Background Federal Banking Regulators The purpose of federal banking supervision is to help ensure that depository institutions throughout the financial system operate in a safe and sound manner and comply with federal laws and regulations for the provision of banking services. In addition, federal banking supervision looks beyond the safety and soundness of individual institutions to promote the stability of the financial system as a whole. Each depository institution in the United States is primarily supervised by one of the following three federal banking regulators: The Federal Reserve supervises state-chartered banks that are members of the Federal Reserve System, bank and savings and loan holding companies, Edge Act and agreement corporations, and the U.S. operations of foreign banks. FDIC supervises insured state-chartered banks that are not members of the Federal Reserve System, state-chartered savings associations, and insured state-chartered branches of foreign banks. OCC supervises federally-chartered national banks and savings associations and federally-chartered branches and agencies of foreign banks. These federal banking regulators have broad authority to examine depository institutions subject to their jurisdiction. Federal Supervision and Examinations of Large Depository Institutions Federal banking regulators carry out a number of supervisory activities in overseeing management of large depository institutions (see table 1 for a summary of supervision programs for large depository institutions). The supervisory activities are conducted both off- and on-site. Generally, federal banking regulators use off-site systems to monitor the financial condition of an individual bank; groups of banks with common product, portfolio, or risk characteristics; and the banking system as a whole between on-site examinations. Federal banking regulators generally conduct on-site supervision by stationing examiners at specific institutions. This practice allows examiners to continuously analyze information provided by the financial institution, such as board meeting minutes, institution risk reports or management information system reports. This type of supervision is intended to allow for timely adjustments to the supervisory strategy of the examiners as conditions change within the institutions. FDIC, the Federal Reserve, and OCC are required to conduct a full- scope, on-site examination of each insured depository institution they supervise at least once during each 12-month period. The regulators may extend the examination interval to 18 months, generally for institutions that have less than $3 billion in total assets and that meet certain conditions, based on ratings, capitalization, and status of formal enforcement actions, among others. For large institutions, federal banking regulators do not conduct an annual point-in-time examination of the institution. Rather, they conduct ongoing examination activities that are generally intended to evaluate an institution’s operating condition, management practices and policies, and compliance with applicable laws and regulations. In particular, examiners review an institution’s condition using the Uniform Financial Institutions Rating System, also known as CAMELS (capital adequacy, asset quality, management, earnings, liquidity, and sensitivity to market risk). Evaluations of CAMELS components consider an institution’s size and sophistication, the nature and complexity of its activities, and its risk profile. Throughout the examination cycle, each target examination will result in a letter that is transmitted to the institution (where applicable). At the end of the supervisory cycle, a report of examination is issued to the institution. The target examination letter and report of examination may include supervisory concerns that examiners found and that an institution is expected to address within specific time frames. The regulators also issue supervisory guidance, which they describe as including interagency statements, advisories, bulletins, policy statements, questions and answers, and frequently asked questions issued to their respective supervised institutions. Supervisory guidance outlines the regulators’ supervisory expectations or priorities and articulates general views regarding appropriate practices for a given subject area. The guidance often provides examples of practices that the regulators generally consider consistent with safety and soundness standards or other applicable laws and regulations. According to the regulators, supervisory guidance is not legally binding. For instance, FDIC financial institution letters generally announce matters of interest to those responsible for operating an institution. Federal Reserve supervision and regulation letters address significant policy and procedural matters. OCC bulletins generally accomplish the same goals as FDIC and Federal Reserve letters. The letters and bulletins are published on each regulator’s website. Often, the contents of these documents are incorporated into broader examination manuals. Moreover, the federal banking regulators have developed internal control functions within the supervision programs for large depository institutions, which consist of several layers of review following examinations. Each regulator has a review process at the conclusion of examinations, and examiners prepare written products documenting their findings and meet with regional and headquarters officials to finalize decisions. Also, each regulator maintains an internal review function to ensure that examiners properly applied examination guidance. Forward-Looking Supervisory Approach We and others previously found that regulators identified underlying risks at depository institutions that failed during the 2007–2009 financial crisis well before their failure, but did not always take timely supervisory action. As stated by the regulators, the strength or weakness of bank management can reflect an institution’s underlying risk. For example, according to FDIC, the quality of management, including the board of directors and executives, is probably the single most important element in the successful operation of an institution. The Federal Reserve noted that the culture, expectations, and incentives established by the highest levels of corporate leadership set the tone for the entire organization and are essential determinants of whether an organization is capable of maintaining fully effective risk-management and internal control processes. Also, according to OCC, an effective corporate and risk governance framework is essential to ensuring the safe and sound operation of the institution and helping to promote public confidence in the financial system. In our past work, regulators told us they recognized bank supervision needed to be more forward-looking and had incorporated more forward- looking elements into examinations. Forward-looking supervision seeks to mitigate emerging risks before they affect the financial condition of an institution. Regulators can respond to emerging risks in the banking sector with a variety of supervisory tools. These include micro-prudential tools, which traditionally have focused on the safety and soundness of individual financial institutions, and macro-prudential tools, which can be used to address vulnerabilities across the banking system and broader financial system. Supervisory concerns are an important micro-prudential tool to support forward-looking supervision by ensuring that a depository institution takes early action to correct deficiencies. Also, trends in examination data and enforcement activity can provide information on regulators’ identification of and response to concerns of institution safety and soundness and emerging risks. Regulators’ Approaches to Oversight of Management at Large Depository Institutions Generally Were Consistent with Leading Risk- Management Practices Since 2009, federal banking regulators have revised policies and procedures to address management weaknesses at large depository institutions, including by differentiating levels of severity for supervisory concerns and specifying when to communicate them to management at the institutions. Based on our review of selected examination documents, the regulators’ policies and procedures often took different approaches for overseeing management of large depository institutions but each generally addressed leading risk-management practices. Regulators Made Progress in Addressing Oversight of Management Weaknesses and Timely Action on Supervisory Concerns Since 2009, federal banking regulators have revised policies and procedures to better address management weaknesses at large depository institutions identified in the aftermath of the financial crisis. Regulatory staff with whom we spoke noted that most important risk- management concepts had been included in their policies for some time. The post-crisis updates were intended to provide better definitions of certain risk categories and enable examiners to consider individual risks within the context of all risks facing the institution. For instance, in June 2009, FDIC re-emphasized the forward-looking approach, which FDIC states encourages examiners to consider the likelihood that identified weaknesses will cause material problems in the future, and consider the severity of damage to an institution if conditions deteriorate. FDIC further noted that this assessment reflects both the board of directors’ and management’s ability to identify, measure, monitor, and control the risks of the institution’s activities, ensure its safe and sound operations, and ensure compliance with applicable laws and regulations. FDIC policy provides that an assessment of management is not solely dependent on the current financial condition of the institution. Also, in 2015 FDIC updated policies and procedures for identifying and assessing the influence of dominant bank officials or policymakers on an institution, and stated the policy was intended to limit the influence of dominant officials when internal controls are inadequate and ensure independence of the risk-management function. In 2012, the Federal Reserve updated procedures for supervision of large financial institutions, which were intended to strengthen traditional firm- level supervision while also incorporating systemic considerations to reduce potential threats to the stability of the financial system and provide insights into financial market trends. In 2013, the Federal Reserve updated expectations for the assessment of an institution’s internal audit function and provided guidance about the degree to which examiners may rely on the work of an institution’s internal audit function. In 2015, OCC updated its Risk Assessment System to help examiners draw conclusions about the quantity of risk, quality of risk management, aggregate risk, and direction of risk for institutions under eight different risk categories. Also, in 2016, OCC published the Corporate and Risk Governance booklet of the Comptroller’s Handbook to incorporate heightened standards requirements for depository institutions with average total consolidated assets of $50 billion or more. The booklet provides guidance to examiners on board and management responsibilities, risk management assessment factors, and measurement and assessment of risk consistent with the heightened standards. Regulators also took steps to enhance their ability to resolve supervisory concerns in a timely manner through improvements to policies and procedures on identifying and communicating concerns. The regulators employ progressive enforcement regimes to address supervisory concerns that arise during the examination cycle (see table 2). If the institution does not respond to the concern in a timely manner, the regulators may take informal or formal enforcement action, depending on the severity of the circumstances. Informal enforcement actions include obtaining an institution’s commitment to implement corrective measures under a memorandum of understanding. Formal enforcement actions include issuance of a cease-and-desist order or assessment of a monetary penalty, among others. The regulators have continued to update these regimes to clarify the distinction between each level of concern and to improve communication of concerns to the boards of directors of depository institutions. For instance, in 2016, the board of directors of FDIC issued a statement setting forth basic principles to guide the identification and communication of supervisory recommendations. The board stated that a supervisory recommendation refers to FDIC communications with a depository institution that are intended to inform it of FDIC’s views about changes needed to its practices, operations, or financial condition. FDIC’s updated policies and procedures state that supervisory recommendations must be