Broker Dealer Reruns: Haven’t I Seen This Before?
I grew up in the 80’s and 90’s and I love late night reruns replaying some of the best television sitcoms, before streaming services changed the game. Seinfeld, Friends, Will & Grace, Frasier, or the ever-classic Three’s Company. Lately, it feels like I’m watching (well, in this case reading) a rerun of the PCAOB Broker Dealer report. In August 2023, the PCAOB released its Annual Report on the Interim Inspection Program Related to Audits of Brokers and Dealers. While the report evolves with different graphics and metrics, when boiled down to the basic findings, it reads much like past reports (almost verbatim in sections). We’ve written about most of these in past articles, including, Nine Years and Still Running: Reflections on the State of the PCAOB’s Interim Broker-Dealer Inspection Program and Broker-Dealer Update: Two Years Later and Still Struggling. If the titles don’t say enough already, for better or for worse, there simply isn’t a lot of evolution of the nature of the findings.
Overall Findings
Perhaps the biggest takeaway this year is the fact that inspection findings are increasing. In last year’s report, the PCAOB stated that the overall deficiency rates were “unacceptably high.” And this year, deficiencies increased year over year at the engagement level as well as the firm quality control level (thanks in large part to engagement quality review findings). (See table at bottom of article.)
For context, the deficiency rate within the issuer inspection program also rose over the past three years. However, the issuer audit deficiency rate is lower with deficiencies in only 40% of audits in 2022 (34% in 2021 and 29% in 2020). So, while the negative trend is not a uniquely broker-dealer audit phenomenon, there is still a large discrepancy between 58% for broker-dealer firm inspections and 40% for issuer firm inspections.
Deficiencies Year Over Year
Within broker-dealer firm inspections, deficiencies remained high (or even increased) in the following focus areas:
- Revenue
- Net capital supplemental information
- Contradictory evidence related to exemptions
- Auditor’s reports and review reports
- Documentation
While overall deficiencies increased, there was some positive news that is worth noting. There was a decrease in deficiencies in audits of customer protection supplemental information and going concern, and a decrease in deficiencies for examination engagements related to testing internal controls over compliance (ICOC). I highlight these improvements because customer protection and ICOC are, in my opinion, some of the most complex and most important areas of broker-dealer audits. So, progress in those areas is definitely a positive for the industry.
Although there has been little change to the standards over the past couple years, here are a couple new considerations specific to current developments we are noticing:
- While ICOC deficiencies have decreased overall, the deficiency rate of 50% is still too high. When testing internal controls over compliance, it’s important to remember that this testing is on par with testing internal controls over financial reporting. While ICFR is held in high regard, the testing of ICOC required by AT 1 is actually more stringent. AT 1 requires the evaluation of internal controls over compliance during the period under audit and as of the period end. This means identifying controls and then evaluating the design and implementation and testing the operating effectiveness of those controls throughout the entire period and as of the period end. While not the same as an ICFR opinion, it requires similar testing. Often there is a perception that because it’s an attestation standard and the scope is specifically limited to the broker-dealer’s assertions required under SEC Rule 17a-5, that the work is not as exigent as PCAOB audit standards, but don’t be fooled.
- Auditors are still struggling to evaluate broker-dealer's exemption reports. While the review procedures under AT 2 are not overly stringent, it’s important that engagement teams carefully read the requirements and perform the required review procedures. And as the PCAOB points out in its report, engagement teams should also consider the information learned during the audit of the financial statements. Often, there is evidence apparent from audit procedures performed over the financial statements that is contradictory to the exemptions claimed in the broker-dealer's exemption report that is missed. And finally, to make this more complicated, the SEC released updated guidance (Footnote 74) in July 2020 for operations that do not specifically fall under paragraph k of Rule 15c3-3, but still permit the broker-dealer to file an exemption report. And many broker-dealers that should be changing their assertions in their exemption reports to place reliance on Footnote 74 have resisted the change, making the auditor’s job more difficult.
