Federal banking regulators release updated internal audit policy statement, guidance on corporate governance, audits and reporting requirements.

The federal banking agencies recently issued a revised internal audit policy statement to update guidance on the independence of an accountant who provides both external and internal audit services to an institution so that it is consistent with the requirements of the Sarbanes-Oxley Act. This policy impacts public institutions as well as those with assets over $500 million that are subject to the reporting requirements of FDICIA. The policy statement also encourages but does not require nonpublic institutions with assets of less than $500 million, and not subject to FDICIA, to follow the Sarbanes-Oxley Act's internal audit outsourcing prohibition.

However, if such an institution decides to use the same firm for both internal and external audit work, the audit committee should document both that it has pre-approved the internal audit outsourcing to its external auditor and has considered the independence issues associated with this arrangement. The agencies also revised the policy statement's discussion of the responsibilities of the board of directors and senior management with respect to the internal audit function and its placement within an organization, its management and staffing, and the communication of concerns and weaknesses in accounting and internal control.

Expanded guidance has been provided on the use of independent reviews of significant internal controls by small institutions that do not have a formal internal audit manager or staff. The policy statement also includes guidance...