presented in writing and most are generally correctable in the normal course of business. When developing and communicating these recommendations, FDIC examiners are required to (1) address meaningful concerns, (2) communicate concerns clearly and in writing, and (3) discuss corrective action. Supervisory recommendations involving an issue or risk of significant importance and that typically would require more effort to address than those correctable in the normal course, would need to be brought to the attention of the board and senior management through matters requiring board attention (MRBA) comments. The Federal Reserve updated its policies and procedures on identification and communication of supervisory concerns in 2013. The supervision and regulation letter defined matters requiring immediate attention (MRIA) to include (1) matters that have the potential to pose significant risk to the safety and soundness of the banking organization; (2) matters that represent significant noncompliance with applicable laws or regulations; (3) repeat criticisms that have escalated in importance due to insufficient attention or inaction by the banking organization; and (4) in the case of consumer compliance examinations, matters that have the potential to cause significant consumer harm. The letter defines matters requiring attention (MRA) as deficiencies that are important and should be addressed over a reasonable period of time, but where the institution’s response need not be immediate. Therefore, the distinction between MRIAs and MRAs is the nature of and severity of the matter and the timing by which the institution must respond. No matter how serious the concern, it is addressed to the institution’s board of directors. According to the Federal Reserve’s policies and procedures, the communication of supervisory findings must be (1) written in clear and concise language, (2) prioritized based upon degree of importance, and (3) focused on any significant matters that require attention. The Federal Reserve proposed new supervisory concern policies and procedures in 2017, which provided that examiners and supervisory staff should direct most MRIAs and MRAs to senior management of institutions for corrective action. MRIAs or MRAs only would be directed to the board for corrective action when the board needed to address its corporate governance responsibilities or when senior management failed to take appropriate remedial action. The proposed policies would not change the definitions of MRAs and MRIAs or the content of communications to institutions. As of April 2019, the proposed policies and procedures had not been finalized. OCC updated its policies and procedures for examiners to identify and communicate MRAs in 2014 and further enhanced them in 2017. OCC’s policy states that MRAs describe practices that an institution must implement or correct, ideally before those deficient practices affect the bank’s condition. Specifically, MRAs describe practices that (1) deviate from sound governance, internal control, or risk-management principles, and have the potential to adversely affect the bank’s condition, including its financial performance or risk profile, if not addressed; or (2) result in substantive noncompliance with laws or regulations, enforcement actions, or conditions imposed in writing in connection with the approval of any application or other request by the bank. OCC refers to such practices as deficient practices. Such practices also may be unsafe or unsound— generally, any action, or lack of action that is contrary to generally accepted standards of prudent operation and the possible consequences of which, if continued, would be abnormal risk or loss or damage to an institution, its shareholders, or the Deposit Insurance Fund. OCC supervisory concerns are to be communicated in writing to the institution’s management and board of directors to ensure timely and effective correction. Written communications must incorporate the “five c’s” format: Describe the concern. Identify the root cause(s) of the deficient practice and contributing factors. Describe potential consequence(s) or effects on the bank from inaction. Describe supervisory expectations for corrective action(s). Document management’s commitment(s) to corrective action and include the time frame(s) and the person(s) responsible for corrective action. If the root cause of the deficient practice is not apparent, OCC’s procedures instruct examiners to direct management to perform a root- cause analysis as part of the corrective action. Based on Our Review, Regulators’ Policies and Procedures for Management Oversight Generally Were Consistent with Leading Risk- Management Practices The regulators’ revised policies and procedures that relate to oversight of risk management at large depository institutions and to supervisory concerns generally were consistent with leading risk-management practices. We reviewed leading standards and practices (such as federal internal control standards) and then developed criteria with which to assess the regulators’ policies and procedures. Criteria we used included that guidance be clear and actionable and that examiners review risk- management and control functions, identify existing and emerging risks, and review compliance with laws and regulations. (See table 3 for the specific criteria we applied, appendix I for more information on our methodology, and appendix II for the list of policy and procedure documents we reviewed). While individual policies or procedures may not have satisfied all of our criteria, when viewed collectively the policies and procedures generally addressed leading risk-management practices. For example, the policies and procedures almost always provided examiners with clear and actionable objectives for risk-management governance; enabled examiners to identify whether an institution had established a clear governance framework; assisted examiners in identifying, reporting, and recommending changes to address existing and emerging risks; and required review of institutions’ compliance with applicable laws and regulations. More specifically, we found FDIC risk-management policies and procedures for examining large insured depository institutions generally provide clear, actionable risk-management objectives with a few exceptions that did not materially affect our overall assessment. For instance, we identified that a policy document contains clear parameters for examiners to assess identified risks, which is consistent with our criteria, but the parameters did not include instructions for when examiners should consider changing a bank’s rating based on identified risk levels. However, related guidance for examiners in considering the impact of risk on the institution can be found in the definitions and descriptions of CAMELS ratings. We also found that FDIC developed adequate policies and procedures to evaluate corporate governance. In particular, consistent with leading practices, the guidance requires separation of board and management; identification and response to dominant officials; and encourages detailed review of the control environment. FDIC also has processes on risk assessment, and tracking and monitoring risk to address existing and emerging risks. For example, examiners are required to review updates to the institution’s risk- management processes for new lines of business. Similarly, we found that Federal Reserve policies and procedures for large depository institutions generally identify clear, actionable risk- management objectives and explain activities that might be riskier at some institutions compared to others, but a few policies and procedures were not fully consistent with our criteria. For instance, while corporate governance policies and procedures provide detailed materials for examiners to use during examination, and there is extensive guidance on risk identification, assessment, and communication, we noted relatively limited written procedures regarding escalation of concerns to enforcement actions. We discuss this issue in more detail later in this report. We also found that the Federal Reserve included forward-looking risk assessment procedures within risk-identification processes, including preliminary risk assessment to address existing and emerging risks. Finally, we found that OCC policies and procedures for large depository institutions generally provide clear requirements for examiner evaluation of the supervised institution’s quantity of risk, quality of risk management, and direction of risk. But the methods of measurement and specific tolerances for risk in these policies and procedures are not as clear as suggested by the leading practices. However, guidance to evaluate the potential impact of risk is separately available to examiners in OCC’s MRA and enforcement action policies and procedures. We found that consistent with our criteria, policies and procedures are detailed to provide examiners a clear framework to review banks’ corporate governance and risk-management systems. In particular, appropriate attention is paid to board oversight and effective management practice, including clear outlines for board and management responsibilities and independence. To address existing and emerging risks, OCC requires examiners to assess a specific set of risks within its risk-based supervision approach using the Risk Assessment System. OCC uses the Risk Assessment System in conjunction with CAMELS and other regulatory ratings during the supervisory process to evaluate an institution’s financial condition and resilience. Examiners Applied Their Policies but Communication of Supervisory Concerns Could Be More Complete Our review of examination documents of nine depository institutions found that examiners from the three banking regulators generally applied their policies and procedures and identified and communicated management weaknesses to those institutions. Practices for communicating concerns varied among regulators and some practices led to communications that often lacked complete information that would help institutions’ boards of directors ensure that senior management respond to emerging risks in a timely manner. Lastly, examiners generally followed up on prior supervisory concerns consistent with their policies and procedures. Examiners Generally Applied Their Policies and Procedures for Supervision of Management at Large Depository Institutions in the Examinations We Reviewed For the examinations we reviewed, we found that examiners generally applied policies and procedures to assess management oversight of risk at large depository institutions, including those relating to corporate governance, internal controls, and internal audit. We compared selected elements of examiner policies and procedures (focusing on the management component of CAMELS) with selected 2014–2016 examination documents to determine how examiners applied policies and procedures. (See appendix III for the questions we used to make these determinations). Our non-generalizable review of examination documents of nine institutions found that examiners reviewed areas relating to corporate governance, internal controls, and internal audit, which are key components of risk-management frameworks for institutional management and governance. For instance, to assess the adequacy of an institution’s overall corporate governance, FDIC, Federal Reserve, and OCC examiners of the selected institutions generally conducted reviews of areas such as board and management oversight and internal audit. For example: In examination documents for one of the institutions, we found that FDIC examiners examined materials regarding independence and qualifications of directors and policies and procedures related to risk assessments. We noted for another institution that Federal Reserve examiners reviewed materials regarding directors’ fulfillment of duties and responsibilities and policies and procedures relating to corporate compliance. Also, we observed that for one institution, in describing the leadership of the board and management, OCC examiners described aspects of the control environment, risk assessment, control activities, accounting, information, and communication as well as self- assessment and monitoring. At eight of the nine institutions we reviewed, we also found that regulators took steps that were designed to communicate deficiencies they identified before the weaknesses affected an institution’s financial condition. More specifically, examiners identified concerns related to board oversight; risk monitoring; policies, procedures, and limits; and internal controls. Also, for at least four of the nine institutions we reviewed, examiners reported they downgraded the management component rating based on weaknesses identified in management of risks independent of the institutions’ financial