12 U.S.C. § 1831m — Early identification of needed improvements in financial management

(a) Annual report on financial condition and management (1) Report required. Each insured depository institution must send an annual report to the Corporation, the appropriate Federal banking agency, and every appropriate State bank supervisor, including a host State supervisor. (2) Contents. The report must include the information management must provide under subsection (b), the information an independent public accountant must provide under subsections (c) and (d), and any other information the Corporation and the appropriate Federal banking agency decide is needed to assess the institution's financial condition and management. (3) Public availability. The report must be open for public inspection. However, the Corporation and the appropriate Federal banking agencies may mark particular information privileged and confidential and keep it from the public. (b) Management responsibility for financial statements and internal controls Each insured depository institution must prepare: (1) annual financial statements using generally accepted accounting principles and any additional disclosure rules prescribed by the Corporation or the appropriate Federal banking agency; and (2) a report signed by the chief executive officer and chief accounting or financial officer. The report must state management's responsibility for (A)(i) preparing financial statements, (ii) establishing and maintaining adequate internal controls and procedures for financial reporting, and (iii) following the safety-and-soundness laws and regulations designated by the Corporation and the appropriate Federal banking agency. It must also assess, as of the end of the institution's latest fiscal year, (B)(i) how effective those controls and procedures were and (ii) whether the institution followed those designated safety-and-soundness laws and regulations. (c) Internal control evaluation and reporting requirements for independent public accountants (1) For every internal-control report required under subsection (b)(2), the institution's independent public accountant must attest to management's statements and report separately on them. (2) The attestation must follow generally accepted standards for attestation engagements. (d) Annual independent audits of financial statements (1) The Corporation, after consulting the appropriate Federal banking agencies, must issue regulations requiring each insured depository institution to have an independent public accountant annually audit its financial statements under generally accepted auditing standards and section 1831n. (2) The accountant must determine and report whether the statements (A) fairly present the institution's finances under generally accepted accounting principles and (B) meet any additional disclosure requirements prescribed by the Corporation or the appropriate Federal banking agency. (3) A holding-company audit may satisfy this requirement for an insured depository institution that is a holding-company subsidiary. (e) Repealed. This subsection was repealed by the cited 1996 law. (f) Form and content of reports and auditing standards (1) Each independent public accountant's report under this section, and the procedures used to prepare it, must meet or exceed generally accepted auditing standards and other standards recognized by the Corporation. (2) The Corporation must consult the other appropriate Federal banking agencies when implementing this subsection. (g) Improved accountability (1) Independent audit committee. (A) Every institution covered by this section must have an independent audit committee made entirely of outside directors independent of management, except as allowed by (D), and meeting any specific Corporation requirements. (B) The committee must review with management and the independent public accountant the basis for reports under subsections (b)(2), (c), and (d). (C) For an institution the Corporation calls a large institution, the committee must (i) include members with banking or related financial-management expertise, (ii) have access to its own outside counsel, and (iii) not include any large customer of the institution. (D)(i) An appropriate Federal banking agency may by order or regulation allow a committee made up of fewer than all outside directors, but at least a majority, if the institution has had difficulty recruiting or keeping enough competent outside directors. (ii) The agency must consider factors such as the institution's size and whether it made a good-faith effort to elect or appoint additional competent outside directors who could serve on the internal audit committee. (2) Reviews of quarterly reports of large institutions. (A) For a large institution, the Corporation may require its independent public accountant to review quarterly financial reports under procedures agreed with the Corporation. (B) The accountant must give the audit committee reports on those reviews, and the committee must give them to the Corporation, each appropriate Federal banking agency, and each appropriate State bank supervisor. (C) Those reports are only for the information and use of the institution, the Corporation, the agencies, and the State supervisor that received the report. (D) The Corporation must promptly give the institution written notice that a review is required. (3) Qualifications of independent public accountants. (A) Required audit services may be performed only by an independent public accountant who (i) agrees, if requested, to provide working papers, policies, and procedures to the Corporation, the appropriate Federal banking agency, and any State bank supervisor, and (ii) has undergone a peer review meeting Corporation-acceptable guidelines. (B) Peer-review reports must be filed with the Corporation and open to public inspection. (4) Enforcement. In addition to section 1818 authority, the Corporation or an appropriate Federal banking agency may, for good cause, remove, suspend, or bar an independent public accountant from required audit work. The agencies must jointly issue rules of practice for this paragraph. (5) If an accountant performing an audit later stops being the institution's accountant, the accountant must promptly notify the Corporation and each appropriate Federal banking agency under their rules. (h) Exchange of reports and information (1) Report to the independent auditor. (A) An institution using an independent auditor must give the auditor its latest report of condition and latest examination report. (B) It must also give the auditor (i) any effective supervisory memorandum of understanding and written agreement with an appropriate Federal banking agency or State supervisor covering the audit period, and (ii) a report of any covered Federal action under section 1818 subsections (a), (b), (c), (e), (g), (i), (s), or (t); any similar State action; or any civil-money-penalty assessment under another law concerning the institution or an institution-affiliated party. (2) Reports to banking agencies. (A) Within 15 days after receiving each audit report, qualification, management letter, or other report from its independent auditors, the institution must give a copy to the Corporation, each appropriate Federal banking agency, and each appropriate State supervisor. (B) Within 15 calendar days after an event, it must give those recipients written notice of an auditor's resignation or dismissal or the hiring of a new auditor, including the reasons. (i) Requirements for insured subsidiaries of holding companies (1) Except for audit requirements under subsection (d), a holding-company subsidiary may satisfy this section if comparable services and functions are provided at the holding-company level and the institution either (i) had beginning-of-fiscal-year assets below $5 billion or (ii) had at least $5 billion and, at its latest Corporation or agency examination, a CAMEL composite rating of 1 or 2 under the Uniform Financial Institutions Rating System or an equivalent comparable-system rating. (2) If such an institution is large, its holding-company audit committee may not include any large customer of the institution. (3) An agency may require an institution with assets over $9 billion to comply despite this exemption if applying the exemption would create a significant risk to the Deposit Insurance Fund. (j) Exemption for small depository institutions This section does not apply for a fiscal year if the institution's beginning-of-year assets are less than the greater of (1) $150 million or (2) a higher amount the Corporation sets by regulation.