We are an FDIC bank and had a recent exam. In reading the "This report of examination is strictly confidential" statement on the front page of the exam report, I'm wondering why/if it is okay to share the exam report with our auditors (third party). They always ask for it as it helps them with their scope and understanding of our compliance program. Is it a problem to provide a copy? Thank you.

Your internal auditors that you engage are acting as an agent of the bank. They sign all the confidentiality agreements required by such parties when you engage them. Of course they can have a copy of the report.

OK. Thank you for the quick response.

And I fully agree with Randy.

I agree with Randy too, but our board has taken the position that we will seek approval from our regulator first, by contacting the last EIC.

That is fine, but it will just show the regulators that the board knows not what it is doing however.

There is regulatory guidance that addresses this question. In the Interagency Policy Statement on Coordination and Communication Between External Auditors and Examiners, it states:

"Consistent with prior practice, a depository institution should provide its external auditors with a copy of certain reports and supervisory documents, including:

• The most recent regulatory Report of Condition (i.e., "Call Reports" for banks, and "Thrift Financial Reports" for savings institutions);
  
• The most recent examination report and pertinent correspondence received from its regulator(s);
  
• Any supervisory memorandum of understanding with the institution that has been put into effect since the beginning of the period covered by the audit;
• Any written agreement between a federal or state banking agency and the institution that has been put into effect since the beginning of the period covered by the audit; and
  
• A report of: Any actions initiated or undertaken by a federal banking agency since the beginning of the period covered by the audit under certain subsections of Section 8 of the Federal Deposit Insurance Act2, or any similar action taken by an appropriate state bank supervisor under state law; and Any civil money penalty assessed under any other provision of law with respect to the depository institution or any institution-affiliated party, since the beginning of the period covered by the audit."

Here is a link to the guidance - http://www.fdic.gov/regulations/laws/rules/5000-3200.html#fdic5000interagencyps2

I hope this helps some...

Thanks,
Russ