condition. For example, at one institution, we observed examiners reporting that weaknesses in an institution’s risk management contributed to a less-than-satisfactory or “3” rating for the management component. Additionally, examiners downgraded the management component rating for two institutions with satisfactorily-rated financial positions because of significant weaknesses in the risk- management program. In another instance, we observed examiners reporting that management’s need to complete remediation of previously identified weaknesses contributed to a “fair” or “3” rating for the management component of CAMELS. As previously discussed, in the past regulators did not always take timely supervisory action on the management weaknesses they identified. In all the reports of examinations we reviewed, examiners generally explained the basis for the rating they assigned to the management component of CAMELS, such as management’s responsiveness to addressing weaknesses and compliance with laws and regulations. Communication of Supervisory Concerns Varied among Regulators and Some Communications Did Not Provide Information on Cause or Potential Effect Practices for communicating supervisory concerns to institutions varied among regulators and some communications do not provide complete information that could help boards of directors monitor whether deficiencies are fully addressed by management. As discussed previously, the regulators require staff to communicate supervisory concerns to institutions through formal written communications. The written communications are generally directed to senior management and boards of directors, which have oversight responsibilities over senior management. According to the Federal Reserve, boards are inherently disadvantaged given their dependence on senior management for the quality and availability of information. One industry representative told us that supervisory concerns were not always clearly communicated, noting that communications of supervisory concerns sometimes can be difficult to interpret and correct. An official from one of the regulators stated that former examiners working as industry consultants sometimes may be hired to help interpret supervisory letters and assist depository institutions in responding to supervisory concerns. Federal internal control standards state that management should communicate quality information externally to help the entity achieve its objectives and address related risks. Quality information is defined as appropriate, current, complete, accurate, accessible, and provided on a timely basis. Other authoritative internal control sources, including Circular A-123 and the framework of the Committee of Sponsoring Organizations of the Treadway Commission (COSO) require cause analysis—that is, an identification of the cause of the deficiencies that have been found. Generally accepted government auditing standards require that auditors plan and perform procedures to develop all four elements of a finding (criteria, condition, cause, and effect) necessary to address audit objectives. Although these authoritative sources do not apply to federal banking regulators, the standards identify principles consistent with the goal of FDIC, Federal Reserve, and OCC guidance in ensuring clear and complete communication of supervisory recommendations. OCC. For two of the three OCC-supervised institutions whose examination documents we reviewed, OCC examiners generally communicated to boards of directors the information they would need to monitor to determine whether deficiencies were fully addressed by management. OCC’s policies and procedures on MRAs require examiners to identify and communicate in writing to depository institutions the concern, cause, consequences of inaction, required corrective action, and management’s commitment for corrective action. If the cause of the deficient condition is not apparent, examiners must direct the institution’s management to perform a root-cause analysis as part of the corrective action. According to OCC staff, they implemented the MRA requirements agency-wide in 2014 after having a positive experience applying them at the community bank level. OCC staff told us that it is necessary for examiners and institutions to understand the cause of a deficiency for examiners to make appropriate recommendations and institutions to address the concern and help ensure the deficiency does not reoccur. Failure of examiners to identify and communicate the root causes of inappropriate practices was among the key findings of an internal OCC review of supervision of sales practices at Wells Fargo. In September 2016, OCC took enforcement action against Wells Fargo for improper sales practices. In April 2017, OCC’s Office of Enterprise Governance and the Ombudsman published an independent review of OCC’s supervisory record for Wells Fargo, which identified gaps in OCC’s supervision and lessons learned. Review findings included that the OCC team responsible for supervising Wells Fargo did not ensure that examiners evaluated root causes of the improper sales practices. In addition, they found that the first MRA that identified the sales practices issue in 2010 did not list the issue as an unsafe or unsound practice and did not identify a root cause or responsible parties. Among the lessons learned was ensuring analysis of root causes and compliance with OCC MRA guidance. In our review, we also observed how OCC’s written communications of concerns changed as its requirements were implemented. For example, in documents from 2014 for two institutions, OCC examiners generally only communicated the concern or the required corrective action and management’s commitment to corrective actions. By 2016, examiners documented each of the required elements for MRAs in their written communication (for two institutions). FDIC. For the three FDIC-supervised institutions whose examination documents we reviewed, FDIC examiners did not communicate to boards of directors the information they would need to monitor whether deficiencies were fully addressed by management. For these three institutions, FDIC examiners stated the concern (deficiency) and required corrective action in their internal communications of supervisory recommendations and also externally with depository institutions. They sometimes stated the potential effect of the deficient condition on the safety and soundness of the institution. These practices were consistent with FDIC policies and procedures in place at the time. For example, in the written communication to one FDIC institution selected for our review, examiners conveyed specific information about the supervisory concerns, the effect of the deficiencies on the institution, and the required corrective action for the MRBAs related to an examination. In another instance, the communication of the supervisory concerns appeared less specific. In that case, examiners reported that the institution management’s actions did not fully address a deficient condition identified in the prior examination. We found that the prior written communication of concerns to the institution did not identify the cause of the deficient condition or propose specific action to be taken. FDIC staff told us they believed that updates to their policies and procedures in 2016 already require examiners to identify the cause for the deficient condition and communicate it to the depository institutions. Specifically, FDIC requires examiners to “describe the deficient practices, operations, or financial condition and how it deviates from sound governance, internal controls, or risk management or consumer protection principles, or legal requirements.” This requirement is similar to OCC’s requirement to “describe the concern.” Specifically, OCC examiners are required to “describe the deficient practice and how it deviates from sound governance, internal control or risk management principles.” FDIC’s policies and procedures do not require examiners to identify the factor(s) responsible for the deficient condition (the “why”) or communicate it to the institutions. Based on the examination documents we reviewed, we did not observe that FDIC examiners communicated the cause of the deficiency. Including the cause facilitates a better understanding of why an institution’s condition is not consistent with law or regulations and, ultimately, can help an institution determine how it could remedy the condition. Federal Reserve. In our review of examination documents for three institutions, Federal Reserve examiners did not include information that boards of directors would need to monitor whether deficiencies were fully addressed by management. Reserve Bank examiners stated the condition and required corrective action in their internal and external communications of supervisory recommendations to depository institutions, consistent with Federal Reserve policies and procedures. Furthermore, the condition and required corrective action were generally closely linked to the criteria examiners applied during the examination, which often consisted of Federal Reserve supervisory guidance. We found that the written communications to depository institutions did not always provide information that would convey the reason the deficient condition occurred (cause) or the potential consequences of the deficient condition (effect). As a result, the information conveyed in the written communications of supervisory concerns was limited. The Federal Reserve Board has broad criteria for Federal Reserve Bank examiners requiring them to communicate only the condition and required corrective action. Federal Reserve Board staff told us that they do not require examiners to identify the cause of a deficient practice or condition. Instead, they leave that responsibility to institutions. Staff stated that they believe the institution is in the best position to identify the cause. They noted that this also could reduce the amount of time examiners otherwise would spend searching for the cause. However, we noted that at least one Reserve Bank builds on the Board’s criteria for communicating supervisory concerns and developed policies and procedures that require examiners to identify condition, criteria, cause, and effect to support supervisory findings in review sessions with Reserve Bank management. As discussed previously, authoritative internal control sources require cause analysis. As an example applicable to banking regulators, OCC requires its staff to identify and communicate the cause of the deficiency that led to the supervisory concern, or, if the root cause is not apparent, to instruct institution management to identify root cause as part of its corrective action. OCC staff noted that identifying root cause in examinations does not require additional resources. Also, if the root cause is not apparent, examiners instruct the institution to identify root cause as part of the corrective action, per OCC’s MRA policy. Furthermore, a September 2018 interagency statement clarifying the role of supervisory guidance instructed examiners to not criticize institutions for a “violation” of supervisory guidance. Identification and communication of the potential effect of a deficiency could enable the Federal Reserve to move away from its practice of closely linking supervisory concerns to failure to comply with guidance and better explain why an institution’s condition is not consistent with law or regulations. FDIC and the Federal Reserve are missing an opportunity to communicate complete information, in writing, to the boards of institutions regarding the cause of the identified deficiency that led to the supervisory concern, which would facilitate a better understanding of why the institution’s condition deviates from safety and soundness standards. Additionally, without communicating the potential effect of a deficiency, the Federal Reserve is missing an opportunity to convey to boards of directors how the concern could undermine the institution’s safety and soundness. Examiners Generally Conducted Follow-Up of Prior Supervisory Concerns In the examination documents of nine institutions we reviewed, federal banking regulators generally followed up on supervisory concerns to determine an institution’s progress in correcting previously identified weaknesses. The regulators require that examiners follow up on corrective actions taken by depository institutions in response to supervisory concerns. Examiners used various methods to follow up on supervisory concerns, such as by conducting limited-scope targeted reviews of one or more issues or incorporating follow-up as part of their regularly scheduled examination of a functional area. In addition, we observed that at four institutions examiners performed follow-up as part of their ongoing supervisory activities. While there are time frame targets