Internal controls over financial reporting include your Call Report

Internal controls over financial reporting, or ICFR, are the processes that give reasonable assurance that a company's financial statements are reliable. For a U.S. bank they include the controls over its Call Report. FDICIA's rule, 12 CFR Part 363, says that for its purposes financial reporting includes the statements a bank prepares for regulatory reporting, and at $5 billion in assets and above, management's assessment of ICFR and the independent accountant's attestation must each state that they covered controls over regulatory financial statements and name the instructions those statements follow. The difficulty is that most ICFR programmes are built around GAAP statements, while the Call Report is assembled line by line from the general ledger through mapping rules to definitions in the FFIEC instructions. Botminds' Regulatory Reporting Controls ties each top Call Report line to the key controls behind it, so the regulatory part of ICFR is tested, not assumed.

What is internal control over financial reporting for banks?

The SEC's definition is the one auditors and examiners know: "a process designed by, or under the supervision of, the issuer's principal executive and principal financial officers... to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles" (17 CFR 240.13a-15(f)). It covers records that fairly reflect transactions, recording that permits proper statements and authorised spending, and the prevention or timely detection of unauthorized use of assets.

Banks add a second definition on top. FDICIA's section 36, in Part 363, requires a management report on "an adequate internal control structure and procedures for financial reporting" from every insured institution with $1 billion or more, and from $5 billion an assessment of its effectiveness with the accountant's attestation. Part 363 then widens what "financial reporting" means, and that widening is what brings the Call Report in.

Does ICFR include regulatory reports?

Yes, under Part 363. The rule says that, for the management report and the accountant's internal control report, financial reporting includes at a minimum two sets of statements: those prepared under GAAP for the institution or its holding company, and those prepared for regulatory reporting (12 CFR 363.1(c)). The FDIC's guidelines define the minimum: "the schedules equivalent to the basic financial statements", and for a bank, "for example, Schedules RC, RI, and RI-A in the Consolidated Reports of Condition and Income (Call Report)" (Appendix A, guideline 4A).

Two limits are worth knowing. The minimum is the basic-statement schedules, not every supporting schedule, though a bank can scope more in and examiners can sample any schedule. And the guidelines exclude regulatory reports filed by a non-bank subsidiary, such as an insurance subsidiary's reports to its insurance regulator. The same section adds a point that shapes the controls: for recognition and measurement, the regulatory statements must follow GAAP and section 37 of the Federal Deposit Insurance Act. The amounts should already be right; what the extra controls guard is where they are reported.

What must the Part 363 management report say?

Every covered institution's management report states management's responsibilities and assesses compliance with designated safety and soundness laws. From $5 billion, it adds the ICFR assessment, which must contain three statements, and the third carries a disclosure rule. The report is signed by the CEO and the chief accounting officer or CFO, at the institution or the holding company level as the components are met.

The fourth row asks for more than a sentence. To say the assessment "included controls over the preparation of regulatory financial statements", management needs to have identified those controls, tested them, and be able to show which instructions they serve: for a bank, the FFIEC 031, 041 or 051 instructions in force for the period. An assessment that tested the general ledger close and relied on it for the Call Report has not tested the mapping, the tie-out or the review against the instructions.

Does the auditor test Call Report controls?

At $5 billion and above, the auditor's attestation must cover them. The accountant's report must include "a statement that the independent public accountant's evaluation included controls over the preparation of regulatory financial statements in accordance with regulatory reporting instructions including identification of such regulatory reporting instructions", using the same framework as management (12 CFR 363.3(b)). The FDIC's guidelines repeat the point: the attestation report "must specifically include a statement as to regulatory reporting."

Which standards the accountant follows depends on the bank. For an institution that is neither public nor the subsidiary of a public company, the AICPA's attestation standards; for one that must comply with the auditor attestation requirement of section 404, the PCAOB's auditing standards (guideline 18A). Either way, the accountant may rely on internal audit's work, and can start from the bank's own documentation of its regulatory reporting controls. A bank that cannot show which controls stand behind a Call Report line is asking its accountant to build that map for it.

Which ICFR controls stand behind a Call Report line, hop by hop

What controls cover regulatory reporting?

The controls that move a number from the general ledger to a line, and the controls that check the line against the instructions. The OCC names the fundamental ones: separation of duties, dual controls and independent reconcilements, with reconciliation of general ledger accounts to reported figures as its example (OCC Comptroller's Handbook, "Regulatory Reporting"). Its procedures add mapping of items, manual adjustments, verifications, quality control before filing and quality assurance after, attestation and signatures, and change management for new reporting requirements.

