(a) Annual reporting requirements—

(1) Audited financial statements. A corporate credit union must prepare annual financial statements in accordance with generally accepted accounting principles (GAAP), which must be audited by an independent public accountant in accordance with generally accepted auditing standards. The annual financial statements and regulatory reports must reflect all material correcting adjustments necessary to conform with GAAP that were identified by the corporate credit union's independent public accountant.

(2) Management report. Each corporate credit union must prepare, as of the end of the previous calendar year, an annual management report that contains the following:

(i) A statement of management's responsibilities for preparing the corporate credit union's annual financial statements, for establishing and maintaining an adequate internal control structure and procedures for financial reporting, and for complying with laws and regulations relating to safety and soundness in the following areas: affiliate transactions, legal lending limits, loans to insiders, restrictions on capital and share dividends, and regulatory reporting that meets full and fair disclosure;

(ii) An assessment by management of the corporate credit union's compliance with such laws and regulations during the past calendar year. The assessment must state management's conclusion as to whether the corporate credit union has complied with the designated safety and soundness laws and regulations during the calendar year and disclose any noncompliance with the laws and regulations; and

(iii) An assessment by management of the effectiveness of the corporate credit union's internal control structure and procedures as of the end of the past calendar year that must include the following:

(A) A statement identifying the internal control framework used by management to evaluate the effectiveness of the corporate credit union's internal control over financial reporting;

(B) A statement that the assessment included controls over the preparation of regulatory financial statements in accordance with regulatory reporting instructions including identification of such regulatory reporting instructions; and

(C) A statement expressing management's conclusion as to whether the corporate credit union's internal control over financial reporting is effective as of the end of the previous calendar year. Management must disclose all material weaknesses in internal control over financial reporting, if any, that it has identified that have not been remediated prior to the calendar year-end. Management may not conclude that the corporate credit union's internal control over financial reporting is effective if there are one or more material weaknesses.

(3) Management report signatures. The chief executive officer and either the chief accounting officer or chief financial officer of the corporate credit union must sign the management report.

(b) Independent public accountant—

(1) Annual audit of financial statements. Each corporate credit union must engage an independent public accountant to audit and report on its annual financial statements in accordance with generally accepted auditing standards. The scope of the audit engagement must be sufficient to permit such accountant to determine and report whether the financial statements are presented fairly and in accordance with GAAP. A corporate credit union must provide its independent public accountant with a copy of its most recent Call Report and NCUA examination report. It must also provide its independent public accountant with copies of any notice that its capital category is being changed or reclassified and any correspondence from NCUA regarding compliance with this section.

(2) Internal control over financial reporting. The independent public accountant who audits the corporate credit union's financial statements must examine, attest to, and report separately on the assertion of management concerning the effectiveness of the corporate credit union's internal control structure and procedures for financial reporting. The attestation and report must be made in accordance with generally accepted standards for attestation engagements. The accountant's report must not be dated prior to the date of the management report and management's assessment of the effectiveness of internal control over financial reporting. Notwithstanding the requirements set forth in applicable professional standards, the accountant's report must include the following:

(i) A statement identifying the internal control framework used by the independent public accountant, which must be the same as the internal control framework used by management, to evaluate the effectiveness of the corporate credit union's internal control over financial reporting;

(ii) A statement that the independent public accountant's evaluation included controls over the preparation of regulatory financial statements in accordance with regulatory reporting instructions including identification of such regulatory reporting instructions; and

(iii) A statement expressing the independent public accountant's conclusion as to whether the corporate credit union's internal control over financial reporting is effective as of the end of the previous calendar year. The report must disclose all material weaknesses in internal control over financial reporting that the independent public accountant has identified that have not been remediated prior to the calendar year-end. The independent public accountant may not conclude that the corporate credit union's internal control over financial reporting is effective if there are one or more material weaknesses.

(3) Notice by accountant of termination of services. An independent public accountant performing an audit under this part who ceases to be the accountant for a corporate credit union must notify NCUA in writing of such termination within 15 days after the occurrence of such event and set forth in reasonable detail the reasons for such termination.

(4) Communications with supervisory committee. In addition to the requirements for communications with audit committees set forth in applicable professional standards, the independent public accountant must report the following on a timely basis to the supervisory committee:

(i) All critical accounting policies and practices to be used by the corporate credit union;

(ii) All alternative accounting treatments within GAAP for policies and practices related to material items that the independent public accountant has discussed with management, including the ramifications of the use of such alternative disclosures and treatments, and the treatment preferred by the independent public accountant; and

(iii) Other written communications the independent public accountant has provided to management, such as a management letter or schedule of unadjusted differences.

(5) Retention of working papers. The independent public accountant must retain the working papers related to the audit of the corporate credit union's financial statements and, if applicable, the evaluation of the corporate credit union's internal control over financial reporting for seven years from the report release date, unless a longer period of time is required by law.

(6) Independence. The independent public accountant must comply with the independence standards and interpretations of the American Institute of Certified Public Accountants (AICPA).

(7) Peer reviews and inspection reports.

(i) Prior to commencing any services for a corporate credit union under this section, the independent public accountant must have received a peer review, or be enrolled in a peer review program, that meets acceptable guidelines. Acceptable peer reviews include peer reviews performed in accordance with the AICPA's Peer Review Standards and inspections conducted by the Public Company Accounting Oversight Board (PCAOB).

