Answer:
With some auditors, personal opinion supplants advice based on regulatory requirements and guidelines. If the internal auditors have presented this as a "best practice" recommendation, management can choose to just ignore their recommendation. Without additional details regarding the specific customer, this is going to be left to management to decide on how seriously they wish to treat this "recommendation". There is no basis in the exemption regulation or guidelines that presents "risk" as a qualifier or disqualifier for exemption purposes.
First published on BankersOnline.com 6/11/12