An official website of the United States government
Parts of this site will be down for maintenance from Friday, October 30, 8:00 p.m. to Sunday, November 01, 9:00 a.m. (Eastern)
Share This Page:
A bank supervised by the Office of the Comptroller of the Currency (OCC) filed a formal appeal with the Ombudsman disputing conclusions communicated in the most recent report of examination (ROE). Specifically, the bank appealed the following:
The appeal asserted that the liquidity component rating should be 2 instead of 4. The appeal contended that the bank had satisfactory liquidity levels and funds management practices. The appeal asserted that the liquidity risk management MRA was not warranted and disputed the assessment of high quantity of liquidity risk, weak quality of liquidity risk management, high aggregate risk, and increasing direction. The appeal disagreed with the conclusion that certain deposits held at the bank were price sensitive, and the level posed a high risk and a funding concentration.
The appeal asserted that the earnings component rating should be 2 instead of 3. The appeal disagreed that the bank’s funding strategy had changed since the prior examination. The appeal asserted that the variance in the bank’s net income to budget was not a result of management’s inability to manage funding concentrations, but a result of the Federal Reserve Bank holding higher market rates for a longer than anticipated period. The appeal also contended that the decline in the net interest margin (NIM) was a result of industry market rates, not due to management’s strategy or strong competition for deposits.
The appeal asserted that the new capital planning MRA was not warranted. The appeal contended that management had maintained profitability during a period of high interest rates, and the bank’s capital ratios were well above regulatory minimums. The appeal stated that the bank’s capital plan was adequate for its size, complexity, and risk profile.
The appeal disputed the new board and management oversight MRA. The appeal asserted that the bank’s president and staff effectively oversaw the bank’s daily operations and had the expertise to operate the bank effectively. The appeal asserted that the supervisory office (SO) had approved the bank’s current succession plan for years. Further, the appeal contended that the SO cannot cite the MRA as it had no basis in law, rules, or regulation.
The appeal disagreed with the assessment of high quantity of strategic risk, weak quality of strategic risk management, high aggregate risk, and increasing direction of risk. The appeal asserted that the SO failed to understand the nature of certain deposits, and management’s funding strategy had not caused any deterioration in the bank’s financial performance. The appeal asserted that the bank remains profitable, and the board and management effectively managed liquidity and made the determination to reduce certain deposits.
The appeal disputed the new strategic planning MRA. The appeal asserted that the bank’s risk profile had not changed since the prior examination; therefore, the existing strategic plan remained adequate for the bank’s size and complexity. The appeal stated that the bank does not have a concentration in certain deposits, and that the level of those deposits decreased from the prior examination. The appeal asserted that the bank effectively managed its sources of liquidity, remained profitable, and had capital ratios well above regulatory minimums.
The appeal disputed the assessment of high quantity of operational risk and increasing direction of risk. The appeal asserted that the bank was in full compliance with 12 CFR 30, operated in a safe and sound manner, and had ample liquidity. The appeal stated that the board and management maintained a sound internal control environment, appropriate for the size of the bank and the nature, scope, and risk of its activities.
The appeal asserted that the new external audit concern within the audit program MRA should be withdrawn because there was no requirement for a bank with its asset size to have an external audit.
The appeal disputed the weak rating for audit. The appeal stated that conclusions in the ROE were misleading regarding late audits, the board’s failure to provide oversight, and lack of management accountability for untimely responses to outsourced internal audit. The appeal asserted that the SO was aware of the discontinuation of services with the bank’s previous audit provider and the backlog of audits with the new audit provider. The appeal also stated that the bank’s internal audit function did not identify weaknesses with the asset liability management (ALM) function.
The appeal disputed the insufficient internal controls rating noting that the board and management maintained a sound internal control environment appropriate for the bank’s size, nature, and risk.