The fifth item is the one most specific to regulatory reporting. GAAP changes a few times a year; the Call Report instructions can change every quarter. A control that reads each quarter's supplemental instructions and traces their effect to lines and mappings is an ICFR control in Part 363's sense, and an easy one to leave out of a programme that was designed for the 10-K. The controls in this list are what a sub-certification process should ask each owner to sign for.

For recognition and measurement, the Call Report already follows GAAP. Its own risk is the line: where an amount is reported, under which definition.

What is the COSO framework for banks?

COSO's Internal Control—Integrated Framework is the framework Part 363 names. The rule's footnote says the COSO report "provides a suitable and available framework for purposes of management's assessment", and the FDIC's guidelines require any framework used to be "free from bias", to permit "reasonably consistent qualitative and quantitative measurements", to be "sufficiently complete" and to be relevant (12 CFR 363.2(b)(3)(i) and Appendix A, guideline 10). The auditor must use the same framework as management.

COSO's 2013 framework introduced principles under its five components; GAO's 2025 Green Book, which "adapts these principles for a government environment", lists five components and 17 principles and is a freely available public statement of the same ideas (GAO-25-107721). Applied to regulatory reporting, the components map cleanly: the control environment (who owns the report and how they are trained), risk assessment (which lines can go wrong and how), control activities (the list above), information and communication (instructions reaching preparers), and monitoring (quality assurance, testing and audit).

Disclosure controls vs ICFR, and where the Call Report sits

The SEC separates two things a bank's regulatory reporting needs both of. Disclosure controls and procedures are designed to ensure that information required in a company's reports "is recorded, processed, summarized and reported, within the time periods specified", and are evaluated every quarter. ICFR is about the reliability of the financial statements and is assessed as of year-end (17 CFR 240.13a-15(b)–(f)).

The Call Report needs both qualities on its own timetable. It is a quarterly report with a 30-day deadline and no extensions, signed by the CFO and attested by directors each time, which is closer to the quarterly discipline of disclosure controls. Part 363 then tests it once a year as part of ICFR. A bank whose regulatory reporting controls are tested only for the annual assessment has three quarterly signatures a year resting on controls nobody checked that quarter. The public record shows what data control failures in regulatory reporting can cost: Citigroup and Citibank were fined about $135.6 million in July 2024 in actions tied in part to data quality management and regulatory reporting (Federal Reserve, July 10, 2024).

How Regulatory Reporting Controls fits an ICFR programme

It covers the regulatory reporting part of ICFR on the Call Report's own quarterly clock. A Lineage agent traces the top Call Report lines from the source systems through the subledger, the general ledger and the mapping rule to the line, and names the key control on every hop; a hop with no control is flagged for a person to close, and the agent never changes a mapping. Key controls are re-performed each quarter, evidence is captured as controls run, and process owners sign sub-certifications that name the report they cover.

The CFO's attestation, with the ICFR evidence for the regulatory report behind it

What it does not do is write the management report, perform the attestation or choose the framework. Those remain with management, the audit committee and the accountant. It gives them a quarter-by-quarter record of the regulatory reporting controls in a form an assessment can use: which controls, which lines, which instructions, what was tested and what was decided. For a bank that crossed $5 billion, or expects to, the timing of building that record is covered in FDICIA threshold 2026.

Questions people ask

Does ICFR cover every Call Report schedule?

Part 363's minimum is the schedules equivalent to the basic financial statements: RC, RI and RI-A for a bank. A bank can and often should test controls over more, especially schedules that feed regulatory capital, and examiners test whatever schedules their scoping points to.

Is the FR Y-9C in ICFR scope?

Part 363's definition reaches regulatory statements of the insured institution "or its holding company", so where the requirements are met at holding company level, the holding company's regulatory report is the relevant one. The FR Y-9C cover also says the holding company's board and senior management are responsible for controls over it.

Does a bank under $5 billion need ICFR?

It needs internal control, and a management report on its responsibility for it if it has $1 billion or more. It does not need Part 363's formal assessment of effectiveness or the accountant's attestation, unless securities law requires one for a public parent.

Can one ICFR report satisfy both the FDIC and the SEC?

Yes. Part 363's guidelines let an institution or holding company file a single report on internal control that meets all of Part 363's requirements and all of the SEC's section 404 requirements, including the regulatory reporting statement, or two separate reports.

What is the difference between a Call Report error and an ICFR deficiency?

An error is a wrong number on a filed report; a deficiency is a control that did not work. An error may or may not trace to a deficiency, and a deficiency may exist with no error. Part 363 asks about the controls; the Call Report instructions and examiners ask about the numbers.