Does FDIC Part 363 apply to my bank and how does it sit beside SOX 404?
FDIC Part 363 requires management's assessment of internal control over financial reporting and an independent public accountant's attestation for insured depository institutions with consolidated total assets of $5 billion or more at the start of the fiscal year. That threshold is adjusted from time to time under 12 CFR 314.1, so confirm the current figure against the eCFR text before you conclude which side of it your bank sits on. The answer then depends on three things: your asset size at the start of the fiscal year, whether your holding company is a public filer subject to SOX 404, and whether any acquisitions in the year change what must be covered. A bank below the threshold may still have supervisory expectations for internal control, but the Part 363 attestation does not apply to it.
If you are a public bank holding company above the threshold, you are likely subject to both regimes. Part 363 guidelines let you file either two separate ICFR reports or a single report that meets the requirements of both the FDIC and the SEC, so decide early with your auditor and counsel which structure you will use. Confirm which fiscal year end and which regulatory reporting instructions your assessment must cover, because management's Part 363 assessment must address controls over the preparation of regulatory financial statements. The bank owns its controls and the assessment. The independent auditor performs the attestation and issues the separate report. DeployOpen can prepare systems, access records, change logs and control evidence for that work, but it does not issue attestations or reports.
How public bank holding companies combine Part 363 and SOX 404 reports
The first option is to prepare one ICFR report for the FDIC under Part 363 and a second report for the SEC under SOX Section 404. Each report stands on its own, so each has its own management assessment, its own scope rationale and its own auditor report. The Part 363 report must state that it covers controls over the preparation of regulatory financial statements and identify the regulatory reporting instructions used. The SOX report follows the Rule 13a-15(c) framework evaluation and the PCAOB attestation structure. Because the two reports can differ in what they cover, the IT team must keep the scope documents aligned so that the systems, reports and controls named in each one match the facts the company has documented.
- Scope document: Keep two scope memos, one for regulatory reporting and one for SOX, and show where the financial systems overlap and where they differ.
- Auditor opinion structure: Expect two separate examination reports from the independent public accountant, with the Part 363 attestation issued separately from the SOX 404(b) opinion.
- IT control evidence: Test access, change and operations controls for the systems that feed regulatory reports and for the systems that feed the consolidated financial statements, and keep both test populations traceable.
- Duplication cost: Plan for two rounds of walkthroughs, testing support and deficiency communications, since the auditor and management both work through each report.
Confirm with your independent auditor and your FDIC and SEC contacts whether two reports is the form they expect for your holding company structure.
The second option, described in Appendix A guideline 8A, is one report that meets all of the FDIC's and the SEC's requirements. Management prepares one assessment and the auditor issues one opinion structure that covers both sets of requirements. The report has to include the Part 363 element on regulatory reporting controls and the SOX element on the framework evaluation under Rule 13a-15(c). This option reduces repeated work, but it also means the report must be written so that neither regulator finds a required element missing.
- Scope document: Build one scope document that identifies the regulatory financial statements, the consolidated financial statements and every system that supports both, with the reasoning for inclusion.
- Auditor opinion structure: Confirm with the auditor how the attestation on the combined report will be worded, and whether any part of the opinion must be separately identifiable for each regulator.
- IT control evidence: Cover access to programs and data, program changes, program development and computer operations for systems used in regulatory reporting as well as financial reporting, with evidence for each area.
- Single-report checklist: Map each element required by Part 363 and by SOX 404 to a section of the combined report so reviewers can confirm nothing is omitted.
Before committing to this form, ask your auditor and regulators in writing whether a combined report is acceptable for your institution's size and filer status.
Whichever form the company chooses, the scope document determines what the auditor tests and what the regulators read. Part 363 focuses on controls over regulatory financial statements prepared under the regulatory reporting instructions, while SOX focuses on controls over the financial statements filed with the SEC. Many systems appear in both, but some regulatory schedules are produced from data sets that do not flow into the SEC filing in the same form. Those gaps are where scope disagreements usually begin, so the scope work should start from the reports themselves rather than from the system inventory.
- Regulatory report inventory: List each regulatory schedule, its source systems, its preparers and its reviewers.
- SEC report inventory: List each financial statement line and disclosure that depends on automated controls or system-generated reports.
