Attestation Standard No. 1

Examination Engagements Regarding Compliance Reports of Brokers and Dealers

Effective Date: For audits of fiscal years ending on or after June 1, 2014

Final Rule: PCAOB Release No. 2013-007

Summary Table of Contents

• (1-2) Introduction
• (3-5) Objective
• (6-33) Performing the Examination Engagement
• (34-35) Communication Requirements
• (36-38) Reporting on the Examination Engagement
• Appendix A—Definitions
• Appendix B—Considerations for Brokers and Dealers with Multiple Divisions or Branches
• Appendix C—Examination Report Modifications

Introduction

1.     This standard establishes requirements that apply when an auditor is engaged to perform an examination^1/ of certain statements made by a broker^2/ or dealer^3/ in a compliance report ("compliance report") prepared pursuant to Securities and Exchange Act of 1934 ("Exchange Act") Rule 17a-5, 17 C.F.R. § 240.17a-5 ("SEC Rule 17a-5") of the U.S. Securities and Exchange Commission ("SEC").^4/

2.     SEC Rule 17a-5 requires a broker's or dealer's compliance report to include the following statements (hereinafter referred to as "assertions") by the broker or dealer as to whether:^5/

1. The Internal Control Over Compliance^6/ of the broker or dealer was effective during the most recent fiscal year;
2. The Internal Control Over Compliance of the broker or dealer was effective as of the end of the most recent fiscal year;^7/
3. The broker or dealer was in compliance with 17 C.F.R. §§ 240.15c3-1 (the "net capital rule") and 240.15c3-3(e) (the "reserve requirements rule") as of the end of the most recent fiscal year; and
4. The information the broker or dealer used to state whether it was in compliance with the net capital rule and the reserve requirements rule was derived from the books and records of the broker or dealer.

Objective

3.     When performing an examination of the assertions made by a broker or dealer in a compliance report (an "examination engagement"), the auditor's objective is to express an opinion regarding whether the assertions made by the broker or dealer in its compliance report are fairly stated, in all material respects.

4.     To express an opinion on the assertions made by a broker or dealer in a compliance report, the auditor must plan and perform the examination engagement to obtain appropriate evidence that is sufficient^8/ to obtain reasonable assurance^9/ about whether (1) one or more Material Weaknesses existed during the most recent fiscal year specified in the broker's or dealer's assertion; (2) one or more Material Weaknesses existed as of the end of the most recent fiscal year specified in the broker's or dealer's assertion; and (3) one or more instances of non-compliance with the net capital rule or the reserve requirements rule existed as of the end of the most recent fiscal year specified in the broker's or dealer's assertion.

Note: Because the broker's or dealer's assertions include assertions regarding Internal Control Over Compliance and its compliance with both the net capital rule and the reserve requirements rule, the auditor's examination should evaluate (a) the effectiveness of Internal Control Over Compliance with each financial responsibility rule^10/ during, and as of the end of, the most recent fiscal year, and (b) compliance with the net capital rule and with the reserve requirements rule as of the end of the most recent fiscal year.

Note: The auditor is not required to express an opinion on the process the broker or dealer used to arrive at the conclusions stated in the broker's or dealer's assertions.

5.     The auditor also must plan and perform the examination engagement to obtain appropriate evidence that is sufficient to obtain reasonable assurance to support the auditor's opinion regarding whether the assertion by the broker or dealer that the information used to assert compliance with the net capital rule and the reserve requirements rule was derived from the books and records of the broker or dealer, is fairly stated, in all material respects.

Performing the Examination Engagement

General Requirements

6.     An auditor who performs an examination engagement pursuant to this standard must:

1. Have adequate technical proficiency in attestation engagements;
2. Obtain an understanding of the financial responsibility rules and other rules and regulations that are relevant to the broker's or dealer's assertions;
3. Determine the auditor's compliance with independence and ethics requirements; and
4. Exercise due professional care, which includes application of professional skepticism, in planning and performing the examination and the preparation of the report.
   

[The following note is effective for audits of fiscal years ending on or before December 14, 2024. See PCAOB Release No. 2022-002. The note effective for fiscal years ending on and after December 15, 2024, can be found here.]  

