Description

A focused course, tailored for you

The Broker-Dealer Internal Audit Workpaper Playbook

A working playbook for internal auditors at US broker-dealers: 15c3-3 reserve testing, SAR sampling, 17a-5 readiness, and the workpaper format your external auditor will not bounce.

Your FY internal audit plan has the Customer Protection Rule reserve computation on it. So does the external auditor's. The question is whether your workpapers will let them rely on your testing or whether they will redo it.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Internal auditors at US broker-dealers sit between three reviewers. The external financial auditor relies on internal audit testing only when the workpapers tie source data to the reserve computation in a format they can re-perform. FINRA examiners reopen 15c3-3 and 17a-5 findings when the WSP testing trail is thin. BSA examiners look at SAR sampling and want to see how you selected the population, how you concluded, and how you escalated. Most internal audit shops at broker-dealers do the testing well and document it in a format that does not survive any of those three review cycles. The workpapers get rebuilt at year end, the same exceptions surface twice, and the audit committee gets the same comments rolled forward. The fix is not more testing. It is a workpaper standard for each of the regulated processes and a sampling matrix that holds up under re-performance.

What you walk away with

A reserve computation workpaper that the external 17a-5 auditor will rely on without rework.
A possession or control testing matrix that ties every position to its location and resolution.
A SAR sampling and conclusion log that holds up under BSA examination.
A WSP testing pattern that closes the FINRA gap between policy and practice.
An audit committee report format that retires rolled-forward findings instead of rolling them forward again.

The 12 modules

Module 1. Reading the FY plan: which broker-dealer rules need workpaper-grade testing

Walk the FY internal audit plan against the rule perimeter: 15c3-3 reserve and possession or control, 15c3-1 net capital, 17a-3 and 17a-4 books and records, 17a-5 supplementary reports, FINRA WSP testing, BSA SAR sampling, Reg BI suitability. Identify which audits the external auditor will want to rely on and which ones BSA or FINRA examiners will reopen. Output is a one-page audit-plan annotation that tells the team which workpapers must be re-performable and which can be narrative.

Module 2. The 15c3-3 customer reserve computation workpaper, end to end

Build the weekly customer reserve computation workpaper from source extract to bank confirmation. Tie the credit items and debit items to the books and records on which 17a-3 relies. Document the haircut decisions, the rounding convention, the deposit timing, and the reconciliation to the reserve bank account statement. The deliverable is a single workpaper format the external auditor can re-perform without follow-up questions. Templates included for both the weekly and the special reserve computation.

Module 3. Possession or control: testing locations, resolutions, and exceptions

Possession or control is the half of 15c3-3 that internal audit usually underweights. Build the testing matrix that ties every fully paid and excess margin security position to its location, names the segregation method, and documents the resolution of each exception within the rule's timeline. Cover DTC, custodian, transfer agent, and physical locations. The workpaper format flows directly into the 17a-5 supplementary report and the FINRA examination request list.

Module 4. Net capital computation review: the 15c3-1 control testing pattern

Test the daily net capital computation as a control, not as a recomputation. Document the haircut categories, the deduction logic for unsecured receivables and aged fails, the credit for subordinated debt, and the early warning notification triggers. The workpaper proves both design and operating effectiveness so the external auditor can rely on it for the 17a-5 supplementary schedule. Includes the cross-walk to the FOCUS report fields.

Module 5. Books and records testing under 17a-3 and 17a-4

Sample the trade blotter, the customer account records, the order tickets, and the communications retention. Document the retrieval timing test required by 17a-4, including WORM compliance for electronic records. The workpaper format separates the design test, the operating effectiveness test, and the retrieval timing test so the external auditor and FINRA examiner can each pull what they need. Includes the audit trail expectations CAT integration introduced.

Module 6. Preparing for the 17a-5 supplementary report cycle

Map every workpaper in the audit universe to the lines of the 17a-5 supplementary schedules. Build the timeline that gets internal audit's reliance package to the external auditor before the field work window. Document the management assertion the supplementary report tests. Format the deficiency log so any exception flows into the supplementary report disclosure rather than surfacing as a surprise at sign-off.

Module 7. FINRA WSP testing: closing the gap between policy and practice

FINRA examination requests start with the written supervisory procedures and ask for evidence that each procedure was tested. Build the WSP testing inventory that ties each supervisory procedure to the evidence of supervision, the deficiency log, and the escalation record. Cover Rule 3110 supervisory controls, Rule 3120 annual certification, Rule 3130 CEO certification, and the branch office inspection cycle. Workpaper format proves the procedure ran, not just that it exists.

Module 8. BSA AML: SAR sampling, escalation, and conclusion log

BSA examiners want to see the SAR sampling matrix: how the population was defined, how the sample was selected, how the alerts were dispositioned, and how escalations to file or not file were documented. Build the sampling matrix, the conclusion log, and the SAR filing timeline test. Cover CIP, CDD, and beneficial ownership refresh testing. The workpaper format closes the gap most internal audit shops have between transaction monitoring testing and SAR program testing.

Module 9. Reg BI and Form CRS: suitability testing as an internal audit

Reg BI is the regulation FINRA and SEC examiners are still calibrating expectations on. Build the suitability testing workpaper that samples recommendations, ties them to the documented best interest analysis, and tests the rollover, account-type, and complex-product decisions specifically. Test the Form CRS delivery evidence and the relationship summary updates. The workpaper format produces evidence the audit committee can act on, not just narrative.