The appeal asserted that the management component rating should be 2 instead of 4 given the bank’s satisfactory management and board performance and satisfactory risk management practices. The appeal noted that there were no weaknesses that were material to the safety and soundness of the bank, and the bank was addressing minor weaknesses. The appeal disagreed with the liquidity conclusions and related risk management criticisms that impacted the management rating.
The appeal asserted that the bank’s composite rating should be a 2 instead of 4 because the bank’s risk profile, level of on-hand liquidity, total liquidity, and certain deposits were consistent with the prior examination. The appeal stated that the bank was stable and capable of withstanding business fluctuations, including liquidity changes, and any issues were well within the board and management’s capabilities and willingness to correct.
The Ombudsman conducted a comprehensive review of the appeal using the following supervisory standards in effect at the time of the examination:
The Ombudsman issued a split decision on the bank’s appeal. The Ombudsman concurred with the SO’s decisions to rate earnings 3, audit weak, and internal controls insufficient. The Ombudsman also concurred with the SO’s assessment of liquidity, strategic, and operational risks, and the MRAs for liquidity risk management and capital planning. The Ombudsman concurred with the bank that the MRAs for board and management oversight, strategic planning, and audit program were not supported. Finally, the Ombudsman did not concur with the SO or the bank on the composite rating and two component ratings. The Ombudsman concluded that a 3 rating for the composite, as well as management and liquidity components was consistent with the rating definitions outlined in the “Bank Supervision Process” booklet of the Comptroller’s Handbook. These ratings differ from the ratings of 4 in the ROE and 2 suggested by the appeal. The Ombudsman instructed the SO to revise and reissue the ROE to reflect the appeal decisions.
The Ombudsman concurred with the SO’s decision on the liquidity risk assessment. The high quantity and aggregate level of liquidity risk were based on the low level of on-hand liquidity coupled with the bank’s significant dependence on short-term, volatile sources of funds. Core deposits declined and short-term noncore funding dependence substantially increased, primarily due to a high balance of time deposits over $250,000 maturing in one year or less. Migration of deposits to short-term, rate-sensitive deposits compounded by the increase in market rates drove the significant change in the bank’s liquidity risk profile. This placed heightened and ongoing pressure on management to quickly obtain sufficient funds to repay maturing time deposits to continue operations and meet immediate financial obligations. Funding sources were not well diversified as the bank did not have any borrowings or brokered deposit relationships established, and the investment portfolio offered limited funding support. The quality of liquidity risk management was weak. The board and management did not establish risk management commensurate with the bank’s increasing liquidity risk that contributed to low liquidity, deterioration in earnings, and, on occasion, undercollateralized public deposits. The board and management did not timely identify liquidity shortfalls, establish sufficient contingent funds, establish prudent limits, and mitigate the bank’s dependence on rate sensitive funds. Management information systems (MIS) to identify and react to anticipated and unanticipated funding needs were insufficient and incomplete. The bank’s contingency funding plan (CFP) was inadequate and not commensurate with the high and increasing liquidity risk profile. The CFP lacked prioritization and assessment of viability of contingent funding sources, identification of bank-specific and sufficiently severe stress events, completion of appropriate stress tests, and identification of adequate action plans to secure sufficient funding. The high quantity and weak quality of risk management resulted in aggregate liquidity risk. The direction of liquidity risk was increasing, as management planned to continue using short-term volatile funds, fluctuations continued in primary and secondary liquidity sources, and risk management processes must improve.
The Ombudsman concurred with the SO’s decision to issue the liquidity risk management MRA. The board and management did not take timely and appropriate actions to identify and control increasing liquidity risk since the previous examination. The SO communicated to the board the deterioration in the bank’s liquidity during periodic reviews in the years preceding the examination, through changes in the liquidity risk assessment and component rating. At the time of the examination, liquidity risk management practices had not improved and were weak.
