FDIC, Federal Deposit Insurance Corporation, Office of Inspector General, core values: communication, objectivity, responsibility, excellence
FDIC.GOV Office of Inspector General core values: communication, objectivity, responsibility, excellence
Search | Accessibility | Privacy | Information Quality | Contact Us | Site Map | Home

FDIC’s Controls Over the CAMELS Rating Review Process

August 2008
Report No. AUD-08-014

FDIC OIG, Office of Audits
Federal Deposit
Insurance Corporation

Why We Did The Audit

The audit objective was to assess the internal controls the FDIC has established over the CAMELS rating system for reviewing and changing proposed ratings included in draft risk management Reports of Examination (ROE). The six components of the CAMELS rating system address the adequacy of Capital, the quality of Assets, the capability of Management, the quality and level of Earnings, the adequacy of Liquidity, and the Sensitivity to market risk. A rating of 1 through 5 is given, with 1 having the least regulatory concern and 5 having the greatest concern.

The audit focused on the Division of Supervision and Consumer Protection’s (DSC) field and regional office processes for reviewing proposed CAMELS ratings from the point at which the FDIC Examiner-in-Charge (EIC) has notified the financial institution of the proposed ratings and has electronically submitted the draft ROE for supervisory review. We focused on these control processes because once the institution receives its proposed CAMELS ratings, subsequent changes should be justified and approved to help ensure the changes are adequately supported.

Background

The FDIC is the primary federal regulator for over 5,200 state-chartered institutions. DSC conducts risk management examinations of FDIC-supervised financial institutions. The objective of an examination is to help ensure a financial institution’s safety and soundness and to minimize the degree of risk exposure presented to the banking system and Deposit Insurance Fund.

As part of each risk management examination, proposed examination ratings are assigned by examiners in the draft ROE. Each financial institution is assigned a composite rating based on an evaluation and rating of the six essential components (noted earlier) of an institution's financial condition and operations.

CAMELS ratings serve a number of purposes within the FDIC, including as input to the process of determining deposit insurance premiums charged to financial institutions. Poorly rated institutions are subject to increased supervisory attention and potentially higher deposit insurance premiums and may be precluded from certain activity otherwise permitted by law or regulation. It is important, therefore, that the FDIC provide assurance to financial institutions that the CAMELS rating process is consistently implemented and that institutions are treated equitably.

DSC’s Case Manager Procedures Manual provides procedures related to making changes to proposed CAMELS ratings.



Audit Results

The FDIC has established and implemented internal controls for reviewing draft risk management ROEs, including the supervisory review of proposed CAMELS ratings. Also, DSC has established a process for resolving disagreements between the EIC and Case Manager (CM) with respect to changes to proposed CAMELS ratings. The resolution process includes maintaining an open dialogue between the EIC and CM and requiring the CM to bring unresolved differences to the attention of the Regional Director, or designee, for resolution prior to completion of the draft ROE review. However, review procedures do not require that changes to proposed CAMELS ratings, agreed to by the EIC, be documented or justified.

Further, we found that none of the six DSC regions centrally maintains a record of all of the CAMELS ratings changes or documentation justifying and approving changes to EIC-proposed ratings. Consequently, the regions and DSC headquarters are not able to track or monitor changes to ratings resulting from the ROE review process. Due to the absence of such centrally-maintained records, we were not able to determine the frequency of, or justification and approval for, changes to EIC-proposed ratings.

However, two regions did maintain records that were useful. Specifically, the FDIC’s New York Regional Office uses a form entitled, ROE Tracking Log For All Reports of Examination, which serves as a cover sheet for the draft ROE and contains various information regarding the processing of the ROE, including the EIC’s proposed CAMELS component and composite ratings. Two examples provided by the regional office showed evidence of CAMELS rating changes—specifically, the hand-written revised rating. According to New York regional personnel, the tracking forms are maintained in the region’s individual examination files. Nevertheless, the region does not centrally track information on ratings changes for monitoring purposes even though evidence of ratings changes appears to exist at the regional office. Further, the tracking forms do not document the justifications for the changes. Additionally, DSC’s San Francisco Regional Office personnel told us that they use a similar form, the Examination Log Sheet, to record information regarding the processing of the ROE and that the form may be annotated to reflect a rating change. However, the one example provided to us did not show evidence of a rating change.

Based on the results of our work, we concluded that DSC controls over changes to EIC-proposed CAMELS ratings could be enhanced. Enhanced controls for tracking and monitoring the justification and approval for CAMELS rating changes will better assure that senior management is informed of ratings changes and help ensure the transparency and integrity of the ratings process.

Recommendations and Management Response

We recommended that DSC revise the Case Manager Procedures Manual to require that changes made to EIC-proposed CAMELS ratings in the draft ROE be centrally managed by DSC, including tracking, monitoring, and maintaining the documented justification and approval for changes. DSC generally agreed with our findings and offered alternative corrective actions, including formalizing the guidance to staff on the required method for documenting unresolved differences related to final CAMELS ratings and developing a method to track those instances. Depending on the content of the DSC guidance, we agree that DSC actions can substantially meet the intent of our recommendation to help ensure process integrity and transparency. Nevertheless, we continue to believe that there is value in maintaining a record when there are changes to an EIC-proposed rating even when the EIC does not ultimately contest that change, and we suggest that DSC also consider requiring such a record during the course of formalizing its guidance in this area.


