Securities Matcon

THE FUTILITY OF SMALL BROKER DEALER AUDITS

“Nothing leads so straight to futility as literary ambitions without systematic knowledge.”

H. G. Wells

On August 19, 2021 the PCAOB issued Release No. 2021-002, titled “Annual Report on the Interim Inspection Program Related to Audits of Brokers and Dealers”.

This tends to be required reading for audit firms that perform audit and assurance services to the broker-dealer industry. The report is numerical data fact based, pleasing to the eye in graphics, recommends “best practices” and true to form, missing in detail and qualitative factors arising from inspection and enforcement deficiencies at the PCAOB itself.

One example of the PCAOB’s lack of detail that applies to smaller firms is for those that claim an exemption under either 15c3-3 or Footnote 74 of the SEC’s notice related to “Non covered firms”.

The overview of the report would tend to instruct that ALL broker dealers are subject to the PCAOB inspection and oversight. It ignores the exemption available to broker dealers that conduct business with ONLY ONE issuer and seek an SEC exemption from the annual audit requirement of Rule 17a-5. To the extent that an audit is prepared and thereby becomes subject to the inspection program, the auditor should carefully assess under its risk assessment, if in fact it is indeed necessary.

The overview makes a critical error in assuming that most if not all broker dealers are fungible entities and thereby the Standards are applicable, when in fact most of the smaller broker dealers operate in specific markets with unique products and characteristics and employ different clearance and settlement functions that may or may not engage in functions that evoke the investor protection requirements of 15c3-3. This mandates that auditors have significant operations and compliance experience and use of “judgement” in determining the nature and extent of tests required. The inspection team at the PCAOB does not share the same experience and thereby insists that all such factors be clearly defined in the workpapers, because if not, such judgements did not exist, even though the audit firm may have had numerous years of audit experience (mandatory auditor rotation does not apply to broker dealer auditors). The inspection team will call upon a PCAOB “specialist” to essentially rubber stamp their findings. Such specialists lack the essential license and qualifications to even be engaged as the FINOP or CCO of a broker dealer, but appear to have no qualms about citing old and defunct rules. Caution wise, firms should thereby trust but verify before responding to comment letters.

It is important to recognize that the audit requirements pertain to SEC Rule 17a-5. The report is ONLY for regulatory purposes and does not rise to the level of an issuer audit. The audit engagement letter should make this point. The Dodd Frank and SOX’s intent was to protect public investors funds held by broker dealers. To the extent that non carrying firms do not hold such under 15c3-3 or Footnote 74, the audit should focus on only whether customer funds are held by such broker dealers and whether they have sufficient net capital. The auditors workpapers related to material deficiency should reflect such measures as opposed to an arithmetic calculation. The PCAOB in their public comments tend to tout the use of the audit as a public tool for investors to select their choice of broker dealers knowing fully well that the staff of the PCAOB themselves never use the audits for their own personal investment selection.

Listed below are my own notes related to the section of the annual report that discusses “Deficiencies in Attestation and Audit Engagements” as they relate to the small broker dealers that do not have exposure to the customer protection rule.

A. Planning for the Examination Engagement:

Here the regulator defines inadequacies in the following:

“Obtain a sufficient understanding of broker dealer processes, including relevant controls, regarding compliance with one or more financial responsibility rules. (AT No. 109)” (emphasis added).

The principle-based language (including such terms as “shall” and “will”) confers a dangerous weapon for use by inspections teams using hindsight. Add the lack of relevant operations history by the inspection team and the audit firm is faced with an inquiry that can seem like a root canal experience.

The good practices section of the report applies only to carrying firms and does not even refer to firms that are exempt from the customer protection rule.

The SEC defines “financial responsibility rules” as applicable to carrying brokers. For non-carrying brokers, such rules are limited to ensuring that:

1.???????????Firms do not inadvertently hold customer funds and if they do, promptly forward such funds to the relevant custodian. Even such a determination is based upon SEC rule interpretations, recent pronouncements and/or FAQs. An example would be holding a customer check payable to a mutual fund, variable annuity or the issuer/bank escrow pending approval of an application (as opposed to wire order)

2.???????????For M&A advisors or Capital Acquisition Brokers (“CAB”), any retainer meets the contract requirements for adoption into revenue or is carefully “reserved for” as a liability pending a cancellation of an agreement and a return of any prepaid items.

