Management Report: Opportunities for Improvements in FDIC's Internal Controls and Accounting Procedures
GAO-11-23R
Published: Nov 30, 2010. Publicly Released: Nov 30, 2010.
Skip to Highlights
Highlights
In June 2010, we issued our report on the results of our audit of the financial statements of the Deposit Insurance Fund (DIF) and the FSLIC Resolution Fund (FRF) as of, and for the years ending December 31, 2009, and 2008, and on the effectiveness of the Federal Deposit Insurance Corporation's (FDIC) internal control over financial reporting as of December 31, 2009. We also reported our conclusions on FDIC's compliance with selected provisions of laws and regulations. During our 2009 financial audit, we identified several control deficiencies over FDIC's process for deriving and reporting estimates of losses to the DIF from financial institution resolution transactions involving loss-sharing agreements. These deficiencies led to misstatements in the draft DIF financial statements, which were ultimately corrected through adjustments to achieve fair presentation in the final financial statements. Although the net adjustments were not material to the DIF's financial statements, the nature of the control deficiencies we identified were such that a reasonable possibility existed that a material misstatement of the DIF's financial statements would not be prevented, or detected and corrected on a timely basis. Thus, these control deficiencies collectively represented a material weakness in FDIC's internal control over financial reporting related to estimated losses from loss-sharing agreements. During our 2009 financial audit, we also identified control deficiencies with respect to FDIC's information-systems security that increased the risk of unauthorized modification and disclosure of financial and other sensitive information, and disruption of critical operations. These control deficiencies, which collectively represented a significant deficiency, reduced FDIC's ability to ensure that authorized users only had the access needed to perform their assigned duties and that its systems were sufficiently protected from unauthorized access. We are issuing a separate report on the issues affecting FDIC's information systems identified during our 2009 audit, along with associated recommendations. The purpose of this report is to discuss in more detail the control deficiencies that collectively represented the material weakness in FDIC's internal control over financial reporting related to its loss-share estimation process and to discuss other internal control issues identified during our 2009 audit for which we did not have previous recommendations. Although not all of these issues were discussed in our report on the results of our 2009 financial statement audit, they all warrant FDIC management's attention and correction. This report provides 14 recommendations to address the internal control issues we identified during our 2009 audit. This report also provides the status of recommendations from prior audits we made to address previously identified internal control issues.
Recommendations
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Deputy to the Chairman and Chief Financial Officer | The Deputy to the Chairman and Chief Financial Officer should direct the appropriate FDIC officials to establish a mechanism for monitoring implementation of newly issued policies and procedures within FDIC's Division of Resolutions and Receiverships (DRR) regarding the review process for calculation of initial loss-share loss estimates to verify compliance by DRR personnel. |
To address this recommendation, FDIC chartered the Closed Bank Financial Risk Committee (FRC) to provide governance and monitoring for policies and procedures related to assumptions and controls over the Least Cost Test methodology, which includes estimating the total cost of resolving failed banks, estimating costs specific to loss-sharing agreements, and valuing failed bank assets. We reviewed the charter of the FRC during the 2010 financial audit and concluded this is an effective governance and monitoring tool.
|
| Deputy to the Chairman and Chief Financial Officer | The Deputy to the Chairman and Chief Financial Officer should direct the appropriate FDIC officials to develop specific procedures for developing the loss-share worksheet, to include documenting the assumptions made in the loss-share worksheet and the rationale behind existing assumptions. |
To address this recommendation, FDIC established the Closed Bank Financial Risk Committee (FRC), which meets quarterly to review the methodology and assumptions used in the loss-share worksheet section of the Least Cost Test document (including loss-share). As a part of this, all new assumptions and methodologies for the Least Cost Test must be documented and explained before they are implemented and FDIC now requires them to be approved in writing by the Associate Director of the Franchise Asset Marketing Branch. We reviewed the charter of the FRC in December 2010 and concluded this is an effective governance and monitoring tool. We also concluded the additional review and approval by the Associate Director of the Franchise and Asset Marketing Branch is an effective control.