The Ombudsman determined that the bank’s liquidity more closely aligns with a rating of 3. Liquidity levels and funds management practices need improvement. The bank had a low and declining, but not deficient, level of liquidity available to meet present and anticipated liquidity needs. A declining core deposit base, low on-hand liquidity, high concentration of public funds, insufficient alternative funding sources, high cost of funds, low level of short-term assets to support an increasing level of short-term liabilities, and reliance on short-term sources to fund longer-term assets supported the high quantity of liquidity risk that contributed to the liquidity rating of a 3. In addition, funds management practices needed improvement, and the bank lacked ready access to funds on reasonable terms. Factors precluding a 4 rating were the bank’s low loan growth, historically satisfactory asset quality with minimal loan losses and manageable loan past dues, noncomplex balance sheet, and satisfactory capital levels as of the examination.
The Ombudsman concurred with the SO that the earnings component should be rated a 3. The level of earnings declined during the supervisory cycle and was insufficient in relation to the bank’s overall condition and other factors affecting the quality, quantity, and trend of earnings. Earnings had been volatile due to inadequate balance sheet management, specifically, sporadic loan growth and expense control. The return on average assets (ROAA) decreased and the NIM declined due to the high cost of funds and elevated overhead expense. While market rates had challenged the bank and the industry, the board and management’s decisions regarding the bank’s balance sheet management directly affected earnings. The migration of lower cost deposits to short-term time deposits, particularly in a large depositor concentration, resulted in the rate of change in interest expense outpacing the rate of change in interest income. This adversely affected the NIM and net income. Funding operations with certain deposits may at times cost less than funding through borrowings or other contingent sources of liquidity. However, core deposits generated locally are typically the most cost effective and reliable sources that are least price sensitive, particularly during a high or increasing interest rate environment. Inadequate budgeting and forecasting processes resulted in significant variances that management had not addressed. The existence of external factors such as significant changes in market rates did not alleviate the board and management’s responsibilities to ensure prudent balance sheet composition and overseeing and managing the bank in a safe and sound manner. This includes reducing concentration risk and its impact on the bank’s earnings and overall financial condition.
The Ombudsman concurred with the SO’s decision to issue the capital planning MRA. The capital plan lacked information regarding an evaluation of sources of capital, prior history, success, and timing for raising capital, current market conditions, and the cost and amount of equity. The bank’s increased risk profile, decline in financial condition, and weak risk management practices across multiple key areas support the need to identify viable capital sources to quickly raise capital. Risk to capital was significant based on moderate credit and interest rate risks combined with high liquidity, operational, and strategic risks. Management completed semiannual capital stress tests, as required by the bank’s policy; however, the board may be making decisions regarding capital adequacy based on inaccurate capital stress testing results. A review of the stress test found that the information was incomplete, and all relevant assumptions were not documented. The capital stress test also did not assess the bank’s compliance with its internal minimum capital ratios. Aside from retained earnings and management of balance sheet assets, the board did not identify tangible actions for raising capital. This short-term strategy of allowing assets to mature or roll off was not sustainable for the long-term given the bank’s asset size and had resulted in volatile earnings and liquidity levels that need improvement. While capital ratios were satisfactory as of the examination, declining earnings, dividend levels, and lack of access to capital markets placed increased pressure on capital.
The Ombudsman concurred with the bank that the audit program MRA was not supported. The audit MRA consisted of a past due board and management oversight concern and a new external audit concern. The board and management oversight concern should have been deemed closed based on the original concern and corrective action outlined in the prior ROE. The bank engaged a new audit firm that had completed and issued audit reports for seven of eight delayed audit areas identified in the previous ROE. The board deferred the audit of one outstanding audit area for acceptable reasons. In addition, the corrective action required was simply to provide a remediation plan that ensured the internal audits for eight audit areas were completed within reasonable timeframes relative to their risk level. The corrective action did not require the board to effectively execute the remediation plan or to implement a practice such as an effective process for the board to ensure timely and effective internal audits going forward. The continuation of past due internal audits is part of the assessment of the bank’s audit rating. Regarding the new external audit concern, the Ombudsman concurred with the bank that there was no statutory requirement for the bank to obtain an external audit of its financial statements, given its size at the time of the examination. An annual financial audit is required by 12 CFR 363 for banks with total assets of $1 billion or more. Additionally, the SO did not identify any significant concerns or discrepancies with financial statement reporting, accounting transactions, general ledger entries, the call report, or violations of laws and regulations to support a need for such an audit.
