ALEXANDRIA, Va.-While on the outside looking in at the NCUA in 2003, then-Empire Corporate General Counsel Gigi Hyland questioned whether the agency had the statutory authority to require credit unions to require supervisory committee audits and place minimum standards on committee members. In its 2003 report, the Government Accountability Office suggested just that, similar to actions required of publicly traded companies. Now as an NCUA Board member, Hyland still has her doubts, which she expressed during the February board meeting when the agency issued an advance notice of proposed rulemaking on the issue. In a follow up interview, she emphasized that the agency is just "casting out a net," there is no statutory requirement and the ANPR "doesn't hold the agency's feet to the fire." Specifically, it requests public comment whether and how to modify the supervisory committee audit regulations to require an "attestation on internal controls"; to identify and impose assessment and attestation standards for such engagements; to impose minimum qualifications for committee members; and to impose an independence standard for state-licensed, compensated auditors. She pointed out that Congress specifically rejected the idea of internal control attestations for credit unions when it was considering Sarbanes-Oxley. Hyland described the cost of such efforts "fairly phenomenal" noting that the FDIC had just upped the minimum size institution that has to obtain the attestation from $500 million in assets to $1 billion. The regulator explained that federal credit unions would have to obtain consultants to help set up the internal controls and ensure they were appropriate then hire other consultants to perform the audit. Hyland figured that would probably cost $140,000 from the start. "What's that going to mean to their bottom line? What's that going to mean for their staffing?" she questioned. She asserted that NCUA already has fairly strict auditing standards. "Once we get comments back, this board member is going to be very leery of issuing a proposed rule because I don't think we have the statutory authority to do that," Hyland stated. She said she is not sure the issue will spawn a lot of public comment but she encouraged credit unions to submit letters. CUNA Associate General Counsel Mary Dunn explained that CUNA's Federal Credit Union and Examination and Supervision Committees, as well as its Accounting Taskforce, looked at this issue when they met during CUNA's Governmental Affairs Conference. "If it can be justified that this is necessary for safety and soundness, that's one thing," she said. If the answer is yes, then NCUA has the statutory authority to impose such requirements. If not, is the change necessary? NAFCU Senior Counsel and Director of Regulatory Affairs Carrie Hunt said that NAFCU has just begun to look at the ANPR, including whether the agency has the statutory authority to require supervisory committee audits with attestations. Regarding the potential financial burden to credit unions, she added, "Certainly if credit unions are going to have to get an attestation that will involve the cost of an outside CPA firm." Crowe Chizek Financial Institutions Group Executive Sydney K. Garmong has done some of the briefing with NCUA staff on the matter. She noted that the agency's ANPR "is just talking about the internal attestations," the infamous Section 404 of the Sarbanes-Oxley Act of which small businesses have been complaining about the cost of compliance. Garmong said the additional cost is really difficult to put a number on, but it is somewhere probably between 75-150% of the cost of the external audit fee. "It is there; it is substantial," she admitted. However, there are benefits to it, like getting more eyes focused on internal controls which could lead to efficiencies, the identification of internal control deficiencies, reducing the potential for fraud and others. She admitted that these are rather "intangible and abstract," but it will take some time with practical application to measure any benefits. Garmong emphasized, "It is important for credit unions to comment on the ANPR." Cost and benefit analysis is definitely something credit unions are looking at judging by the comment letters already received by NCUA. Commenters have until April 24 to send something in to the agency. According to Sandia Laboratory Federal Credit Union Senior Manager of Risk Assessment Rick Anderson, the benefits of Sarbanes-Oxley-like requirements for credit unions are "unclear." First, there is the obvious cost of the independent auditor, Anderson wrote in his comment letter to NCUA on its advance notice of proposed rulemaking. "Further," he stated, "the costs involved, both explicit and implicit, will be borne by credit union members for whom the benefit is not as obvious as for those who hold shares in a publicly traded company." He noted that NCUA and GAO have said the point of an attestation requirement for credit unions would be to improve the agency's oversight. "Fortunately, it hasn't been demonstrated that the NCUA's oversight of credit unions' financial reporting needs improvement. Clearly, the credit union charter is inherently less risky than state and federal bank and savings and loan charters. Relating to the reduced risks/opportunities, the incentives for fraudulent reporting are significantly reduced in the credit union industry. It would seem the disparity.is in fact justified." The benefit of a formally-tested attestation is dubious given the subjective nature of evaluating internal controls," Anderson added. "Though there are widely-accepted models of internal control, the implementation and evaluation of them is by necessity a subjective process. It is unclear whether any significant measurable benefit would accrue to the NCUA as a result of the expenditures and efforts made by the insured institutions and their members." Timber Country Community Federal Credit Union ($2.2 million) President Paul Weed called the effort "redundant and burdensome." He added, "Internal controls are already addressed by the external auditors as part of their audit. In our case, as a very small credit union with limited staff (less than 2 persons), the auditors address this issue in detail. They thoroughly examine the procedures we use to compensate for our inability to follow `common practice' internal controls due to our limited staff size." As a former external auditor, Farmers Insurance Group Federal Credit Union Executive Vice President Laura Campbell, wrote, "While I understand the intent of Sarbanes-Oxley, I think it was a knee-jerk reaction to a few highly publicized frauds, and I don't believe the attestation requirement will prevent such frauds from happening in the future. Crooked people can always figure out a way around a control to accomplish what they want, so these rules end up punishing the honest businesses and the consumers.The costs of an attestation, additional staffing and documentation requirements are going to be paid for by our credit union members, and I don't see the benefit they would get from this cost.[T]he people I see benefiting from these new audit requirements are the public accounting firms themselves, and no one else." She also questioned the attestation's usefulness. "A report that tells me my controls are sufficient today is useless to me tomorrow," Campbell wrote. NCUA also asked for comments about the feasibility of setting certain minimum standards for supervisory committee members. Topline Credit Union Supervisory Committee Chair Tom Kleinschmit told the agency that he felt the best way to gauge a committee's skill set would be during the regular examination process. "There is a wide range of skills that committee members need in order to cover all the bases of committee issues and activities," his letter read. "I think it would be very difficult to mandate a set of skills in any way other than a very general way. That might consist of listing a series of skills that would be helpful to the committee like banking, financial management, accounting, business management, etc. We find at various times there are a lot of other skills that come in handy, like technical knowledge related to data security, or experience with contracts and the bidding process." Alaska USA FCU CEO William Eckhardt wrote that adapting a policy intended for public companies to the credit union business model is contradictory. "Modeling credit union Supervisory Committee Audit responsibilities after the requirements of Sarbanes-Oxley or the FDICIA fosters parallels in structure and purpose that do not exist, and in fact serve to undermine credit union distinctions," he wrote. However, he did agree with the idea of "developing certain financial reporting and accountability standards serves the interests of members." -

[email protected]