3.???????????For a dually registered broker-dealer any prepaid advisory fees that were collected but not earned due to a cancellation of a customer account. Such amounts should be reflected and tested as accounts payable and as customer funds held by the broker dealer that could impact the exemption report.

4.???????????For a “nickel” broker-dealer, any principal transactions that exceed ten such trades ( five “roundturns”), even in an error account that could raise their net capital to $100,000.

5.???????????The clearing agreement for fully disclosed forms clearly defines the PAB and SIPC requirements of the clearing firm; for piggyback arrangements, ensuring that the deposit is maintained by the clearing firm under PAB requirements and the agreement itself is approved by the clearing firm.

The term “sufficient understanding” is ill-defined and will differ on the same broker-dealer depending upon the number of prior audits conducted by the audit firm, and the experience gained from such prior audits. To ensure that the inspection team fully appreciates the depth of knowledge gained from prior audits, it is often advisable to include a reference to such experience in the workpapers. An example of this will apply to M&A or CAB broker-dealers who perform limited activity or no activity at all for the audit period. My experience is that some firms will take 3 to 7 years before engaging in any securities-related activity.

The” relevant controls” in a small broker-dealer that should be documented include:

1.???????????Registration requirements of the entity’s principals by examination and supervisory experience (12 months) for the principals engaged in controls such as the CCO and FINOP.

2.???????????Rule 3120 and 3110 certifications by which the registered CEO attests to the effectiveness of controls.

3.???????????Periodic reporting of financials, form custody to regulators.

4.???????????Periodic examination and review by FINRA, SEC and State regulators.

5.???????????Annual compliance meetings and mandatory firm element and regulatory element training.

6.???????????Maintenance of written supervisory policies and procedures, including any changes.

7.???????????Requirement for an annual review for part time FINOP.

For auditors experienced in the industry, the above controls are ones that are taken for granted by existing regulations and deemed statutory. Still, for PCAOB inspections, it is best to explicitly note them in work papers.

B. Testing controls over compliance:

This obviously does not apply to non-carrying firms.

In a FAQ to footnote 74 of its 2013 Release adopting amendments to Rule 17a-5, the SEC identified firms engaged in certain activities that are not covered under 15c3-3 (non-covered firms), but essentially do not engage in the handling of customer funds and/or securities as being subject to the “exemption report” requirement of AT No. 2 as opposed to AT No. 1. (Refer to the answer to question 8).

In addition, there are firms that effectively maintain a $250,000 net capital under the Alternative method of Net Capital, but nevertheless operate under the exemption provisions or as non-covered firms under SEC Footnote 74.

The PCAOB report does not address this.

The report further elaborates “Deficiency Focus” on Testing Controls over Compliance. This applies only to carrying firms. One notable item that inspection teams pick upon are the Account Statement Rule. Under NYSE Rule 382 and NASD (FINRA) Rule 3230, by which customers of fully disclosed firms are deemed to be customers of the clearing firm who by agreement are required to issue statements to the broker-dealers’ customers. Only dual-registered firms engaged in advisory activities are required to have a copy of or access to such statements for the purpose of testing accuracy for custody purpose. As audits today are conducted more for the PCAOB inspection, a copy of the clearing firm’s SSAE 16 report and review of the adequacy of statements should be documented.

C. Performing Compliance Test; D. Evaluating Results; E. Obtaining a Representation letter and F. Reporting on the Examination Engagement

Not applicable to both firms that rely on the exemption under 15c3-3 and those that are covered under Footnote 74 FAQ number 8.

It is not uncommon for audit firms to obtain one representation letter covering the entire audit report to include reviews and agreed upon procedures. PCAOB inspection teams, however, typically insist on a separate representation letter for reviews, though that’s essentially putting form over function.