- Shared systems: Mark which applications, databases and interfaces support both inventories, and record the control owner for each.
- Acquired businesses: Note any acquisition that the company wants to exclude under guideline 8B, and the significance reasoning that supports the exclusion.
Ask your auditor to review the scope memo before testing begins, because a scope change late in the cycle can alter the work for both reports.
The IT evidence in a single report must show that the controls over systems feeding both regulatory and SEC reporting operated throughout the period. For a bank, that usually includes core banking and general ledger applications, reporting and data warehouse platforms, interfaces that move balances between them, and the databases and infrastructure beneath those applications. Evidence should show who can change regulatory calculations, how those changes are approved and tested, how batch jobs and reconciliations are monitored, and how the company oversees its service providers. Evidence that works for one regulator should be traceable for the other, so the same population and sample can support both reports where the scope overlaps.
- Access controls: Show periodic user access reviews for regulatory reporting tools, privileged access logs and timely removal of leavers.
- Program changes: Keep change tickets, testing sign-offs and production approvals for changes that affect regulatory calculations.
- Computer operations: Retain job scheduling records, reconciliation results and incident tickets tied to reporting processes.
- Service providers: Collect SOC 1 reports for outsourced processing, review the complementary user entity controls and document the company's own responses.
Confirm with your auditor which populations and evidence formats they will accept, since each report may test the same controls at different points in time.
What changes the Part 363 and SOX 404 workload for a bank
A bank's ICFR workload depends less on the headline rule than on a few drivers that decide which reports apply and how much evidence they need. The cards below cover asset size, filer status, regulatory reporting scope, acquisitions, third-party providers and evidence maturity, with the controls a bank can use to keep each one manageable.
Total assets at the start of the year
Part 363 applies when consolidated total assets are $5 billion or more at the start of the fiscal year, so the test is applied at the beginning of the year, not at the year end. A bank near the line should document its start-of-year asset figure, the threshold it used and who approved the conclusion. Confirm with counsel and your primary regulator how the threshold adjustments under 12 CFR 314.1 apply to your position before the year begins.
Whether the holding company files with the SEC
A bank holding company with SEC-registered securities must also meet SOX 404, which can run alongside Part 363 on the same controls. Map each entity's filer status early, because it determines whether you prepare one combined report or two separate reports under guideline 8A. Confirm your accelerated filer status with your securities counsel each year, since it depends on public float tests.
Regulatory reporting systems in scope
Management's Part 363 assessment must state that it covers controls over the preparation of regulatory financial statements and name the reporting instructions used. Every system that feeds regulatory reports, including general ledger consolidation, call report tooling and data warehouses, becomes part of the population. Inventory these systems, their owners and the instructions each one follows, and keep that inventory current as reporting changes.
Acquired businesses and the one-report exclusion
Guideline 8B allows an acquired business to be excluded from management's ICFR assessment in no more than one annual report, provided the report identifies the business and states its significance. Record the acquisition date, the business's share of assets and income, and the year you plan to bring it into scope. Missing the second-year inclusion is a common gap, so set a dated plan for integrating the acquired systems' controls.
Core and cloud provider dependence
A bank's core banking platform, payment processors and cloud hosting often sit with third parties, but management still owns the conclusion on controls over those services. Collect each provider's independent control report, the complement of user entity controls the provider lists, and evidence that you reviewed them. Ask providers early for the report types and testing periods auditors will expect, since gaps in provider evidence are hard to close late in the year.
Maturity of control evidence
Auditors test both design and operating effectiveness, so the workload grows fastest where evidence is produced ad hoc. Run each key control on a fixed schedule, store the reviewer sign-off and retain the reconciliation or log that supports it. Banks that automate evidence collection for access reviews, change approvals and reconciliations usually spend less time at attestation than banks that rebuild the same proof each year.
How a Part 363 ICFR audit moves from scoping to attestation
The sequence runs from scoping the financial and regulatory reporting controls through management's testing, remediation and report, ending with the independent accountant's separate attestation. Each phase produces a specific output that the next phase depends on.
