(a) The superintendent encourages all foreign bank offices to employ qualified internal auditors as an important aspect of adequate internal control. The superintendent may, in his or her discretion, require a foreign bank office to follow requirements similar to those set forth in paragraph (b) of this section.

1. (1) Internal auditors, whether head office, resident or regional, are expected to be well-qualified to perform their duties. Qualified internal auditors should possess significant experience in bank accounting, auditing and control functions, and attend relevant professional education courses on an annual basis.

(b) Foreign bank offices with a composite ROC-A rating of four or worse, and an “O” rating of four or worse, and, on a case-by-case basis as determined by the superintendent, foreign bank offices with an “O” rating of three or worse, regardless of the composite rating, must have comprehensive on-site internal audits performed annually by either the foreign banking corporation's head office internal auditors or foreign bank office resident or regional internal auditors who report directly to the head office.

1. (1) A “comprehensive internal audit” shall include the performance of annual detailed internal audit procedures on all high risk areas which represent significant potential exposure to the foreign bank office. The designation of high risk areas will require the internal auditor's judgment, and will be reviewed during examinations of the office.
2. (2) Foreign bank office resident or regional internal auditors should be hired with the approval of the foreign banking corporation's head office and be authorized to communicate directly with the head office without any foreign bank office management intervention. The superintendent requires such resident or regional internal auditors to remain independent of foreign bank office management.