Contents

BACKGROUND

DSC Guidance

RESULTS OF AUDIT
INTERNAL CONTROLS OVER THE RATING REVIEW PROCESS
INTERNAL CONTROLS OVER CHANGES TO PROPOSED CAMELS RATINGS

Conclusion

Recommendation on Improving Internal Controls

CORPORATION COMMENTS AND OIG EVALUATION
APPENDICES

1. OBJECTIVE, SCOPE, AND METHODOLOGY

2. RISK MANAGEMENT EXAMINATION PROCESS

3. CORPORATION COMMENTS

4. MANAGEMENT RESPONSE TO RECOMMENDATION

5. ACRONYMS USED IN THE REPORT
















FDIC, Federal Deposit Insurance Corporation, Office of Inspector General,Office of Auidts, 3501 Fairfax Drive, Arlington, VA 22226-3500
DATE: August 12, 2008
 
MEMORANDUM TO:Sandra L. Thompson, Director
Division of Supervision and Consumer Protection
 
FROM:Russell A. Rau [Electronically produced version; original signed by Russell A. Rau]
Assistant Inspector General for Audits
 
SUBJECT:FDIC’s Controls Over the CAMELS Rating Review Process
(Report No. AUD-08-014)
 

This report presents the results of our audit of the FDIC’s CAMELS rating review process.1 The Federal Financial Institutions Examination Council (FFIEC)2 and state banking agencies assign component and composite ratings based on the results of periodic risk management examinations. The agencies use the CAMELS ratings as a supervisory tool for uniformly evaluating the safety and soundness of financial institutions and identifying those institutions requiring special attention. The audit objective was to assess the internal controls the FDIC has established over the CAMELS rating system for reviewing and changing proposed ratings included in the draft risk management reports of examination (ROE).

The audit focused on the Division of Supervision and Consumer Protection’s (DSC) field and regional office processes for reviewing proposed CAMELS ratings from the point at which the FDIC Examiner-in-Charge (EIC) has notified the financial institution of the preliminary ratings and has electronically submitted the draft ROE for supervisory review. We focused on these control processes because once the institution receives its proposed CAMELS ratings, subsequent changes should be justified and approved to help ensure adequate support for changes. We conducted this performance audit in accordance with generally accepted government auditing standards. Appendix 1 of this report discusses our audit objective, scope, and methodology in detail.

BACKGROUND

The FDIC is the primary federal regulator for about 5,200 state-chartered financial institutions. Under section 10(d) of the Federal Deposit Insurance Act (FDI Act), the FDIC, in conjunction with the states, is required to conduct on-site full-scope examinations of each FDIC-supervised institution every 12-18 months, depending on asset size and bank performance, to assess the safety and soundness of the institution. The FDIC complies with this requirement by conducting risk management examinations, the objective of which is to assess an institution’s overall financial condition and identify risks. (Appendix 2 of this report discusses the risk management examination process in more detail.)

CAMELS ratings serve a number of purposes within the FDIC, including as input to the process of determining deposit insurance premiums charged to financial institutions. The FDIC also uses the ratings to indicate the safety and soundness of individual institutions, to identify institutions requiring special supervisory attention, and to monitor industry trends. Poorly rated institutions are subject to potentially higher deposit insurance premiums and may be precluded from certain activities otherwise permitted by law or regulation. Therefore, it is important that the FDIC be able to provide assurance to financial institutions that the CAMELS rating process is consistently implemented and that institutions are treated equitably.

Within DSC, the EIC has the primary responsibility for leading an examination team and completing the risk management examination. At the conclusion of the examination fieldwork, it is the EIC’s responsibility to prepare a preliminary ROE documenting the outcome of the risk management examination, including the proposed CAMELS component and composite ratings for the financial institution. The EIC holds an exit conference with the institution’s senior management (and the board of directors, as needed) to discuss the preliminary examination results and the CAMELS ratings. During the exit conference, the EIC informs the bank officials that the CAMELS ratings are subject to review and approval by FDIC management. Then, based on established delegations of authority,3 the EIC submits the preliminary ROE to more senior field or regional management for final review and approval.

DSC Guidance

The primary guidance for conducting risk management examinations is contained in DSC’s Risk Management Manual of Examination Policies (Examination Manual). The Examination Manual discusses the specific criteria for the six CAMELS components and indicates that ROE comments should clearly support the corresponding ratings. Additionally, the ROE contains a Confidential-Supervisory Section where information of interest can be included for Case Managers (CM) or other field, regional, or Washington office management. We were told that this section of the ROE could be used by the EIC for indicating disagreements with CAMELS rating changes.