Scope the financial and regulatory reporting controls
Management identifies which financial statement line items, regulatory reporting schedules and processes fall within the Part 363 assessment, then maps the controls that address those risks. Management also identifies the systems that feed those controls, including the applications, databases and infrastructure they run on. The output is a documented scope that lists controls, systems and the regulatory reporting instructions the assessment will cover. Confirm with your primary regulator and your independent accountant that the scope matches what they expect before testing begins.
Document and walk through the key controls
Process owners describe each in-scope control, and the team traces a sample transaction or report from origin to the reported figure to confirm the design works as documented. IT general controls over access, program changes, program development and computer operations are walked through where automated controls or reports depend on them. The output is a set of control narratives and walkthrough records that show the design is understood and in place. Auditors will read these records before they rely on any testing.
Test IT general controls and automated controls
Management tests whether the IT general controls that support financial and regulatory reporting operate consistently over the period, and whether automated controls and system-generated reports are complete and accurate. Testing combines inquiry, inspection of records and re-performance, with samples sized to the risk of each control. Internal audit or an outside firm may perform some of this work, but management retains responsibility for the conclusions. The output is a test record for each key control with a conclusion on operating effectiveness.
Evaluate and remediate deficiencies
Management classifies each exception as a deficiency, significant deficiency or material weakness, based on whether a misstatement or a failure in regulatory reporting could reasonably occur and go undetected. Where a control failed, management determines whether a compensating control covered the risk and records that analysis. Remediation is performed and retested before the assessment date where possible. The output is a deficiency log with severity conclusions and evidence of remediation or compensating coverage.
Prepare the management report and regulatory reporting statement
Management issues its annual report on internal control over financial reporting, stating its assessment of effectiveness as of the fiscal year end and identifying the framework used, which is a recognized framework such as COSO's 2013 framework. Under the Part 363 requirements, the report must also state that the assessment included controls over the preparation of regulatory financial statements and identify the regulatory reporting instructions that apply. The output is a signed management report that the board and officers approve before it goes to the accountant. Review it against the regulatory reporting statement so the two do not contradict each other.
Complete the independent accountant's examination
The independent public accountant examines management's ICFR assertion, tests the controls on its own, and forms its opinion on whether the assertion is fairly stated. Under Part 363, the accountant may not conclude that internal control is effective if one or more material weaknesses exist. The output is the accountant's separate attestation report, which is distinct from the management report and is included in the annual report. Ask the accountant early which samples, systems and periods they will test so the evidence is ready when they request it.
Decide how to combine Part 363 and SOX 404 reporting
Where a bank holding company is subject to both Part 363 and SOX 404, management and the accountant choose between two separate ICFR reports or one report that meets both the FDIC and SEC requirements. This choice affects the wording of the management report, the attestation and the timing of filings. The output is a documented reporting approach agreed with the accountant and reviewed by the company's regulators where needed. Make the decision before the assessment year begins so testing is planned to satisfy both sets of requirements.
Handling acquisitions and first-year Part 363 reporting
An acquired business can sit outside management's Part 363 ICFR assessment for a limited time, but the exclusion is narrow. Under Appendix A, guideline 8B, management may exclude an acquired business from the assessment in no more than one annual report, provided that report identifies the business and states its significance. The exclusion is a one-time allowance, not a standing carve-out. Treasury, finance and IT should agree on the acquisition date, the first annual report that will cover the target, and how the significance statement will be calculated before the deal closes, because the auditor will test whether the exclusion was used correctly.
IT integration drives how long the exclusion can realistically last. If the acquired bank runs its own core banking platform, general ledger and regulatory reporting feeds, the controls over those systems still shape the regulatory financial statements that Part 363 covers. Teams should inventory the acquired systems, record who administers access, and confirm which change, backup and job-scheduling processes were inherited from the seller and which were replaced. A migration onto the buyer's core before the next annual report removes the exclusion question but moves the testing burden into the parent's environment. Ask the auditor early which evidence it will accept for the seller's systems during the excluded period, such as seller-provided access reviews, change logs and reconciliation reports, and whether that evidence will be sufficient for the year after the exclusion ends.
