Description

A focused course, tailored for you

The Internal Audit Manager's Brokerage Risk-Based Audit Plan

Build a risk-based annual audit plan a retail brokerage Audit Committee will sign off without rework.

Your annual audit plan goes to the Audit Committee and the chair asks why operational risk hours dropped 18 percent. You need the residual-risk math, the regulator focus area, and the prior-cycle finding ready on one page.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Internal audit managers running brokerage and wealth audit plans get squeezed from four directions in a single planning cycle. The CAE wants fewer hours overall to fund a new technology audit. The Audit Committee chair wants visible coverage of trading supervision and the consolidated audit trail. The regulators publish a yearly examination priorities list that shifts the heat-map after the plan was drafted. And the business owners push back hard on any review they perceive as duplicative of compliance testing. The plan defence holds or fails on whether the rebalance can be explained in four sentences with a risk-assessment workbook behind it. Where most plans break is at the join between residual-risk scoring and obligation-anchored assurance: the score moves, the regulator focus moves, but the SEC Rule 17a-5 and SOX 404 baseline obligations do not, and the plan has to honour both at once. The course covers exactly that joint.

What you walk away with

Annual audit plan that survives Audit Committee scrutiny on first presentation.
Risk-assessment workbook that ties residual scores to regulator examination priorities and prior findings.
Defensible scoping of SOX 404, SEC Rule 17a-5, and SOC 2 reliance work within the same plan.
Quarterly rebalance pack the CAE can take to the AC without a full re-vote.
Reusable testing templates for trading supervision, consolidated audit trail, segregation-of-duties, and third-party reliance.

The 12 modules

Module 1. The brokerage internal audit risk universe

Build the auditable-entity inventory that covers the front, middle, and back office of a retail brokerage. The module walks through how to scope branch supervision, trading desks, clearing operations, custody, wealth advisory, technology, and the third-party reliance population, with a workbook that survives a CAE challenge on completeness. Includes the cross-reference matrix between auditable entities and FINRA/SEC obligations.

Module 2. Residual risk scoring for brokerage operations

Move from inherent-risk gut scoring to a residual model that incorporates control maturity, prior-finding density, regulator focus, and management self-assessment. The module shows the weighting decisions that hold up under Audit Committee questioning and gives the calibration approach for the seven highest-volatility risk categories in a brokerage book.

Module 3. FINRA, SEC, and SRO examination priorities integration

Translate the annual FINRA examination report, SEC Division of Examinations priorities, and MSRB rule changes into specific risk-score adjustments inside the workbook. The module gives the lookup table that maps published priorities to auditable entities and the rationale documentation the Audit Committee expects to see when a regulator-driven rebalance happens.

Module 4. SOX 404 scoping inside the IA plan

Run the SOX scoping decisions that determine which entities and processes feed external auditor reliance versus pure internal coverage. The module gives the materiality and coverage math, the IT-general-controls scoping logic for the financial-reporting systems, and the walkthrough documentation pattern that holds up to PCAOB-inspected external auditor review.

Module 5. SEC Rule 17a-5 and the consolidated audit trail assurance baseline

Anchor the assurance baseline on the broker-dealer-specific obligations that do not move when business risk shifts. The module covers Rule 17a-5 reporting obligations, the CAT reporting controls, customer protection rule testing, and the net-capital computation control points, and shows how to keep these as a fixed floor in the annual plan.

Module 6. Trading supervision and Rule 3120 supervisory-control testing

Design the audit programme over FINRA Rule 3110 supervisory procedures and Rule 3120 supervisory-control system. The module gives the sampling approach for trade reviews, the exception-handling test, the branch-office inspection coverage logic, and the workpaper structure for testing supervisor-of-supervisor controls in a multi-branch environment.

Module 7. Segregation of duties across brokerage operations and clearing

Test SoD in environments where front, middle, and back office share systems and where a clearing arrangement complicates the control boundary. The module gives the role-to-transaction matrix, the privileged-access review approach, and the compensating-control documentation pattern when a small operations team cannot fully segregate by headcount.

Module 8. Third-party SOC 2 reliance evaluation

Evaluate clearing firm, custodian, fintech vendor, and core platform SOC 2 reports for reliance. The module covers complementary user entity control identification, sub-service organisation carve-outs, qualification handling, gap-period bridging, and the reliance memo that goes into the workpaper file and survives external auditor inspection.

Module 9. IT general controls for the brokerage technology stack

Scope ITGC across order management, trading, clearing connectivity, CRM, custody, and reporting systems. The module gives the access provisioning, change management, computer operations, and SDLC control programme, with the cloud and SaaS-specific scoping adjustments needed when the platform has moved off mainframe in the last several years.