- Relevance and reliability and completeness and accuracy continue to emerge across all audits and reviews, whether in broker-dealer or issuer inspections. We cannot emphasize this enough. The first thing an associate learns is to tie everything back to the general ledger before performing any audit procedures. Similarly, now, the first thing (or maybe second thing, after tying out to the GL if possible) auditors should be doing is asking: “how is this audit evidence relevant and reliable (external information) or complete and accurate (internal information)?” Don’t forget that service providers act as an extension of management’s controls and thus information coming from a service provider (such as a clearing broker-dealer) should also be evaluated for completeness and accuracy. The PCAOB has more guidance coming through various new proposals to encompass additional information coming from external parties but maintained within the company’s systems; what this means is that the PCAOB is hyper-vigilant and is very conscientious that an audit is only as good as the audit evidence is relevant and reliable.
- For the other deficiencies, we’ve delved into many of these focus areas before, so let’s not do our own rerun here. However, in reading through some of the deficiencies in the most recent report, we thought it was pertinent to call out the importance of review and supervision. While there are difficult and complex audit areas, yes, some of these deficiencies are “low-hanging fruit.” For instance: failures related to documentation and archiving, failure to obtain a management representation letter, failing to identify GAAP departures and omitted disclosures, and report deficiencies (including incorrect dating). These are simple errors that should be caught through proper review and supervision. While many claim the PCAOB is overly exigent, it does not excuse the lack of thorough review and supervision from firms, and we need to own our responsibility here.
New Quality Management Standards
One of the key differences between the broker-dealer and issuer inspection programs is the fact that the broker dealer program is still interim and not permanent. Without a permanent program, the PCAOB does not issue firm-specific reports and as a result, there is no required PCAOB remediation. Certainly, the PCAOB will follow-up on comment forms and ask what firms have done to address the engagement specific issues, but there is no mandatory remediation. While potentially a blessing (less mandatory regulatory procedures), we believe there is the shadow side of a curse. Mandatory remediation affords broker-dealer auditors an opportunity to engage with the PCAOB and have meaningful remediation discussions. These discussions could help clarify where and how firms are falling short and would offer feedback on the efficacy of remedial efforts.
Especially considering the new quality management standards (including ISQM 1 (IAASB), SQMS 1 (AICPA) and QC 1000 (PCAOB)), firms across the entire audit industry will be forced to formally start remediating deficiencies. Although these new quality management standards take effect at various times over the next couple years, firms need to begin planning for these changes today. The standards are all very similar and all include the requirement to perform a root cause analysis to understand the core issue contributing to audit quality deficiencies. Once the root causes are identified, firms will then need to implement remedial actions to address those issues. This is true for both AICPA and PCAOB audits, which means all US broker-dealer audit firms will be subject to these new requirements.
The requirement to perform a root cause analysis and remediate the issues is true regardless of whether the deficiencies are internally identified through in-flight reviews or externally identified through peer reviews or regulatory reviews, such as PCAOB inspections. In other words, broker-dealer audit firms will be required to implement firmwide remedial actions to address PCAOB inspection findings, but they won’t necessarily be afforded the opportunity to seek PCAOB feedback that would enable more informed remedial actions. In our view, this suggests an increased need for a permanent program, or at least an exchange with the PCAOB for firms to obtain current, relevant insights.
Until that day, however, we must keep the course, but know that in a world of reruns and déjà-vu, we’re here to help break the recurring cycle, whether triaging specific PCAOB comments, helping identify root causes or providing feedback on remedial actions. After inspecting hundreds of audits, we’ve seen the gamut and sometimes, it does feel like a rerun of an old television sitcom, though a little less comical.
Key Takeaways
- Deficiencies in broker-dealer audits increased year over year and remain significantly higher than the deficiency rates found in the issuer inspection program.
- The deficiencies are recurring in nature and continue to revolve around auditing revenue and net capital supplemental information, examining ICOC, and reviewing exemption reports.
- Though not specific to a focus area, the concept of relevance and reliability and completeness and accuracy is pervasive in all findings and with the continued integration of IT throughout every part of business, this theme will continue to rise in significance.
- Supervision and review are paramount to audit quality.
- New quality management standards will soon require all audit firms issuing opinions under ISA, AICPA and PCAOB standards to identify root causes for engagement and firm-level deficiencies and implement remedial measures to address the issues.
Inspection Results | 2022 | 2021 | 2020 |
---|---|---|---|
Firms with deficiencies in audit and/or attestation engagements | 90% | 78% | 78% |
Audit Engagements With Deficiencies | 58% | 49% | 61% |
Examination Engagements With Deficincies (AT 1) | 50% | 64% | 67% |
Review Engagements With Deiciencies (AT 2) | 40% | 28% | 23% |