First-year Part 363 reporting usually requires more walkthroughs, documentation and reconciliation evidence than later cycles, because management must establish the design of controls over regulatory reporting before it can show they operate. Expect to document the regulatory reporting instructions the assessment relies on, map each reported figure to its source system, and retain samples that show the controls ran throughout the year. Confirm with the independent public accountant what walkthrough depth and sample periods it expects, and with the FDIC's current instructions which filings are in scope, before committing internal effort. A readiness review in the year before the first attestation, scoped with the external auditor, is often the most efficient way to find gaps while there is still time to remediate.
What a bank must have in place before the attestation
An independent auditor can only attest to an ICFR assertion that management has already built, documented and tested. The six items below form that foundation for an insured bank above the Part 363 threshold, and each one needs a named owner and a check by internal audit or an independent reviewer before the auditor arrives.
Documented ICFR framework
Management needs a written framework for its evaluation. For a public bank holding company, Rule 13a-15(c) requires a suitable, recognized framework, and COSO's 2013 Internal Control, Integrated Framework is the one most issuers use. The document should name the processes, risks and control owners in scope and state the evaluation date. Internal audit should confirm that the framework matches the controls actually operating, not the version written for last year's examination.
Scoped list of regulatory reports
Management's Part 363 assessment must cover controls over the preparation of regulatory financial statements and must identify the regulatory reporting instructions it relies on. Build a register that lists each regulatory report, its source systems, its preparers and reviewers, and the instruction version used. An independent reviewer should trace a sample of figures from source data through to the filed report to confirm the register is complete.
ITGC design and operating evidence
Access, program changes, program development and computer operations must work as designed for the period under review. For each area, collect the policy, the population of users or changes, and dated evidence that reviews and approvals happened. Auditors test the design of these controls and whether they operated consistently across the year, so gaps in access reviews or change approvals often surface here first.
Documented management testing
Management must test its own controls and keep records that show who tested what, when, against which criteria, and what they found. Internal audit or a qualified reviewer should assess whether the testing is independent, sufficient for the risk and documented well enough that the external auditor can rely on it. Testing that exists only as conclusions in a summary memo rarely holds up.
Remediation log with owners
Every deficiency, whether found by management, internal audit or the examiner, belongs in one log with a severity assessment, an owner, a target date and the evidence that closes it. Auditors will ask how the bank evaluates whether a deficiency is a material weakness, and the log is where that evaluation should be visible. A reviewer should check that closed items have retesting evidence and that open items have realistic dates.
Third-party and hosted system coverage
Core banking, loan servicing and reporting platforms are often run by vendors or hosted in cloud environments. Management must still obtain evidence that controls at those providers operate, usually through service organization reports, and must test the bank's own user access and change controls around them. Confirm in each vendor contract what reports the provider will supply and how often, because gaps in this area are common in readiness reviews.
Who owns each Part 363 and SOX 404 responsibility
This table compares who does what across management's assessment, control ownership, ITGC testing, system implementation and the independent attestation for a bank subject to Part 363 and SOX 404. Read each row as a split of duties: the bank owns the conclusion, a partner may prepare systems and evidence, and only the independent accountant or auditor issues the attestation or opinion.
| Responsibility | Bank (management) | Implementation partner such as DeployOpen | Independent accountant or auditor |
|---|---|---|---|
| Management's assessment | Management evaluates ICFR, including controls over regulatory reporting, and states its conclusion in the annual management report | Can supply documentation, control matrices and evidence packs that management reviews, but does not form or sign the conclusion | Reads management's assessment and tests whether it is supported; does not write it for management |
| Control ownership | Named control owners operate and monitor controls over financial and regulatory reporting, including ITGCs over financially significant systems | Can configure, document and harden the platforms those controls run on; ownership of the control stays with the bank | Identifies key controls during risk assessment and walkthroughs; does not take ownership of them |
| ITGC testing | Management tests its own controls and reviews results; may use internal audit or co-sourced testers | Can run pre-assessment checks and prepare populations, logs and access reports for testing | Tests design and operating effectiveness of ITGCs independently, using its own sampling and procedures |
| Implementation of systems and evidence | Approves system changes, retains records and decides what evidence is kept and for how long | Can implement, integrate and back up self-hosted open-source platforms in the bank's own environment and produce evidence exports | Does not implement systems for the bank in a way that would impair independence; may review evidence produced |
| Part 363 and SOX 404 attestation | Issues management's report on ICFR, including the regulatory reporting statement required for Part 363 | Does not issue or sign any attestation, report or certificate | Only the independent accountant issues the Part 363 attestation; the external auditor issues the SOX 404 opinion |
| Commonly outsourced work | Retains accountability and sign-off for every outsourced activity | Platform build, hardening, backup configuration, evidence collection, documentation and security testing, under a written scope | Attestation work; cannot be outsourced to a firm that also performs prohibited management functions for the same client |
| Independence boundary | Must keep management responsibilities in-house, including the assessment conclusion and decisions on control design | Must not perform management functions or design the controls it later evaluates for the same auditor client, as the auditor requires | Must remain independent of management and of the parties that prepared the evidence it tests |
How to choose an accounting firm or implementation partner for bank ICFR
A bank choosing help with Part 363 and SOX 404 internal control work is really choosing who prepares evidence, who attests, and who answers to the regulator. The checks below separate the independent auditor's role from the implementation partner's role so the bank keeps ownership of its controls and its reports.