Note: Due professional care imposes a responsibility on each engagement team member to comply with this standard. The exercise of due professional care requires critical review at every level of supervision of the work done and the judgment exercised by those assisting in the engagement, including preparing the report.^11/

[The following note is effective as of December 31, 2016. See PCAOB Release No. 2015-002. The note effective before December 31, 2016, can be found here.] 

Note: AS 1215, Audit Documentation, establishes the documentation requirements for examination engagements performed pursuant to this standard.

7.     The engagement partner is responsible for the examination engagement and performance of the examination procedures. Accordingly, the engagement partner is responsible for proper planning of the examination engagement, proper supervision of the work of engagement team members, and compliance with the requirements of this standard. The engagement partner may seek assistance from appropriate engagement team members in fulfilling these responsibilities.

Note: For purposes of this standard, the term "engagement partner" means the member of the engagement team with primary responsibility for the examination engagement.

Note: Proper planning includes establishing an overall strategy for the examination engagement and developing a plan for the engagement, which includes, in particular, the nature, timing, and extent of procedures necessary to obtain reasonable assurance. Proper supervision includes supervising the work of engagement team members so that the work is performed as directed and supports the conclusions reached.

Relationship Between the Examination Engagement and the Audit of the Financial Statements and the Audit Procedures Performed on Supplemental Information

8.     The examination engagement should be coordinated with the audit of the financial statements and the audit procedures performed on supplemental information of the broker or dealer.^12/ In planning and performing procedures for, and evaluating the results of the procedures performed in, the examination engagement, the auditor should take into account relevant evidence from the audit of the financial statements and the audit procedures performed on the supplemental information. However, the objectives of the financial statement audit and the examination engagement are not the same, so the auditor must plan and perform the work to meet the objectives of both engagements.

Planning the Examination Engagement

9.     The auditor should plan the examination engagement to perform procedures that are sufficient to provide a reasonable basis for determining whether the broker's or dealer's assertions are fairly stated, in all material respects. In planning the examination engagement, the auditor should:

1. Evaluate the nature of instances of non-compliance with the financial responsibility rules and Deficiencies in Internal Control Over Compliance identified during previous examination engagements;

2. Obtain an understanding of the broker's or dealer's processes, including relevant controls, regarding compliance with the financial responsibility rules;^13/

   Note: The nature, timing, and extent of procedures that are necessary to obtain an understanding of the broker's or dealer's processes, including relevant controls, regarding compliance with the financial responsibility rules depend on the size and complexity of the broker or dealer; the auditor's existing knowledge of the broker's or dealer's processes and controls; the degree to which the broker's or dealer's compliance depends on the completeness and accuracy of the broker's or dealer's internally-generated data; the nature and extent of changes in systems and operations, if any; and the nature of the broker's or dealer's documentation of its processes and controls.

   Note: Obtaining an understanding of the broker's or dealer's processes, including relevant controls, includes evaluating the design of controls that are relevant to the examination and determining whether the controls have been implemented.

3. Obtain an understanding of instances of non-compliance with the financial responsibility rules and Deficiencies in Internal Control Over Compliance identified by management during the most recent fiscal year;
4. Assess the risks associated with related parties,^14/ including related parties that are investment advisors or entities with which the broker or dealer has a custodial or clearing relationship, that are relevant to compliance and controls over compliance;
5. Obtain an understanding of management's competence regarding the relevant rules and regulations;
6. Read the Financial and Operational Combined Uniform Single Reports ("FOCUS Reports")^15/ filed by the broker or dealer and obtain an understanding of the reasons for resubmissions, if any;
7. Read reports of internal auditors, others who perform an equivalent function, compliance functions, and other auditors that are relevant to the broker's or dealer's assertions;
8. Inquire of management, and, if applicable, other individuals at the broker or dealer who have relevant knowledge regarding regulatory examinations and correspondence between the SEC or the broker's or dealer's DEA and the broker or dealer that are relevant to the broker's or dealer's assertions;
9. Read correspondence and notifications regarding non-compliance that the broker or dealer has sent to or received from the SEC or the broker's or dealer's DEA that are relevant to the broker's or dealer's assertions, and, when necessary in the circumstances, make inquiries of the regulatory agencies; and
10. Obtain an understanding of the nature and frequency of customer complaints that are relevant to compliance with the financial responsibility rules.

