SAN ANTONIO - Noting that fraud felled three national banks last year, Comptroller of the Currency John D. Hawke Jr. said Tuesday that examiners are on the lookout for institutions with weak internal controls.
"We have become increasingly concerned about the quality of audit and internal control functions at many other banks, large and small," he said. "We have noted with dismay cutbacks in the size, status, independence, and proficiency of many banks' internal audit departments."
Without a careful, consistent eye on a bank's operations, he said, it is easy to lose a lot of money - fast.
"Proper internal controls and an effective audit function must be management's first line of defense against the unpleasant surprises that can cause severe, even irreparable damage," he said.
Mr. Hawke spoke to 1,200 bankers at the Independent Community Bankers of America's 70th annual convention here. In his remarks and in a follow-up interview, Mr. Hawke outlined steps for maintaining proper internal controls.
He was critical of bankers who sacrifice oversight in favor of higher profits. As he put it, a "subculture" in bank management is emerging that, "under pressure to maximize earnings, accepts a higher risk of operational losses stemming from weak internal controls in return for whatever quick savings might be realized by failing to make those controls more robust."
He said that a bank must strengthen its internal controls as it grows. Otherwise, information systems and managers can be overwhelmed.
"Growth brings challenge," Mr. Hawke said. "It brings staff turnover and, occasionally, the need to throw newcomers into the breach before they've been fully trained."
Maintaining effective internal controls often depends on managers' being willing to hear bad news, correct problems, and budget enough resources for auditors, he said. "Bankers should ask themselves whether they're fostering an atmosphere in which people know that it's wrong not to identify and surface problems and in which those involved in the process can be assured that no negative repercussions will be suffered if they do," he said.
Banks also must be able to identify and understand the risks they face, especially as they enter new territories or new lines of business. "Too many banks, in their zeal for income growth and new markets, have ignored this basic precept," he said.
Banks must also adopt policies and procedures to review performance and transaction approvals, he said. To avoid being blindsided, managers must be sure that oversight and responsibility are spread to a number of people, he said, adding that employees in sensitive posts must be required to take vacations.
All this will mean nothing if a bank cannot deliver timely and accurate information to executives, he said. "Management must have the proper tools to manage risk," he said. "We see an alarming increase in the number of 'surprises' - problems that don't come to light until they have already had a sizable impact on the bank's financial condition."
Mr. Hawke noted that some banks have recently had to restate earnings due to inadequate accounting controls. He said his agency is emphasizing internal controls and audit in all its exams.
"Large banks may have more to lose in dollar terms when internal controls slip," he said. "But community banks' smaller margins for error make them no less vulnerable to such slippage."
In an interview, Mr. Hawke singled out banks that operate exclusively on-line. "We're focusing on fraud at Internet banks," he said.
The agency is in the midst of evaluating how these virtual banks are faring, comparing things like actual growth to what the owners had predicted, he said.