|
| Deputy to the Chairman and Chief Financial Officer | The Deputy to the Chairman and Chief Financial Officer should direct the appropriate FDIC officials to develop policies and procedures to provide for and document periodic management review and approval of the loss-share worksheet, to include assumptions, and any changes in assumptions over time, used in preparing the worksheet. |
To address this recommendation, FDIC established the Closed Bank Financial Risk Committee (FRC), which meets quarterly to review and approve the methodology and assumptions used in the Least Cost Test (including loss-share). In addition, before new assumptions and methodologies for the Least Cost Test are implemented, they are approved in writing by the Associate Director of the Franchise Asset Marketing Branch. We reviewed the charter of the FRC in December 2010 and concluded this is an effective governance and monitoring tool. We also concluded the additional review and approval by the Associate Director of the Franchise and Asset Marketing Branch is an effective control and we will monitor FDIC compliance with that control as assumptions change.
|
| Deputy to the Chairman and Chief Financial Officer | The Deputy to the Chairman and Chief Financial Officer should direct the appropriate FDIC officials to establish and document detailed procedures for Division of Finance (DOF) officials to follow in reviewing the Loan Loss Reserve (LLR) template calculations to ensure they are complete and accurate, including data requiring verification. |
To address this recommendation, FDIC embedded additional review checklist procedures into each Loan Loss Reserve (LLR) template to improve the review process for the LLR templates. We tested FDIC's new checklist procedure during our 2010 financial audit. Although FDIC's actions to improve its controls over the LLR template process were largely effective in preventing or detecting and correcting significant errors and omissions as of December 31, 2010, FDIC's review process did not always detect and correct errors as of year-end. In 2011, FDIC further improved the accuracy of the process by implementing a new WebFocus process to automatically import receivership information into the LLR templates. These actions addressed the intent of our recommendation.
|
| Deputy to the Chairman and Chief Financial Officer | The Deputy to the Chairman and Chief Financial Officer should direct the appropriate FDIC officials to establish a mechanism to monitor the implementation of the newly issued policies and procedures pertaining to the documentation of review and approval of loss-share payment certificates. |
To address this recommendation, FDIC created a Loss Share Certificate and Data Checklist that is included in the loss-share payment voucher package along with the payment voucher, acquiring institution filed asset certificates, and asset loss schedules. The entire payment voucher package is reviewed and approved by management. We tested FDIC's new checklist process in December 2010 and found it to be working effectively.
|
| Deputy to the Chairman and Chief Financial Officer | The Deputy to the Chairman and Chief Financial Officer should direct the appropriate FDIC officials to establish a monitoring process to ensure that reconciliations between the receivership general ledger and the receivership operating bank account are timely prepared and differences arising from these reconciliations are timely identified, researched, and resolved. |
To address this recommendation, in July 2010, FDIC established a written weekly reporting process to monitor whether receivership operating bank account reconciliations are prepared timely. We tested FDIC's implementation of its new process late in 2010 and found it to be working effectively.
|
| Deputy to the Chairman and Chief Financial Officer | The Deputy to the Chairman and Chief Financial Officer should direct appropriate FDIC officials to establish a process to monitor the corporation's adherence to its procedures to complete reconciliations of the DIF's cash account balances, to timely resolve any unreconciled differences, and to identify and address any obstacles that would preclude the completion of such reconciliations. |
To address this recommendation, FDIC established written procedures for reconciling the Deposit Insurance Fund's cash account balances. FDIC has also coordinated with Federal Home Loan Bank of New York's check processing servicing company (FISERV) to receive check presentments in a time frame that allows FDIC to promptly reject previously voided checks. We tested FDIC's new procedures at the end of 2010 and found them to be working effectively.