Additional examination-related guidance is contained in DSC’s Case Manager Procedures Manual (CM Manual). The CM Manual states that the regional office CM will perform activities related to reviewing, analyzing, and processing ROEs. According to the CM Manual, for those ROEs reviewed at the field office, the field supervisor (FS), or designee, serves as the CM. The established delegations of authority determine who may eventually review and sign the final ROE. ROE review procedures described in the CM Manual include, among other things, the following:

  • Ensure the report has been completed in accordance with written ROE instructions contained in the Examination Manual and Regional Directors (RD) Memoranda. If the ROE is not prepared in accordance with these guidelines or the findings are unclear, the CM should contact the EIC to resolve the differences. If ROE changes are necessary, the CM should discuss the changes with the EIC prior to the final processing of the ROE. Unresolved differences between the EIC, CM, and/or FS must be brought to the attention of the RD, or designee, for resolution prior to completion of the review.
  • Ensure the proposed CAMELS ratings are appropriate. If a CAMELS component or composite rating change is considered, concurrence of the EIC should be sought. If the EIC concurs with the change, the new rating should be reflected throughout the ROE. If the EIC does not agree to change the originally proposed rating, the CM (with approval of the RD or designee) will draft a memorandum to the file supporting the rating change, with copies to the EIC and FS. The new rating should then be reflected throughout the ROE. Bank management should be informed of the change before DSC transmits the ROE to the bank.
  • Ensure the final electronic version of the report is posted to the Completed Examinations folder in Microsoft Outlook for upload to the Interagency Examination Repository, a facility used to store completed risk management examination data for future review and download.


RESULTS OF AUDIT

The FDIC has established internal controls for reviewing draft risk management ROEs, including the supervisory review of proposed CAMELS ratings. Specifically, after the EIC discusses tentative examination results and preliminary CAMELS ratings with the financial institution’s senior management, the EIC electronically submits the draft ROE to the region. Then, based on established delegations of authority, the draft ROE is submitted to either the FS, or designee, or to the regional office CM for review. Based on our review of DSC’s policies and procedures, discussions with field and regional office officials, and limited testing, we concluded that controls related to the review of draft ROEs were being implemented as intended (Internal Controls Over the Rating Review Process).

Also, DSC has established a process for resolving disagreements between the EIC and CM with respect to changes to proposed CAMELS ratings in draft ROEs. The resolution process includes maintaining an open dialogue between the EIC and CM and requiring the CM to bring unresolved differences to the attention of the RD, or designee, for resolution prior to completion of the review. However, ROE review procedures do not require that changes to proposed CAMELS ratings that are agreed to by the EIC (before the ROE is signed) be documented or justified in writing—two well-recognized internal controls to help ensure adequate support and proper approval for the changes.

Further, we found that none of the six DSC regions centrally maintains a record of all CAMELS ratings changes and documentation justifying and approving changes to EIC- proposed ratings in draft ROEs. Consequently, the regions and DSC headquarters are not able to track or monitor changes to ratings resulting from the ROE review process. Due to the absence of such centrally-maintained records, we were not able to determine the frequency of, or justification and approval for, changes to EIC-proposed ratings.

However, two regions did maintain records that were useful. Specifically, the FDIC’s New York Regional Office uses a form entitled, ROE Tracking Log For All Reports of Examination, which serves as a cover sheet for the draft ROE and contains various information regarding the processing of the ROE, including the EIC’s preliminary CAMELS component and composite ratings. Two examples provided by the regional office showed evidence of CAMELS rating changes—specifically, the hand-written revised rating. According to the New York Regional Office personnel, the tracking forms are maintained in the region’s individual examination files. Although evidence of ratings changes appears to exist at the regional office, the region does not centrally track information on ratings changes for monitoring purposes. Additionally, according to DSC San Francisco Regional Office officials, the San Francisco Regional Office uses a similar form, the Examination Log Sheet, to record information regarding the processing of the ROE. It too includes the CAMELS ratings as proposed by the EIC. According to regional officials, the form may be annotated to reflect a rating change. The one example the regional office gave to us did not show evidence of a rating change.

Based on the results of our work, we concluded that DSC controls over changes to EIC-proposed CAMELS ratings could be enhanced. Enhanced controls for tracking and monitoring the justification and approval for CAMELS rating changes will better inform FDIC senior management of rating changes and help ensure the transparency and integrity of the ratings process (Internal Controls Over Changes to Proposed CAMELS Ratings).




INTERNAL CONTROLS OVER THE RATING REVIEW PROCESS

The draft ROE review process relies on the use of delegated authority to align risk with the appropriate level of supervisory review. According to officials at each of the six DSC regional offices, the primary internal control in the draft ROE review process is the supervisory review function. Specifically, every draft ROE receives a supervisory review by a field or regional office official, in accordance with established delegations of authority, before the ROE is finalized. The draft ROE review process contains other controls, including: policies and procedures related to the examination process, clear guidance on the rating criteria for assigning component and composite CAMELS ratings, and comprehensive training of examiner and reviewer personnel.

