Sarbanes-Oxley Internal Controls

Financial-reporting and compliance controls can overlap, but their reporting frameworks differ:

• Substantive rules (net capital, customer protection, FOCUS reporting, early-warning notification) tell the firm what to do and what numbers to report
• ICFR supports reliable financial statements. ICOC supports compliance with specified financial-responsibility requirements.

Sarbanes-Oxley ICFR reporting applies to covered public companies. Auditor attestation depends on applicable status and exemptions. Broker-dealer status alone does not impose a universal SOX ICFR attestation. Periodic FOCUS filings do not replace the annual financial-statement audit or the applicable compliance or exemption engagement.

Internal Control over Financial Reporting (ICFR)

When public-company SOX reporting applies, management assesses and reports on ICFR effectiveness. ICFR encompasses processes and IT systems that:

• Produce the underlying transactional data
• Aggregate that data into financial statements and regulatory schedules
• Apply the firm's accounting policies consistently
• Prevent errors and fraud from corrupting the reported numbers

For a broker-dealer, ICFR includes:

• Trade processing controls (every trade properly recorded with correct terms)
• Position-keeping controls (firm and customer positions accurately tracked)
• Controls over accounting data used in financial statements and regulatory computations
• Reconciliations (firm books to depository, customer books to firm books)
• Access controls (only authorized personnel can modify accounting records)
• Segregation of duties (initiator and approver for material transactions are different people)

Management Assessment vs. Auditor Evaluation

For a nonexempt broker-dealer's compliance engagement:

• Management prepares the Compliance Report, including assertions about ICOC effectiveness throughout the year and at year-end, specified year-end compliance, and the information used for its assertions.
• The accountant examines those assertions and issues a separate examination report.

An exempt firm's management instead prepares an Exemption Report identifying its claimed provisions and whether it met them throughout the year, including exceptions and their dates and nature. The accountant reviews those assertions. This differs from a compliance-controls examination and does not provide the same opinion. The financial-statement audit remains separately required.

Exam Tip: Gotchas

• Identify the report before identifying the engagement. A Compliance Report is examined; an Exemption Report is reviewed. Public-company ICFR reporting is a separate framework.

What "Material Weakness" Means

A material weakness is a deficiency (or combination of deficiencies) in ICFR such that there is a reasonable possibility that a material misstatement of the firm's financial statements will not be prevented or detected on a timely basis.

A significant deficiency is defined by comparison to a material weakness. It does not mean the finding carries no chance of misstatement. It means the finding falls short of the material-weakness level. A finding that meets the material-weakness definition is a material weakness, whatever lower tier it might otherwise resemble.

A material weakness prevents an effective-ICFR conclusion in the applicable report, and management must disclose it there. Lower-severity findings also require appropriate attention and communication; a control deficiency should not automatically be dismissed as minor.

Two kinds of disclosure differ. A public company's certifying officers must tell the auditors and the audit committee about all significant deficiencies. That is an internal communication. Only a material weakness must appear in management's public report and bars an effective conclusion.

The broker-dealer ICOC definition concerns a reasonable possibility of noncompliance escaping timely prevention or detection. For net capital and the customer reserve requirement, do not add a separate financial-statement materiality threshold. For the other covered requirements (customer protection beyond reserves, quarterly securities counts, and the designated account-statement rule), the definition addresses noncompliance to a material extent.

Control Gaps Requiring Severity Assessment

• The firm's reserve-formula computation is run on a spreadsheet without formal controls; staff can override formulas without supervisor approval
• The firm's position-keeping system does not reconcile to the depository on a daily basis
• The firm's net-capital computation depends on a single individual without backup or peer review
• The firm's trade-processing system has weak access controls allowing unauthorized adjustments

These conditions can produce a material weakness, but classification is not automatic. Evaluate potential effects, likelihood, duration, and compensating controls under the correct definition. A spreadsheet or a small team alone does not establish a material weakness.

Exam Tip: Gotchas

• For ICFR, test for the reasonable possibility of a material financial-statement misstatement. For ICOC, apply the specified noncompliance standard. Do not automatically label every control gap a material weakness.

PCAOB Oversight

Auditors of broker-dealers must be registered with the PCAOB (Public Company Accounting Oversight Board). The PCAOB:

• Inspects the audit work of registered firms
• Enforces audit quality standards through its inspection and enforcement programs
• Issues auditing standards for both public-company audits and BD audits

Dodd-Frank extended PCAOB oversight to broker-dealer audits. The SEC retained its regulatory authority. This oversight promotes audit quality without guaranteeing every reported number or replacing the firm's controls.

Exam Tip: Gotchas

• A BD that engages a non-PCAOB-registered auditor has a FOCUS reporting violation on its annual audit, even if the audit work itself is high-quality. PCAOB registration is a procedural threshold the firm must verify before engagement.

How the Annual Reports Fit Together

The broker-dealer's annual reporting requirements call for distinct management reports and accountant engagements:

A firm files the Compliance Report or Exemption Report as applicable, together with the financial report and required accountant reports. These obligations are separate from public-company SOX ICFR reporting.

What Should You Check on Exam Day?

• Can you apply the correct material-weakness definition for ICFR or ICOC?
• Can you distinguish a Compliance Report examination from an Exemption Report review?
• Can you state the auditor registration requirement for broker-dealer audits: registration with the PCAOB, which inspects the audit work?
• Do you know what a material weakness is: a reasonable possibility that a material misstatement goes undetected on a timely basis?