SecProbe.io

CORRESP
1
filename1.htm

		Citi-9.17.2014-CommentLetterResponse

September 30, 2014

VIA EDGAR CORRESPONDENCE

Stephanie J. Ciboroski

Securities and Exchange Commission

100 F Street, NE

Mail Stop 4561

Washington, DC 20549-7553

Re:    Citigroup Inc.

Form 10-K for the Fiscal Year Ended December 31, 2013

Filed March 3, 2014

File No. 001-09924

Dear Ms. Ciboroski:

Enhancement of Citigroup’s disclosures is an objective that we share with the staff (“Staff”) of the Securities and Exchange Commission (“SEC”) and one that we consider in all of our filings. This letter sets forth the responses of Citigroup to the comments of the Staff contained in the Staff’s letter dated September 17, 2014.

For your convenience, the text of the Staff’s comments is set forth in bold below, followed in each case by our response.

Form 10-K for the Fiscal Year Ended December 31, 2013

Item 9A. Controls and Procedures, page 147

1.

 We note your response to prior comment 4 regarding locations with controls similar to the failed controls at Banamex in which you indicated that “certain processes had been modified in the Pemex accounts receivable financing program, resulting in the elimination of some basic operating controls in the execution of that program.” Your response further specifies that “the Pemex accounts receivable financing program was reflected internally as a ‘buyer centric’ program,” but you “discovered that the program in fact was operated as ‘seller centric’.” Please address the following:

•

 While your “rapid review” identified no other process breakdowns at your worldwide portfolio of accounts receivable financing facilities, tell us how you considered whether it was reasonably possible that a lack of effective review and approval and segregation of duties and a lack of effective reconciliation could have resulted at other locations.

As explained in our response to prior comment 4, Citigroup designed its “rapid review” not only to identify any other reporting issues but also any other process breakdowns in its accounts receivable programs worldwide.  As to the possibility of process breakdowns, we examined whether any of our other accounts receivable financing facilities worldwide operated in a similar manner to the Pemex accounts receivable financing program.  In particular, the rapid review was designed to address the central issue of whether there was a reasonable possibility that a lack of effective review and approval and segregation of duties or a lack of effective reconciliation existed at other locations.

1

As noted in our prior response, in connection with the rapid review, Citigroup asked local employees to answer a “scorecard” of questions about the operation of each accounts receivable financing facility.  Those questions focused on, among other things, the manner in which information was received from customers, which offices handled the information, discounting and payment processes, whether any processes were performed manually, how collections were reconciled against payments, and how often reconciliations were performed.  Those responses were reviewed and certified by each country head, regional head and, ultimately, senior members of Citigroup’s risk, product and business groups.  Because senior members of risk, product and business groups were reviewing the answers for every facility, they were able to identify any answer that suggested that the control processes were not functioning as intended at a given facility.  Any answer to any question that suggested a reasonable possibility of a lack of effective review and approval and segregation of duties or a lack of effective reconciliation with respect to a given facility was flagged and further information was obtained prior to the facility being certified.  As noted in our prior response, through the rapid review, only one other facility, which was also within the Pemex accounts receivable financing program, was identified as having process breakdowns similar to that of the Oceanografia facility.

In light of the structure, comprehensive nature and outcome of the rapid review, together with the prior history of effective controls within Citigroup’s worldwide accounts receivable financing programs, Citigroup concluded that the process breakdowns associated with the Pemex accounts receivable program were isolated and that there was not a reasonable possibility that a lack of effective review and approval and segregation of duties or a lack of effective reconciliation could have resulted in accounts receivable financing programs in other locations.

•

 Tell us whether and how this significant deficiency in operating effectiveness was considered in your evaluation of the effectiveness of the monitoring component of COSO. In particular, explain how you considered whether it was reasonably possible that other accounts receivable financing programs may not be operating effectively. To the extent you determined that the control process breakdowns are an indication of a deficiency in your monitoring process, tell us how you evaluated its severity.

Citigroup did consider whether the significant deficiency it identified in the operating effectiveness of the Pemex accounts receivable financing program, including deficiencies in the direct oversight of the transactions within the Oceanografia facility, reflected a deficiency in the monitoring component of COSO. Citigroup concluded that the specific and isolated nature of the significant deficiency did not suggest a separate deficiency in overall monitoring controls and that the monitoring component of its internal control over financial reporting was effective.

As the Staff is aware, appropriate monitoring includes a proper mix of ongoing oversight and separate, periodic evaluations.  Here, ongoing oversight included monitoring and enforcement of the Pemex accounts receivable financing credit limits which, as noted in our prior response, were effective.  In addition, there was no indication that Citigroup’s ongoing monitoring function had been compromised as none of the individuals Citigroup identified as having been potentially responsible for failing to identify the fraud earlier (as discussed in response to comment 2 below) were involved in the monitoring function of internal control over financial reporting and were not involved in the monitoring of the Pemex credit limits.  As to separate, periodic evaluations, Citigroup has a regular internal audit program, and prior to (and independent of) the February 2014 identification of the fraud, Citigroup’s internal audit function had scheduled an audit of Banamex’s supply chain finance business for the second quarter of 2014, due in part to a prior audit of Banamex’s cash management and trade control design for which corrective actions (unrelated to the instant deficiency) were being implemented.

