Report on the Review of Internal Control Assessments Performed During Community Bank Examinations

We initiated this review in light of the circumstances surrounding the failure of the Oakwood Deposit Bank Company (Oakwood). Our Report on the Failure of the Oakwood Deposit Bank Company showed how a trusted senior executive exploited a weak corporate-governance environment and inadequate internal-control structure to perpetrate a massive and pervasive fraud. In addition, we reported that Federal Reserve examiners did not properly apply risk-focused examination principles that would have warranted more in-depth testing when significant internal-control weaknesses had been identified.

To determine if Oakwood represented an anomaly or a systemic deficiency in examination practices, we evaluated the depth and adequacy of risk-focused internal control reviews performed during examinations of state member banks with an asset size similar to Oakwood's. To accomplish this objective, we reviewed risk-focused examination policies, procedures, and guidelines pertaining to internal control evaluations. We reviewed workpapers and reports for thirty-six safety and soundness examinations conducted by four Reserve Banks (Richmond, Chicago, Kansas City, and Minneapolis) during the period spanning August 2000 through May 2003. In addition, we interviewed staff and key examination managers at each of the four districts where workpapers were reviewed. We chose these four Federal Reserve Banks because the institutions within their districts account for 67 percent of the total assets of state member banks under $100 million. The sample of examinations we reviewed was selected judgmentally to ensure that banks of varying asset sizes and CAMELS ratings were included.

Our review of the documentation supporting the examinations indicates that examiners had performed internal-control assessments, and had appropriately applied risk-focused principles. In addition, the depth of their review was commensurate with the risk profile that the examiners established for each financial institution. However, it is important to note that our conclusions were limited to the examinations selected for our sample, and may not necessarily be reflective of all examinations conducted within the Reserve Banks we inspected.

During the course of our review, we observed that Reserve Bank managers were aware of our Report on the Failure of the Oakwood Deposit Bank Company that discussed undetected internal-control deficiencies that existed prior to the Oakwood failure. Accordingly, each of the Reserve Banks we visited had initiatives underway that we believe could offer opportunities for enhancing internal-control evaluations performed during risk-focused community bank examinations. Therefore, we suggested that the director of the Division of Banking Supervision and Regulation review and evaluate these initiatives, as well as others being pursued by Reserve Banks that we did not visit, to determine if any represent "best practices" that would be worthy of Systemwide implementation.