In assessing DSC’s ROE review process from the time an EIC discusses the preliminary ROE and CAMELS ratings with an institution’s board, we determined that EICs electronically submit the draft ROE to the regional office using a predetermined distribution list. The draft ROE is then printed in hard copy by an administrative focal point who then, based on the delegations of authority, distributes the ROE to either the FS or the regional office CM for review and approval. The larger and more complex institutions, or those institutions with noted problems, receive higher-level attention and scrutiny, which can occur before presentation to the institution’s board. Additionally, ROEs of 1- and 2-rated institutions are generally reviewed and signed by the FS at the field office, while ROEs for institutions with a 3 rating or higher are reviewed and signed at the regional office.




INTERNAL CONTROLS OVER CHANGES TO PROPOSED CAMELS RATINGS

DSC controls over changes to proposed CAMELS ratings could be enhanced. Specifically, controls are in place to document circumstances when a reviewer changes a CAMELS rating proposed by the EIC and when the EIC does not agree with the change. However, DSC has not established controls to document when ratings changes are agreed-upon by the EIC and CM or FS. Moreover, changes to proposed CAMELS ratings are not routinely documented, justified, or tracked. Accordingly, the CAMELS rating process is not as transparent as it could be.

According to DSC regional officials, changes to proposed CAMELS ratings are rare. Several CMs indicated that they could recall only 2-3 changes to a proposed CAMELS component or composite rating over the course of a year. According to the CM Manual, reviewers are required to discuss necessary changes to the draft ROE with the EIC prior to making any changes and processing the final ROE. If the EIC agrees with the suggested change, the rating is changed, the review process continues, and the ROE is signed. (It is important to note that where the EIC agrees with the suggested rating change, there is no requirement to either obtain the approval of a higher-level official or document the justification for the change.) In contrast, according to the CM Manual, unresolved differences between the EIC and reviewer are required to be brought to the attention of the RD, or designee, for resolution, thus providing an audit trail of the decision-making process. Specifically, in this regard, the CM Manual states:

If the EIC does not agree to change the originally assigned rating, the CMs (with the approval of the Regional Director or designee) will draft a memorandum to the file to support the rating change with copies to the EIC and Field Supervisor.

Although documentation in the form of a memorandum to the file is required, none of the regional officials we spoke with provided evidence of such a memorandum. Further, we specifically asked DSC officials in all six regions for examples or evidence of proposed rating changes or memorandums of the disagreements. However, only the New York Regional Office could provide us documentation showing where a proposed CAMELS rating had been changed. Personnel from the San Francisco Regional Office gave us a sample Examination Log Sheet, which they stated may be annotated to reflect a CAMELS rating change.

We determined that all six regional offices follow the same ROE review procedures. However, the New York Regional Office augments these procedures by using an ROE Tracking Log For All Reports of Examination, and the San Francisco Regional Office uses the Examination Log Sheet. In both cases, the document serves as a cover sheet for the draft ROE and contains various information regarding the processing of the ROE, including the EIC’s proposed CAMELS component and composite ratings. According to the regional personnel, the forms are maintained in the region’s individual examination files. Therefore, evidence of ratings changes may exist in the New York and San Francisco Regional Offices, but those regions do not centrally track information on ratings changes for monitoring purposes and do not document the justification and approval for changes. Consequently, each examination file would need to be reviewed to determine whether a particular examination included a change to the proposed CAMELS ratings in the draft ROE.

Although not a requirement, the EIC’s proposed CAMELS ratings may be captured in several other documents during the report review process. According to many Assistant Regional Directors and CMs we interviewed, it has been a practice for DSC regional officials to use the Confidential-Supervisory Section of the ROE to discuss proposed rating changes, particularly if there is any disagreement over the change. However, no one provided us with examples showing a discussion of disagreements in the Confidential-Supervisory Section. Finally, we were told that the Report of Examination Review Feedback Form4 may contain comments regarding a proposed CAMELS rating change. DSC officials acknowledged, however, that this form is primarily a training or instructional tool and is not retained in either the EIC’s personnel file or the examination file.

According to regional officials, the only consistent practice among the regional offices regarding the handling of proposed CAMELS rating changes seems to be that, if the proposed CAMELS ratings are changed during the ROE review process, the EIC notifies the bank’s management of any rating change either orally before the final ROE is issued or in the final ROE transmittal letter. If bank management chooses to challenge the CAMELS ratings in the final ROE, the bank will use the FDIC’s independent intra-agency appeals process.

Although all the DSC regional officials we interviewed acknowledged that CAMELS rating changes are not always documented, justified, or tracked, it is important to note that there is no requirement to do so. DSC regional officials provided similar responses regarding why such changes were not routinely documented or tracked. For example, several officials stated that comparing the EIC’s originally proposed CAMELS ratings with the final ratings transmitted to the institution in the final ROE would be a waste of time because a draft ROE is subject to changes until it becomes a final. The official went on to say that the final ROE is the important outcome after much communication and dialogue between the reviewer, the EIC, and other pertinent staff in order to reach agreement on the final assigned CAMELS ratings; and it is the final ROE that is presented to the bank.

Conclusion

According to DSC officials, changes to CAMELS ratings initially proposed by EICs, though rare, do occur, and often, there is no written record of the rating change or a written justification for the change. Accordingly, we concluded that DSC controls over changes to EIC-proposed CAMELS ratings could be enhanced. Enhanced controls, including the written justification and approval for proposed CAMELS rating changes and the tracking and monitoring of such changes, will better assure that senior management is informed of rating changes and help ensure the transparency and integrity of the CAMELS ratings process.