Confirm auditor independence
The firm that attests to management's ICFR assertion under Part 363 must be independent of the bank under the rules that apply to it. Ask the firm to state in writing which independence rules it applies, and check whether the same firm is already doing the bank's tax, consulting or system implementation work. Where a firm designed or operated the controls it is now testing, the independence question becomes a live one, so get the answer before the engagement letter is signed.
Check bank regulatory reporting experience
Part 363 extends the ICFR assessment to controls over the preparation of regulatory financial statements, so the firm needs more than general SOX experience. Ask for examples of work on call report or regulatory reporting controls at banks of similar size, and ask which reporting instructions the firm tests against. A firm that cannot explain how regulatory schedules are produced, reviewed and reconciled to the general ledger is not ready for this scope.
Verify PCAOB registration where SOX applies
Where the bank is also an SEC registrant, the auditor that opines under SOX 404 must be registered with the PCAOB. Confirm registration status on the PCAOB public register before engagement, and confirm that the same firm will issue both the Part 363 and SOX reports if the bank chooses a single combined report. Ask who the engagement partner is and whether that person has signed PCAOB-standard attestations before.
Keep reports with the auditor
The implementation partner can prepare systems, control descriptions, test support and evidence packages, but it cannot issue the Part 363 attestation or the SOX opinion. Put this boundary in the statement of work and ask the partner to name the deliverables it signs, which should be working papers and evidence, not assertions. The bank's management owns the ICFR assessment and signs it. Any proposal that promises a certificate or an audit report from the partner should be treated as a warning sign.
Require fixed scope and written deliverables
Ask for a written scope that lists the in-scope systems, reporting processes, control areas, test periods and deliverables, each with an owner and an acceptance step. Clarify which items are one-time, such as walkthrough documentation and remediation design, and which recur each year, such as interim testing and roll-forward. Ask what changes the price and how the firm handles scope growth from an acquisition or a new core system, so cost drivers are visible before work begins.
Ask who tests and how evidence is kept
Before signing, ask who will perform the ITGC and reporting control tests, whether they are the same people who built the controls, and how their work is reviewed. Ask where evidence is stored, how long it is retained, who holds access to it, and how it is tied to each control and test period. Confirm that the bank can take a complete copy of the evidence at the end of the engagement, because the bank must answer examiner and auditor questions after the partner has left.
Questions banks ask about Part 363 and SOX 404
Does a bank with less than $5 billion in assets have to comply with Part 363 ICFR reporting?
No. Under 12 CFR 363.2(b)(3), the management assessment of internal control over financial reporting and the auditor attestation that follow it apply to insured depository institutions with consolidated total assets of $5 billion or more at the start of the fiscal year. A bank below that level is not required to include the Part 363 ICFR assessment in its annual management report. A bank under the threshold may still face SOX 404 if its holding company is a public issuer, and it may choose to follow the same discipline voluntarily. Confirm your status with your primary federal regulator and your external auditor, because the threshold is applied to a specific measurement date and the rules are amended from time to time.
How is the $5 billion Part 363 threshold measured?