for completion of corrective action, concerns can remain open until examiners are satisfied with the effectiveness of the remedial actions taken to address the supervisory concern. For instance, at three institutions we found that examiners closed concerns in targeted follow-up examinations once they validated the completion of remedial action by reviewing documents and activities that verified the implemented action was effective. We also observed instances for at least three institutions in which examiners refrained from closing supervisory concerns because they determined that the institutions’ management had not yet adequately addressed the concerns and further attention was warranted to ensure the corrective action was sustainable. In performing regularly scheduled target examinations of specific functions or risk areas examined during a previous examination cycle, examiners assessed management’s progress in addressing prior supervisory concerns at eight of the nine institutions we selected for examination documentation review. They examined documents, and reviewed processes and other related actions taken by management to address weaknesses in the institution’s management of risk. Lastly, at four institutions, examiners reviewed management’s progress and reported updated information on the institutions’ actions to address supervisory concerns that were escalated to enforcement actions. For example, at one institution OCC examiners documented substantive discussion on the work they performed in conducting follow-up on a consent order, which included reviewing revised documents and reports as well as validation efforts by a third-party consultant. Review of Supervisory Concern Data Revealed Data Limitations and Incomplete Procedures for Escalation of Concerns Federal banking regulators collect and analyze supervisory concern data but do so to different degrees, and FDIC collects supervisory concern data in a manner that challenges management’s ability to fully monitor its supervision activities. We reviewed supervisory concern data for all institutions supervised by FDIC, OCC, and the Federal Reserve. The data we reviewed indicate that management weaknesses have been a consistent concern since 2012. In general, the amount of time supervisory concerns remain open generally has been reduced. The Federal Reserve and OCC track escalation of supervisory concerns to enforcement actions, but the Federal Reserve lacks specific, measurable guidelines for examiners to consider when supervisory concerns are not addressed in a timely manner. Regulators Use Supervisory Concern Data to Different Degrees but FDIC Data Are Limited Federal banking regulators analyze supervisory concern data to inform examination strategy and forward-looking supervision to varying degrees. FDIC staff uses the data to track the duration of open MRBAs. FDIC’s Risk Management Supervision Division has staff responsible for categorizing and analyzing MRBA summary comments quarterly and providing an analysis memorandum to the division’s management to assist with forward-looking risk identification. FDIC staff stated that these analyses supplement other data used to conduct supervisory follow-up. Federal Reserve Board staff told us that they use the data to track MRA and MRIA information over time within portfolios of depository institutions of different sizes. Staff noted that the data are used to inform supervisory strategy development for upcoming examination cycles. According to staff with whom we spoke, the data are useful for conducting horizontal reviews across a single portfolio and determining issues that crop up across institutions in that portfolio. Staff said that the data can be used to identify common issues as they relate to Board guidance. Staff said that the data also are used to determine whether MRAs and MRIAs are closed in a timely manner, both across portfolios and at a granular level—tracking the progress of individual firms. The data are aggregated across all supervision portfolios. OCC staff told us that they use MRA data to track the number of MRA concerns issued, amount of time open, the types of supervisory concerns for which an MRA was issued, and other information useful to OCC supervisory offices and the National Risk Committee. OCC conducts analysis of supervisory concern data in aggregate. Quarterly reports aggregate trends (including number of concerns, whether concerns are increasing or decreasing, and the number of banks with these concerns). For example, OCC analyzes the data by lines of business, examination areas, categories, and primary risk, which helps track existing risks and growing risks and whether MRA concerns have been escalated to enforcement actions. OCC staff said that data regarding aging of MRAs, which can raise visibility of longstanding concerns, are of particular interest to the National Risk Committee, which we observed in internal reports summarizing supervisory concern data. The regulators have internal tracking systems and policies and procedures to record and track examination data but FDIC does not collect certain data in a manner that provides management with comprehensive information to fully monitor the effectiveness of supervision activities. The Federal Reserve System has two systems for recording and tracking supervised institution data: the “C-SCAPE” platform for institutions with assets greater than $50 billion and all foreign banks, and the “INSite” platform for smaller community banks. Each Reserve Bank has issued guidance on recording MRAs and MRIAs specific to the examiners at those Reserve Banks. The MRA and MRIA data are recorded under a broad area of supervisory focus (for C-SCAPE) or MRA and MRIA category (for INSite), with subcategories for the name and description of the issue for greater detail. OCC’s supervisory information system is Examiner View, in which examiners record, update, and view MRAs. The baseline for the required fields is documented in OCC’s policy and procedures manuals on MRAs and Examiner View, as well as in a supplemental memorandum for large bank supervision. Since March 2017, the data have been recorded in a four-level concern framework (examination area, category, concern type, and topic), as determined by a cross- agency working group under OCC’s National Risk Committee. FDIC supervisory data are collected and retained in various systems. Supervisory recommendations are maintained (by institution) in text format in a separate system that is not readily searchable. FDIC maintains information on MRBAs that are not included in an enforcement action in the Supervisory Tracking and Reporting module of the ViSION system. Supervisory recommendations and MRBAs issued to large institutions supervised by FDIC are also tracked in spreadsheets by examination teams. Supervisory recommendations contained in an enforcement action are collected and tracked in the Formal and Informal Actions Tracking system. In 2017, FDIC updated its MRBA policies and procedures to require that examiners enter summary information into ViSION about individual MRBA events, rather than an overall summary of all MRBA events during an examination. But the summary approach means that MRBA data are not categorized at different levels (from a broad level such as examination area to more specific levels, including risk or concern type). Federal internal control standards state that management should use quality information to achieve objectives. Quality information is defined as appropriate, current, complete, accurate, accessible, and provided on a timely basis. Federal internal control standards also stress the importance of management conducting ongoing monitoring of the internal control system, which includes regular management and supervisory activities, comparisons, reconciliations, and other routine actions. As noted above, FDIC policies and procedures do not require examiners to record MRBAs under different categories in the MRBA reporting and tracking system. Instead, FDIC Risk Management Supervision staff is responsible for analyzing summary MRBA data entered by examiners and then categorizing the data for FDIC management reports. These categories are based on staff expertise rather than the experience of examiners in the field who developed the MRBAs. A structure that examiners could use to record more granular details about MRBAs directly after examinations would help ensure that reports prepared for FDIC management are not missing important details about FDIC MRBAs. Currently, FDIC management lacks complete information to better monitor the effectiveness of supervision activities in remediating emerging risks in a timely manner. Data Indicate Continuing Concerns about Management Weaknesses at Depository Institutions Through 2017 Our analysis of supervisory concern data and federal banking regulators’ internal reporting based on the data indicate that management weaknesses at depository institutions of all sizes continued to exist through 2017. The number of supervisory concerns issued for all concern categories decreased each year during 2012–2016. All the regulators frequently cited management as a primary risk area in the supervisory concerns issued during the period. For instance, management and board and loan and credit administration were the largest of 14 categories of MRBAs issued by FDIC in 2012–2016, each constituting about 22 percent of all MRBAs. Corporate governance was the largest of 26 categories of MRAs issued by the Federal Reserve in that period, constituting approximately 19 percent of all MRAs. The next largest category of MRAs issued was credit risk management at 13 percent. Enterprise governance and operations was the third-largest of 16 examination areas of MRA concerns issued and closed by OCC in 2012–2016, constituting about 11 percent of all MRA concerns. The largest examination area of MRA concerns issued was credit at about 37 percent, followed by bank information technology at 13 percent. Similarly, internal reports from the regulators for late 2016 through 2017 indicated that supervisory concerns about management’s ability to control and mitigate risk at depository institutions continued. Our review of the reports showed that corporate governance issues were among the most common categories for issued supervisory concerns. In addition, the Federal Reserve reported in November 2018 that governance and controls issues constituted about 70 percent of outstanding supervisory concerns for the Large and Foreign Banking Organizations portfolio. The Amount of Time Supervisory Concerns Remained Open Was Reduced Our review of supervisory concern data from the Federal Reserve and OCC from 2012 through 2016 generally showed that the amount of time concerns remained open was reduced (for example, see figure 2 for data on the supervisory concerns issued most frequently by the Federal Reserve and OCC during the period). Federal banking regulators told us that they have made efforts in recent years to have institutions remediate the deficiencies that cause supervisory concerns. FDIC data regarding MRBAs were limited and we were not able to determine how long MRBAs remained open by type of concern. Federal Reserve data indicated that the average amount of time needed to close corporate governance MRAs changed from 568 days in 2012 to 155 days in 2016. The time to closure for corporate governance MRAs ranged from 3 to 1,605 days for 2012-2016. Time to closure for credit risk-management concerns, the second-largest MRA category for the Federal Reserve, saw a similar decrease (from 431 days on average in 2012 to 246 days on average in 2016). For OCC, the average time to closure for enterprise governance and operations MRAs decreased from 517 days in 2012 to 245 days in 2016. The time to closure for enterprise governance and operations MRA concerns ranged from 7 to 1,724 days in 2012-2016. Time to closure for OCC’s largest MRA examination area (credit concerns) decreased from 445 days on average in 2012 to 241 days on average in 2016. Federal Reserve Lacks Specific Guidelines for Escalating Supervisory Concerns Federal banking regulators vary in the nature and extent of data they collect on escalation of supervisory concerns to enforcement actions. As noted above, under their progressive enforcement regimes, the regulators may take informal or formal enforcement action against an institution if it does not respond to a supervisory concern in a timely manner. OCC collects data on escalation of supervisory concerns to enforcement actions. These data show that about 2,300 MRA concerns, or about 10 percent of all MRA concerns, were escalated to enforcement actions from 2012 through 2016. Of this amount, 18 percent related to enterprise governance and operations concerns, the second-largest number of escalated MRA concerns behind credit concerns at 41 percent. Federal