Sarbanes-Oxley Act (SOX)

 Annual Audit and Reporting Requirements - Proposed Amendments To Part 363

Summary: The FDIC is requesting comments on the attached proposed amendments to Part 363 of its regulations, which sets forth annual independent audit and reporting requirements for insured institutions with $500 million or more in total assets.

 Sarbanes-Oxley Act - Consideration of Key Principles Needed in Addressing Implementation for Smaller Public Companies

Regulators, public companies, audit firms, and investors generally agree that the Sarbanes-Oxley Act of 2002 has had a positive and significant impact on investor protection and confidence. However, for smaller public companies (defined in this report as $700 million or less in market capitalization), the cost of compliance has been disproportionately higher (as a percentage of revenues) than for large public companies, particularly with respect to the internal control reporting provisions in section 404 and related audit fees. Smaller public companies noted that resource limitations and questions regarding the application of existing internal control over financial reporting guidance to smaller public companies contributed to challenges they face in implementing section 404. The costs associated with complying with the act, along with other market factors, may be encouraging some companies to become private. The companies going private were small by any measure and represented 2 percent of public companies in 2004. The full impact of the act on smaller public companies remains unclear because the majority of smaller public companies have not fully implemented section 404.

 Threats from Fraudulent Bank Web Sites: Risk Mitigation and Response Guidance for Web Site Spoofing Incidents

The purpose of this bulletin is to provide banks with guidance on how to respond to incidents of Web-site spoofing. The bulletin addresses procedures banks can implement to mitigate the risks to themselves and their customers by detecting and responding to Web-site spoofing. It also identifies the types of information banks can provide to law enforcement authorities to assist in investigating illegal activities. This bulletin expands on OCC Alert 2003-11, “Customer Identity Theft: E-mail-Related Fraud Threats,” September 12, 2003.

 Removal, Suspension, and Debarment of Accountants from Performing Annual Audit Services

The attached final rule, published in the Federal Register on August 13, 2003, concerns the removal, suspension, and debarment of accountants from performing annual audit and attestation services. The final rule will become effective on October 1.

Section 36 of the Federal Deposit Insurance Act (FDIA) requires that each national bank with $500 million or more in total assets submit an annual report on its financial statements and required management assessments to the Comptroller of the Currency (OCC). An independent public accountant must audit these financial statements to determine whether they are presented in accordance with generally accepted accounting principles.

 Electronic Record Keeping

This advisory letter highlights issues regarding bank electronic record systems in light of the E-SIGN Act. 15 USC 7001, et seq. The letter provides a basic framework that bank management can use to assess and address key issues posed by electronic record keeping systems.

BACKGROUND

Federal legislation changed the legal framework for electronic records and will likely result in more banks adopting electronic record retention systems. Banks can implement electronic record retention systems in many ways to support different business processes. Some examples of possible electronic record retention systems are loan file imaging, retention of paperless applications and online agreements, and the use of electronic payment systems.