supervision of the U.S. operations of FBOs and (2) identify and
address internal control and audit weaknesses in those operations.
The Board also said that several rough measures currently indicate
some degree of improvement in those areas. As an example of such
measures, the Board noted a decline, since 1993, in the number of FBO
branches with fair or lower overall examination ratings or component
ratings that are substantively affected by internal control and audit
weaknesses.
DATA COLLECTED FROM EXAMINATION
REPORTS USING DATA COLLECTION
INSTRUMENT
=========================================================== Appendix I
Using our data collection instrument (DCI), we collected data on a
variety of internal control and audit weaknesses reported at foreign
banking organizations' branches and agencies (FBO branches) in
addition to those presented in chapter 3. The DCI was organized by
type of internal control and audit weakness. Table I.1 provides a
description of the types of internal control and audit weaknesses
from the DCI.
Table I.1
Descriptions of DCI Internal Control and
Audit Weakness Categories
Category Description
---------------------------- --------------------------------------------------
Internal control
weaknesses:
Lack of Instances in which the examiner notes that a
segregation of single individual or department has control over
duties two functions within the FBO branch that ought to
be separate due to the potential for damaging the
FBO branch.
Lack of adequate Situations where the examiner notes that there is
policies, a lack of policies, procedures, or manuals
procedures, and covering certain aspects of an FBO branch's
manuals operations or functions.
Problems with Situations where a problem exists with regard to
personnel personnel issues or practices, probably involving
practices one or a few individuals.
Lack of proper and Situations in which there is a specific
accurate shortcoming with regard to an accounting principle
accounting for or practice that is failing to be performed within
all activities the FBO branch. This would include situations
where the FBO branch's banking activities are not
being properly recorded or reconciled according to
standard accounting principles.
Inadequate Instances where there is a lack of records or
safekeeping documentation being maintained for various
and/or activities for which records ought to be
documentation maintained. The category also covers instances
where such records are maintained under inadequate
security.
Lack of compliance Instances where there is clearly a policy or
with policies procedure in place, but it is not followed.
and procedures
Inaccurate Used when the examiner determines that the FBO
regulatory branch is filing inaccurate regulatory reports.
reporting
Lack of dual Applies to situations where a procedure that ought
control and to be controlled in some way by at least two
independent individuals is not. For example, in the case of
verification dual control, an action such as wiring funds out
of the FBO branch or opening the vault can only be
done by two individuals simultaneously. In other
cases, it might be appropriate for a single
individual to carry out a specific function, but
it might be necessary for another individual to
independently verify that the function was done
properly.
Lack of security A lack of security for any number of banking
and/or access operations that require security, usually in the
restrictions form of restrictions, physical or electronic, on
access to information or machinery that could
potentially be used to do financial harm to
individuals or the FBO branch.
Inadequate Cases where the examiner specifically notes a lack
/Inaccurate of or inaccurate information, or control on the
management part of an FBO branch's management. This category
control or is to be used when there is a lack of information
information on the part of management that hinders its ability
to direct the FBO branch's operations, or where
there is a lack of management control in a case in
which the examiner clearly believes there should
be.
Inadequate Instances where the examiner states that the FBO
management branch's management, in general, is poor or where
oversight the examiner notes a lack of adequate oversight by
the home office.
Lack of expertise This category should be used in cases where the
examiner notes that management or staff lack
either the education, training, or experience to
effectively execute their duties.
Audit weaknesses:
Inadequate scope Situations where the scope of the audit is
of audit considered to be inadequate to cover all of the
coverage FBO branch's activities.
Inadequate Any case where the frequency of audits is
frequency of criticized.
completed audits
Inadequate audit Cases where the independence of the audit function
independence is questioned. A lack of segregation of duties
involving the audit function would be noted here.
Audit manual and Cases where audit manuals and reports are not
reports not in available to the examiners in English.
English
Lack of head Cases where the examiner notes a lack of head
office office involvement in the audit function,
supervision of including approving the general audit program, and
audit function reviewing audit results.
Inadequate audit Situations where there is insufficient retention
workpapers and protection of audit workpapers as required by
/documentation generally accepted auditing standards.
Inadequate Cases where the examiner determines that the FBO
/Untimely branch has been too slow in responding to audit
response to recommendations or criticisms or appears to have
audit ignored audit recommendations or criticisms.
recommendations
or criticisms
Lack of self Instances where there is a shortcoming with a FBO
inspection branch's self-inspection program.
Audit manual and Instances where the examiner notes that an audit
reports not manual or report is not available.
available
Inadequate audit Cases where the audit department staff is
department staff considered inadequate in terms of number or level
of audit expertise.
--------------------------------------------------------------------------------
Source: GAO analysis.
Figure I.1 shows the percentage of the 254 FBO branches rated fair or
lower that were reported to have each type of internal control
weakness listed above from January 1, 1993, to June 30, 1996. Figure
I.2 shows the percentage of the 254 FBO branches rated fair or lower
that were reported to have each of the audit weaknesses described
above during the same period.
Figure I.1: Percentage of FBO
Branches Rated Fair or Lower
That Were Reported to Have Each
Type of Internal Control
Weakness, January 1993 to June
1996
(See figure in printed
edition.)
Source: GAO analysis of supervisory examination reports.
Figure I.2: Percentage of FBO
Branches Rated Fair or Lower
That Were Reported to Have Each
Type of Audit Weakness, January
1993 to June 1996
(See figure in printed
edition.)
