There is an interagency policy statement on this. Go to the
FDIC's website. See the second paragraph under footnote #8. It talks about a dual reporting relationship to Audit Committee and CEO.
That being said, the CFO performs my review with the AC signing off on it. I know this is what the policy statement says not to do, but this is the way they want to do it. Sometimes you just gotta roll with it.