Financial Services Alert

The OCC issued an advisory letter (AL 2000-6) to national bank directors and chief executive officers to emphasize the importance of director and senior management oversight of audit and control systems to ensure that these systems are effective. The OCC stated that the risk of audit and control deficiencies has been heightened by "new products, services, delivery channels, and other rapid changes in the banking environment" and, accordingly, audit programs may need to be modified and strengthened to address these changes. The OCC noted that it will continue to take into account a national bank's size, complexity and overall risk profile when evaluating the effectiveness of the bank's audit and internal control program. A bank's audit program now will be rated "strong," "satisfactory" or "weak" (rather than "acceptable," "partially acceptable," or "unacceptable") and this rating will be reflected in the bank's CAMELS and Risk Assessment System ratings.

In another matter related to audit programs, OCC Comptroller Hawke, in remarks delivered at an SEC hearing, praised the SEC for issuing its proposed rule concerning auditor independence (the "SEC Proposal") that was described in the July 11, 2000 issue of the Alert. Mr. Hawke stated that "ensuring not only the independence of external auditors, but also the appearance of independence, is vitally important for investors and other users of financial statements, including bank supervisors." External audits are required for all national banks with $500 million or more in total assets and the OCC also encourages smaller banks to seek independent audits. The Comptroller stated that the OCC, through its bank examination process, has become aware of reductions in the "size, status, independence and proficiency" of the internal audit staff at many national banks.

Mr. Hawke then focused his remarks on the risks faced by each bank that outsources its internal audit function to the same firm that performs the bank's external audit. On July 27, 2000, the American Banker reported that an OCC survey of national banks in the Northeast revealed that "one-third outsource their internal audit function, and half of those use the same firm for the external audit." Mr. Hawke expressed concern that when a bank selects one firm to provide both internal and external audit services, the arrangement creates an inherent conflict and eliminates the "normal checks and balances that can be expected to operate where the internal and external audit functions are performed independently." Mr. Hawke further cautioned bank boards of directors that outsourcing the internal audit function in no way relieves the board of directors of responsibility for "establishing, maintaining and operating effective and independent audit programs." Mr. Hawke's remarks raise issues as to: (1) how a bank's board of directors and senior management can effectively perform due diligence on a firm which serves as both the bank's internal and external auditor; and (2) the need for a bank to have an internal officer of unquestioned stature, competence and integrity supervising the work of the outsourced internal audit function and reporting directly to the board of directors or the audit committee. Moreover, Mr. Hawke expressed special concerns about internal audit outsourcing arrangements at smaller community banks. At some small banks, suggested the Comptroller, neither the bank nor the outside auditors have the staff or resources to implement the protective procedures recommended by the federal bank regulatory agencies. Mr. Hawke stressed that the "maintenance of independence can be even more important in banks that lack the resources to manage their internal audit effectively." Mr. Hawke applauded the balanced approach taken by the SEC in the SEC Proposal. The Comptroller indicated, however, that the OCC would be concerned if a rigid rule were to be adopted which, in practice, had the unintended effect of leading small banks to eliminate independent, external audits so that they could continue to use their former external audit firm to provide outsourced internal audit services. Small banks have also expressed concern that the SEC Proposal will cause them to incur additional expenses, that they may not be able to find two qualified audit firms in small towns, and that it is difficult to have more than one audit firm truly understand a bank's business and operations.

The FRB issued an opinion with respect to Deere & Company's ("Deere") new thrift granting an exemption from the anti-tying rules of Section 106 of the Bank Holding Company Act of 1956 ("Section 106"). More specifically, the thrift would offer three credit cards which could be used to purchase any items sold by participating dealers, but which would offer certain discounts if the cards were used in connection with the purchase of Deere products. Deere represented to the FRB that customers may use other credit cards, cash, and other forms of payment to purchase products sold by participating dealers. The FRB thus determined that the cards are a convenience for customers, rather than a mechanism for Deere to increase unfairly sales of its nonbank products, and thus the card program does not violate the purpose of Section 106, which is to prevent banks from using their market power in banking products to gain an unfair advantage in markets for nonbanking products and services.

The SEC has adopted interim Rule 160 (the "Rule") under the Securities Act of 1933 (the "Securities Act") which exempts from the consumer consent requirements of the Electronic Signatures in Global and National Commerce Act (the "Electronic Signatures Act"), mutual fund prospectuses used for the sole purpose of permitting supplemental sales literature to be provided to prospective investors, (e.g., prospectuses appearing on a website in conjunction with fund advertising). The SEC noted in the adopting release that if an investor views a fund's prospectus and supplemental sales literature on the fund's website and subsequently purchases shares, the Rule would not apply to prospectus delivery requirements triggered by the purchase. The Rule is effective October 1, 2000, the effective date for the consumer consent requirements of the Electronic Signatures Act. Because the Rule has been issued as an interim final rule, the SEC will accept comments on the Rule through August 31, 2000 and may amend the Rule in light of comments received.

The SEC has also clarified its position regarding a mutual fund's adoption of hyperlinked information in its advertising for purposes of the antifraud provisions of the federal securities laws. In the SEC's April 2000 interpretive release on the use of electronic media (Securities Act Release No. 7856, the "April Release"), that was discussed in the May 2, 2000 issue of the Alert, the SEC indicated that an issuer would always be deemed to have adopted hyperlinked information for these purposes when the hyperlink appears in a document required to be filed or delivered under the federal securities laws (as is required for fund advertising). Under the SEC's revised position, whether or not a mutual fund has adopted information hyperlinked to an advertisement depends on analysis of the factors sets forth in the April Release as applied to the facts and circumstances of the particular advertisement. These factors include, among others, the context of the hyperlink and any precautions against investor confusion about the source of information in the hyperlink. The SEC noted, however, that for a fund in registration, hyperlinked information that constitutes an "offer to sell," "offer for sale" or "offer " within the meaning of Section 2(a)(3) of the Securities Act gives rise to a strong inference that the fund has adopted the hyperlinked information. The SEC's revised position on hyperlinks was effective July 27, 2000.

Federal law requires all insured banks with $500 million or more in total assets to (1) obtain annual independent audits, (2) submit certain management reports to the bank regulatory agencies, and (3) establish audit committees comprised of independent directors. A copy of a preliminary checklist that the FRB is issuing to its examiners with respect to these requirements is available upon request.