Source: GAO analysis of supervisory examination reports.
For each type of internal control and audit weakness, we noted in
what part of the FBO branch's operations the weakness was reported.
For example, we noted whether a weakness in an FBO branch's
segregation of duties was reported in its trading, electronic funds
transfer, or some other activity. Table I.2 provides the percentage
of the 254 FBO branches that were reported to have each type of
weakness listed above, and shows where in the FBO branches'
operations the weaknesses were found.
Table I.2
Internal Control and Audit Weaknesses
Reported at FBO Branches Rated Fair or
Lower During January 1993 to June 1996
Percentage of FBO
branches with
Internal control and/or audit weakness weakness
-------------------------------------------------- ------------------
Lack of segregation of duties:
Trading activities 15
Treasury activities (asset/liability 14
management)
Electronic funds transfer 17
Intrabank funds transfer 1
Security officer 3
EDP 7
Internal controls officer 1
Internal auditor 7
Other 28
Lack of adequate policies, procedures, and manuals:
----------------------------------------------------------------------
Treasury activities (asset/liability 42
management)
Employees in sensitive positions not 9
absent for a minimum number of
consecutive days
Electronic funds transfer 32
Intrabank funds transfer 3
Trading activities 35
Emergency preparedness/Disaster recovery 39
Accounting practices 45
Credit administration 63
Returned mail/Hold mail 15
Dormant accounts 18
Official checks and other negotiable 15
instruments
Bank Secrecy Act 26
Criminal referrals 14
Payable through accounts 1
Clearing services 2
Problems with personnel practices:
----------------------------------------------------------------------
Employees in sensitive positions not 22
absent for a minimum number of
consecutive days
Conflict of interest 2
Lack of internal controls officer 1
Lack of effective supervision 1
Lack of proper and accurate accounting:
----------------------------------------------------------------------
Trade activities 14
Credit administration 15
Separate accounts for home office and 1
branches
Improper reconciliation of general ledger 25
accounts
Suspense accounts 12
Expenses 2
Chart of accounts 16
Incorrect use of accounts 9
Inadequate safekeeping and/or documentation:
----------------------------------------------------------------------
Trading activities 15
Inadequate confirmation of discrepancy log 4
Credit files 61
Accounting 6
Electronic funds transfer 8
Intrabank funds transfer 1
Minutes of committee meetings 4
Bill paying services 2
Bank Secrecy Act 14
Lack of compliance with policies and procedures:
----------------------------------------------------------------------
Trading activities 11
Treasury activities (asset/liability 10
management)
Credit administration 36
Regulatory reporting:
----------------------------------------------------------------------
Inaccurate reporting 70
Lack of dual control and independent verification:
----------------------------------------------------------------------
Electronic funds transfer 13
Intrabank funds transfer 1
Revaluation of trading positions 8
Trading activities 8
Authorized signatures 6
Vault 10
Lack of security and/or access restrictions:
----------------------------------------------------------------------
Electronic funds transfer 22
Back office 6
Accounting systems/Software 6
Signature list 2
Checks and other negotiable items 17
Vault security 5
Electronic security 6
Premises 8
Inadequate/Inaccurate management
control or information:
----------------------------------------------------------------------
Client services 1
Electronic funds transfer 2
Control of client accounts 2
Reporting to head office 3
Trading activities 9
Inadequate management/oversight:
----------------------------------------------------------------------
Home office 23
Management 17
Lack of Expertise:
----------------------------------------------------------------------
Management 5
Staff 17
Inadequate scope of audit coverage 67
Inadequate frequency of completed audits 41
Inadequate audit independence 26
Audit manual and reports not in English 12
Lack of head office supervision of audit 9
function
Inadequate audit workpapers/documentation 24
Inadequate/Untimely response to audit 28
criticisms
Lack of self inspection:
----------------------------------------------------------------------
Independence 2
Documentation 2
Procedures and scope 4
Audit manual and reports not available 7
Inadequate audit department staff:
----------------------------------------------------------------------
Staff size 13
Staff audit expertise 12
----------------------------------------------------------------------
Source: GAO analysis.
Figure I.3 shows the 10 most frequently reported internal control
weaknesses.
Figure I.3: The 10 Most
Frequently Reported Internal
Control Weaknesses at FBO
Branches Rated Fair or Lower,
January 1993 to June 1996
(See figure in printed
edition.)
(See figure in printed edition.)Appendix II
COMMENTS FROM THE FEDERAL RESERVE
BOARD
=========================================================== Appendix I
(See figure in printed edition.)
The following is GAO's comment on the Federal Reserve Board's
September 5, 1997, letter.
GAO COMMENT
--------------------------------------------------------- Appendix I:1
We added information on page 55 about the Federal Reserve's rough
measures for assessing progress in its efforts to improve internal
controls and audits at FBO branches.
MAJOR CONTRIBUTORS TO THIS REPORT
========================================================= Appendix III
GENERAL GOVERNMENT DIVISION,
WASHINGTON, D.C.
------------------------------------------------------- Appendix III:1
Susan S. Westin, Acting Associate Director
Thomas L. Conahan, Evaluator-in-Charge
Kristi A. Peterson, Senior Evaluator
Barry Reed, Senior Social Science Analyst
John J. Strauss, Senior Evaluator
Desiree W. Whipple, Communications Analyst
SAN FRANCISCO FIELD OFFICE
------------------------------------------------------- Appendix III:2
Bruce K. Engle, Evaluator
*** End of document. ***