Reserve data for escalation of MRAs to MRIAs and enforcement actions were collected in a manner that made it difficult for us to reliably determine the extent to which escalation occurred. Therefore, we did not use the Federal Reserve’s escalation data. FDIC does not track escalation of supervisory concerns in a manner that allowed us to determine the extent to which escalation occurred. FDIC and OCC have relatively detailed policies and procedures for escalation of supervisory concerns to enforcement actions, while the Federal Reserve has broad guidelines. Although the Federal Reserve tracks escalation of supervisory concerns, as noted above, Federal Reserve policies and procedures do not delineate specific factors for examiners to follow in deciding whether to identify a concern as warranting possible enforcement action. Instead, the Federal Reserve provides broad guidelines; for instance, stating only that informal enforcement actions are tools used when circumstances warrant a less severe form of action than formal enforcement actions. Federal Reserve staff told us that in practice the facts and circumstances of the case dictate when escalation is appropriate. They said that they take into account the institution’s response to prior safety and soundness actions against the institution and determine whether the institution’s conduct meets enforcement action standards. However, the Federal Reserve has not defined specific and measurable guidelines for when a supervisory concern would require escalation to a more formal regulatory action (such as an enforcement action). In contrast, FDIC and OCC have relatively detailed guidelines for escalating concerns. For example, FDIC guidelines published in 2016 instruct examiners to consider several factors, including management’s attitude towards complying with laws and regulations and correcting undesirable or objectionable practices; management’s history of instituting timely remedial or corrective actions; and whether management established procedures to prevent future deficiencies or violations. Similarly, OCC guidelines published in 2017 instruct examiners to consider several factors, including the board and management’s ability and willingness to correct deficiencies within an appropriate time frame; the nature, extent, and severity of previously identified but uncorrected deficiencies; and the bank’s progress in achieving compliance with any existing enforcement actions. Federal internal control standards provide that management conducts risk assessment to develop appropriate risk responses. Key attributes of effective risk assessment are definitions of objectives and risk tolerances, and management defines risk tolerances in specific and measurable terms so they are clearly stated and can be measured. In assessing risks that might necessitate an enforcement action, the Federal Reserve’s guidelines do not provide its examiners with guidance as to the acceptable level of variation in an institution’s performance relative to the achievement of supervision objectives. Without formalized, specific, and measurable guidelines for escalation of supervisory concerns, the Federal Reserve relies on the experience and judgment of examiners, Reserve Bank management, and Federal Reserve staff to determine when escalation is appropriate. Reliance on a single mechanism or tool can be risky. For instance, institutional knowledge can disappear in times of turnover, such as occurred after the 2007–2009 financial crisis. In addition, reliance on judgement alone can produce inconsistent escalation practices across Reserve Banks and supervision teams. Conclusions Federal banking regulators have strengthened their approach to oversight of management at large depository institutions since 2009. This stronger approach is important as management weaknesses can reflect an institution’s underlying risk. However, we identified areas where written communication of supervisory concerns to institutions and monitoring of supervisory data at FDIC and the Federal Reserve could be strengthened. The communications of supervisory concerns from FDIC and the Federal Reserve did not fully convey why a practice at a depository institution was deficient and, for the Federal Reserve, the effect of the deficient practice on safety and soundness. Complete information about deficiencies is essential to ensuring timely corrective action by senior bank management before the deficiencies negatively affect safety and soundness at the institution. Furthermore, we identified data gaps in FDIC’s recording of MRBAs that resulted in incomplete information for FDIC management on supervisory concerns. Complete supervisory concern information would allow FDIC management to fully monitor the effectiveness of supervision activities (that is, to remediate risks in a timely manner). Finally, the Federal Reserve lacks specific, measurable guidelines for escalating supervisory concerns. Although escalation of a supervisory concern can depend on the facts and circumstances of the case, a lack of formalized, specific, and measurable guidelines for escalation of supervisory concerns could result in inconsistent escalation practices across Reserve Banks and examination teams. Recommendations for Executive Action We are making a total of four recommendations: two to FDIC and two to the Federal Reserve. The Director of the Division of Risk Management Supervision of FDIC should update policies and procedures on communications of supervisory recommendations to institutions to provide more complete information about the recommendation, such as the likely cause of the problem or deficient condition, when practicable. (Recommendation 1) The Director of the Division of Supervision and Regulation of the Board of Governors of the Federal Reserve System should update policies and procedures on communications of supervisory concerns to institutions to provide more complete information about the concerns, such as the likely cause (when practicable) and potential effect of the problem or deficient condition. (Recommendation 2) The Director of the Division of Risk Management Supervision of FDIC should take steps to improve the completeness of MRBA data in its tracking system, in particular, by developing a structure that allows examiners to record MRBAs at progressively more granular levels (from a broad level such as examination area to more specific levels, including risk or concern type). (Recommendation 3) The Director of the Division of Supervision and Regulation of the Board of Governors of the Federal Reserve System should update policies and procedures to incorporate specific factors for escalating supervisory concerns. (Recommendation 4) Agency Comments and Our Evaluation We provided a draft of this report to FDIC, the Federal Reserve, and OCC for review and comment. During their review of the draft report, FDIC and the Federal Reserve provided oral comments about Recommendations 1 and 2 (to update policies and procedures for communication of supervisory concerns to provide more complete information, such as the likely cause and, for the Federal Reserve, potential effect). We modified the respective recommendations to address technical issues raised by their comments. FDIC provided written comments that are summarized below and reprinted in appendix IV. FDIC disagreed with Recommendation 1 and agreed with Recommendation 3. More specifically, FDIC stated that its current instructions to examiners meet the intent of Recommendation 1 (to update policies and procedures for communicating supervisory recommendations to provide more complete information). In particular, FDIC cited its policies and procedures on drafting supervisory recommendations in the report of examination, which include a section entitled, “Explain the Basis for any Supervisory Recommendations or Concerns.” FDIC stated this instruction requires examiners to communicate why there is a concern within the supervisory recommendation. Furthermore, FDIC issued an internal memorandum in October 2018 that reminds examiners to take prompt action to address root causes of deficiencies in complex and changing situations. FDIC stated that it began training in 2018 on developing strong enforcement action provisions to address root causes of deficiencies at problem banks, which continues in 2019. We describe FDIC’s policies and procedures in our report and agree that examiners are instructed to communicate why they are concerned about a deficient condition. However, examiners are not instructed to communicate what they believe to be the root cause of the deficient condition. We are encouraged that FDIC agrees it is important to identify root causes when addressing deficiencies in problem bank corrective actions. Nevertheless, the emphasis on identifying root cause is not found in examination policies and procedures. If, as FDIC indicated, examiners already identify the root causes of deficiencies during bank examinations, then FDIC can address our recommendation by formalizing that process in its policies and procedures. For Recommendation 3 (to improve MRBA data in its supervisory recommendations tracking system, by developing a structure that allows recording of MRBAs at more granular levels), FDIC agreed that a structure should be enhanced to allow staff to further categorize MRBAs at the point of entry into the system. FDIC further agreed that input of more granular information about MRBAs directly after examinations should provide the functionality to track an MRBA from a broad level such as examination to more specific levels, including concern type. The Federal Reserve provided written comments summarized below and reprinted in appendix V. The Federal Reserve did not state whether it agreed or disagreed with Recommendations 2 and 4 but responded that it would take our recommendations into consideration. For Recommendation 2 (to update policies and procedures for communicating supervisory concerns to provide more complete information, such as likely cause (when practicable) and potential effect), the Federal Reserve stated it recognizes that more effectively communicating supervisory concerns may achieve faster resolution of identified deficiencies and ultimately promote a more resilient banking system. The Federal Reserve noted it issued proposed guidance in August 2017 (which we discuss in the report) that would, in part, clarify expectations for communications of supervisory concerns, and that it continues to evaluate commenters’ suggestions. The Federal Reserve stated that it will consider ways to update its policies and procedures consistent with our recommendation. For Recommendation 4 (to update policies and procedures to incorporate specific factors for escalating supervisory concerns), the Federal Reserve stated it appreciated our recognition that the decision to escalate a supervisory concern ordinarily depends on the particular facts and circumstances of each case. The Federal Reserve stated that it will consider whether there are specific factors that staff should consider when escalating supervisory concerns. The Federal Reserve and OCC also provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees and the Chairman of the Board of Governors of the Federal Reserve System, the Chairman of the Board of Directors of FDIC, and the Comptroller of the Currency. This report will also be available at no charge on our website at http://www.gao.gov. Should you or your staff have questions concerning this report, please contact me at (202) 512-8678 or clementsm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix VI. Appendix I: Objectives, Scope, and Methodology This report examines (1) the extent to which federal banking regulators’— the Federal Deposit Insurance (FDIC), Board of Governors of the Federal Reserve System (Federal Reserve), and Office of the Comptroller of the Currency (OCC)—revised policies and procedures for supervision of management at large depository institutions were consistent with leading risk-management practices; (2) how examiners applied agency policies and procedures for supervision of management at large depository institutions they oversee; and (3) trends in regulators’ supervisory concern data for all depository institutions since 2012 and how regulators tracked and used such data. General Methodology To address all our objectives, we focused on risk-management issues, such as those related to corporate governance, internal controls, and internal audit because management weaknesses in these areas could threaten the safe and sound operation of a depository institution. We selected this approach because recent GAO reports have addressed risk- management issues related to financial conditions such as capital and liquidity requirements, stress testing, and commercial real estate risk. We reviewed relevant federal laws and regulations, including