The test uses consolidated total assets at the start of the fiscal year. The bank looks at its own consolidated figure for that point, not the average over the year or a figure at year end. The threshold is stated as $5 billion and is adjusted from time to time under 12 CFR 314.1, so the number your bank tests against should be the one in effect for the fiscal year in question. Confirm the adjusted figure and the start-of-year balance with your auditor before the year begins, because a bank that crosses the line will need the first-year work in place ahead of its first required report.
Can one ICFR report satisfy both Part 363 and SOX 404?
Yes, if the report meets the requirements of both regimes. Part 363 guideline 8A lets an institution subject to both Part 363 and SOX 404 file either two separate ICFR reports or a single report that meets all of the FDIC's and the SEC's requirements. Choosing a single report is a drafting and scoping decision. The report must cover the controls over regulatory financial statements prepared under the regulatory reporting instructions, which Part 363 requires management to identify, as well as the financial reporting controls that SOX 404 covers. Agree the format with your auditor early, since the two reports are attested under different standards and the auditor must be able to opine on each.
What must the bank give the independent accountant for the Part 363 examination?
The bank gives the accountant the evidence needed to examine and attest to management's ICFR assertion. In practice that means the written assessment, the scoped list of controls over financial reporting and over regulatory financial statements, the regulatory reporting instructions the assessment cites, documented walkthroughs, test results for design and operating effectiveness, and records of any deficiencies and how they were classified. Under 12 CFR 363.3(b), the accountant may not conclude that ICFR is effective if one or more material weaknesses exist, so the bank should also give the accountant its evaluation of each deficiency and any remediation before year end. Ask your auditor for a written list of required evidence, since the exact package depends on scope and prior-year findings.
Can a consultant or implementation partner prepare the Part 363 ICFR work alone?
A partner can prepare systems, controls and evidence, but it cannot own the assessment or issue the attestation. Management must make and sign its own ICFR assessment and assertion, and the independent public accountant must examine and report separately on that assertion. A partner can help document controls, configure and harden systems, produce reconciliation and access evidence, and support testing. The bank keeps accountability for scope, conclusions and remediation, and the accountant decides what it can rely on. Before engaging anyone, ask the auditor which work it will accept from a consultant, how it will treat independence, and which tasks must stay with bank staff.
How do acquisitions affect the first Part 363 ICFR year?
Part 363 guideline 8B allows an acquired business to be excluded from management's ICFR assessment in no more than one annual report, provided that report identifies the business and states its significance. The exclusion is a one-time allowance, so the acquired operations must be brought into scope in the following year. For a bank that crosses the threshold through an acquisition, this means planning the scope, the regulatory reporting instructions, and the systems integration before the first required report. Confirm the treatment of the acquired business, its significance and the timing of the exclusion with your regulator and auditor before the deal closes, since the choice affects both the report and the remediation plan.
How DeployOpen prepares systems and evidence for a bank's ICFR audit
DeployOpen's role in a bank's Part 363 and SOX 404 work is to prepare systems and evidence, not to conclude on them. Before any work starts, DeployOpen and the bank agree in writing on the scope: which open-source platforms are involved, which financially significant applications, databases and interfaces feed the regulatory financial statements, which ITGC areas (access, program changes, program development and computer operations) are covered, and which deliverables the bank receives. Most engagements are fixed-scope, so the bank can see what is included and what is not before committing budget. The bank remains the owner of its controls, its risk assessment and its conclusion on whether ICFR is effective.
Within that scope, DeployOpen implements and hardens the self-hosted platforms inside the bank's own cloud accounts, data centers or private networks. That work covers configuration baselines, role-based access designs, change workflow and approval records, backup and restore settings, logging and the documentation that explains each control. DeployOpen then documents the evidence the bank's management will need for its assessment, including the controls over preparation of regulatory financial statements that Part 363 requires management to address, and the regulatory reporting instructions those controls follow. Confirm with your accountant which instructions and reports they will sample so the evidence package matches the testing approach.
At handover, DeployOpen delivers the documentation package, system configuration records and evidence index to the bank, which shares it with its independent public accountant. DeployOpen does not issue any Part 363 report, SOX 404 report, attestation or opinion, and it does not decide whether a deficiency is a material weakness. Those judgments belong to the bank's management, its audit committee and the independent accountant. Ask any implementation partner to state this boundary in the statement of work, and confirm that the bank's internal audit or compliance team reviews the package before the accountant receives it.
