Ratings

As part of its surveillance process, Standard & Poor's conducted a survey of U.S. financial institutions in early March 2005 to assess the state of their compliance with Section 404. Although there is a possibility that firms that have not yet filed or responded and the ones whose fiscal year does not end on December 31 will ultimately disclose material weaknesses or that their auditor's interpretation (for companies who have not yet filed) will differ from management's assessment as outlined in the responses to our survey, we do not believe that many more will be reported.

Section 404 requires U.S. public companies to provide in their annual reports an assessment, performed by the company's management and audited by the company's independent auditors, of the effectiveness of internal controls over financial reporting. Companies are required to provide these reports and disclose any material weaknesses in internal controls in their annual reports filed with the SEC, commencing with reports filed for fiscal years ending after Nov. 15, 2004—that is, March 16, 2005 for calendar-year companies (a delayed deadline is provided for foreign and smaller issuers). (See "Credit Policy Update: Sarbanes-Oxley Section 404, and Standard & Poor's Approach to Evaluating Control Deficiencies," published Nov. 22, 2004, on RatingsDirect.)

The number of financial institutions reporting material weaknesses were relatively low. Since "material weaknesses" are the most severe of the control deficiencies described in Public Company Accounting Oversight Board (PCAOB) Standard No. 2, which governs audits performed under Section 404 ("An Audit of Internal Control over Financial Reporting Performed in Conjunction with An Audit of Financial Statements"), the relatively low reporting suggests that the regulated nature of the financial institutions' business may have positively contributed to a better control environment and significantly fewer material weaknesses as compared to other nonregulated industries that reported a higher number of material weaknesses.

As of early March, most notably, Countrywide Financial Corp. (A/Stable/A-1); Providian Financial Corp. (B/Positive/--); CIT Group Inc. (A/Stable/A-1); SunTrust Banks Inc. (A+/Stable/A-1); HSBC Finance Corp. (A/Stable/A-1); and Riggs National Corp. (B-/Watch Dev/--) have reported they have discovered, or are expected to report, a material weakness (see table 1). Based on the nature of currently disclosed matters, these material weaknesses do not warrant ratings actions due to their limited scope and limited financial impact. Standard & Poor's will closely monitor these matters and, in doing so, plans to discuss the nature and extent of these deficiencies and remediation plans with management.

PCAOB Standard No. 2 provides that a restatement of financial statements to correct a financial misstatement constitutes a strong indicator that a material weakness exists. Restatements arising from misapplication of Statement of Financial Accounting Standards (SFAS) No. 140, "Accounting for Transfers and Servicing of Financial Assets and Extinguishments of Liabilities," triggered the actual, or expected, material weaknesses for two of the six institutions noted above that disclosed material weaknesses (Countrywide Financial Corp. and Providian Financial Corp.).

The other financial institutions reported material weaknesses for other reasons: The CIT Group Inc. reported ineffective controls over certain book/tax reconciliations associated with their deferred tax accounts; SunTrust Banks Inc. identified a material weakness related to the process of establishing the allowance for loan and lease losses; HSBC Finance Corp. concluded that the control weaknesses relate to the process of establishing and maintaining effective hedges under SFAS No. 133, "Accounting for Derivative Instruments and Hedging Activities"; and Riggs National Corp. deemed matters related to implementing additional controls over its commercial loan system, additional access controls over its computer systems, increased employee turnover, and the demand on internal resources aggregated to a material weakness.

Also noteworthy are Fannie Mae (senior unsecured debt, AAA/Stable/A-1+) and Freddie Mac (senior unsecured debt, AAA/Stable/A-1+), which have reported internal control weaknesses concerning financial reporting controls and have not yet filed their 2004 Form 10-K. Fannie Mae is delinquent on its SEC filings due to a pending restatement. Freddie Mac, which is still in the midst of restating its financial results, has yet to be a SEC registrant. Freddie Mac was scheduled to begin financial reporting under the SEC on March 31, 2003; however, this was postponed due to the need to restate financial results for the periods 2001-2003 as announced in January 2003.

Standard & Poor's survey provided details of the nature of the discoveries and the status of the respondents' Section 404 implementation process. Specifically, we requested the surveyed entities to identify: 1) the nature of the significant deficiencies and material weaknesses discovered including whether the deficiency related to the design or operating effectiveness of the internal controls over financial reporting (see table 2); 2) an estimate of the progress made in remedying deficiencies; and 3) the quantitative thresholds applied in determining the severity of the deficiencies.

