Description

A focused course, tailored for you

The Retail Broker-Dealer Internal Audit Working Paper Playbook

Build defensible internal audit working papers for a US retail broker-dealer that hold up under FINRA, SEC, and external auditor review the first time.

Your sample memo, your population query, your attribute table and your exception write-up are the four artefacts the quality reviewer, the external auditor and the FINRA examiner will read. Most internal audit work fails on those four, not on the testing itself.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Internal audit inside a US retail broker-dealer carries a stack the rest of internal audit does not. The annual audit plan has to cover Reg BI suitability and care obligations, Customer Protection Rule (SEC 15c3-3) reserves and possession-or-control, Net Capital (15c3-1), AML and BSA monitoring, supervisory controls under FINRA 3110 and 3120, electronic communications surveillance under 17a-4, Regulation SP customer information protection, and Reg SCI where applicable to alternative trading systems. Each of those audits produces a working paper file that the SOX external auditor will sample, the FINRA examiner will request, and the audit committee will see summarised. The failure pattern is consistent: population scoping that cannot be tied back to a source-of-record system, sample rationale that reads as cosmetic, attribute design that does not map cleanly to the stated control objective, exception write-ups that the auditee successfully argues down, and re-audit notes that leave the issue open. This course is the discipline that closes those gaps before the file ever leaves the audit team's hands.

What you walk away with

Write a population scoping memo that ties one-to-one back to the trade blotter, supervisory queue, or AML alert system it sampled from.
Design attribute tables that map each attribute to a single stated control objective with no overlap and no gap.
Document sample rationale that names the specific regulatory exposure being tested and survives a quality reviewer challenge.
Draft exception write-ups that the auditee cannot argue down on facts and that the external auditor accepts without rework.
Close re-audit notes with evidence that survives the next FINRA exam cycle without reopening.

The 12 modules

Module 1. The four artefacts that decide the working paper

A retail broker-dealer audit file lives or dies on four documents: the scoping memo, the sample rationale, the attribute table, and the exception write-up. This module unpacks each one against an actual supervisory controls audit example and shows what a quality reviewer, an external auditor, and a FINRA examiner each look for in those four artefacts. You leave with the test you will apply to every working paper you write for the rest of the audit plan.

Module 2. Population scoping that ties back to the source of record

Walks the discipline of defining a population from the trade blotter, the supervisory exception queue, the AML alert system, or the customer complaint log, and proving the tie-back. Covers how to handle multiple source systems, how to document data extraction parameters so the population is reproducible months later, and how to write the scoping paragraph so the reviewer does not have to ask where the numbers came from.

Module 3. Sample rationale linked to Reg BI, 15c3-3, 15c3-1 and AML risk

Sample rationale is where most internal audit working papers thin out. This module teaches how to name the specific regulatory exposure the sample tests, how to size the sample against the population risk profile, and how to document why a judgemental, attribute, or statistical approach was chosen. Worked examples cover a Reg BI suitability audit, a 15c3-3 reserve formula audit, a 15c3-1 net capital audit, and an AML transaction monitoring audit.

Module 4. Attribute tables that map one-to-one to the control objective

Attribute design is where the control objective and the test step have to meet without overlap and without gaps. The module covers how to decompose a stated control objective into attributes, how to avoid the common pattern of one attribute testing two objectives, and how to handle dependencies. Includes the attribute table template and three worked tables for FINRA 3110 supervisory reviews, 17a-4 communications retention, and Regulation SP customer information safeguarding.

Module 5. Workpaper documentation standards the external auditor will accept

Walks the IIA standards and the practical extension your external auditor expects when they reperform a sample from your file. Covers preparer and reviewer sign-off, tickmark legends, evidence cross-referencing, and the level of narrative that lets a reperformer arrive at your conclusion without re-asking the business. Includes the workpaper review checklist the quality reviewer will use against your file.

Module 6. Exception write-ups the auditee cannot argue down on facts

Exception write-ups fail when they describe the symptom rather than the control failure, or when they leave the auditee an opening to argue the facts. This module teaches the four-part structure (condition, criteria, cause, effect) tuned to brokerage controls, how to separate factual finding from management response, and how to write the effect statement so the audit committee sees the regulatory and customer impact rather than a process complaint.

Module 7. Reg BI care obligation and suitability audits end-to-end

A full working paper walkthrough of a Reg BI care obligation and suitability audit at a retail broker-dealer. Scoping against the recommendation population, sampling against high-risk recommendation types, attribute design against the four Reg BI obligations, evidence collection from the CRM and supervisory review system, and exception write-up against the documented care obligation standard. Delivers as a downloadable working paper exemplar.

Module 8. 15c3-3 customer protection and 15c3-1 net capital audits

Customer Protection Rule audits cover the special reserve bank account computation, possession or control determinations, and the weekly reserve formula. Net Capital audits cover haircuts, allowable assets, and the early warning thresholds. This module walks the working paper structure for both, including how to scope around treasury and finance handoffs, how to test the reserve formula reperformance, and how to evidence possession-or-control on a sample of customer securities.

Module 9. AML, BSA and CIP control audits with transaction monitoring sampling

AML audits at a broker-dealer cover the Customer Identification Program, customer due diligence and beneficial ownership, SAR filing, and transaction monitoring alert handling. This module covers population scoping from the alert management system, judgemental sampling weighted to high-risk customer segments, attribute tables that test alert investigation quality and SAR decisioning rationale, and exception write-ups that survive the next FinCEN or FINRA AML exam.