G. Deficiencies in Review Engagements:

In its section defining “Performing the Review Engagement.” the PCAOB describes activities that do not comply with the exemptive provisions of paragraph K(2)(ii).

This is an industry problem that has long been recognized until it was finally addressed by the SEC in its Footnote 74, in July 13, 2013. The SEC subsequently expanded on the release in?FAQ subsequent to its adoption in its update on July 1, 2020. In response to question 8, the SEC identified firms that it defines as “non covered” firms that do not qualify under the statute of 153c-3 (either k(1); K(ii) or k(iii)) but nevertheless do NOT engage in activities that rise to the level where the “customer protection” will apply. Neither PCAOB Standard AT1 or AT2 were modified to accommodate this, leaving audit firms exposed to inspection team critique.

To fully understand the importance of the auditor’s obligation, some historical perspective is necessary.

Section 982 of the Dodd-Frank Act authorized the PCAOB to establish standards for registered public accounting firms related to audits of broker-dealers. However, it was the SEC and not Dodd-Frank that on July 31, 2013, issued a final rule that required broker-dealers to file new reports with the SEC (the exemption and/or the compliance report). In October 2013, the PCAOB approved two attestation standards for examining the assertions in a broker-dealer’s compliance or exemption report. Given that the SEC had already amplified the issue related to 15c3-3, the PCAOB failed to adequately accommodate such in its standards.

Further, the Self-Regulatory Organizations (such as FINRA) registered with the SEC are the primary control over a broker-dealers’ exemption or compliance reports. Broker-dealers are required under Rule 17a-5 to submit periodic (monthly/quarterly) reports related to their exemption and/or compliance obligations to such SROs and are reviewed by such SROs for compliance. The SROs themselves are subject to a risk-based inspection by the SEC, which is further subject to GAO review, under Section 964 of the Dodd-Frank Act.

Such overlapping legal rules in financial regulations and the administrative state was discussed in a September 2018 white paper by Matthew C Turk, an Assistant Professor of Business Law, Indian University.?Professor Turk noted that “[a] common source of dissatisfaction with the Dodd-Frank Act is the perception that it swings the legal pendulum too far towards regulatory discretion and an explicit goal of the leading reforms proposals to ex parte standards in financial regulation.”

When reading the PCAOB report on deficiencies ask yourself. Is the auditor’s review opinion intended to replace the statutory role of the SRO and does it achieve a financial objective unique to CPA auditors that is not achievable by SRO’s who operate as boots on the ground for broker-dealers?

Deficiencies in Auditing Financial Statements:

Revenue

When dealing with the PCAOB, auditors have become familiar with the notion of “low hanging fruit.”??Such areas as “assessed risk of material misstatements for all relevant assertions of each significant account…. plan appropriate audit samples and obtain audit evidence that is sufficient and appropriate” are not an uncommon, generalized observations lacking in detail.

The item that causes deficiencies to occur is based upon an observation that “firms either identified a fraud risk related to revenue or did not rebut the presumption of revenue recognition as a fraud risk”.

It is common for auditors to identify revenue as a fraud risk. After all broker-dealers are revenue based. What auditors sometimes do not document is the rebuttal of the presumption of revenue recognition as a fraud risk. Relevant factors may include but not be limited to (for small broker-dealers exempt from or under footnote 74):

1.???????????For non-carrying firms, customer funds are not accepted as being held under the broker-dealer’s title or even in the name of the clearing firm/issuer over a 24-hour period (with some exceptions). A review of the firm’s checks/securities received and delivered blotter (normally blank) and bank account deposits in conjunction should alleviate an extreme fraud risk.

2.???????????To the extent that the broker-dealer operates on a fully disclosed basis, or as a Mutual Fund retailer where commissions are paid by the Investment Company (under the 40 Act) or a broker-dealer associate, payments are subject to the industry’s code of procedures and fair practice standards. Given that most clearing firms and other industry participants are automated in their commission accounting, a review of their SSAE 16 report section on commission accounting control should be sufficient to reduce the fraud risk.