sections of the Federal Deposit Insurance Act, Federal Reserve Act, National Bank Act, and interagency regulations on safety and soundness. We reviewed prior GAO reports, including reports on quantitative risk-management issues as they relate to financial condition, supervision of compliance with laws and regulations, and regulatory capture in bank supervision. We reviewed reports from the Offices of Inspector General for the federal banking regulators. We also drew on prior and on-going work related to regulatory capture in bank supervision. In addition, we reviewed the 2013 OCC-commissioned assessment of OCC’s supervision of large and mid-size institutions. We interviewed staff at FDIC, Federal Reserve, and OCC about examination policies and procedures for large depository institutions, processes related to supervision of management at such large institutions, and use of supervisory concerns to address weaknesses they identified. We interviewed staff in the Office of the Inspector General at each banking regulator. We also interviewed three industry representatives with prior experience in bank supervision to obtain their perspectives on bank examinations and supervisory concerns. Reviewing the Extent to Which Regulators’ Revised Policies and Procedures Were Consistent with Leading Practices For this objective, we took steps to identify relevant changes to examination approaches and processes (focusing on oversight of qualitative risk-management activities and communication of supervisory concerns). First we obtained confirmation from the regulators of the list of policies and procedures and other guidance documents we identified for review and solicited suggestions for additional documents to review. We then reviewed and analyzed guidance the agencies issued to examiners and depository institutions, relevant to (1) assessment of board and senior management’s management of risks, (2) metrics used to measure risk, and (3) assessment of depository institutions’ internal controls and audit procedures. Specifically, we reviewed and described regulators’ policy and procedural manuals, supervisory statements, and other supervisory guidance issued since 2009 to identify changes to the agency’s approach and process subsequent to the financial crisis. We focused primarily on changes to address oversight of risk management. We then reviewed documents from several standard-setting organizations to identify criteria for assessing risks and risk management. More specifically, we reviewed federal internal control standards; Internal Control - Integrated Framework of the Committee of Sponsoring Organizations of the Treadway Commission (COSO); safety and soundness standards developed by the federal banking regulators; Core Principles for Effective Banking Supervision of the Basel Committee on Banking Supervision; Federal Reserve’s enhanced prudential standards regulation, which applies to bank holding companies with assets greater than $10 billion and thus applies to the bank holding companies that own the depository institutions within the scope of our review; and GAO reports developing risk-management frameworks for government entities. Based on these documents, we selected a list of criteria to use in assessing the regulators’ risk-management guidance for examining large depository institutions (see table 3). We made connections between the principles listed in each of the documents to highlight the key elements of risk assessment, risk measurement, corporate governance, internal controls, and internal audit requirements. Additionally, we factored in regulators’ consideration of compliance with laws and regulations in their evaluation of the management component of CAMELS (capital adequacy, asset quality, management, earnings, liquidity, and sensitivity to market risk). Specifically for the first three criteria, we considered principles from GAO Standards for Internal Control, COSO’s Integrated Framework, the federal banking regulators’ safety and soundness standards, and the Federal Reserve’s risk management regulation. Additionally, for the second criterion we considered the Basel Committee on Banking Supervision Core Principles for Effective Banking Supervision. For the fourth criterion we considered the regulators’ safety and soundness standards. We also identified sub-criteria to help determine the extent to which the regulators’ guidance to address past supervisory weaknesses aligned with the criteria. Our baseline for the sub-criteria related to the first criterion was that the guidance communicates the need for clear lines of authority and responsibility for monitoring internal controls. The baseline for the sub-criteria related to the second criterion was that the guidance require independence of the risk management function. For the sub- criteria related to the third criterion, the baseline was that the guidance provide for identification of and timely action to address existing and emerging risks. Finally, for the sub-criteria related to the fourth criterion we looked for guidance to require compliance with laws and regulations, which regulators considered in the evaluation of management performance. Reviewing How Examiners Applied Policies and Procedures for Examinations of Risk Management at Large Depository Institutions Selection of Institution Sample For this objective, we undertook a multistep process to select institutions from which to obtain examination documents for review. First, we obtained the lists of institutions subject to examination by the regulators’ large bank examination programs in recent years. For FDIC, these were institutions with total assets of $10 billion or more; for the Federal Reserve and OCC, generally, these were institutions with assets greater than $50 billion. More specifically, we obtained a listing of all FDIC-supervised institutions in its Large Insured Depository Institution program that were subject to examination from June 2013 through March 2017, all Federal Reserve member banks in its Large Banking Organization portfolio as of December 2016, and all OCC-supervised institutions in its Large Bank Supervision portfolio from 2012 to 2016. Next, we selected a non-generalizable sample of three depository institutions from each of the regulators (nine in total) for which to request 2014-2016 examination documents for review. To assemble the sample, we determined the asset size of each institution supervised by the regulators’ large bank examination program as of December 2016, and selected institutions with a range of asset amounts. If these institutions were from the same geographic area (supervised by the same regional office or Reserve Bank), we selected other institutions with comparable asset amounts in order to have geographic dispersion in our sample. The purpose of this selection approach was to assess whether material differences existed in examinations conducted by the different regional offices in our sample. Also, if the selected institutions were headquartered in a foreign country, we selected other institutions with comparable asset amounts. The purpose of this selection approach was to omit institutions with only a branch office in the United States, which would allow the regulator to only examine a portion of the institution’s operations. In addition, if the selected institutions were not primarily engaged in traditional banking activities, we selected other institutions with comparable asset amounts. To make this determination, we conducted a separate analysis to determine if (1) the institutions engaged in traditional banking activities (accepting deposits and making consumer loans), (2) traditional banking activities made up a majority of the bank’s activities as recorded on the balance sheet, and (3) the bank’s loan activities were primarily domestic. The purpose of this selection approach was to omit companies that primarily conduct “non-traditional” banking activities such as investment banking and credit cards but have a regulated depository institution to support those activities. We conducted a separate analysis of OCC-supervised institutions in its Large Bank Supervision portfolio because a number of entities were nationally chartered banks under a foreign holding company or were not primarily depository institutions. In our analysis, we first determined if (1) an institution engaged in traditional banking activities, (2) traditional banking activities made up a majority of its activities as recorded on the balance sheet, and (3) the institution’s loan activities were primarily domestic. We included three federal savings banks in our universe of OCC-supervised institutions because we determined they were subject to many of the same supervision policies and procedures as national banks. We then determined that the geographic location of the examiners-in- charge for the institutions in the Large Bank Supervision portfolio determined the regional office to which the examiner-in-charge reported. To obtain geographic dispersion, we based our selection on the location of the examiners-in-charge to ensure that each examiner was associated with a different regional office. Using these criteria and considerations, we selected small, moderate, and large OCC-supervised institutions. Document Selection and Development of Questions for Regulators To determine how regulators applied agency policies and procedures for supervision of management during examinations of large depository institutions, we requested selected examination documents from the regulators for the nine institutions we selected. For FDIC, initially we requested 2016 examination documents for the three selected large institutions subject to the Large Insured Depository Institution program. For the Federal Reserve, we initially requested 2016 examination documents for the three selected large institutions subject to the Large Banking Organization program. For OCC, we initially requested 2016 examination documents for the three selected large national banks subject to the Large Bank Supervision program. We reviewed these examination documents to learn how examiners reviewed qualitative risk-management issues, such as those relating to the management component of CAMELS. Based on our initial review, we submitted another document request to the regulators. FDIC. Through our initial review of FDIC documents, we identified the risk categories for which FDIC examined corporate-wide risk-management functions. We then requested relevant examination documents for each of the three FDIC-supervised institutions, such as scope, summary, and conclusion memorandums and supervisory letters related to corporate-wide risk-management functions and the Bank Secrecy Act; examination documentation for supervisory recommendation (remediation) follow-up reviews that were reviewed during the 2014, 2015, and 2016 supervisory cycles; summary examination documents related to ongoing monitoring work; explanation of planned target review areas that appeared to cover review of corporate-wide risk-management functions for the same supervisory cycles that had not been completed; and supervisory plans and reports of examination for 2014 and 2015 examination cycles. In total, we reviewed 94 FDIC examination documents. We took as criteria the examination procedures from the examination documentation modules referenced in FDIC’s Basic Examination Concepts and Guidelines and the Management portion of the agency’s examination policy manual. We also incorporated elements of other FDIC policies and procedures, such as those relating to internal routine and controls, dominant officials, and incentive compensation. Our criteria also included FDIC memorandums to assess communication and follow- up on supervisory recommendations, including matters requiring board attention (MRBA). Finally, we used information on enforcement policies and procedures in the agency’s Report of Examination Instructions manual. Federal Reserve. Based on our initial review, we requested conclusion memorandums and supervisory letters (letters of findings) pertaining to several targeted and enhanced continuous monitoring examinations the Federal Reserve conducted during the 2014, 2015, and 2016 supervisory cycles at the three institutions we selected. In total, we reviewed 83 Federal Reserve examination documents. To assess how examiners applied agency policies and procedures, we used examination procedures contained in the Commercial Bank Examination Manual for most of our criteria. In particular, the Commercial Bank Examination Manual includes a section on “Assessment of the Bank” with detailed examination procedures for review of boards of directors, management, internal controls, and audit. In addition, we used guidance from supervision and regulation letters to the extent the information was not incorporated in the manuals. OCC. Based on our initial