Recommendation on Improving Internal Controls

We recommend that the Director, DSC:

Revise the Case Manager Procedures Manual to require that changes made to EIC-proposed CAMELS ratings in the draft ROE be centrally managed by DSC, including tracking, monitoring, and maintaining the documented justification and approval for changes.




CORPORATION COMMENTS AND OIG EVALUATION

On August 5, 2008, the Director, DSC, provided a written response to the draft of this report. Management’s response is presented in its entirety in Appendix 3. Management generally agreed with our findings and offered alternative actions to meet the intent of our recommendation. A summary of management’s response to the recommendation is in Appendix 4.

In response to the recommendation, DSC stated it believes its process for deliberating and resolving differences of opinion regarding EIC-proposed CAMELS ratings is strong and effective. DSC further stated that it fosters an atmosphere that encourages open deliberation and will continue to emphasize the importance of high quality dialogue on ratings between examiners, Case Managers, and supervisors. DSC agreed that it is important that raising differences with no stigma attached is vital to ensure process integrity and that maintaining a procedure to document unresolved differences of opinion is significant and could be enhanced.

To meet the intent of the recommendation, DSC will formalize the guidance to staff on the required method for documenting unresolved differences related to final CAMELS ratings. DSC will also develop a method to track those instances. DSC stated that it will complete these actions by June 30, 2009.

DSC’s planned actions are potentially responsive to our recommendation. Specifically, we agree that DSC actions can substantially meet the intent of our recommendation to ensure process integrity through emphasizing open deliberation and high-quality dialogue on ratings and recognition of the importance of raising differences with no stigma attached. Concerning transparency, proposed actions to document and track unresolved differences can help keep FDIC management informed of the justification and approval for ratings changes. We continue to believe that there is value in maintaining a record when there are changes to an EIC-proposed rating even when the EIC does not ultimately contest that change. Such records would enable higher-level management to detect any pattern of changes within a given area during the course of DSC’s periodic field oversight, and we suggest that DSC also consider requiring such a record during the course of formalizing its guidance in this area. Nevertheless, the recommendation is considered resolved but will remain open until we determine that the agreed-to corrective actions have been completed and are responsive.

Further, in its response, DSC provided clarifying information concerning the examination process where CAMELS ratings of 3, 4, or 5 are being deliberated. In these cases, the EIC consults extensively with responsible Case Managers, supervisors, and Subject Matter Experts regarding both ratings and supervisory actions. Our report noted that larger or more complex institutions or those with problems resulting in higher ratings receive increased scrutiny. We made modifications to our report, as appropriate, to reflect this additional information.

APPENDIX 1

OBJECTIVE, SCOPE, AND METHODOLOGY

Objective

The objective of this audit was to assess the internal controls the FDIC has established over the CAMELS rating system for reviewing and changing proposed ratings included in draft risk management ROEs. We conducted this performance audit from February through May 2008 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient and appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective.

Scope and Methodology

We reviewed FDIC policies and procedures manuals related to the ROE review process. We interviewed a DSC Risk Management and Applications Section Chief from DSC’s Washington Office regarding the ratings appeals process, an Associate Ombudsman from DSC’s Washington Office, and the Dallas Regional Office Ombudsman.

We performed our test work in the Dallas Regional Office where we interviewed the DSC Risk Management Deputy Regional Director, Assistant Regional Director (ARD), several CMs, a DSC FS, a Supervisory Examiner, and an administrative assistant who handles the electronic reporting requirements. We received a DSC listing of all risk management ROEs completed in 2006 and 2007 for FDIC-supervised institutions, by regional office. The list showed 7,831 ROEs: 4,049 ROEs for 2006, and 3,782 ROEs for 2007. The Dallas Regional Office issued 409 ROEs in 2007. We judgmentally selected a non-statistical sample5 of four recently completed Dallas Regional Office ROEs for review. Specifically, for each ROE, we looked at the Confidential-Supervisory Section for pertinent comments about the CAMELS ratings and the proper use of delegated authority. We also reviewed the examination files for each of the four financial institutions, looking for evidence or documentation that CAMELS rating changes may have occurred. We then focused our audit work on interviewing responsible DSC risk management officials in the other regional offices.

We consulted with the DSC Internal Control Review (ICR) Section and selected two additional DSC Regional Offices for site visits—Atlanta and San Francisco. Where pertinent, we looked at the bank examination files. We held telephone conference calls with DSC officials in the other three regional offices—Chicago, Kansas City, and New York. We made arrangements through the headquarters ICR to interview appropriate risk management CMs, ARDs, and several Deputy Regional Directors. We assessed the activities associated with the receipt of the EIC’s draft ROE and subsequent field, regional, and headquarters review efforts leading to the final ROE. This included a review of the CM functions, supervisory oversight of the examination and reporting process, and the use of management monitoring tools/reports. We also reviewed pertinent DSC ICR reports on each DSC regional office.