10.     In addition, in planning the examination engagement, the auditor should assess the risk of fraud, including the risk of misappropriation of customer assets, relevant to compliance with the net capital rule and the reserve requirements rule and the effectiveness of the broker's or dealer's Internal Control Over Compliance.

Testing Controls over Compliance

11.     The auditor must test those controls that are important to the auditor's conclusion about whether the broker or dealer maintained effective Internal Control Over Compliance for each financial responsibility rule during the fiscal year and as of the end of the fiscal year. The auditor must obtain evidence that the controls over compliance selected for testing are designed effectively and operated effectively during the fiscal year and as of the fiscal year end.

12.     For each control selected for testing, the evidence necessary to persuade the auditor that the control is effective depends upon the risk associated with the control. The risk associated with a control consists of the risk that the control might not be effective and, if not effective, the risk that a Material Weakness would result. As the risk associated with the control being tested increases, the persuasiveness of the evidence that the auditor should obtain also increases.

Note: Although the auditor must obtain evidence about the effectiveness of the selected controls for each financial responsibility rule, the auditor is not responsible for obtaining sufficient evidence to support an opinion about the effectiveness of each individual control.

13.     Factors that affect the risk associated with a control include:

• The nature of the financial responsibility rule;
• The risk associated with non-compliance with the financial responsibility rule and the significance of potential non-compliance;
• Changes in the broker's or dealer's policies or procedures or personnel that might adversely affect control design or operating effectiveness;
• The broker's or dealer's history of instances of non-compliance with the financial responsibility rule that the control is intended to prevent or detect;
• The existence and effectiveness of controls that monitor other controls;
• The risk of management override of controls over compliance;
• The nature of the control and the frequency with which it operates;
• The degree to which the control relies on the effectiveness of other controls (e.g., the control environment or information technology general controls);
• The competence of the personnel who perform the control or monitor its performance and whether there have been changes in key personnel who perform the control or monitor its performance;
• The extent of use of part-time personnel to perform controls over compliance;
• Whether the control relies on performance by an individual or is automated (i.e., an automated control would generally be expected to be lower risk if relevant information technology general controls are effective); and
• The complexity of the control and the significance of the judgments made in connection with its operation.

Testing Design Effectiveness

14.     The auditor should test the design effectiveness of the selected controls by determining whether the broker's or dealer's controls, if they are operating as prescribed by persons possessing the necessary authority and competence to perform the control effectively, can effectively prevent or detect instances of non-compliance with the financial responsibility rules on a timely basis.

Note: If a broker or dealer makes changes to its policies and procedures or key personnel during the fiscal year, the auditor should obtain evidence regarding the design effectiveness of the selected controls before and after the change.

15.     Procedures the auditor performs to obtain evidence about design effectiveness include inquiry of appropriate personnel, observation of the broker's or dealer's operations, and inspection of relevant documentation. Walkthroughs that include these procedures ordinarily are sufficient to evaluate design effectiveness.

Testing Operating Effectiveness

16.     The auditor should test the operating effectiveness of the selected controls by determining whether each selected control is operating as designed and whether the person performing the control possesses the necessary authority and competence to perform the control effectively.

Note: The auditor should obtain evidence regarding the operating effectiveness of the selected controls throughout the entire year and as of the end of the fiscal year.

17.     Procedures the auditor performs to test operating effectiveness include a mix of inquiry of appropriate personnel, observation of the broker's or dealer's operations, inspection of relevant documentation, and re-performance of the control.

18.     The evidence provided by the auditor's tests of the effectiveness of controls depends upon the mix of the nature, timing, and extent of the auditor's procedures. Further, for an individual control, different combinations of the nature, timing, and extent of testing might provide sufficient evidence in relation to the risk associated with the control.

Note: Generally, a conclusion that a control is not operating effectively can be supported by less evidence than is necessary to support a conclusion that a control is operating effectively.

Using Evidence Obtained in Past Examination Engagements

19.     The auditor should obtain evidence during the current fiscal year about the design and operating effectiveness of controls selected for testing. If controls selected for testing in the current year were tested in past examination engagements, and if the auditor plans to use evidence about the effectiveness of those controls that was obtained in prior years, the auditor should take into account the factors discussed in paragraph 13 and the following factors to determine the evidence needed during the current fiscal year examination:

• The nature, timing, and extent of procedures performed in previous examination engagements;
• The results of the previous years' testing of the control; and
• Changes in the control or the process in which the control operates since the previous examination engagement.

