(a) Those foreign bank offices with a composite ROC-A rating of four or worse, and a separate operational controls (“O”) rating of four or worse, and, on a case-by-case basis as determined by the superintendent, foreign bank offices with an “O” rating of three or worse, regardless of the composite rating, must engage an independent external auditor, subject to the superintendent's approval, to:

1. (1) Issue a report on the foreign bank office's balance sheet and accompanying disclosures, which shall include off-balance sheet amounts and assets held on behalf of others. The balance sheet and disclosures must be stated under GAAP and audited under GAAS. The balance sheet and disclosures must be audited as of a quarter-end date within six months following the date the department issues its transmittal letter corresponding to an examination report and annually thereafter for such period as the foreign bank office shall be subject to this subdivision.
2. (2) Attest to management's assertions regarding the effectiveness of the foreign bank office's internal control structure over financial reporting based on reasonable criteria established by management. Independent external auditor attestation reports must be performed in accordance with United States generally accepted standards for attestation engagements. These reports must be dated as of the same date chosen in paragraph (1) of this subdivision.