Internal Control

To obtain an understanding of the FDIC risk management examination and reporting processes, we reviewed relevant FDIC and DSC policies and guidelines, including the:

  • FDIC’s Risk Management Manual of Examination Policies, Section 16.1, Report of Examination Instructions
  • FDIC’s Case Manager Procedures Manual, Section 3.1, FDIC Full Scope Reports
  • DSC Director’s Memorandum, Report of Examination Review Feedback, Form 6600-53, dated August 26, 2004
  • DSC Directors Memorandum, Administration of Delegations of Authority, dated May 27, 2005
  • DSC Director’s Memorandum, Relationship Manager Program Implementation, dated September 30, 2005
  • DSC Memorandum, Internal Control and Review Section, Structure and Internal Review Changes, dated February 8, 2006
  • RD Memorandum ROA-06-014, Delegations of Authority to Sign Supervision, Compliance, and Applications Documents, dated October 13, 2006
  • RD Memorandum RO-07-019, Examiner Call-in Memorandum, dated August 28, 2007

We also obtained an understanding of the internal controls appropriate and pertinent to reporting, supervisory oversight, and the handling of financial institution complaints as outlined in the above DSC policies and procedures. We flowcharted the various processes and identified the key internal controls. Finally, we reviewed U.S. Government Accountability Office (GAO) Standards for Internal Control in the Federal Government and GAO’s Internal Control Management and Evaluation Tool.

Reliance on Computer-processed Information

For purposes of the audit, we did not rely on computer-processed information to support our significant findings, conclusions, or recommendations. Our assessment centered on reviews of ROEs from the time the EIC prepares the ROE, using the GENESYS report platform, and forwards the ROE, using Outlook, to the region for review. 6 Accordingly, we did not consider it necessary to develop procedures to assess the reliability of data stored in GENESYS.

Performance Measurement

We reviewed annual performance plans and FDIC strategic plans to identify goals, objectives, and results and determine whether the Corporation has (1) established quantifiable performance measures and (2) developed and analyzed data to assess program, project, or function performance related to conducting periodic risk management examinations.

In its 2008 Annual Performance Plan, the FDIC has a strategic goal that FDIC-supervised institutions are safe and sound and a strategic objective that FDIC-supervised institutions appropriately manage risks. The plan also contains an annual performance goal to conduct on-site risk management examinations to assess the overall financial condition, management practices and policies, and compliance with applicable laws and regulations of FDIC-supervised depository institutions. These strategic goals and objectives do not directly relate to control over the CAMELS rating review process.

In addition, we reviewed the FDIC’s 2005-2010 Strategic Plan, 2007 Annual Performance Plan, 2008 Strategic Priorities, and 2008 Corporate Performance Objectives.

Compliance With Laws and Regulations

We reviewed applicable laws and regulations related to the FDIC’s conduct of on-site risk management examinations of each FDIC-supervised institution. We found no instances where the FDIC was not in compliance with applicable laws and regulations.

We assessed the risk of fraud and abuse related to the audit objective in the course of evaluating audit evidence.

Prior Coverage

In March 2004, we issued Audit Report No. 04-015 entitled, Division of Supervision and Consumer Protection’s Supervisory Appeals Process. The overall objective of the audit initially was to determine whether DSC followed appropriate procedures in upgrading a preliminary examination component rating of an institution and in processing the institution’s appeal of its final safety and soundness examination ratings. The Office of Inspector General (OIG) determined that the DSC regional office complied with procedures related to upgrading a preliminary examination component rating. Consistent with those procedures, FDIC and state examiners held discussions with bank management regarding its concerns with the preliminary ratings during the course of the examination. In addition, the Regional Director acted within delegated authority when changing the preliminary component rating. However, with respect to the bank’s formal appeal of the final examination ratings, the appeals procedures did not require an independent DSC analysis of examination information relevant to an appeals case when critical examination findings are not fully supported. Further, DSC did not fully coordinate with the state regulatory authority throughout the appeals process, even though the examination was conducted jointly. Finally, during the appeals process, both the DSC regional and Washington offices had considered information on institution actions implemented after the timeframe covered by the examination, which is contrary to FDIC policy.

The OIG recommended that DSC enhance and enforce current appeals procedures for material supervisory determinations to help ensure that the FDIC appeals process is administered in a fair, efficient, and effective manner and that fully informed decisions are made that are reflective of the merits of the case at the time of the supervisory determination.


APPENDIX 2

RISK MANAGEMENT EXAMINATION PROCESS

The purpose of conducting a risk management examination is to assess an institution’s overall financial condition, review management practices and policies, monitor adherence with banking laws and regulations, review internal control systems, identify risks, and uncover fraud or insider abuse. This examination process is articulated in DSC’s Risk Management Manual of Examination Policies. The overall outcome is the CAMELS/composite rating for a particular financial institution.