review, we requested examination documents for targeted and ongoing examination work related to enterprise risk management, operational risk, and other safety and soundness (management) for the 2014, 2015, and 2016 examinations cycles. Specifically, we requested ongoing supervision memorandums, conclusion memorandums, supervisory letters, and risk assessments. We also requested the supervisory strategy and report of examination for the 2014 and 2015 examination cycles. In total, we reviewed 268 OCC examination documents. As criteria, we applied examination procedures from the Large Bank Supervision booklet for certain risk elements related to bank governance and management. We also applied examination procedures for internal control and audit as criteria. In addition, we included agency guidance on follow-up for matters requiring attention (MRA) and enforcement action. We then developed questions to assess the examination documents based on the criteria we selected. See appendix III for our list of questions. Assessing How Examiners Applied Policies and Procedures Using a data collection instrument populated with the selected questions, we assessed each of the regulators’ examination documents. To demonstrate how examiners applied each criterion, we either took language from the examination document or included explanatory language of what the examiner did during the examination to assess risk management. We also tracked the examiner’s findings on each individual risk area we reviewed to the annual report of examination to ensure that the risk was considered in the context of the entire institution. The results of our review of depository institution examination reports and examination documents are not generalizable to all of the regulators’ examination reports and documents. Each individual review serves as an independent assessment of the examiners’ application of relevant agency guidance. Examining How Regulators Tracked and Used Supervisory Concern Data To evaluate the extent to which the federal banking regulators ensured that large depository institutions addressed risk management-related supervisory concerns, such as MRA, and addressed supervisory concerns since 2012, we (1) analyzed the regulators’ policies and procedures for escalating supervisory concerns to enforcement actions, and (2) analyzed aggregate supervisory concern data from 2012 to 2016 for all institutions supervised by FDIC, the Federal Reserve, and OCC. We did not collect data on all the different types of supervisory concerns issued. In particular, we did not collect data on supervisory recommendations by FDIC and matters requiring immediate attention (MRIA) by the Federal Reserve. Therefore, our analysis of the data does not provide a complete representation of the status of supervisory concerns issued by the regulators. To examine trends, we requested that each regulator provide the data by risk category so that we could analyze whether certain risk areas generated more timely resolution of risk management-related supervisory concerns and whether supervisory concerns were elevated to enforcement actions. FDIC. Because of the current structure of FDIC’s data collection and storage systems, FDIC could not provide data on MRBA in a format that would have been easily analyzable for our purposes. Specifically, FDIC examiners enter summary information about MRBAs into the system with no categorization by examination or risk area. FDIC provided us two data sets—raw data downloaded from its ViSION system; and a data set sorted by topics, which was prepared by the FDIC Emerging Risks section and used for publication in FDIC’s Supervisory Insights newsletter. For large institutions, FDIC informed us that the data were not complete because MRBAs reflected in ViSION were those that remained open at the end of the year when the annual report of examination was issued and that MRBAs opened and closed during the examination cycle were not recorded in the system. Due to the limitations with the data and the inability to combine the data sets, some analyses were completed with the raw data set and others with the data set divided by topics. As a result, the analysis provides a general understanding of trends in FDIC supervisory concerns, rather than a rigorous trend analysis. Federal Reserve. We obtained data on MRAs issued to all Federal Reserve-supervised institutions from 2012 through 2016. The Federal Reserve has two systems for recording and tracking supervised institution data: the “C-SCAPE” platform for institutions with assets greater than $50 billion and all foreign banks, and the “INSite” platform for smaller community banks. Some of the MRA data were not categorized by supervisory concern and were assigned a “null” value. According to Federal Reserve staff, in 2012 the Federal Reserve migrated from a legacy tracking system to the current C-SCAPE platform. The MRA data contain both broad MRA categories and sub-categories for greater detail. For ease of explanation and analysis, the data under the sub-categories were consolidated under their larger categories. The number of MRAs uncategorized by supervisory concern did not present a significant obstacle to our analysis. The data on escalation of MRAs to MRIAs and enforcement actions were collected in a manner that made it difficult for us to determine the extent of escalation. Specifically, the glossary that was provided with the data stated that issues closed through the “transformation process” are marked “closed,” and are distinguished from other closed issues by indicating how they were closed (for example, transformed to MRA, transformed to MRIA, or transformed to provision). We determined that any results we produced regarding escalation would be unreliable given the lack of clarity around data collection methods. OCC. We obtained MRA data from OCC that included records opened from January 2012 through December 2016. OCC’s supervisory information system is Examiner View, in which examiners record, update, and view MRAs (among other things). For our purposes, OCC staff stated that we could use the data to count the number of concerns; however, analyzing the concerns by categories could have been problematic because of changes to the classification method that occurred in October 2014 and March 2017. As a result of the 2017 changes, OCC supervisory concern data are recorded in a four-level framework (examination area, category of concern, type, and topic) that allows for tracking of supervisory concerns at the MRA level and at the “concern” level. Before 2017, the information was classified differently. The newer data allow for enhanced trend analysis and risk identification. We were able to analyze OCC data to show the MRAs issued in 2012– 2016 by exam area. We also could show trends in risk management- specific exam areas, as well as the average time it took to close risk- management specific concerns. Furthermore, we obtained and analyzed data on MRAs that were escalated to enforcement actions. For all the regulators, we assessed the reliability of the data. First, we interviewed staff at each of the regulators who were knowledgeable about the data. We asked for the source of the data, how frequently it was updated, and about the controls in place to ensure the data were accurate and complete. Additionally, in assessing the reliability of the data, we reviewed internal reports and other documents prepared by the regulators. Specifically, for FDIC we reviewed management reports for each quarter of fiscal year 2017. For the Federal Reserve, we analyzed draft 2017 annual assessment letters, feedback from the Operating Committee of the Large Institution Supervision Coordinating Committee to dedicated supervisory teams, and other organizing documents. For OCC, we analyzed management reports to different oversight committees for calendar year 2017. While the data did not allow all of the analysis we had planned to complete, overall, we determined that the FDIC, Federal Reserve, and OCC data were reliable for purposes of showing general trends in the number of supervisory concerns, the time frames for closing supervisory concerns, and—additionally for OCC—the number of supervisory concerns escalated to enforcement actions. We conducted this performance audit from March 2017 to April 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: Federal Banking Regulators’ Risk-Management Examination Policy and Procedure Documents We Reviewed This appendix lists the federal banking regulators’ policy and procedure documents included in our review. Federal Deposit Insurance Corporation Division of Risk Management Supervision Manual of Examination Policies – Basic Examination Concepts and Guidelines section (section 1.1), including relevant Financial Institution Letters and internal memorandums. Provides overview of the Federal Deposit Insurance Corporation (FDIC) bank examination process, including rationale for examinations; the Uniform Financial Institutions Rating System, also known as CAMELS (capital adequacy, asset quality, management, earnings, liquidity, and sensitivity to market risk); examination types; scheduling guidelines; and communication with management. Division of Supervision and Consumer Protection Risk Management Manual of Examination Policies – Management section (section 4.1), including relevant internal memorandums. Focuses on the management component of CAMELS ratings, with the main emphasis on the powers, responsibilities, and duties vested in bank directors. It also includes policies and procedures for identifying and assessing the influence of dominant bank officials. Division of Risk Management Supervision Manual of Examination Policies – Internal and Routine Controls section (section 4.2), including relevant internal memorandums. Discusses internal controls, internal control programs, management’s responsibilities, internal control and fraud review examination instructions, and includes a reference tool for examiners. Division of Risk Management Supervision Manual of Examination Policies – Informal Actions section (section 13.1) Identifies procedures for memorandums of understanding to address weak operating practices, deteriorating financial conditions, apparent violations of laws or regulations, or weak risk-management practices. Division of Risk Management Supervision Manual of Examination Policies – Formal Administrative Actions section (section 15.1) Identifies the statute and regulations that authorize the use of formal enforcement actions when necessary to reduce risks and address deficiencies, particularly when an insured state nonmember bank is rated 4 or 5 and evidence of unsafe or unsound practices is present. Division of Risk Management Supervision Manual of Examination Policies – Report of Examination Instructions section (section 16.1), including relevant Financial Institution Letters. Includes procedures for examiners to communicate supervisory recommendations (including matters requiring board attention and deviations from safety and soundness principles underlying policy statements) and identifies schedules for inclusion in reports of examination. Large Bank Supervision Procedures (internal manual), including relevant internal memorandum Describes procedures and processes (in three broad categories: planning, examination activities, and communication) for conducting continuous examination programs at state nonmember banks with total assets exceeding $10 billion. Supervisory Recommendations, Including Matters Requiring Board Attention (internal memorandum) Describes policies and procedures for scheduling supervisory recommendations (including matters requiring board attention) in reports of examination and for tracking bank management’s actions in response to these items after examinations. Pocket Guide for Directors and Statement Concerning the Responsibilities of Bank Directors and Officers The pocket guide describes FDIC’s expectations for boards of directors of institutions to carry out their duties. A second document, the statement, responds to concerns expressed by representatives of the banking industry and others regarding civil damage litigation risks to directors and officers of federally insured banks. Board of Governors of the Federal Reserve System Consolidated Supervision Framework for Large Financial Institutions (SR 12-17) Framework for consolidated supervision of large financial institutions with more than $10 billion in total assets. Bank Holding Company Supervision Manual Provides guidance to examiners as they conduct on-site inspections of bank holding companies and their nonbank subsidiaries. Provides guidance to examiners as they assess risk-management practices of state member banks, bank holding companies, and savings and loan holding companies (including insurance and commercial savings and loan holding companies) with less