It’s been more than a decade since the formation of the interim program and unfortunately, it remains unclear as to when or if a permanent program will be established. Understandably, it’s difficult to agree on the appropriate scope for the broker-dealer program and with multiple changes in government administrations as well as multiple changes to the PCOAB board, it’s been a tumultuous decade.
Despite the lack of a permanent program, the PCAOB is still actively inspecting auditors of broker-dealers, regardless of the size or nature of operations. As well, the PCAOB has made clear time and again, they take the inspection process very seriously; the new Board is big on audit quality and inspections is its largest quality tool.
As firms prepare for inspection season and begin to plan 2023 audits, we thought we’d share some of the key broker-dealer findings that seem to recur, and in light of the current economic situation, there is arguably even greater risk.
Revenue
Revenue is consistently the number one focus area across all audit inspections (including issuers and broker-dealers) with audit deficiencies. In its August 19, 2022 Annual Report on the Interim Inspection Program Related to Audits of Brokers and Dealers (2021 Annual Report), the PCAOB indicated 33% deficiency rate for audits where revenue was inspected. Given the rebuttable presumption of fraud risk in revenue, the PCAOB consistently picks this area for inspection. For context, 79 audits included revenue as a focus area; the next highest focus area was receivables and payables (21 audits).
Specific to broker-dealers, the most common findings included:
Generally speaking, these findings mean teams are failing to obtain sufficient, appropriate audit evidence to corroborate selling price, volume, and commission/fee/interest rates and percentages applied. Often, teams pull reports from clearing broker-dealers and fail to perform additional procedures to evaluate the completeness and accuracy of those reports. The PCAOB has taken the position that a clearing broker is the equivalent of a service organization, or said differently, an extension of management’s internal control. Thus, although technically outside of management (i.e. external), information coming from the service organization is considered internal.
Regardless of the source of information, teams must always document their evaluation of the relevance and reliability and for internally derived information, teams must either identify and test controls over completeness and accuracy or substantively test reports for completeness and accuracy each time they use a report.
The other theme here is ensuring we test all relevant assertions. Often overlooked, teams must be sure to validate occurrence of revenue transactions.
In light of the current economy and depressed markets, revenues are likely to be lower year over year. Trading prices are down which means commissions will be down. Lower stock prices also mean trailing fee revenues will be down. Given the economic uncertainty, M&A deals are also down which means investment banking fees will be lower. All of these factors and other economic uncertainties increase the risk of fraud surrounding revenue, so teams need to ensure they are critically evaluating the risks and appropriately designing audit procedures responsive to the assessed risks.
Supplemental Information
Common within the broker-dealer industry is the audit of supplemental information included in the financial statements including audit procedures related to the financial responsibility rules.[1] Though each distinctly different, the recurring theme was the failure to test the information used in the calculations (yes, we’re talking about relevance and reliability and completeness and accuracy yet again) as well as validating all calculations were in accordance with the specific rules and regulations.
It's important to ensure teams fully understand the applicable rules and design audit procedures to ensure the broker-dealer calculated and presented supplemental information in accordance with those rules. For information used, those procedures need to address completeness and accuracy for internally derived information.
Considering the current economy and the depressed markets, again, there is heightened risk around compliance such as with the net capital calculation.
Examination Engagements – Compliance Report
As a general rule, broker-dealers that hold customer funds or securities or clear customer transactions must establish internal controls over compliance (ICOC) with the financial responsibility rules, and report on the effectiveness of those controls annually in its compliance report, pursuant Rule 17a-5 of the Securities Exchange Act of 1934. The auditor’s examination of the statements made within the compliance report falls under AT No. 1 - Examination Engagements Regarding Compliance Reports of Brokers and Dealers and for lack of a better comparison, it’s similar to an audit over internal controls over financial reporting, except this standard relates to compliance. AT1 Paragraph 4 states:
To express an opinion on the assertions made by a broker or dealer in a compliance report, the auditor must plan and perform the examination engagement to obtain appropriate evidence that is sufficient to obtain reasonable assurance about whether (1) one or more Material Weaknesses existed during the most recent fiscal year specified in the broker's or dealer's assertion; (2) one or more Material Weaknesses existed as of the end of the most recent fiscal year specified in the broker's or dealer's assertion; and (3) one or more instances of non-compliance with the net capital rule or the reserve requirements rule existed as of the end of the most recent fiscal year specified in the broker's or dealer's assertion.