Module 10. Customer complaint and error account testing

The customer complaint log, the error account, and the trade correction journal are three of the highest-signal populations in a broker-dealer audit. Build the sampling pattern for each, document the root cause categorisation, and tie the trend to the WSP testing in module seven. The workpaper format surfaces process-level findings the external auditor and FINRA examiner both look for, instead of one-off exceptions.

Module 11. Cybersecurity, vendor management, and Reg SCI adjacency

Cover the SEC cybersecurity disclosure rule testing for material incident notification, the FINRA cybersecurity examination priorities, and vendor management testing for outsourced clearing, market data, and execution services. For dual-registrants and ATSs, cover Reg SCI adjacency. The workpaper format documents the testing of control design without re-performing the cyber controls themselves, which is the line internal audit holds against management's own testing.

Module 12. Audit committee reporting and the retire-the-rolled-forward-finding pattern

The audit committee deck is where the workpaper quality compounds or compounds against you. Build the reporting format that separates new findings, rolled-forward findings with a closure plan, and rolled-forward findings without one. Document the management response standard so a finding cannot stay open without a date. Tie the audit plan progress to the FY plan from module one so the committee can see coverage at the rule level, not just the audit level.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

FY audit plan that lists 15c3-3 and 17a-5 readiness and the external auditor is asking for reliance: modules one, two, three, six.

FINRA examination request just landed and the WSP testing trail is thin: modules five, seven, ten.

BSA examination cycle is open and SAR sampling and CDD refresh need documenting: modules eight, ten.

Audit committee is rolling forward the same findings into a third cycle and the chair wants a new format: modules one, twelve.

What you get with this course

Twelve written modules in the Art of Service learning environment, self-paced.
Downloadable workpaper templates for each module: reserve computation, possession or control, net capital, books and records, WSP testing, SAR sampling, Reg BI suitability, audit committee deck.
A hand-built implementation playbook tailored to the buyer's audit universe and FY plan, delivered alongside course access.
Worked examples drawn from the rulebook itself: 15c3-3, 15c3-1, 17a-3, 17a-4, 17a-5, FINRA 3110/3120/3130, BSA, Reg BI.
Thirty-day refund window if the workpaper format does not survive the next external auditor review.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours: account provisioned in the Art of Service learning environment, all twelve modules and templates accessible, hand-built implementation playbook delivered.

Week one: complete modules one to three, draft the FY plan annotation and the reserve computation workpaper.

Weeks two to four: work through modules four to eight, build the possession or control, books and records, WSP, and SAR workpapers against your own audit universe.

Weeks five to six: complete modules nine to twelve, rebuild the audit committee reporting format and the rolled-forward findings register.

Ongoing: workpaper templates apply each cycle. The implementation playbook covers the next external auditor review and the next FINRA or BSA examination.

Before and after

Before

Internal audit testing on 15c3-3, WSP, SAR, and Reg BI is thorough but the workpaper format means the external auditor and FINRA examiners re-perform the testing themselves. Findings roll forward. Audit committee comments repeat. Year-end fieldwork window shortens every cycle.

After

Each regulated process has a workpaper standard the external auditor relies on. SAR sampling holds under BSA examination. WSP testing closes the gap between policy and practice. The audit committee sees retired findings instead of rolled-forward ones.

What happens if you do not address this

The external auditor opens scope at year end and the 17a-5 supplementary report timeline slips. FINRA reopens the WSP testing finding from the prior examination. The audit committee starts asking why the same comment surfaces a third cycle running. Internal audit's role gets reframed as documentation rather than assurance.

Who it is for

Internal auditors at US broker-dealers, dual-registrants, and clearing firms. Anyone whose audit universe includes Customer Protection Rule (15c3-3), Net Capital (15c3-1), books and records (17a-3 and 17a-4), the annual 17a-5 supplementary reports, FINRA WSP testing, BSA SAR sampling, and Reg BI suitability testing.

Who this is NOT for. External financial auditors performing the 17a-5 attestation, audit committee chairs, compliance officers running the WSP itself, or anyone outside the US broker-dealer regulatory perimeter. Also not for someone who only needs a high-level overview of SEC rules; this is workpaper-level operational.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable workpaper templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Roughly twenty to twenty-five hours across six weeks at the buyer's pace. The implementation playbook adds another six to eight hours of focused work against the buyer's own audit universe.

Why $199 is the right number

Internal audit CPE catalogs cover the rules at an overview level but not the workpaper format. External audit firms sell the same content at a managed-services price point with a reliance gap closed only by paying them to do the testing. Building the workpaper standard internally takes one to two cycles of trial and external auditor feedback. This course compresses that into six weeks with the templates and the implementation playbook included.

FAQ

We are a dual-registrant. Does this cover the investment adviser side?

The course is built for the broker-dealer perimeter. Investment adviser rule testing (Advisers Act, Form ADV, custody rule, marketing rule) is adjacent and the workpaper discipline carries across, but the rule-by-rule walkthroughs are broker-dealer specific. The implementation playbook can be scoped to the dual-registrant side on request.

Our external auditor already gives us a reliance template. Why do we need this?

The reliance template tells you what they want documented. The course is the workpaper format that gets the documentation through their re-performance test without rework. Two different artefacts.

Is this for the head of internal audit or the staff auditor?

Both. The head of internal audit gets the FY plan annotation, the audit committee report format, and the rolled-forward findings register. The staff auditor gets the workpaper templates and the testing matrices that produce the evidence.

What does the implementation playbook include that the course modules do not?

The playbook is hand-built against the buyer's actual audit universe: the specific clearing relationship, the WSP version on file, the BSA program structure, the open findings carried into the cycle. The modules teach the standard. The playbook applies it to your shop.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.