Module 10. Privacy, books-and-records, and Reg S-P testing

Cover the books-and-records obligation under Rule 17a-4, Reg S-P customer information protection, and the state privacy obligations that overlay (CCPA, CDPA, and equivalents). The module gives the records-retention sampling approach, the privacy-incident-response control test, and the supervisory review of customer communications including electronic channels.

Module 11. Quarterly rebalance and the change-control discipline on the plan itself

Handle the mid-year regulator action, market event, or business pivot that requires re-pointing audit hours. The module gives the rebalance approval workflow, the AC notification threshold, the documentation pattern that keeps the original plan defensible while showing why the change was made, and the metrics that report against both the original and the rebalanced plan.

Module 12. The one-page Audit Committee narrative

Produce the AC pack that converts the workbook into a yes. The module gives the page layout, the four-sentence rationale structure, the heat-map presentation that does not bury the rebalance, the prior-year finding closure summary, and the rehearsal script for the three questions the chair will ask. Includes the talking-point pack for the executive session that follows the plan vote.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Annual planning cycle, end of fiscal year, building the workbook from scratch or refreshing last year's.

Audit Committee plan vote, one-page rationale on the screen, chair asks about a specific scope reduction.

Mid-year regulator priority shift or enforcement action that requires rebalancing audit hours.

Quarterly progress reporting, plan-to-actual variance, and the rebalance ask that follows.

What you get with this course

12 written modules in the Art of Service learning environment.
Risk-assessment workbook template tuned to brokerage auditable entities.
Examination-priority-to-auditable-entity cross-reference matrix.
Audit Committee one-page narrative template and rehearsal guide.
Workpaper templates for trading supervision, SoD, third-party reliance, and ITGC.
Hand-built implementation playbook tailored to the buyer's brokerage internal audit function.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.

Modules 1 through 4 anchor the workbook rebuild and typically take the first week.

Modules 5 through 9 cover the obligation-anchored and operational testing design, weeks two and three.

Modules 10 through 12 close the loop with privacy testing, rebalance discipline, and the Audit Committee narrative.

Before and after

Before

The annual plan goes to the Audit Committee and the chair asks why two operational areas got fewer hours this cycle. There's no clean answer on the page. The vote happens but the rebalance pressure carries into every quarterly check-in.

After

The plan goes in with the residual-risk math, the regulator focus area, and the prior-finding closure summary visible on one page. The AC vote is clean. Quarterly rebalances are pre-staged and approved without a full re-vote.

What happens if you do not address this

Audit plans that cannot be defended in four sentences get rebalanced by the Audit Committee instead of by the audit function. That signal moves outward: external auditors notice, regulators notice on the next exam, and the IA function loses the planning authority that justifies its hours.

Who it is for

An internal audit manager in a retail or full-service brokerage who owns the annual planning workbook, runs the operational and compliance audit teams that execute against it, presents the plan and quarterly progress to the Audit Committee, and absorbs the rebalance pressure when regulator priorities or business risk shifts mid-year.

Who this is NOT for. Not for external auditors, not for first-year IA staff who do not yet own a planning workbook, not for compliance-monitoring leads whose work is supervised by IA rather than the other way around, not for audit functions outside broker-dealer or wealth verticals.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Around three to four weeks of part-time study at roughly four hours per week, with the workbook and testing templates usable on the live plan during the same cycle.

Why $199 is the right number

Free IIA and SIFMA materials cover internal audit standards and brokerage operations at the level of general principle. They do not give you the workbook that maps FINRA examination priorities to auditable entities, the SOX 404 scoping math for a broker-dealer, or the one-page Audit Committee narrative pattern. Big-four advisory benchmarking runs into six figures and produces a report, not a workbook your team can run. This course is the working artefact.

FAQ

Is this aimed at the CAE or at the audit manager who owns the plan?

The audit manager who owns the workbook and presents the plan, with material the CAE will recognise and approve.

Does it cover wealth and advisory audit work as well as brokerage operations?

Yes. The risk universe and testing modules cover both broker-dealer and registered-investment-adviser auditable entities, including the Reg BI and Form CRS supervisory layer.

Will the workbook need to be rebuilt for a different fiscal calendar?

No. The workbook is calendar-agnostic and the rebalance discipline module covers off-cycle adjustments.

Is the implementation playbook generic or tailored?

Tailored. It is hand-built against the buyer's actual brokerage internal audit function, sized to the team and the auditable-entity inventory.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.