|
| Deputy to the Chairman and Chief Financial Officer | The Deputy to the Chairman and Chief Financial Officer should direct the appropriate FDIC officials to develop and implement written policies and procedures that prescribe specific actions required for assigning responsibility and detailing actions required to effectively review and approve payment vouchers, enter and verify payment vouchers in the accounts payable system, and generate receivership payments whether through check, wire, or electronic funds transfers (EFT). |
To address this recommendation, FDIC updated its policies and procedures to include assigning responsibility and giving guidance for approving payment vouchers and related activities.
|
| Deputy to the Chairman and Chief Financial Officer | The Deputy to the Chairman and Chief Financial Officer should direct the appropriate FDIC officials to develop and implement written policies and procedures that prescribe specific actions required for reviewing receivership liabilities, including assigning responsibility and detailing actions required for performing oversight reviews and the frequency for performing such reviews. |
To address this recommendation, FDIC assigned a contractor to monitor receivership liabilities. Additionally, FDIC updated its policies and procedures and provided support showing how to perform a reconciliation of receivership liabilities. The updated procedures assigned responsibilities and provided guidance for approving receivership payment vouchers and related activities. FDIC's action to address our recommendation decreases the risk that liabilities are not paid promptly or are not accurately accounted for.
|
| Deputy to the Chairman and Chief Financial Officer | The Deputy to the Chairman and Chief Financial Officer should direct the appropriate FDIC officials to develop and implement written policies and procedures that prescribe specific actions required for reviewing and canceling stale checks, including assigning specific responsibility, stating the frequency in which stale checks should be reviewed and cancelled, and detailing the manner in which banks are to be notified to cancel stale checks. |
To address this recommendation, FDIC updated its policies and procedures to include a policy that governs the frequency in which stale checks should be reviewed and cancelled.
|
| Deputy to the Chairman and Chief Financial Officer | The Deputy to the Chairman and Chief Financial Officer should direct appropriate FDIC personnel to establish written procedures to provide for the periodic review of the computer program used in the DGP loss estimation process, how such reviews should be conducted, and documentation evidencing the review. |
To address this recommendation, FDIC developed written procedures to provide for periodic review of the computer program used in the Debt Guarantee Program loss estimation process, how such reviews should be conducted, and documentation evidencing the review. During our 2010 financial audit, we verified that these procedures were documented and implemented.
|
| Deputy to the Chairman and Chief Financial Officer | The Deputy to the Chairman and Chief Financial Officer should direct the appropriate FDIC personnel to revise procedures to review and analyze the effect of institution failures that occur subsequent to year-end, but prior to the issuance of the DIF's financial statements, on the year-end contingent liabilities for TAG in a manner consistent with that performed for the contingent liability for anticipated failures. |
With the passage of the Dodd-Frank Wall Street Reform and Consumer Protection Act, beginning on December 31, 2010, and continuing through December 31, 2012, the contingent liability for the Transaction Account Guarantee Program (TAG) deposits was in essence replaced with a transaction account deposit guarantee program with the related contingent liability being consolidated within the Contingent Liabilities for Anticipated Failures line item on Deposit Insurance Fund's Balance Sheet. FDIC is now following the same subsequent event period procedures for the TAG deposit estimate as it does for the contingent liability for anticipated failures estimate, which satisfies the intent of this recommendation.
|
| Deputy to the Chairman and Chief Financial Officer | The Deputy to the Chairman and Chief Financial Officer should direct appropriate staff to revise FDIC's process used to prepare the statement of cash flows to (1) include capital cash entries in determining the change in the "Accounts Payable and Other Liabilities" line item, and (2) include capital cash entries in the "Purchase of Property and Equipment" line item. |
FDIC revised its procedures for preparing the Deposit Insurance Fund's Statement of Cash Flows in a manner that improved the accuracy of the financial statements and thus met the intent of these recommendations.
|
Full Report
GAO Contacts
Steven J. Sebastian
Topics
Accounting proceduresDeposit fundsFederal corporationsFederal fundsFinancial disclosureFinancial managementFinancial recordsFinancial statement auditsFinancial statementsFund auditsFunds managementInformation systemsInternal controlsLossesMaterialityReconciliation processReporting requirementsFinancial reportingPolicies and procedures