The Federal Deposit Insurance Corporation (FDIC) has approved an increase to the FDICIA threshold for internal controls over financial reporting (ICFR) assessment by management and external auditors in 12 CFR Part 363 from $1 billion to $5 billion. As a result, banks with assets between $1 billion and $5 billion are no longer required to annually assert to ICFR under Part 363 or obtain an independent financial statement audit. For many institutions, this shift reduces compliance costs and frees resources for growth and customer service.
However, the approval does not lessen the need for strong financial reporting discipline. ICFR remains essential to preventing errors, unauthorized activity, and fraud — risks that do not disappear with regulatory relief.
Why throw away the investment and hard work bank leadership has put into FDICIA? Maintain that investment with responsible, continued testing of ICFR. Integrate ICFR into your risk-based internal audit plan.
Why ICFR Discipline Still Matters
As community and regional banks expand product offerings, deepen digital channels, and integrate third-party services, operations become more complex. That complexity increases the chance of control gaps if monitoring and testing decline. Positive habits typically yield positive results but verification of those habits is key to success.
That’s why continued internal control testing matters:
- Risk persists regardless of size. Smaller institutions face material financial reporting risk, particularly as they grow. Stakeholders—depositors, investors and regulators—depend on accurate, timely reporting.
- Fraud and error can escalate quickly. Recent fraud cases show how insider manipulation, disabled alerts and weak segregation of duties can lead to significant losses—even at large institutions. Smaller banks with limited staffing are even more vulnerable, as single points of failure can go unnoticed.
- Best practice frameworks are size-agnostic. COSO 2013 and guidance from the Institute of Internal Auditors emphasize scalable, principles-based controls. The message is clear: tailor control strength to risk, not to an arbitrary regulatory threshold.
- Governance expectations remain. Boards and audit committees need reliable visibility into control performance, incidents and remediation. Threshold relief does not change accountability.
Maintaining Effective Controls
Even without a mandated ICFR audit, banks with assets fewer than $5 billion can keep controls effective by prioritizing risk, simplifying processes, and strengthening oversight.
- Focus on the highest risks: Scope monitoring and testing to material accounts, key processes and major IT systems; update after big changes.
- Keep controls aligned: Maintain a current risk/control matrix for override, third parties, models and data quality.
- Test smart: Rotate low-risk controls; test high-risk and manual controls annually; use analytics for continuous checks.
- Control access: Review privileged access, remove unused accounts, and prevent conflicting roles.
- Manage change: Treat system upgrades and new integrations as control events with pre- and post-implementation testing.
- Close issues fast: Assign owners and deadlines, track to closure and retest fixes.
- Inform oversight: Provide concise dashboards to the audit committee on control metrics, issues and third-party/model risk.
- Coordinate teams: Clarify roles for management, risk/compliance and internal audit; co-source specialized testing when needed.
Stay Ahead of Risk and Keep Controls Strong
FDICIA threshold relief may reduce reporting requirements, but your bank’s risk doesn’t shrink Ensure your institution stays protected by maintaining robust internal controls.
Connect with our national financial services industry team today to learn how CBIZ can help with practical strategies for effective, efficient control management.
© Copyright CBIZ, Inc. All rights reserved. Use of the material contained herein without the express written consent of the firms is prohibited by law. This publication is distributed with the understanding that CBIZ is not rendering legal, accounting or other professional advice. The reader is advised to contact a tax professional prior to taking any action based upon this information. CBIZ assumes no liability whatsoever in connection with the use of this information and assumes no obligation to inform the reader of any changes in tax laws or other factors that could affect the information contained herein. Material contained in this publication is informational and promotional in nature and not intended to be specific financial, tax or consulting advice. Readers are advised to seek professional consultation regarding circumstances affecting their organization.
“CBIZ” is the brand name under which CBIZ CPAs P.C. and CBIZ, Inc. and its subsidiaries, including CBIZ Advisors, LLC, provide professional services. CBIZ CPAs P.C. and CBIZ, Inc. (and its subsidiaries) practice as an alternative practice structure in accordance with the AICPA Code of Professional Conduct and applicable law, regulations, and professional standards. CBIZ CPAs P.C. is a licensed independent CPA firm that provides attest services to its clients. CBIZ, Inc. and its subsidiary entities provide tax, advisory, and consulting services to their clients. CBIZ, Inc. and its subsidiary entities are not licensed CPA firms and, therefore, cannot provide attest services.