Using Tests of Controls that are Modified During the Year

20.     A broker or dealer might implement changes to controls over compliance to make them more effective or efficient or to address control deficiencies. The auditor should obtain an understanding of the reason for the change and obtain evidence regarding the design and operating effectiveness of the new and superseded controls. The nature, timing, and extent of the testing of new and superseded controls depend on the evidence needed to support the auditor's conclusions about the effectiveness of Internal Control Over Compliance during and as of the end of the fiscal year.

Performing Compliance Tests

21.     The auditor must perform procedures ("compliance tests") that are sufficient to support the auditor's conclusions regarding whether the broker or dealer was in compliance with the net capital rule and reserve requirements rule as of the end of its most recent fiscal year. This includes performing the following procedures on the schedules^16/ the broker or dealer used to determine compliance with the net capital rule and the reserve requirements rule as of its fiscal year end:

1. Evaluate whether the amounts in the schedules were determined in accordance with the net capital rule or reserve requirements rule, as applicable;
2. Test the accuracy and completeness of the information in the schedules;
3. Determine whether the broker or dealer maintained the required level of net capital in accordance with the net capital rule;
4. Determine whether the broker or dealer maintained a special reserve bank account for the exclusive benefit of customers and deposited funds in at least the required amount in accordance with the reserve requirements rule;
5. Determine whether the information in the schedules was derived from the books and records of the broker or dealer; and
6. Determine whether the broker or dealer made the notifications, if any, required by the net capital rule and reserve requirements rule as of the end of the most recent fiscal year.

Note: Procedures performed as part of the audit of the financial statements and audit procedures performed on supplemental information also might provide evidence regarding the broker's or dealer's compliance with the net capital rule and the reserve requirements rule.

22.     The auditor should plan and perform compliance tests that are responsive to the risks, including fraud risks, associated with non-compliance with the net capital rule and the reserve requirements rule. As the risk associated with non-compliance with the net capital rule or the reserve requirements rule increases, the persuasiveness of the evidence that the auditor should obtain from compliance tests also increases. The evidence provided by the auditor's compliance tests depends upon the mix of the nature, timing, and extent of those procedures. Inquiry alone does not provide sufficient appropriate evidence to support the auditor's conclusions about the broker's or dealer's compliance with the net capital rule or the reserve requirements rule.

23.     In conjunction with performing the compliance tests pursuant to paragraphs 21 and 22, the auditor must perform procedures to obtain evidence about the existence of customer funds or securities held for customers.

Note: Examples of procedures that provide evidence about the existence of customer assets include: (1) counting customer securities or observing and testing the broker's or dealer's procedures for physical inspection and (2) confirming customer security positions directly with depositories and clearing organizations. Procedures performed in the audit of the financial statements and the audit procedures performed on supplemental information to test the existence of assets held for customers also may provide evidence that is relevant to the requirement in this paragraph.

Effect of Tests of Internal Controls on Compliance Tests

24.     The auditor should take into account the results of the auditor's tests of controls over compliance with the net capital rule and the reserve requirements rule in determining the necessary nature, timing, and extent of compliance tests. If the test results indicate that the controls are effective, less evidence is needed from compliance tests. If the test results indicate that the controls are ineffective, the auditor should revise the planned compliance tests as necessary to obtain more persuasive evidence regarding compliance.

Evaluating the Results of the Examination Procedures

25.     In forming an opinion on whether the assertions made by the broker or dealer in the compliance report are fairly stated, in all material respects, the auditor should evaluate all evidence obtained, regardless of whether the evidence corroborates or contradicts the broker's or dealer's assertions.

26.     The auditor should evaluate:

1. Identified instances of non-compliance with the net capital rule and the reserve requirements rule to determine whether any instance of non-compliance existed as of the end of the most recent fiscal year;
2. Identified instances in which the information used to assert compliance with the net capital rule or the reserve requirements rule was not derived from the broker's or dealer's books and records to determine whether they are material, individually or in combination; and
3. Identified Deficiencies in Internal Control Over Compliance to determine whether the deficiencies, individually or in combination, are Material Weaknesses

Note: A Material Weakness can exist even when no instances of non-compliance exist. However, instances of non-compliance might indicate the existence of one or more Deficiencies in Internal Control Over Compliance.