Similar to ICFR findings in issuer audits, auditors of broker-dealers continue to struggle with internal controls over compliance. In order to identify and test the relevant controls, engagement teams need to ensure they have a complete understanding of the processes in place. For instance, understand the entire process for how account statements are generated and sent to customers; this often involves understanding automated controls, which need to be identified and tested. Foundational to automated controls however are effective information technology general controls (ITGCs). So, understand the process and then select the relevant controls that address the risks around each compliance requirement.
Many teams obtain service organization reports and while these are a strong start, teams struggle to sufficiently review and test the reports. Specifically, teams should review the opinion, the coverage dates, the gap period and the bridge letter (if applicable), the inclusion (or exclusion) of subservice organizations, control objectives and the correlated activities (including control exceptions), and the complimentary user entity controls (these need to be tested just like any other control).
Pervasive within the entire audit industry, engagement teams continue to struggle testing management review controls (MRCs). We must ensure we understand the objective of the control, management’s expectations, the level of precision, and the process for resolving exceptions. With MRCs, understanding design is the first step, but we must also test the operating effectiveness which means ensuring the control operated as designed. This often means incorporating elements of reperformance in the testing approach.
Finally, all controls use data and so, yet again, testing completeness and accuracy of data used in the controls is critical for effective operation of the control.
Review Engagements – Exemption Report
Many broker-dealers have limited operations and are exempt from certain SEC rules. SEC Rule 17a-5 allows these broker-dealers to claim an exemption in an exemption report. The auditor’s review of the broker-dealer's exemption report falls under AT 2 - Review Engagements Regarding Exemption Reports of Brokers and Dealers. Although merely a review, engagement teams continue to struggle when performing review procedures. The main issue here stems from which exemption applies to the broker-dealer.
The exemption report is the responsibility of management, but the auditor performs a review to ensure the exemption is appropriate. Engagement teams should perform the appropriate inquiries of management, review regulatory filings and communications (e.g. FINRA membership agreements and FOCUS reports), and consider the totality of audit evidence obtained from all procedures (both under the review engagement as well as the audit of the financial statements). The 2021 Annual Report says: “The most frequently cited deficiency in review engagements involves firms that did not take into account evidence obtained during the audit that contradicted broker-dealer assertions in review reports regarding compliance with the exemption provision claimed.” Contradictory evidence is also a common finding in issuer audits. Though not engaged to identify contradictory evidence, when we become aware of contradictory evidence, we must consider and document the resolution of that information.
EQR
As is true with issuer audits, the PCAOB will consider audit deficiencies and evaluate whether the EQR should have identified the deficiency. Though there is judgment involved, generally, if the deficiency relates to a significant risk and/or to the attestation standards, the PCAOB will take issue with the EQR review. For many teams, the EQR is considered an afterthought and is given a very limited budget to perform a review, typically at the last minute. We encourage EQRs to be actively involved in the planning and risk assessment phases of the audit and to understand (and challenge, if needed) the engagement team’s planned audit responses. As the engagement team completes its testing and documents the conclusions, EQRs need to perform detailed reviews over the significant risks and other areas required by the standards.
Looking Forward
Certainly, a permanent program would help drive audit quality. Currently, under the interim program, the PCAOB does not issue firm-specific reports, which means there is no mandatory remediation process. Ideally firms would take the initiative to proactively address deficiencies, but without remediation, there is limited accountability. Of course, there is always enforcement and the PCAOB has made clear its efforts to strengthen its enforcement activities. But without the reporting and remediation processes, there is not only less accountability to remediate issues, there is also less opportunity for firms making best efforts to remediate issues to engage with the PCAOB and determine if their remediation efforts are adequate. Until we have a permanent program, we encourage firms to continue engaging with the PCAOB through the inspection process and taking the comments seriously and designing and implementing remedial actions at both the engagement and firm level. And if you aren’t sure where to start, we’re here to help.
Key Takeaways
[1] The term “financial responsibility rules” refers to the rules cited in Exchange Act Rule 17a-5 paragraph (d)(3)(ii) and AT No. 1, namely, the Net Capital Rule, Customer Protection Rule, Quarterly Security Counts Rule, and Account Statement Rule. Paragraph (e) of the Customer Protection Rule, specifically, is referred to as the “Reserve Requirements Rule.”
Johnson Global Advisory
1717 K Street NW, Suite 902
Washington, D.C. 20006
USA
+1 (702) 848-7084