than $50 billion in total consolidated assets, and foreign banking organizations. Supervisory Considerations for the Communication of Supervisory Findings (SR 13-13/CA 13-10) Discusses the standard language the Federal Reserve uses to enhance focus on matters requiring attention and highlights supervisory expectations for corrective actions, Reserve Bank follow-up, and other supervisory considerations. Also defines matters requiring attention and matters requiring immediate attention and outlines procedures that safety- and-soundness and consumer compliance examiners will follow in presenting and communicating their supervisory findings. Framework for Risk-Focused Supervision of Large Complex Institutions, including relevant supervision and regulation letter (SR 97-24) Describes aspects of the Federal Reserve’s program to enhance the effectiveness of its supervisory processes for state member banks, bank holding companies, and the U.S. operations of foreign banking organizations. Rating the Adequacy of Risk Management Processes and Internal Controls at State Member Banks and Bank Holding Companies (SR 95-51) Directs examiners to assign separate rating for risk management to state member banks and bank holding companies with $50 billion or more in total assets, and highlights the importance of risk management as a facet of the supervisory process. Office of the Comptroller of the Currency Comptroller’s Handbook – Bank Supervision Process Includes explicatory materials on types of banks, supervision responsibilities, regulatory ratings, supervisory process, functional regulation, rating systems, and disclosure. Comptroller’s Handbook – Large Bank Supervision Outlines the supervisory process for large banks: the core assessment, risk assessment system, evaluation of bank internal control, and audits. Comptroller’s Handbook – Corporate and Risk Governance Focuses on management of a variety of risks and the roles and responsibilities of the board of directors and senior management, and provides relevant examination procedures. Comptroller’s Handbook – Internal and External Audits Addresses risks inherent in the audit function (which compromises both internal and external audit functions) and the audit function’s role in managing risks. Also addresses internal and external audit functions’ effect on risk-management supervisory expectations and the regulatory requirements for prudent risk management. Includes guidance and examination procedures to assist examiners in completing bank core assessments affected by audit functions. Comptroller’s Handbook – Internal Controls Discusses the characteristics of effective controls to assist examiners and bankers to assess the quality and effectiveness of internal control. Describes OCC’s supervisory process for internal control reviews and the roles and responsibilities of boards of directors and management. Enforcement Action Policy (Policies and Procedures Manual 5310-3), internal memorandum Describes policy for taking appropriate enforcement action in response to violations of law, rules, regulations, final agency orders, and unsafe or unsound practices and conditions. Violations of Laws and Regulations (Bulletin 2017-18) Describes updated policies and procedures on violations of laws and regulations and provides the agency with consistent terminology for communication, format, follow-up, analysis, documentation, and reporting of violations. Articulates the level and type of risk the agency will accept while conducting its mission. Matters Requiring Attention (Policies and Procedures Manual 5400- 11), internal memorandum Describes procedures for examiners to identify and aggregate supervisory concerns into matters requiring attention including criteria, communication, and follow-up of concerns. Also describes the relationship between matters requiring attention and interagency ratings, OCC’s risk-assessment system and enforcement actions. Includes examiner tools in the appendixes. Risk Management of New, Expanded, or Modified Bank Products and Services (Bulletin 2004-20, replaced by Bulletin 2017-43) Outlines the expectations for national banks’ management and boards to implement an effective risk-management process to manage risks associated with new, expanded, or modified bank products and services. Interagency Policies Guidance on Sound Incentive Compensation Policies 75 Fed. Reg. 36395 (June 25, 2010) Interagency statement on sound incentive compensation practices to banking organizations supervised by FDIC, the Board of Governors of the Federal Reserve System (Federal Reserve), and the Office of the Comptroller of the Currency (OCC). It is intended to assist banking organizations in designing and implementing incentive compensation arrangements and related policies and procedures that effectively consider potential risks and risk outcomes. Appendix III: GAO Questions for Evaluating How Federal Bank Examiners Applied Risk- Management Guidance for Large Depository This appendix lists the questions we used to determine how federal bank examiners applied their policies and procedures to assess management oversight of risk at large depository institutions. We found that each federal banking regulator has slight variation in its policies and procedures for oversight of management at large depository institutions. Therefore, we did not apply generally applicable criteria in our assessment; instead, we applied the specific policies and procedures used by each federal banking regulator. Federal Deposit Insurance Corporation: 1. To what extent did examiners assess board and management oversight? 2. To what extent did examiners assess the bank’s control environment, including whether management takes appropriate and timely action to address recommendations by auditors and regulatory authorities? 3. To what extent did examiners assess the bank’s risk assessment? 4. To what extent did examiners assess the bank’s control activities, to include determining if policies, procedures, and practices were adequate for the size, complexity, and risk profile of the bank and if management took appropriate steps to comply with laws and regulations? 5. To what extent did examiners assess the bank’s information and communication, to include adequacy of information systems to identify, capture, and report relevant internal and external information? 6. To what extent did examiners assess the bank’s systems in place to monitor risk arising from all major activities the bank is engaged in with respect to b. legal risk, and c. reputation risk? 7. In identifying matters requiring attention, did examiners consistently explain the rationale for the concern (whether the matter deviates from sound governance or internal controls and how it could adversely impact the condition of the institution)? 8. In communicating matters requiring attention, did examiners a. write in clear and concise language b. describe the deficient practices, operations, or financial condition, c. recommend actions the board should take to address the deficiency? 9. What steps did examiners take to follow up on matters requiring attention and verify completion? 10. To what extent did the examiner comment on how the bank accomplished compliance with enforcement actions or the reason why the bank is not in compliance with enforcement actions? Conclusions: To what extent did examiners follow agency risk- management guidance for this examination? To what extent do the conclusion memorandums link to the supervisory letter and report of examination? Board of Governors of the Federal Reserve System: 1. Within the context of the consolidated financial entity, to what extent did examiners assess the bank’s implementation of its corporate governance framework? 2. Within the context of the consolidated financial entity, to what extent did examiners assess management of the bank’s core business lines? 3. To what extent did the examiners assess the bank’s board and management for active oversight of the bank, to include the extent to which examiners a. assessed the adequacy of the bank directors’ fulfillment of their duties and responsibilities; and b. assessed bank management’s fulfillment of their duties and responsibilities? 4. To what extent did examiners assess the adequacy of the bank’s policies, procedures, and limits? 5. To what extent did examiners assess the adequacy of the bank’s risk monitoring and management information systems? 6. To what extent did examiners assess the adequacy of the bank’s internal controls? 7. To what extent did examiners assess the adequacy of the bank’s audit function, to include a. internal audit staff, c. internal audit function adequacy and effectiveness, d. external audit staff, and e. regulatory examinations? 8. How did examiners assess the Management rating for CAMELS? 9. In identifying matters requiring attention, did examiners consistently explain the rationale for the concern? 10. In communicating matters requiring attention, did examiners a. write in clear and concise language, b. prioritize based upon degree of importance, and c. focus on any significant matters that require attention? 11. To what extent did examiners follow-up on matters requiring attention and verify completion? 12. To what extent did the examiner comment on how the bank accomplished compliance with enforcement actions or the reason why the bank was not in compliance with enforcement actions? Conclusions: To what extent did examiners follow agency risk- management guidance for this examination? To what extent do the conclusion memorandums link to the supervisory letter and report of examination? Office of the Comptroller of the Currency: 1. To what extent did the examiners assess the quantity and quality of b. reputation risk, c. operational risk, and d. compliance risk? 2. To what extent did the examiners assess the bank’s internal controls, d. accounting information, communication, and e. self-assessment and monitoring? 3. To what extent did the examiners assess the bank’s audit function, b. audit management and processes, c. audit reporting, and d. internal audit staff? 4. How did examiners assess the Management rating for CAMELS? 5. In identifying matters requiring attention, did examiners consistently a. deviates from sound governance, internal control, or risk management principles, and has the potential to adversely affect the bank’s condition, including its financial performance or risk profile, if not addressed; b. results in substantive noncompliance with laws and regulations, enforcement actions, supervisory guidance, or conditions imposed in writing in connection with the approval of any application or other request by the bank; or c. describes an unsafe or unsound practice. An unsafe or unsound practice is generally any action, or lack of action, which is contrary to generally accepted standards of prudent operation, the possible consequences of which, if continued, would be abnormal risk or loss or damage to an institution, its shareholders, or the Deposit Insurance Fund? 6. In communicating matters requiring attention, did examiners a. describe the concern(s); b. identify the root cause(s) of the concern and contributing factors; c. describe potential consequence(s) or effects on the bank from d. describe supervisory expectations for corrective action(s); and e. document management’s commitment(s) to corrective action and include the time frame(s) and the person(s) responsible for corrective action? 7. In follow-up on matters requiring attention, did examiners consistently a. monitor the board and management’s progress implementing b. verify and validate the effectiveness of the board and management’s corrective actions; c. perform timely verification after receipt of the documentation or communication from the bank that the documentation is ready for review; d. meet, as necessary, with the bank’s board or management to discuss progress assessments and verification results; and e. deliver written interim communications to the board summarizing the findings of validation activity? 8. To what extent did examiners verify and validate bank actions to comply with enforcement actions? Conclusions: To what extent did examiners follow agency risk- management guidance for this examination? To what extent do the conclusion memorandums link to the supervisory letter and report of examination? Appendix IV: Comments from the Federal Deposit Insurance Corporation Appendix V: Comments from the Board of Governors of the Federal Reserve System Appendix VI: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Karen Tremba (Assistant Director), Philip Curtin (Analyst in Charge), Enyinnaya David Aja, Bethany Benitez, Rachel DeMarcus, M’Baye Diagne, Risto Laboski, Yola Lewis, Christine McGinty, Kirsten Noethen, David Payne, Amanda Prichard, Barbara Roesmann, Jena Sinkfield, and Farrah Stone, made key contributions to the report.