The FDIC’s risk management safety and soundness examinations consist of three parts: pre-examination planning (PEP), on-site examination, and completion of the ROE. Pre-examination planning generally takes place off-site at the field office, where the EIC completes an analysis and review of the institution, contacts the institution for financial records, and develops an examination work plan. During this stage, the EIC decides on areas that need special attention and on the work that will be done first. The EIC prepares a PEP memorandum to document the initial conclusions relative to the perceived risk an institution poses and the examination procedures that will be used. Examination instructions tell the examiner to summarize significant discussion topics, such as risk areas; management’s concerns regarding economic conditions; and any other data meaningful to the examiner’s efforts to allocate examination resources. Also, the PEP memorandum should mention targeted risk areas, specifying areas with more than normal risk to which the EIC intends to devote additional or “above-normal” examination resources; and the proposed loan scope, with emphasis on risk areas within the portfolio where the loan file review will be concentrated.

Once on-site at the institution, the examiners concentrate on the institution’s asset quality, financial condition, and operations. Additionally, the examination team evaluates the institution’s adherence to banking laws and regulations, the adequacy of the institution’s internal controls and procedures, and the capability of management reporting systems to provide reliable and accurate data. At the end of the examination cycle, the EIC prepares a consolidated report using the GENESYS report platform. The ROE is intended to factually present the institution’s condition, identify problems, provide management with suggestions and recommendations, and disclose the examination ratings. The ROE, in other words, documents the results of the examination and the basis on which the composite rating was determined.

Prior to the exit meeting with the financial institution, the EIC, under certain conditions, is required to prepare an Examiner Call-In Memorandum to alert the appropriate regional CM and ARD of pending examination results. Specifically, regional management must be informed if the:

  • institution is currently assigned a composite rating of a 3 or worse;
  • EIC plans to downgrade an institution to a rating of a 3 or worse;
  • bank is operating pursuant to an outstanding corrective action plan;
  • examination has identified unusual or complex matters that warrant the attention and oversight of regional management; and
  • examination identified concerns of such magnitude as to warrant a downgrade in the management or composite rating of the bank to a 3 or worse.

Subsequent to submission of the memorandum, the EIC is instructed to call the CM or ARD to discuss the preliminary findings and proposed CAMELS ratings prior to meeting with institution management where the findings/ratings would be discussed so as to allow for the possibility of a representative from regional management to attend the exit and or board meeting.

The EIC holds an exit conference with the institution’s senior management and board of directors to discuss the preliminary examination results and CAMELS ratings. At the exit meeting with the financial institution, the preliminary CAMELS ratings are discussed. Bank officials are informed that these CAMELS ratings are preliminary and subject to the review and approval by FDIC management.

The EIC’s draft ROE is submitted, using Outlook, to the Regional Office for review and approval. The ROE is received by the administrative staff and downloaded into hard copy format for supervisory review. Typically, the field office reviews those financial institutions that have composite 1 and 2 ratings, less than $10 billion in assets, less than a 3 rating for management, and fewer than two 3-rated components. All other ROEs are reviewed at the regional office level. According to DSC regional officials, if the CAMELS ratings are changed during the regional office review, the EIC notifies the bank’s management of the rating change either orally before issuance of the final ROE or in the final ROE transmittal letter. If bank management chooses to challenge the CAMELS ratings in the final ROE, the bank will use the FDIC’s independent intra-agency appeals process.


APPENDIX 3

CORPORATION COMMENTS

FDIC, Federal Desposit Insurance, 550 17th Street, NW, Washington D.C., 20429, Division of Supervision and Consumer Protection.
 
DATE:August 4, 2008
 
TO:Russell A. Rau
Assistant Inspector General for Audits
 
FROM:Sandra L. Thompson [Electronically produced version; original signed by Sandra L. Thompson]
Director
 
SUBJECT:Response to Draft Report Entitled:
FDIC’s Controls Over the CAMELS Rating Review Process
(Assignment No. 2008-011)
 

The Division of Supervision and Consumer Protection (DSC) appreciates that you found that “The FDIC has established internal controls for reviewing draft risk management ROEs, including the supervisory review of proposed CAMELS ratings” and further, “Based on our review of DSC’s policies and procedures, discussions with field and regional office officials, and limited testing, we concluded that controls related to the review of draft ROEs were being implemented as intended.”

We agree that FDIC has effective controls in place to assure that CAMELS ratings are fully vetted and approved by appropriate authority. The Report of Examination (ROE) presents the analysis and the ratings to the institution and constitutes the complete justification and documentation of the CAMELS ratings.

We would like to clarify a description in your report that while factually accurate may easily be misunderstood to infer that minimal vetting occurs until after preliminary ratings have been discussed with an institution. Under the heading Results of Audit on page 3 you state accurately that in most cases “after the EIC discusses tentative examination results and preliminary CAMELS ratings with the financial institution’s senior management, the EIC electronically submits the draft ROE to the region. Then, based on established delegations of authority, the draft ROE is submitted to either the FS, or designee, or to the regional office CM for review.” However, the majority of cases entail institutions with satisfactory CAMELS ratings; therefore, this citation does not accurately capture the cases with problem ratings.

