Proposed CCAR attestation change would be about more than just forms

CCAR attestation change would be about more than just forms
Posted by David Wright, on October 05, 2015.

Download the report

Expectations for the largest banks continue to rise with the latest Federal Reserve proposal for CFOs to attest to the integrity and accuracy of the firm’s regulatory stress testing reports. On September 16, 2015, the Fed published a proposal in the Federal Register to revise the FR Y-14A/Q/M Capital Assessments and Stress Testing Reports.  While proposed changes to reporting forms and instructions are typically viewed as a routine process, the inclusion of a CFO attestation of the filed reports, for both the actual data as well as the projections, raises the bar on expectations and accountability and reflects the Federal Reserve’s ongoing concerns with data quality.

The proposed requirement was prompted by material inaccuracies the Fed had identified in past stress test submissions for some institutions. It would apply to the banking companies included in the Large Institution Supervision Coordinating Committee (LISCC) program, but also encourages enhancement to the internal control environment for all FR Y-14A/M/Q filers.  The Fed’s focus on data quality is understandable as it seeks to maintain the credibility of the stress testing results of industry participants as well as the Fed’s own independent stress tests, which rely on this data.

For the projected data on FR Y-14A/Q, the proposal would require attestation for the conformity to report instructions. That implies adherence to US Generally Acceptable Accounting Principles (“GAAP”) and “fair presentation” of forecasted information.

For the actual data on FR Y-14A/Q/M reports, the proposal calls for the CFO or an equivalent senior officer to attest to the responsibility for, and effectiveness of, the internal controls over the filed reports, as well to the material accuracy of the reported data and process of gaining reasonable assurance over such accuracy.  In addition, the CFO would need to attest that the company’s controls are assessed regularly by management and audited annually.   There is also a requirement to identify and promptly report internal controls material weaknesses and material errors/omissions in reported data.

Some initial takeaways for affected institutions:

  • Attestation brings a higher level of accountability to the CFO function as well as to the end-to-end process, and will require coordinated bank-wide effort to ensure that the CFO, or equivalent senior officer, has enough information and level of comfort to make the attestation.
  • As far as projected data goes, the focus is expected to center on adequacy of the forecasting process from both a management and internal audit perspective. The key is to strike a balance in determining the right level of work required to provide such assurance over “fair presentation.”  Similar attestation is already part of “traditional” regulatory reports (FR Y-9C, Call Reports).  However, FR Y-14A/Q/M reports represent a challenge due to complexity of CCAR processes and the diverse volume of data.
  • The effectiveness of controls over actual data is not a new concept (given current SOX attestations for financial statements purposes). What makes it much more interesting is the design of the controls at the right level of materiality that will need to be implemented to ensure appropriate coverage of granular reporting data of FR Y-14A/Q/M reports.
  • Internal Audit departments will likely have to enhance and/or re-evaluate their coverage of FR Y-14 reporting to support the proposed annual attestation.

The FR Y-14A/Q/M attestation requirement is subject to a public comment period that ends on Nov. 16, 2015, and the Federal Reserve has proposed that it go into effect on June 30, 2016. As the comment period begins and the process of formalizing this change moves ahead, Deloitte will continue to monitor and report on it.

David Wright
Managing Director
Banking and Securities

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s