Module 10. Supervisory controls (FINRA 3110/3120) and 17a-4 communications surveillance

FINRA Rule 3110 supervisory reviews and Rule 3120 supervisory control system testing produce some of the most reviewed internal audit files in a broker-dealer. This module covers how to scope a supervisory controls audit across multiple supervisory hierarchies, how to test the principal review evidence trail, and how to audit 17a-4 electronic communications retention and surveillance lexicon coverage. Includes a tested attribute table for principal review sampling.

Module 11. Re-audit and issue closure that survives the next FINRA cycle

The follow-up audit is where issues get closed cleanly or quietly reopened. This module covers re-audit scoping against the original finding, evidence standards for closure (the difference between management's representation and the auditor's reperformance), and how to document a partial closure so the audit committee sees the remaining exposure. Includes the issue closure memo template the course delivers.

Module 12. The audit committee summary and the FINRA exam response file

The audit committee reads a one-page summary. The FINRA examiner reads the full working paper file. This module covers how to write the audit committee summary so it survives a board director question, how to organise the working paper file index so a FINRA request is a one-day pull rather than a three-week reconstruction, and how to maintain the audit file evidence between cycles so the next reviewer does not start from zero.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

The supervisory controls audit memo on your desk where the sample rationale needs to tie back to the trade blotter.

The Reg BI care obligation audit the audit committee will see summarised this cycle.

The 15c3-3 reserve formula reperformance the external auditor will sample as part of their integrated audit.

The AML transaction monitoring audit FINRA will request the working paper file for at the next routine exam.

What you get with this course

Twelve written modules in the Art of Service learning environment.
Working paper templates: scoping memo, sample rationale, attribute table, exception write-up, issue closure memo.
Four end-to-end working paper exemplars: Reg BI suitability, 15c3-3 reserve formula, AML transaction monitoring, FINRA 3110 supervisory review.
Workpaper review checklist tuned to retail broker-dealer audits.
A hand-built implementation playbook tuned to your specific audit plan, delivered alongside course access.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours: account in the learning environment provisioned, implementation playbook delivered.

Weeks 1 to 2: Modules 1 to 4 plus the scoping memo and attribute table templates applied to your next audit on the plan.

Weeks 3 to 4: Modules 5 to 8 plus the Reg BI and 15c3-3 working paper exemplars applied to a live audit.

Weeks 5 to 6: Modules 9 to 12 plus the AML, supervisory controls, and audit committee summary work.

Before and after

Before

Working papers that the quality reviewer sends back for sample rationale rework, exception write-ups the auditee successfully argues down on facts, and audit files the external auditor or FINRA examiner asks four follow-up questions on before accepting.

After

Working papers that pass quality review on the first pass, exception write-ups the auditee cannot argue down on facts, and an audit file index that responds to a FINRA exam request in a single day rather than three weeks.

What happens if you do not address this

A working paper file that does not survive the external auditor reperformance becomes a SOX deficiency. A working paper file that does not survive a FINRA exam becomes a 1002 letter and a Matter Requiring Attention on the firm's record. The cost of an internal audit team that writes thin working papers is paid by the firm at the next exam cycle, not at the audit.

Who it is for

Internal auditors at US retail broker-dealers and the bank-affiliated broker-dealer subsidiaries inside large financial services groups. Senior auditors and audit managers who own end-to-end audits of supervisory controls, customer protection, AML, electronic communications surveillance, or trading and clearing operations, and who write the working papers that the quality reviewer, the external auditor and FINRA will read.

Who this is NOT for. External audit staff at public accounting firms doing financial statement work. Compliance officers who own the first line monitoring function rather than the independent audit function. SOX testers who only test ITGCs without exposure to brokerage operational controls.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Six weeks at roughly four hours a week. Most learners run two modules a week alongside live audit work, applying each module's template to the audit in progress.

Why $199 is the right number

IIA standards documentation and broker-dealer audit guidance from FINRA and SEC speeches give you the principles. CPE courses give you the regulatory updates. Neither gives you the four working paper artefacts written end-to-end against a US retail broker-dealer audit plan, with templates and exemplars you can use this week. This course closes that specific gap.

FAQ

Is this for SOX testing or for operational internal audit?

Operational internal audit at a retail broker-dealer. SOX ITGC testing is touched only where it intersects with broker-dealer operational controls, for example the 15c3-3 reserve computation.

Does it cover wealth management and RIA audits as well?

The Reg BI and supervisory controls modules apply to a registered representative population. RIA-specific Advisers Act audits are not the focus; the focus is the broker-dealer side of a dual registrant.

How current is the regulatory content?

Tuned to the current FINRA rulebook, SEC Customer Protection Rule, Net Capital Rule, Reg BI, and FinCEN BSA expectations. Updated when the regulators move.

Does it apply to a bank-affiliated broker-dealer subsidiary?

Yes. The supervisory controls, AML, and customer protection modules apply unchanged. The bank-affiliated broker-dealer adds an extra dimension around bank-broker information sharing and Reg W, which the implementation playbook addresses for your specific entity structure.

What is the implementation playbook?

A hand-built document tuned to the recipient's specific audit plan, delivered alongside course access. It maps the course templates to the specific audits on the recipient's plan, with the population sources, sample sizes, and attribute tables sketched for each one.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.