Standard & Poor's observed no noted trends in the aforementioned institutions' bond price movements over the course of recent months that may be correlated or explained by the disclosure or existence of a material weakness. These observations are based on the review of credit default swap prices, when available, and the bond spreads of five-year and/or 10-year issues 30 days before the material weakness announcement date and a subsequent period of 30 days or less, for recent announcements.

Due to the heterogeneous nature of control deficiencies, Standard & Poor's has taken a case-by-case approach to its analysis. This includes an evaluation of the underlying issues to determine, for example, how pervasive the identified matters are, whether mission-critical elements of the business involved may be adversely affected or at risk, whether these are systemic problems or isolated occurrences, assessment of the "tone at the top" and management's posture in addressing these critical issues, ability to obtain in a timely manner a clean audit opinion on the financials, and the time and cost involved in the resolution, among others. (Standard & Poor's approach is more fully described in "Credit Policy Update: Sarbanes-Oxley Section 404, and Standard & Poor's Approach to Evaluating Control Deficiencies," published Nov. 22, 2004, on RatingsDirect).

Although not present in the matters disclosed so far, it is possible that certain issuers may be unable to meet their Section 404 reporting deadlines or file incomplete reports with the SEC. This could further trigger violation of debt covenants or other regulatory noncompliance.

Of course, obtaining a clean bill of health on financial controls under Section 404 is no panacea. Although it is very far-reaching and covers controls over many organizational functions, the Section 404 audit addresses only financial reporting-related controls without focusing on operational controls. Standard & Poor's considerations of an issuer's control environment are made on a broader basis that encompasses both financial and operational controls. For example, Citigroup Inc. (AA-/Stable/A-1+) has received a clean opinion under Section 404 notwithstanding their public acknowledgment that certain nonfinancial control problems existed in their Japanese operations. Although Section 404 leaves out other control risks such as operational or reputational risks, undergoing an evaluation process may reveal nonfinancial control issues that companies consider but are not required to disclose under Section 404 (these may very well be required disclosures pursuant to other statutes). In fact, many companies have acknowledged improvements in operational and risk-management processes arising from the Section 404 evaluation process.

From the results of the survey and discussions with issuers, Standard & Poor's learned that financial institutions discovered far more significant deficiencies—which are of lesser severity than material weaknesses—and are in the process of aggressively remedying both in first-quarter 2005. According to PCAOB Standard No. 2, significant deficiencies that have been communicated to management and the audit committee, which remain uncorrected after some reasonable period of time, constitute a strong indicator of a material weakness since the control issue, which is not being resolved in a timely manner would serve as an indicator of a more severe concern. In addition, significant deficiencies are evaluated in the aggregate to determine whether a material weakness exists. These possibilities underscore the importance of monitoring and timely remedying significant deficiencies.

Fifty-nine percent of the respondents surveyed have significant deficiencies in internal controls over financial reporting. The most commonly reported significant deficiency (occurring in 57% of respondents reporting significant deficiencies) is related to controls over initiating, authorizing, recording, processing, and reporting significant accounts and disclosures. The second most common one (occurring in 40% of respondents reporting significant deficiencies) is related to information technology controls. Although significant deficiencies are not required to be disclosed, if they opt to do so, firms may disclose them and can also provide a discussion of their comprehensive internal control story, which could include significant deficiencies that have a pervasive company-level impact, or are of a high risk of becoming material weaknesses, in the "Management's Discussion and Analysis" (MD&A) section of their financial reports. (Companies are now required to provide in their MD&A or in Item 9A of Form 10-K disclosures of changes or developments during the last fiscal period that materially affected—or are likely to materially affect—their internal control over financial reporting.)

The deficiency evaluations made by the surveyed institutions were assessed using for the most part similar quantitative thresholds. Specifically, 70% of the respondents that provided quantitative measures applied a threshold of "greater than 5% of pretax income" to determine material weaknesses, while the remaining respondents used more stringent criteria. However, there was greater diversity in the quantitative measures respondents used to determine significant deficiencies. The use of varying measures may result in inconsistent application and results, although some level of inconsistency is expected since it is inherent in the company-specific risk assessment made by the auditors as part of their audit process in reaching their materiality thresholds. Despite the observed variations, we anticipate and clearly hope that U.S. financial institutions have captured substantially all material weaknesses based on their determined levels of materiality as a result of their management evaluation and testing processes and the independent auditor's attestation process.

Of note is that all the institutions reporting material weaknesses or significant deficiencies already began and made substantial progress in remedying their control processes. The majority of companies that reported significant deficiencies to Standard & Poor's are more than 80% underway with their remediation action plans.

