In February 2008, two months into his job as CEO, Pandit certified in Citigroup's 2007 annual report that the company's internal controls were effective. Eight days before he did that, the U.S. Office of the Comptroller of the Currency had sent him a seven-page letter detailing all sorts of ways in which Citigroup's controls were inadequate.