(ii) Within 15 days of receiving notification that the AICPA has accepted a peer review or the PCAOB has issued an inspection report, or before commencing any audit under this section, whichever is earlier, the independent public accountant must file a copy of the most recent peer review report and the public portion of the most recent PCAOB inspection report, if any, accompanied by any letters of comments, response, and acceptance, with NCUA if the report has not already been filed.

(iii) Within 15 days of the PCAOB making public a previously nonpublic portion of an inspection report, the independent public accountant must file a copy of the previously nonpublic portion of the inspection report with NCUA.

(c) Filing and notice requirements—

(1) Annual Report. Each corporate credit union must, no later than 180 days after the end of the calendar year, file an Annual Report with NCUA consisting of the following documents:

(i) The audited comparative annual financial statements;

(ii) The independent public accountant's report on the audited financial statements;

(iii) The management report; and

(iv) The independent public accountant's attestation report on management's assessment concerning the corporate credit union's internal control structure and procedures for financial reporting.

(2) Public availability. The annual report in paragraph (c)(1) of this section will be made available by NCUA for public inspection.

(3) Independent public accountant's letters and reports. Each corporate credit union must file with NCUA a copy of any management letter or other report issued by its independent public accountant with respect to such corporate credit union and the services provided by such accountant pursuant to this part (except for the independent public accountant's reports that are included in the Annual Report) within 15 days after receipt by the corporate credit union. Such reports include, but are not limited to:

(i) Any written communication regarding matters that are required to be communicated to the supervisory committee (for example, critical accounting policies, alternative accounting treatments discussed with management, and any schedule of unadjusted differences); and

(ii) Any written communication of significant deficiencies and material weaknesses in internal control required by the AICPA's auditing standards.

(4) Notice of engagement or change of accountants. Each corporate credit union that engages an independent public accountant, or that loses an independent public accountant through dismissal or resignation, must notify NCUA within 15 days after the engagement, dismissal, or resignation. The corporate credit union must include with the notice a reasonably detailed statement of the reasons for any dismissal or resignation. The corporate credit union must also provide a copy of the notice to the independent public accountant at the same time the notice is filed with NCUA.

(5) Notification of late filing. A corporate credit union that is unable to timely file any part of its Annual Report or any other report or notice required by this paragraph (c) must submit a written notice of late filing to NCUA. The notice must disclose the corporate credit union's inability to timely file all or specified portions of its Annual Report or other report or notice and the reasons therefore in reasonable detail. The late filing notice must also state the date by which the report or notice will be filed. The written notice must be filed with NCUA before the deadline for filing the Annual Report or any other report or notice, as appropriate. NCUA may take appropriate enforcement action for failure to timely file any report, or notice of late filing, required by this section.

(6) Report to Members. A corporate credit union must submit a preliminary Annual Report to the membership at the next calendar year's annual meeting.

(d) Supervisory committee—

(1) Composition. Each corporate credit union must establish a supervisory committee, all of whose members must be independent. A committee member is independent if:

(i) Neither the committee member, nor any immediate family member of the committee member, is supervised by, or has any material business or professional relationship with, the chief executive officer (CEO) of the corporate credit union, or anyone directly or indirectly supervised by the CEO, and

(ii) Neither the committee member, nor any immediate family member of the committee member, has had any of the relationships described in paragraph (d)(1)(i) for at least the past three years.

(2) Duties. In addition to any duties specified under the corporate credit union's bylaws and these regulations, the duties of the credit union's supervisory committee include the appointment, compensation, and oversight of the independent public accountant who performs services required under this section and reviewing with management and the independent public accountant the basis for all the reports prepared and issued under this section. The supervisory committee must submit the audited comparative annual financial statements and the independent public accountant's report on those statements to the corporate credit union's board of directors.

(3) Independent public accountant engagement letters.

(i) In performing its duties with respect to the appointment of the corporate credit union's independent public accountant, the supervisory committee must ensure that engagement letters and/or any related agreements with the independent public accountant for services to be performed under this section:

(A) Obligate the independent public accountant to comply with the requirements of paragraph (b) of this section (including, but not limited to, the notice of termination of services, communications with the supervisory committee, and notifications of peer reviews and inspection reports); and

(B) Do not contain any limitation of liability provisions that:

(1) Indemnify the independent public accountant against claims made by third parties;

(2) Hold harmless or release the independent public accountant from liability for claims or potential claims that might be asserted by the client corporate credit union, other than claims for punitive damages; or

(3) Limit the remedies available to the client corporate credit union.

(ii) Engagement letters may include alternative dispute resolution agreements and jury trial waiver provisions provided that the letters do not incorporate any limitation of liability provisions set forth in paragraph (d)(3)(i)(B) of this section.

(4) Outside counsel. The supervisory committee of any corporate credit union must, when deemed necessary by the committee, have access to its own outside counsel.

(e) Internal audit. A corporate credit union with average daily assets in excess of $400 million for the preceding calendar year, or as ordered by NCUA, must employ or contract, on a full- or part-time basis, the services of an internal auditor. The internal auditor's responsibilities will, at a minimum, comply with the Standards and Professional Practices of Internal Auditing, as established by the Institute of Internal Auditors. The internal auditor will report directly to the chair of the corporate credit union's supervisory committee, who may delegate supervision of the internal auditor's daily activities to the chief executive officer of the corporate credit union. The internal auditor's reports, findings, and recommendations will be in writing and presented to the supervisory committee no less than quarterly, and will be provided upon request to the IPA and NCUA.

[76 FR 23868, Apr. 29, 2011, as amended at 80 FR 25939, May 6, 2015]