3.???????????M&A, CAB brokers are normally registered only because of performance-based revenue related to a transfer of securities. Recognition of such revenue is determined by agreement. Except for disputes, such revenue may become constrained if the performance obligations are scoped below that in an agreement. In any event fraud risk is minimal.

4.???????????Refer to a PWC discussion on the application of broker-dealer revenue FAQ titled “Selling and distribution fees and variable consideration constraints” on the application of Revenue 606 for other variable considerations. Also, riskless principal trades are exempt from ASC 606, even if the SEC treats them as agency commission.

5.???????????The extent and process of sampling is often found insufficient by the inspection team. Conducting an audit of evidence exceeding 60% of the population rarely provides the probabilistic assurance demanded by inspectors. The extrapolation from samples is often of limited utility because the fundamental basis of extrapolation is homogeneity. Portfolio performance or even commission revenue is rarely homogeneous. Substantiative testing in the form of analytical review should indicate areas of focus for an audit.

Good Practices: The good practices sections of the PCAOB report suggest a troubling lack of real-world experience on a number of fronts:

?????????????Trade date: I am not aware of firms that recognize revenue on a preferred trade date basis. More often they record revenue on a settlement date basis based upon their respective clearing firm statements. Obligations of firms to their representatives are also recorded on a settlement date basis. As most trades are introduced on a clearing firm’s Order Management System (OMS) system, this is a closed loop that would not require a trade blotter on a trade date. The SEC addressed this issue in an April 23, 1986, letter to the AICPA and in its Rule Interpretations of 15c3-1(c)(2) /012, which permit settlement date basis of revenue recognition based upon materiality differences between settlement date and trade date. Given that most trades are T+1 and T+2, the audit workpapers need materially determination to accommodate such. Further determine if a related note on accounting principles is necessary such that the language does not reflect trade date.

?????????????Tracing customer trades and related commissions: This best practice ignores the process as details of customer trades and related commissions are based upon the clearing firm statements which in turn is reflected on the general ledger. Therefore, little is gained by tracing the statement to the general ledger when you know that the statement is the source for the general ledger entry. One comment letter I have seen indicated that the audit firm relied upon statements from the broker-dealer bearing the title of the clearing firm, which allegedly presented a potential fraud risk. I disagree, because the audit firm had third-party confirmation from the clearing firm (including revenue earned for the period) and a review of the clearing firm’s SSAE16 report on commission accounting. Given that today almost all clearing firms are automated, you do not need to sample a large population to determine if the compensation rate is reflected accurately.

B. Good Practices: Supplemental Net Capital Information: If only the entirety of Net Capital and its nuances could be summarized in less than half a page, we would not require the services of a registered financial principal.

?????????????Relevant assertions of the receivable and payable: SRO rules related to assertions are that they are defined. Therefore, the receivable is more often constrained by relevant rules and engagements. An example will be a fully disclosed clearing agreement is required to be reviewed for rule application. These will include PAB (both for the deposit and for the broker-dealer’s receivable), required SIPC language and early termination arrangements. Broker-dealers are also required to identify vendors and conduct appropriate due diligence including leases and or rents, expense share agreements, IT vendors such as email retention and maintain a document that explains the form of compensation for its registered staff. Most of such are fixed and or relatively immaterial in difference that cannot be explained by substantive testing using alternative procedures.

?????????????The next paragraph ties into the recognition of receivables as allowable assets with payable to registered staff. Without any context, it appears to me that this relates to cash versus accrual basis, where payables are recorded on a cash basis with revenues recorded on an accrual basis per SEC Rule interpretations. The paragraph of the report is confusing at best.

Summary: This paper is intended to highlight certain shortcomings in the PCAOB report discussed herein and the real-world realities of broker-dealer audits and related inspections.?The author hopes this paper will bring overdue attention to these matters from relevant regulators and policymakers.

Provide your response and comments to enable the author to determine if HR 6021 “The small business correction act” designed to eliminate the PCAOB audit requirements for small broker dealers should be reconsidered by Congress for relief.