The recent observations of Section 404 compliance and our survey results suggest pre-existing rules and procedures may not have been sufficient to prevent the types of financial reporting issues that Section 404 is intended to address. For example, existing SEC and Federal Deposit Insurance Act of 1991 (FDICIA) rules are intended to reveal ineffectiveness in control processes. Since the early 1990s, Section 36 of FDICIA has required certain insured depository institutions to prepare, among other things, a report signed by the chief accounting or financial officer that assesses the effectiveness of the internal control structure and procedures. Since 2002, Section 302 of the Sarbanes-Oxley Act required that both the chief executive and financial officer certify that they have evaluated the effectiveness of the internal controls. Furthermore, independent auditors have evaluated the effectiveness of these controls as part of their FDICIA attestation or their financial statements' audits in prior years. Section 404, which later became effective, is considered more rigorous than FDICIA due to the extent of evidential matter, management testing, and the more rigorous independent auditor testing and opinion required as well as perhaps different materiality considerations. However, it is likely FDICIA's internal control requirements have positively influenced the minimal material weaknesses reported by depository institutions as well as translated to reduced compliance and preparedness costs as compared with other issuers.

Standard & Poor's believes that companies should expound upon their internal control environment disclosures, including matters that can potentially have implications for internal control over financial reporting, in their annual and interim reporting. A robust and transparent discussion in the MD&A of the risks of internal control over financial reporting, integrated with operational and reputational control assessments, will undoubtedly enhance analysts' and other financial market participants' ability to better discern the risks facing the company and the manner in which they are being managed. While Section 404 has pushed accountability to a new level, it provides no panacea. Standard & Poor's will continue to analyze issuers on a holistic basis.

Table 1 Financial Institutions Reporting Or Expecting To Report Material Weaknesses And The Nature Of Weakness Identified
Financial Institutions	Basis for Material Weaknesses
Countrywide Financial Corp. (A/Stable/A-1)	The result of the restatement of the financial statements, based on an interpretation of SFAS 140.
Providian Financial Corp. (B/Positive/--); Expected to report a material weakness in their 2004 Form 10-K	The result of the restatement of the financial statements resulting from the review of assumptions used to estimate the value of interest-only strips recorded in connection with securitized receivables.
CIT Group (A/Stable/A-1)	Not maintaining effective controls over the reconciliations of the differences between the tax basis and book basis of each component of their balance sheet with the deferred tax asset and liability accounts.
SunTrust Banks Inc. (A+/Stable/A-1)	The process of establishing the allowance for loan and lease losses.
HSBC Finance Corp. (A/Stable/A-1)	The process of establishing and maintaining effective hedges under the shortcut method of accounting under SFAS No. 133.
Riggs National Corp. (B-/Watch Dev/--)	The aggregation of matters related to implementing additional controls over its commercial loan system to minimize the risk of errors in the calculation of certain loan fees, additional access controls over its computer systems, increased employee turnover, and the demand on internal resources.
Ameritrade Holding Corporation (NR)	The controls in place relating to their FDIC insured deposit sweep program were not properly designed to provide reasonable assurance that these funds were properly recorded and disclosed in the financial statements and assets were appropriately considered in regulatory net capital computations.
Midwest Banc Holdings, Inc. (NR)	The determination of whether its available-for-sale floating rate perpetual preferred equity securities are “other-than-temporarily” impaired, pursuant to SFAS 115 and SEC Staff Accounting Bulletin No. 59.
Credit Acceptance Corporation (NR)	The accounting for income taxes related primarily to its foreign operations.
Unizan Financial Corp. (NR)	Inadequate general computer controls and lack of sufficient documentation over the year end closing process combined with key employee turnover and lower staffing levels resulting from the pending merger with Huntington.
Net Bank Inc. (NR)	The manner in which they estimate the change in “fair market value” of rate locks and their associated hedges.

Table 2 Material Weaknesses And Significant Deficiencies Identified By Type
Controls Over The Following	Financial Institutions Disclosing Material Weaknesses						Financial Institutions with Significant Deficiencies
	Countrywide Financial Corp.	Providian Financial Corp.	CIT Group Inc.	SunTrust Banks Inc.	HSBC Finance Corp.	Riggs National Corp.	Various Firms (Per Standard & Poor's Survey)
Restatement of financial statements	X	X		X
Transactions, significant accounts, and disclosures			X	X	X	X	17
Information technology						X	12
Adequacy of documentation							7
Application and selection of accounting principles					X		6
Period-end financial reporting process							3
Safeguarding of assets							3
Other control environment							2
Human resources						X
Anti-fraud programs							1
Other (various)							6