Description

A focused course, tailored for you

The Brokerage Internal Audit Workpaper Playbook

A working audit kit for retail-brokerage internal audit specialists who own walkthroughs, control testing, and the workpaper trail that survives the next QAR.

Your testing was sound. Your workpaper got circled anyway.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Internal audit specialists at large retail-brokerage firms own the workpaper, not just the test. The SOX 404 walkthrough has to read clean for the SOC sign-off, the customer reserve formula test has to satisfy SEC Rule 15c3-3 inspection, the books-and-records testing has to map back to Rule 17a-4, and FINRA Rule 4530 events have to be tracked from notification through disposition. The senior auditor signing off, the QAR reviewer two cycles from now, and the external auditor reading the population memo all want the same three things: a clean scoping rationale, IPE completeness evidence, and an exception write-up that names root cause and the management action. The actual testing is usually fine. The piece that costs days is the workpaper shape that proves the testing was complete. This course is the working kit for that shape.

What you walk away with

Scope a SOX 404 walkthrough so the testing population is defensible at first review.
Write IPE completeness memos that QAR reviewers do not send back.
Document control testing on 15c3-3 customer reserve and 17a-4 books-and-records that survives external auditor reperformance.
Build exception write-ups that name root cause, control owner, and the management action without rework.
Track FINRA Rule 4530 events from notification through MRA closure in a single workpaper trail.

The 12 modules

Module 1. The retail-brokerage audit universe

A map of the audit universe a brokerage internal audit specialist actually owns: SOX 404 financial reporting controls, the customer protection rule (15c3-3) reserve formula, the net capital rule (15c3-1), books and records under 17a-4, FINRA Rule 4530 reportable events, AML and KYC, supervision under FINRA 3110. Where the lines run between IA, compliance, and operational risk. Which controls live in shared scope with the external auditor and which are IA-only.

Module 2. Scoping and risk assessment that survives review

How to write the scoping memo and risk assessment so the senior auditor signs off on first read. Population definition, risk rating, control selection rationale. The three sentences QAR reviewers look for in a scoping memo and the two they reject. Worked example: scoping the annual SOX walkthrough for the customer reserve calculation, including the data sources, the control owners, and the testing approach narrative.

Module 3. Walkthroughs that hold up

Walkthrough mechanics for financial reporting and operational controls. How to document the inquiry, the inspection, the reperformance step. The walkthrough narrative shape the external auditor will rely on. Where IA walkthroughs differ from external audit walkthroughs and why the workpaper has to stand alone. Worked example: 15c3-3 reserve formula walkthrough including the data feed, the reconciliation, and the segregation point.

Module 4. IPE completeness and accuracy memos

Information Produced by the Entity is the workpaper line that fails most often. How to write the IPE memo: source system, query, parameters, completeness check, accuracy check, the sign-off and the timestamp. Why a query screenshot is not enough and what the QAR reviewer is actually asking for. Worked example: IPE memo for a customer-trade population pulled from the books-and-records system for 17a-4 testing.

Module 5. Sampling: attribute, dollar-value, and judgmental

Sampling approaches for brokerage controls. Attribute sampling for control operation testing, dollar-value sampling for substantive testing, judgmental sampling for high-risk targeted reviews. Sample size rationale, selection method, the documentation that proves the sample is representative. Worked example: attribute sample on the daily 15c3-3 reserve computation review control across a quarter.

Module 6. Customer reserve formula (15c3-3) testing

End-to-end testing of the customer protection rule reserve formula. The data inputs, the formula, the deposit and the lock-up. Testing the reserve account reconciliation, the daily computation, the weekly and monthly look-back. What evidence the SEC inspector and the external auditor want in the same workpaper. The exception write-up pattern when the reserve under-deposit threshold is breached, including the FINRA self-report path.

Module 7. Books and records (17a-4) and electronic storage

Testing the books-and-records control set under SEC Rule 17a-4: WORM storage, indexing, audit trail, retention period, third-party access letter. The control points an IA specialist tests vs the technology audit. The documentation the external auditor expects on electronic storage compliance. Worked example: testing the email retention control for a year-end SOX walkthrough.

Module 8. FINRA Rule 4530 disclosure tracking

Reportable events under FINRA Rule 4530: customer complaints, written grievances, internal reviews, settlements, terminations for cause. How IA tests that the firm tracked the event from intake through disposition and that the Rule 4530 filing was timely. The workpaper that maps each event to its filing reference and its MRA disposition. Worked example: testing a quarter of customer complaint events through filing.

Module 9. AML, KYC, and supervisory testing

Testing the AML programme: customer identification, customer due diligence, enhanced due diligence triggers, transaction monitoring, SAR escalation, OFAC screening. Supervisory testing under FINRA Rule 3110: branch reviews, communications with the public, registered representative supervision. The IA testing approach when the AML team and the supervisory principal each own a piece of the same control.