The monitoring component of COSO also includes evaluation and communication of identified deficiencies.  Citigroup concluded that its response to the discovery of the Oceanografia fraud reflected effective monitoring and controls for the evaluation and communication of the identified

2

deficiencies.  The discovery and evaluation of the fraud and deficiencies were promptly and effectively communicated to senior managers within Citigroup and to its Audit Committee and Board of Directors and were actively monitored, and the reviews undertaken and remedial measures taken since the discovery of the fraud have similarly been communicated and monitored effectively.

2.  We note your response to prior comment 4 regarding your consideration of CNBV’s findings and your indication that you identified an individual “within Banamex who was responsible for validating factoring documents that facilitated the fraud.” Please address the following:

•

 Tell us if there are any other individuals at Banamex who were involved in the Pemex and Oceanografia relationships that did not identify the fraud (for example, individuals that approved the relationship and monitored the relationship). If so, how was this considered in your assessment, and in particular your evaluation of the control environment, of whether there is a reasonable possibility that the Company’s controls will fail to prevent or detect a material misstatement?

Through its internal investigation following the identification of the Oceanografia fraud, Citigroup identified certain individuals within Banamex who were involved in the Pemex and Oceanografia relationship and who, in Citigroup’s view, while not actively participating in the fraud, failed to perform their duties adequately and whose failures may have contributed to Citigroup’s failure to identify the fraud earlier.  In particular, Citigroup identified 12 such Banamex employees in addition to the employee who was responsible for validating factoring documents that facilitated the fraud. Citigroup has terminated each of these 13 employees and will make determinations on potential employment actions as to certain ongoing employees who, in Citigroup’s view, could have performed their duties more effectively.

Citigroup has considered these findings in its ongoing evaluation of its control environment as of December 31, 2013 and as of subsequent periods.  In particular, Citigroup has evaluated whether the fact that such individuals were employed in prior periods created a reasonable possibility that Citigroup’s controls would have failed to prevent or detect a material misstatement.  As part of its evaluation, Citigroup considered that these individuals were not responsible for Citigroup’s internal controls over financial reporting and that the significant deficiency was isolated to the Pemex accounts receivable financing program.  In addition, because the amount available for lending to Oceanografia under the Pemex accounts receivable financing program was capped by credit limits set by Citigroup at an amount substantially below quantitative materiality for Citigroup and was effectively monitored by other individuals, Citigroup concluded that there was no reasonable possibility that Citigroup’s controls would have failed to prevent or detect a material misstatement as of December 31, 2013.

•

 You indicated that CNBV’s findings were not considered in your analysis of ICFR as of December 31, 2013 because CNBV had not issued any findings at the time you filed your 2013 Form 10-K. It is our understanding that CNBV has since issued its report. Tell us whether CNBV’s report included any information of which you were previously unaware and if it reached any conclusions inconsistent with the results of your “rapid review” or any other internal reviews. If so, tell us how you considered the impact of the information in CNBV’s report on your original conclusions on ICFR as of December 31, 2013.

As we noted for the Staff in our prior response, the CNBV’s report has not called into question Citigroup’s conclusion that the control failures related to the fraud at Banamex constituted a significant deficiency in Citigroup’s internal controls as of December 31, 2013.  Similarly, the CNBV’s report did not reach any conclusions that were inconsistent with Citigroup’s rapid review or its own internal investigation.

While certain of the information contained in the CNBV report was unknown to Citigroup at the time it filed its 2013 Form 10-K, none of that information was materially different from the information that Citigroup knew at the time of filing.  Specifically, while the CNBV report and Citigroup’s own internal

3

investigation have shed further light on the process control breakdowns identified by Citigroup prior to filing its 2013 Form 10-K, they have not called into question Citigroup’s conclusion that the breakdowns were isolated to the Pemex accounts receivable financing program in which the amount available for lending to Oceanografia was appropriately capped by credit limits.

Accordingly, Citigroup believes that the findings of the CNBV’s report and Citigroup’s own internal investigation, together with the “deep dive” Citigroup has conducted into the operation of certain of its accounts receivable financing programs subsequent to the “rapid review” discussed above and since the filing of Citigroup’s 2013 Form 10-K (as noted in our prior response), have reconfirmed Citigroup’s original conclusions as to Citigroup’s internal control over financial reporting as of December 31, 2013.

*********

In connection with responding to the Staff’s comments, Citigroup acknowledges that it is responsible for the adequacy and accuracy of the disclosures in its filings; that the Staff’s comments or changes to disclosure in response to Staff comments do not foreclose the SEC from taking any action with respect to the filing; and that Citigroup may not assert Staff comments as a defense in any proceeding initiated by the SEC or any person under the federal securities laws of the United States.

Sincerely,

/s/ John C. Gerspach_

John C. Gerspach

Chief Financial Officer

4