The Ombudsman concurred with the SO that the audit program was weak. Pages 242 to 246 of the “Community Bank Supervision” booklet of the Comptroller’s Handbook provide audit rating definitions. The handbook notes, “a weak audit program is one that is not an integral part of the organization, and the OCC cannot rely on the audit function’s work or conclusions. The audit program does not have the full support of the board and management. Audit’s role is unclear and not used in overall risk management, new product and service deployment, changes in strategy, and organizational and structural changes.”
The audit committee, made up of the full board, was not effective in its oversight of the audit program given the failure to ensure timely responses to audit requests, continued delay of multiple years’ internal audits, and lack of an independent internal audit function. While the Ombudsman deemed the audit program MRA as closed based on this appeal review, there were significant delays in audit areas since the prior examination. Several of the past due audit areas were rated moderate or high risk with most recent audits completed between two to five years prior. The audit committee did not hold themselves, management, and/or the outsourced internal auditor accountable for the significant delays in audits. Board minutes do not include documentation acknowledging audits falling behind schedule or actions to address the delays. The supervisory record includes emails from the current external audit provider stating that the delays in completing audits were due to a combination of the backlog in past due audits at the time of engagement and untimely management responses. Regardless of whether delays resulted from the bank or third-party issues, the audit committee was responsible for ensuring sufficient and timely audits and, ultimately, an effective audit function. The board and management have a risk-based audit program. However, the risk assessments do not include narrative explanations for ratings assigned to each factor that together determine the overall internal audit risk and audit frequency for each audit area. Changes to the risk rating assigned to a factor from one year to another were not explained, particularly when there was no audit completed in the area revealing new information that could explain the change. The bank’s president engaged the internal auditor and provided all audit related communication to the board, rather than the outsourced audit firm, which compromised the independence of the audit program.
The Ombudsman concurred with the SO’s decision to rate internal controls insufficient. Internal control weaknesses were evident in the bank’s liquidity risk identification and monitoring. Liquidity MIS was not accurate or complete, capital planning needed improvement, and the audit program was weak. Multiple year delays in moderate and high-risk internal audit areas combined with the lack of an independent financial statement audit prevent an objective, independent assessment of the quality of the bank’s system of internal controls. This hinders the board’s ability to have confidence in the bank’s internal controls, compliance with laws and regulations, and financial and regulatory reporting.
The Ombudsman concurred with the bank that the board and management oversight MRA was not warranted. The Ombudsman determined that one of the concerns outlined in the board and management oversight MRA was redundant with the liquidity risk management MRA. If the board implemented effective corrective actions for the liquidity risk management MRA, the concern and corrective actions related to board and management for that issue would be addressed. The second concern regarding succession planning was a lesser concern. The board should assess the need for additional staff to maintain risk management practices and internal controls; however, given the small size and limited resources of the bank, this issue did not rise to the level of an MRA at of the examination. Contrary to the appeal assertion, there is no requirement that the SO must identify noncompliance with a law or regulation to issue an MRA.
The Ombudsman concurred with the SO’s decision of high quantity of strategic risk, weak quality of risk management, high aggregate risk, and increasing direction of risk. The board and management were slow to react to and plan for changes in the market related to asset liability management. The funding strategy resulted in deterioration in the bank’s financial performance, adding pressure and risk to capital. Strategic planning needed strengthening as the board did not evaluate and outline the bank’s funding structure, potential risks from high concentrations in certain deposits, and strategies to reverse direction, if necessary. Staffing and succession planning concerns did not sufficiently support operations, and additional expertise and training were necessary for board and management to understand and control the risks facing the bank. The weak audit program and insufficient internal controls prevented the board and management from effectively identifying, measuring, monitoring, and controlling all risks to the bank and reversing the bank’s deteriorating financial condition. The direction of strategic risk was increasing as the financial deterioration of the bank was anticipated to be costly to reverse as the board and management work to improve policies, processes, controls, and the strategic direction in a competitive and challenging banking environment.
