(a) In general. In addition to complying with SBA's requirements for SBA Lenders, an SBA Supervised Lender must meet the additional requirements set forth in this regulation and the SBA Supervised Lender regulations that follow.

(b) Operations and internal controls. Each SBA Supervised Lender's board of directors (or management, if the SBA Supervised Lender is a division of another company and does not have its own board of directors) must adopt an internal control policy which provides adequate direction to the institution in establishing effective control over and accountability for operations, programs, and resources. The internal control policy must, at a minimum:

(1) Direct management to assign responsibility for the internal control function (covering financial, credit, credit review, collateral, and administrative matters) to an officer or officers of the SBA Supervised Lender;

(2) Adopt and set forth procedures for maintenance and periodic review of the internal control function; and

(3) Direct the operation of a program to review and assess the SBA Supervised Lender's assets. The asset review program policies must specify the following:

(i) Loan, loan-related asset, and appraisal review standards, including standards for scope of selection for review (of any such loan, loan-related asset or appraisal) and standards for work papers and supporting documentation;

(ii) Asset quality classification standards consistent with the standardized classification systems used by the Federal Financial Institution Regulators;

(iii) Specific internal control requirements for the SBA Supervised Lender's major asset categories (cash and investment securities), lending, and the issuance of debt;

(iv) Specific internal control requirements for the SBA Supervised Lender's oversight of Lender Service Providers; and

(v) Standards for training to implement the asset review program.

[73 FR 75512, Dec. 11, 2008]