During the examination process where CAMELS ratings of 3, 4, or 5 are being deliberated, the Examiner-In-Charge will consult extensively with appropriate case managers, supervisors, and subject matter specialists regarding both ratings and appropriate supervisory actions. The presentation and discussion of preliminary or final CAMELS ratings is often more formal and involves both examiners and supervisors. It is also more likely that preliminary ratings are not presented until they are finalized. As you note, unresolved differences of opinion as to CAMELS ratings are rare. We would add that when differences occur they usually involve a complex problem and the effect on CAMELS ratings. Therefore, these issues are part of an extensive consultation, vetting, and approval process.

Recommendation

We recommend that the Director, DSC:

Revise the Case Manager Procedures Manual to require that changes made to EIC-proposed CAMELS ratings in the draft ROE be centrally managed by DSC, including tracking, monitoring, and maintaining the documented justification and approval for changes.

DSC Response:

We affirm that our process for deliberating and resolving differences of opinion regarding EIC-proposed CAMELS ratings is strong and effective. DSC fosters an atmosphere that encourages open deliberation and we will continue to emphasize the importance of high quality dialogue regarding ratings between our examiners, case managers, and supervisors. We agree that it is important that raising differences with no stigma attached is vital to ensure process integrity. Also, we agree that maintaining a procedure to document unresolved differences of opinion is significant and could be enhanced.

To meet the intent of your recommendation, we will formalize the guidance to staff on the required method for documenting unresolved differences related to final CAMELS ratings. Further, we will develop a method to track those instances. These actions will be completed by June 30, 2009.

















APPENDIX 4

MANAGEMENT RESPONSE TO RECOMMENDATIONS

This table presents the management response on the recommendations in our report and the status of the recommendations as of the date of report issuance.

Corrective Action: Taken or Planned Expected Completion Date Monetary Benefits Resolved:a Yes or No Open or Closedb
DSC will formalize the guidance to staff on the required method for documenting unresolved differences related to final CAMELS ratings. Further, DSC will develop a method to track those instances. June 30, 2009 $0 Yes Open
a Resolved – (1) Management concurs with the recommendation, and the planned corrective action is consistent with the recommendation.
(2) Management does not concur with the recommendation, but planned alternative action is acceptable to the OIG.
(3) Management agrees to the OIG monetary benefits, or a different amount, or no ($0) amount. Monetary benefits are considered resolved as long as management provides an amount.
b Once the OIG determines that the agreed-upon corrective actions have been completed and are effective, the recommendation can be closed.

APPENDIX 5

ACRONYMS USED IN THE REPORT

ARD Assistant Regional Director
CAMELS Capital Adequacy, Asset Quality, Management, Earnings, Liquidity, and Sensitivity to Market Risk
CM Case Manager
DSC Division of Supervision and Consumer Protection
EIC Examiner-in-Charge
FDI Act Federal Deposit Insurance Act
FFIEC Federal Financial Institutions Examination Council
FS Field Supervisor
FRB Federal Reserve Board
GAO Government Accountability Office
GENESYS General Examination System
ICR Internal Control Review
OIG Office of Inspector General
PEP Pre-Examination Planning
RD Regional Director
ROE Report of Examination
UFIRS Uniform Financial Institutions Rating System/td>




Footnotes
1 The Uniform Financial Institutions Rating System (UFIRS) was adopted by the Federal Financial Institutions Examination Council in 1979. Under the UFIRS, each financial institution is assigned a composite rating by a federal or state banking agency based on an evaluation and rating of six essential components of an institution's financial condition and operations. These component factors address the adequacy of Capital, the quality of Assets, the capability of Management, the quality and level of Earnings, the adequacy of Liquidity, and the Sensitivity to market risk (otherwise known as CAMELS). A rating of 1 to 5 is assigned by the examiner, for each component factor and composite score, with 1 having the least regulatory concern and 5 having the greatest concern.

2 The agencies comprising the FFIEC are the Board of Governors of the Federal Reserve System, FDIC, National Credit Union Administration, Office of the Comptroller of the Currency, and Office of Thrift Supervision.

3 The delegation of authority is the method by which authority is granted, to individuals holding a specific position, for making decisions or obligations on behalf of the Corporation.

4 After the final ROE is issued, the FS or CM prepares a Report of Examination Review Feedback Form (Feedback Form), which is intended to provide constructive feedback on the ROE. According to the instructions for completion, the form should give reasons for substantive report changes. The reviewer is to provide constructive commentary on the strengths and weaknesses of the ROE, addressing each of the broad categories included in the form. The form is routed, as appropriate, to either the Assistant Regional Director or the FS. The EIC reviews the feedback form and discusses any questions, concerns, or disagreements about the feedback with the FS or Supervisory Examiner. In effect, feedback promotes the continuation of high-quality reports and, when appropriate, aids EICs in improving subsequent reports.

5 The results of a non-statistical sample cannot be projected to the intended population by standard statistical methods.

6 GENESYS is an interagency automated product for bank examination. The GENESYS application is generally used to plan the examination, analyze the financial condition of the bank, review management's involvement in the bank operations, and develop the ROE. The GENESYS information is transmitted to the Interagency Examination Repository via the Examination Transmittal Outlook process for the FDIC.
Search | Accessibility | Privacy | Information Quality | Contact Us | Site Map | Home
Last updated 8/25/2008