Note: The auditor cannot assume that an identified instance of non-compliance or an identified Deficiency in Internal Control Over Compliance is an isolated occurrence. The auditor should evaluate the effect of any instance of non-compliance or identified control deficiency on the auditor's assessment of the risks associated with controls and non-compliance.

Note: The auditor also should evaluate the effect on the audit of the financial statements and audit procedures performed on supplemental information of any non-compliance, Material Weaknesses, or instances in which the information used to assert compliance with the net capital rule or reserve requirements rule was not derived, in all material respects, from the broker's or dealer's books and records.

27.     The auditor should evaluate whether he or she has obtained sufficient appropriate evidence to support the conclusions to be presented in the examination report taking into account the risks associated with controls and non-compliance, the results of the examination procedures performed, and the appropriateness (i.e., the relevance and reliability) of the evidence obtained.

28.     If the auditor has not obtained sufficient appropriate evidence about an assertion or has substantial doubt about an assertion, the auditor should perform procedures to obtain further evidence to address the matter.

29.     If the auditor is unable to obtain sufficient appropriate evidence about an assertion, the auditor should express a disclaimer of opinion.^17/

Subsequent Events

30.     For the period from the end of the period specified in the broker's or dealer's assertions to the date of the auditor's examination report (the "subsequent period"), the auditor should perform procedures to identify subsequent events relevant to the auditor's conclusions about the assertions made by the broker or dealer in the compliance report. Such procedures should include, but are not limited to:

1. Reading relevant reports of internal auditors, others who perform an equivalent function, compliance functions, and other auditors, and correspondence that the broker or dealer has sent to or received from the SEC or the broker's or dealer's DEA during the subsequent period that is relevant to the broker's or dealer's assertions; and
2. Evaluating information obtained through other engagements performed by the auditor for the broker or dealer, including subsequent events procedures performed in the audit of the financial statements and the audit procedures performed on supplemental information.

31.     The auditor should evaluate the results of the procedures described in the previous paragraph to determine whether the results corroborate or contradict the broker's or dealer's assertions.

Obtaining a Representation Letter

32.     The auditor should obtain written representations from management of the broker or dealer:

1. Acknowledging management's responsibility for establishing and maintaining a system of internal control with the objective of providing the broker or dealer with reasonable assurance that any instances of non-compliance with the financial responsibility rules will be prevented or detected on a timely basis;
2. Stating the broker's or dealer's assertions included in the compliance report are the responsibility of management;
3. Stating that management has made available to the auditor all records and other information relevant to the broker's or dealer's assertions, including all known matters contradicting the assertions, and all communications from regulatory agencies, internal auditors, others who perform an equivalent function, compliance functions, and other auditors, that are relevant to the broker's or dealer's assertions, received through the date of the auditor's report; and
4. Stating whether there were, subsequent to the period addressed in the broker's or dealer's assertions, any known events or other factors that might significantly affect the broker's or dealer's assertions.

33.     The failure to obtain written representations from management, including management's refusal to furnish them, constitutes a limitation on the scope of the engagement, as described in Appendix C of this standard.

Communication Requirements

34.     The auditor should communicate to management all identified Deficiencies in Internal Control Over Compliance.

35.     The auditor should communicate to management and the audit committee^18/ identified instances of non-compliance with the financial responsibility rules, identified Material Weaknesses, and identified instances in which information used to determine compliance with the net capital rule or the reserve requirements rule was not derived, in all material respects, from the broker's or dealer's books and records.

Note: The auditor also must comply with the requirements of paragraph (h) of SEC Rule 17a-5, which contains notification requirements that apply to auditors of brokers and dealers.