The Ombudsman concurred with the bank that the strategic planning MRA was not warranted. While the board and management should strengthen its strategic planning, the bank has an informal strategic planning framework that the board and management have relied on that was reasonable given the bank’s asset size and complexity of operations, the bank was profitable, albeit with low earnings, and capital levels were satisfactory as of the examination. Beyond the discussion of whether the bank has a formal, written strategic plan, the SO identified a lack of responsiveness to an increasing risk profile from changes in the banking industry and operating
environment. Management’s funding strategy caused significant deterioration in the bank’s financial performance and increased the risk to capital. The board should ensure strategic planning was commensurate with the bank’s high-risk profile and the bank’s capital plan and levels. Strategic planning should assist the board and management in identifying, reducing, and planning for risks, reversing the bank’s deteriorating financial condition, and ensuring short- and long-term success of the bank. The SO considered the issues surrounding the strategic when rating the management component rating.
The Ombudsman concurred with the SO’s decision of high quantity of operational risk, insufficient quality of risk management, high aggregate risk, and increasing direction of risk. The volume and severity of weaknesses in internal systems related to audit, internal controls, liquidity, budgeting, and capital planning combined with concerns with staffing levels and expertise have negatively impacted earnings and placed additional risk on capital. Effective controls in the bank’s information technology function, noncomplex products and services, and satisfactory vendor risk management activities preclude a weak quality of risk management. The direction of operational risk was increasing, as internal audits remain delayed, management noted plans to continue with the current funding structure, and the board and management need to improve policies, procedures, and processes to address increasing risks throughout the bank.
The Ombudsman concluded that the management component closely aligns with a rating of 3. The Ombudsman determined that risk management practices were less than satisfactory and need improvement, rather than deficient, given the noncomplex nature of the bank’s operations. Board and management performance needs improvement. Risk management practices were less than satisfactory for liquidity and capital planning to fully support the bank’s high-risk profile. The board was not actively involved in supporting management to administer appropriate risk management processes or in holding themselves and management accountable. Strategic and operational risks were high and increasing with weak or insufficient risk management. The board did not ensure adequate succession planning, staffing, and expertise relative to the change in the bank’s risk profile. The number and severity of problems and risk exposure were not excessive for the bank’s size and complexity. However, the board and management inadequately identified, measured, monitored, and controlled material risks to the bank and were more reactive to changes in the market and environment.
The Ombudsman concluded that a composite rating of 3 was supported based on the decisions rendered in this appeal. The bank exhibited supervisory concerns in multiple component areas, including liquidity, earnings, capital, and board and management supervision. Risks range from moderate to high, and weaknesses led to component areas being downgraded from 2 to 3. Risk management practices were less than satisfactory in several key areas of the bank, but weaknesses ranged from moderate to severe rather than critically deficient for the size and noncomplex operations of the bank. Management lacked the ability to effectively address weaknesses in a timely manner, as evidenced by being reactive in securing contingent funding, continued delay of internal audits, and delayed and inaccurate liquidity MIS. The bank was vulnerable to increasing interest rate, liquidity, operational, and strategic risks from weaknesses in board and management oversight, strategic planning, capital planning, liquidity risk management, and audit. The bank was less capable of withstanding business fluctuations and more vulnerable to outside influences, evidenced by the negative financial impact from management’s funding strategy during a time of high and increasing interest rates. The bank president’s significant workload and inadequate level of staff support contributed to the concerns identified in liquidity and audit.
