To: All Affiliated Credit Union CEOs
From: Matt Beard - Regulatory Specialist
Date: March 28, 2006
RE: Supervisory Committee Audits — Advance Notice of Proposed Rulemaking
NCUA has issued an Advance Notice of Proposed Rulemaking (ANPR) seeking input on whether NCUA should modify its Supervisory Committee Audit Rules, and if so, how.
The Credit Union Membership Access Act (CUMAA) and Part 715 of NCUA’s Rules (Supervisory Committee Audits and Verifications), mandate that credit unions with $500 million or more in assets obtain a financial statement audit on an annual basis, performed in accordance with generally accepted auditing standards (“GAAS”) by an independent certified public accountant or public accountant licensed by the appropriate state or jurisdiction. One of the specific issues NCUA is raising is whether credit unions should be required to secure an “attestation on internal controls” in connection with their annual audits.
An “attestation on internal controls” consists of two parts. First, management must report its assessments of the effectiveness of the credit union’s internal control structures and procedures. Second, the credit union’s external auditor must examine, attest to (certify), and report separately on management’s written report. The scope of the attestation could be limited only to the effectiveness of internal controls over financial statements prepared for regulatory purposes (such as the “report on examination of internal controls over Call Reporting” audit option available to credit unions under $500 million in assets,) or extended to include all financial reporting (i.e., financial statements prepared according to generally accepted accounting principals [“GAAP”] and required regulatory reports).
In addition, the ANPR seeks input on specific issues including whether the audit options currently available to credit unions with less than $500 million in assets should be retained. The NCUA is also requesting input on qualifications for serving on a credit union’s Supervisory Audit Committee.
Comments are due to NCUA by April 24, 2006. Please send your comments to MCUL by April 17, 2006. I f you would like a copy of the proposal, you may access it at: http://a257.g.akamaitech.net/7/257/2422/01jan20061800/edocket.access.gpo.gov/2006/pdf/E6-2531.pdf
- Should credit unions be required to obtain an external auditor’s “attestation on internal controls” in connection with their annual audits?
- What standards that should govern the assessment and attestation components of such audit engagement?
- The Federal Deposit Insurance Corporation has increased from $500 million to $1 billion the minimum asset size of the institutions required to obtain the attestation. What minimum asset size threshold would be appropriate for credit unions?
- Should the same auditor be permitted to perform both the financial statement audit and the attestation?
- If an attestation on internal controls were to become required, should it be required annually or less frequently?
- What minimum qualifications should be required to serve on a Supervisory Committee? Should Supervisory Committee members of credit unions above a certain minimum assets size be required to have a minimum level of experience or expertise in credit union, banking or other financial matters? If so, what criteria should be required and what should the asset size requirement be?
- Should Supervisory Committee members be required to have access to their own outside counsel? If so, at what minimum asset size?
- Should Supervisory Committee members be prohibited from being associated with any large customer of the credit union other than its sponsor? If so, at what minimum asset size?
- If these Supervisory Committee requirements were added, would credit unions have difficulty recruiting and retaining competent individuals?
- Under Part 715, a financial statement must be “performed in accordance with GAAS by an independent person who is [State-licensed].” GAAS incorporates the “independence” standards established by the American Institute of Certified Public Accountants (AICPA). Should state-licensed, compensated auditors performing credit union audits be obligated to adhere to other/additional “independence” standards?
- Part 715 provides that credit unions with less than $500 million in assets may choose among the four audit options: (1) a financial statement audit; (2) a “balance sheet” audit; (3) a “report on examination of internal controls over Call Reporting”; and (4) an audit as prescribed in NCUA’s Supervisory Committee Guide. Is there value in retaining these options?
- Should Part 715 require the credit union to forward to NCUA a copy of the auditor’s attestation, management letter, qualification, or any other report? If so, should Part 715 also require the auditor to review those reports with the Supervisory Committee before forwarding them to NCUA?
- Should Part 715 require the credit union to notify NCUA in writing when entering into an engagement with an auditor, and/or when an engagement ceases as a result of the auditor’s dismissal or resignation (including the reasons for dismissal or resignation)?
- Should Supervisory Committee members be prohibited by regulation from executing engagement letters that contain language limiting various forms of auditor liability to the credit union? Should the Supervisory Committee members be prohibited from waiving the auditor’s punitive damages liability?
Potential Impact to Credit Unions. ( Note: Below is a list of issues the MCUL identified as potentially impacting credit union policies, procedures, or operations. Keep in mind that as each credit union is unique, this list may not be exhaustive.)
- Credit unions over $500 million in assets will be required to secure an “attestation on internal controls” in connection with their annual audits.
- This would include management reporting its assessments of the effectiveness of the credit union’s internal control structures and procedures; and
- The credit union’s external auditor examining, attesting to (certify), and reporting separately on management’s written report.
- Credit unions under $500 million may have more restricted audit options, such as losing their rights to a balance sheet audit, or Supervisory Committee Audit.
- There may be new required qualifications for serving on a Supervisory Audit Committee.
If you have any further questions, or to submit a response, please contact:
Michigan Credit Union League
112 East Allegan St., Suite 800
Lansing , MI 48933
Fax: (517) 482-3762