Reporting on the Examination Engagement

36.     The auditor's examination report must include the following elements, modified as necessary in the circumstances and manner discussed in Appendix C:

1. A title that includes the word independent;
2. An identification of the compliance report and the broker's or dealer's assertions regarding the effectiveness of Internal Control Over Compliance during the fiscal year and as of the fiscal year end, compliance with the net capital rule and the reserve requirements rule as of the fiscal year end, and whether the information used to assert compliance with those rules was derived from the broker's or dealer's books and records;
3. A statement that management of the broker or dealer is responsible for establishing and maintaining a system of internal control that has the objective of providing the broker or dealer with reasonable assurance that any instances of non-compliance with the financial responsibility rules will be prevented or detected on a timely basis;
4. A statement that the auditor's responsibility is to express an opinion on the broker's or dealer's assertions based on his or her examination;
5. A statement that the examination was conducted in accordance with the standards of the Public Company Accounting Oversight Board (United States);
6. A statement that the standards of the Public Company Accounting Oversight Board require that the auditor plan and perform the examination engagement to obtain reasonable assurance about whether the broker's or dealer's Internal Control Over Compliance was effective during and as of the end of the most recent fiscal year, whether the broker or dealer complied with the net capital rule and the reserve requirements rule as of the end of the most recent fiscal year, and whether the information used to assert compliance with the net capital rule and the reserve requirements rule was derived from the books and records of the broker or dealer;
7. A statement that an examination engagement includes evaluating the design and operating effectiveness of Internal Control Over Compliance; testing and evaluating the broker's or dealer's compliance with the net capital rule and the reserve requirements rule; determining whether the information used to assert compliance with the net capital rule and reserve requirements rule was derived from the broker's or dealer's books and records; and performing such other procedures as the auditor considered necessary in the circumstances;
8. A statement that the auditor believes the examination provides a reasonable basis for his or her opinion;^19/
9. The auditor's opinion on whether the assertions made by the broker or dealer in the compliance report are fairly stated, in all material respects;
10. The manual signature of the auditor's firm;
11. The city and state (or city and country, in the case of non-U.S. auditors) from which the auditor's examination report has been issued; and
12. The date of the examination report.

37.     The following example examination report expressing an unqualified opinion on the assertions made by a broker or dealer in a compliance report illustrates the report elements described in this section.

Report of Independent Registered Public Accounting Firm

[ Introductory paragraph ]

We have examined W Broker's statements, included in the accompanying [title of the compliance report], that (1) W Broker's internal control over compliance was effective during the most recent fiscal year ended [date]; (2) W Broker's internal control over compliance was effective as of [date]; (3) W Broker was in compliance with 17 C.F.R. §§ 240.15c3-1 and 240.15c3-3(e) as of [date]; and (4) the information used to state that W Broker was in compliance with 17 C.F.R. §§ 240.15c3-1 and 240.15c3-3(e) was derived from W Broker's books and records. W Broker's management is responsible for establishing and maintaining a system of internal control over compliance that has the objective of providing W Broker with reasonable assurance that non-compliance with 17 C.F.R. § 240.15c3-1, 17 C.F.R. § 240.15c3-3, 17 C.F.R. § 240.17a-13, or Rule [fill in name/number] of [fill in DEA] that requires account statements to be sent to the customers of W Broker will be prevented or detected on a timely basis. Our responsibility is to express an opinion on W Broker's statements based on our examination.

[ Scope paragraph ]

We conducted our examination in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the examination to obtain reasonable assurance about whether W Broker's internal control over compliance was effective as of and during the most recent fiscal year ended [date]; W Broker complied with 17 C.F.R. §§ 240.15c3-1 and 240.15c3-3(e) as of [date]; and the information used to assert compliance with 17 C.F.R. §§ 240.15c3-1 and 240.15c3-3(e) as of [date] was derived from W Broker's books and records. Our examination includes testing and evaluating the design and operating effectiveness of internal control over compliance, testing and evaluating W Broker's compliance with 17 C.F.R. §§ 240.15c3-1 and 240.15c3-3(e), determining whether the information used to assert compliance with 240.15c3-1 and 240.15c3-3(e) was derived from W Broker's books and records, and performing such other procedures as we considered necessary in the circumstances. We believe that our examination provides a reasonable basis for our opinion.

[ Opinion paragraph ]

In our opinion, W Broker's statements referred to above are fairly stated, in all material respects.

[Signature ]

[ City and State or Country ]

[ Date ]

Examination Report Date

38.     The auditor should date the examination report no earlier than the date on which the auditor obtains sufficient appropriate evidence to support his or her opinion.

Note: Because of the coordination between the examination engagement, the audit of the financial statements and the audit procedures performed on supplemental information, the date of the examination report should not be earlier than the date of the auditor's report on the financial statements and supplemental information.