Bank Holding Company Audits: FDICIA, Part 363 and Regulatory Reporting

A bank audit is two engagements stacked together. The first is a GAAP audit of a balance sheet dominated by loans, securities, and deposits. The second is a regulatory overlay: FDIC rules in 12 CFR Part 363 set who must be audited, what management must report, who the auditor can be, and what has to be filed with the regulators and by when.

This guide covers the Part 363 requirements, the audit areas that carry the risk, and the PBC items to request.

When Part 363 applies

Section 363.1(a) applies Part 363 to an insured depository institution whose consolidated total assets at the beginning of the fiscal year reach $1 billion, as adjusted from time to time under 12 CFR 314.1. Part 363 sets three tiers worth knowing:

Institutions below the threshold still need the GAAP audit their lender, regulator, or holding company requires. Where the management report is split between a holding company and its bank, both sets of officers sign and the report states which level satisfies each component.

What management must report

Under section 363.2, the institution prepares annual GAAP financial statements audited by an independent public accountant. Management's annual report must include:

• A statement of management's responsibilities for the financial statements, ICFR, and compliance with designated safety and soundness laws.
• Management's assessment of compliance with those laws during the year, with its conclusion and any noncompliance.
• At $5 billion or more, an assessment of ICFR effectiveness that names the framework used, states that controls over regulatory reporting were assessed, and discloses any unremediated material weakness. Management cannot conclude controls are effective if a material weakness exists.

The CEO and the chief accounting officer or CFO sign the report. The auditor of a $5 billion institution issues an attestation report on management's ICFR assessment under section 363.3, in the same framework, covering controls over the regulatory financial statements, and cannot conclude controls are effective in the presence of a material weakness.

The auditor's own obligations

Section 363.3 puts requirements on the firm, and they decide whether a firm can accept the engagement:

• Independence. The auditor follows AICPA, SEC, and PCAOB independence standards, and where they differ, the more restrictive rule applies.
• Peer review. Before starting any work the firm must have a qualifying peer review or be enrolled in one. Copies of the most recent peer review report and the public portion of any PCAOB inspection report are filed with the FDIC within 15 days of acceptance or issuance, or before the audit begins, whichever is first.
• Communications. The auditor reports promptly to the audit committee on critical accounting policies, alternative GAAP treatments discussed with management, and other written communications such as management letters and schedules of unadjusted differences.
• Working papers. Audit and internal control working papers are kept for seven years from the report release date.
• Termination. An accountant that stops serving the institution notifies the regulators in writing within 15 days with the reasons.

Section 363.5 also requires the audit committee to ensure engagement letters do not indemnify the accountant against third-party claims, release the accountant from client claims other than punitive damages, or limit the client's remedies. Review the firm's standard engagement letter against that language before issuing it. See engagement letter indemnification and liability limits.

Filing deadlines

Under section 363.4, a standard institution files its Part 363 annual report within 120 days after fiscal year end. An institution that is a public company, or a qualifying subsidiary of one, files within 90 days. The report contains audited comparative financial statements, the accountant's report, the management report, and, where applicable, the attestation report. Copies of management letters and other accountant reports go to the regulators within 15 days after receipt. A change in accountants is also reported within 15 days.

Build these dates into the engagement timeline. A December year-end client on the 120-day clock needs the signed report, management report, and committee communications in hand by the end of April.

Where the audit risk sits

Allowance for credit losses. The allowance under ASC 326 is a major estimate on a community bank balance sheet. Test the data feeding the model (loan tape completeness, risk ratings, past due status), the segmentation, loss rates and look-back periods, the qualitative adjustments, and the reasonable and supportable forecast. Read the loan review reports and compare the model's pools to the classified and watch list. See CECL for private companies.

Worked example (illustrative numbers). A bank has $200,000,000 of commercial real estate loans in one pool with a modeled loss rate of 1.10%, giving $2,200,000. Management adds a qualitative overlay of 0.15% for rising office vacancy, or $300,000. The auditor asks what evidence supports 0.15% rather than 0.05%. Is the overlay tied to a documented factor, and does the same factor already appear in the loss rate? Double counting is as much a misstatement as omission.

Loans. Confirm a sample of balances with borrowers, test collateral values on impaired and collateral-dependent loans, test nonaccrual and the disclosures on loan modifications to borrowers experiencing financial difficulty, and test loan fee and cost deferrals.

Deposits and cash. Reconcile the deposit subledger to the general ledger, confirm correspondent balances, and test the overdraft and dormant account treatment.

Securities. Confirm holdings with the custodian, test fair value under ASC 820, and test classification between available for sale and held to maturity.

Information technology. The core processor, loan origination system, and online banking platform are outsourced at many community banks. Obtain the processor's SOC 1 report and test complementary user entity controls. See service organizations and SOC 1 reports.

Regulatory reporting. Reconcile the Call Report and, for the holding company, the Federal Reserve report to the audited financial statements. The FR Y-9SP is the parent-only report for small holding companies with total consolidated assets under $3 billion, filed semiannually as of June 30 and December 31. Investigate each difference between audited and regulatory numbers.

Red flags

• Loan files with stale appraisals or financial statements that have not been refreshed since origination.
• Risk ratings that stay constant while borrower conditions change.
• Loans extended or modified near quarter end that avoid past due or nonaccrual status.
• Related party and insider loans on different terms. See related party transactions.
• Concentrations in one property type or one borrower group without board-approved limits.
• A management report that cannot be traced to supporting testing.
• Unreconciled differences in the deposit subledger, suspense accounts, or ATM and card settlement accounts.

PBC items to request

• Loan tape at year end with risk rating, collateral, and delinquency fields
• Allowance model, assumptions memo, and loan review reports
• Regulatory exam reports and correspondence
• Board and audit committee minutes
• Internal audit reports and the management ICFR assessment documentation
• Securities custodian statements and pricing support
• Core processor SOC 1 report
• Call Report and holding company reports filed during the year
• Management representation letter

Sources

• 12 CFR 363.1 through 363.5, Annual Independent Audits and Reporting Requirements, Cornell Legal Information Institute
• Federal Reserve Board, Reporting Forms, FR Y-9SP

CORAA prepares ready-to-review audit files for US CPA firms; see /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error