Module 10. Exception write-ups, root cause, and management action

The exception write-up shape that closes on first review. Naming the control point, the population, the exception count, the dollar impact, the root cause, the control owner, the management action, the target date. Why root cause is the field reviewers reject most often and how to write it. The escalation path when a control exception is also a regulatory reportable event.

Module 11. MRA tracking and remediation testing

Matter Requiring Attention tracking from issuance through closure. How IA tests management remediation: design effectiveness, operating effectiveness, sustainability. The remediation testing memo shape. The closure recommendation and the workpaper that supports it. Worked example: testing the remediation of a prior-year SOX 404 design deficiency on the customer reserve formula.

Module 12. The QAR-ready workpaper file

Building the workpaper file for the Quality Assurance Review cycle. The index, the cross-references, the review notes, the sign-offs. What the QAR reviewer is checking against the IIA standards. The three things a QAR reviewer always looks for and the two patterns that always trigger a finding. The final review checklist before the workpaper goes to the file.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Module 4 (IPE memos) is the one to read first if your last walkthrough got a population completeness comment.

Module 6 (15c3-3) is the one if your reserve formula testing is on the year-end SOX scope.

Module 8 (FINRA 4530) is the one if reportable-event tracking is a recurring finding in the audit committee report.

Module 10 (exceptions) is the one if your exception write-ups keep coming back with root-cause edits.

What you get with this course

Twelve written modules with worked examples drawn from retail-brokerage internal audit testing.
A downloadable IPE completeness memo template, a scoping rationale template, an exception write-up template, and an MRA remediation memo template.
Worked walkthrough narratives for 15c3-3 customer reserve, 17a-4 electronic storage, and FINRA Rule 4530 disclosure tracking.
A QAR-ready workpaper index and review checklist.
The hand-built implementation playbook tuned to the buyer's audit cycle and reporting line.
Thirty-day money-back if it does not fit.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours: learning environment account provisioned and the hand-built implementation playbook delivered alongside it.

Week one: modules one through four (audit universe, scoping, walkthroughs, IPE memos).

Week two: modules five through eight (sampling, 15c3-3 testing, 17a-4 records, FINRA 4530).

Week three: modules nine through twelve (AML and supervisory, exceptions, MRA tracking, QAR file).

Ongoing: templates and worked examples remain available; the hand-built playbook is buyer-specific.

Before and after

Before

Walkthroughs get senior reviewer comments on population completeness, root cause is the field that always gets rewritten, the QAR file pull lands on the workpaper that has the thinnest IPE memo.

After

Scoping, IPE, sampling, and exception write-ups have a shape that closes on first review. The QAR cycle pulls clean. Time on workpaper rework drops; time on actual testing and findings goes up.

What happens if you do not address this

Repeat senior reviewer rework on workpaper shape, slow QAR cycles, a year-end SOX push where the population memos and the exception write-ups become the bottleneck, and a track record where the testing was sound but the workpaper trail did not show it.

Who it is for

Internal Audit Specialist at a large retail-brokerage firm. Owns walkthroughs and control testing across SOX 404 financial reporting, the customer reserve formula (15c3-3), books and records (17a-4), AML KYC, and FINRA Rule 4530 reportable events. Reports into an audit manager who reviews workpapers before they go to the QAR file. Quarterly testing rhythm with a year-end SOX push and an ongoing operational audit cycle. Knows the controls and the testing approach; wants a sharper workpaper shape and a faster path through senior reviewer comments.

Who this is NOT for. External audit seniors at Big4 firms (different workpaper conventions). Compliance officers who do not own internal audit testing. Operational risk managers without an internal audit reporting line. Newly-licensed registered representatives. Anyone outside the retail-brokerage or wealth-management vertical.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Eight to twelve hours across three weeks at a self-paced rhythm. Modules are short enough to read between testing engagements; templates and the playbook are usable on the next walkthrough.

Why $199 is the right number

IIA training and the CIA learning material cover the standards but not the retail-brokerage testing shape. Vendor SOX courses cover financial reporting but not 15c3-3 or 17a-4. Internal audit shop training covers your firm's templates but not the QAR-ready shape that survives external review. This course is built around the workpaper shape, not the standards or the templates.

FAQ

Is this aligned to the IIA standards?

Yes. Scoping, sampling, evidence, and reporting modules cite the relevant IIA standards and the IA workpaper conventions that QAR reviewers check against.

Does this cover the wealth management side, or only the broker-dealer side?

Both. The control set on the broker-dealer side (15c3-3, 17a-4, FINRA 4530) is the deeper focus. The wealth and advisory side is covered through the supervision and the books-and-records modules.

Is the course updated when FINRA or SEC issues new guidance?

Modules are written around the standing rule set and the workpaper shape. When a rule changes materially, the affected module gets a revision and buyers are notified.

What is the implementation playbook?

A hand-built document tuned to the buyer's audit cycle, reporting line, and current open findings. It is built after purchase and delivered alongside course access.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.