Sec. 5.3. External audits

(a) Those foreign bank offices with a composite ROC-A rating of four or worse, and a separate operational controls (“O”) rating of four or worse, and, on a case-by-case basis as determined by the superintendent, foreign bank offices with an “O” rating of three or worse, regardless of the composite rating, must engage an independent external auditor, subject to the superintendent's approval, to:

(1) Issue a report on the foreign bank office's balance sheet and accompanying disclosures, which shall include off-balance sheet amounts and assets held on behalf of others. The balance sheet and disclosures must be stated under GAAP and audited under GAAS. The balance sheet and disclosures must be audited as of a quarter-end date within six months following the date the department issues its transmittal letter corresponding to an examination report and annually thereafter for such period as the foreign bank office shall be subject to this subdivision.

(2) Attest to management's assertions regarding the effectiveness of the foreign bank office's internal control structure over financial reporting based on reasonable criteria established by management. Independent external auditor attestation reports must be performed in accordance with United States generally accepted standards for attestation engagements. These reports must be dated as of the same date chosen in paragraph (1) of this subdivision.

(b) The superintendent may, in the superintendent's discretion, require foreign bank offices, in addition to the requirements imposed in subdivision (a) of this section, to engage an independent external auditor, subject to the superintendent's approval, to perform agreed-upon procedures or other additional engagements in accordance with United States auditing or attestation standards. The superintendent will identify specific objectives based on the examination findings, and permit the foreign bank office to draft the procedures with its independent external auditors for the superintendent's approval and agreement.

(c) For balance sheet and disclosures audits required pursuant to subdivision (a) of this section, a consolidating balance sheet must be provided where applicable.

(d) When an independent external auditor determines that a “disclaimer of opinion” is required for a report pursuant to this Part, management and the independent external auditor must consult with the superintendent before such report is issued.

(e) The reports of independent external auditors required pursuant to subdivisions (a) and (b) of this section shall be submitted by management to the superintendent no later than six months from the date the superintendent approves the appointment of the independent external auditor. For each report issued, independent external auditors also must provide a formal management letter containing recommendations to improve internal controls, and include management's response to each recommendation. Management letters are to be provided to the superintendent within two months of the initial report's issuance. Extensions of deadlines shall require the written approval of the superintendent.

(f) The reports of independent external auditors together with supporting workpapers must be in English. Workpapers shall be made available to the superintendent upon the superintendent's request.

(g) Management of the foreign bank office shall notify the superintendent in writing if the services of the independent external auditor are terminated prior to the end of the engagement and issuance of the reports, and the reasons for the termination. The notification must be provided within 15 days of such termination.