CFTC Staff Letter 99-32: Interim Financial and Segregation Interpretation No. 4-2 Risk-Based Auditing

CFTC Letter No. 99-32
CFTC Letter No. 99-32
August 20, 1999
Interpretation
Division of Trading & Markets
Financial and Segregation Interpretation No. 4-2 Risk-Based Auditing
Section 5a(a)(9) of the Commodity Exchange Act and Commission Regulation 1.52(b) require self￾regulatory organizations ( SROs ) to enforce rules which provide minimum financial standards and
related reporting requirements for member-futures commission merchants ( FCMs ). On July 29, 1985, the Division of Trading and Markets ( Division ) issued Financial and Segregation Interpretation No. 4-1 ( Interpretation 4-1 ) which provides the SROs with minimum standards for carrying out their surveillance of compliance by FCMs with applicable financial and related reporting requirements. 1 Subsequently, the Division adopted addenda to Interpretation 4-1 that set forth an SRO s responsibilities with respect to sales practice and compliance audits of member FCMs ( Addendum A ) and that addressed the coordination by commodity and securities industry SROs of the audit and financial surveillance activities conducted over FCMs registered with both the Commission and the Securities and Exchange Commission ( Addendum B ).2 The Joint Audit Committee ( JAC ) has requested that the Division modify Interpretation 4- 1 and Addendum A to permit risk-based auditing.3 The proposal would not modify a DSRO s ability to coordinate surveillance and audit responsibilities over dually-registered FCMs with the appropriate securities SRO as set forth in Addendum B. Interpretation 4-1 requires each designated self-regulatory organization ( DSRO ) to conduct, at least once every two years, a full scope financial audit of each member-FCM that carries customer accounts. In those years in which a full scope audit is not performed, a DSRO must make an examination of sufficient scope to satisfy itself that the FCM is in compliance with applicable segregation, recordkeeping, and reporting requirements (a limited scope examination). Addendum A requires each DSRO to audit FCMs carrying customer funds routinely for applicable sales practice and compliance matters. The scope of the sales practice/compliance audit is determined by the DSRO after taking into account information available on the FCM, including information related to the number of complaints, results of past audits, adequacy of the systems of internal control, and the general nature of the FCM s business. The sales practice/compliance audit is performed by the DSRO in conjunction with the biennial full scope financial audit. The risk-based auditing procedures proposed by the JAC would amend Interpretation 4-1 file:///S|/Website%20Management/LegacyDataCopyasof2010-04-21/tm/letters/99letters/tm99-32.htm (1 of 5) [5/6/2010 7:12:27 PM]

CFTC Letter No. 99-32 and Addendum A in regard to the frequency and scope of the DSRO s financial and sales practice/compliance audits. Under the proposal, both the frequency and scope of the examination would be determined based upon the DSRO s overall assessment of the financial and operational risks posed by an FCM. The DSRO s assessment would include on-site evaluation and testing of the FCM s systems of internal controls and an assessment of the FCM s financial and compliance history by exchange personnel who, through ongoing oversight activities, are familiar with the FCM s operations. The Division believes that risk-based auditing, in concept, is consistent with the Commodity Exchange Act and with Commission regulations. The Division, however, would like to have the opportunity to assess the DSROs implementation of risk-based auditing, including the procedures for establishing audit scope, prior to adopting final amendments to Interpretation 4-1 and Addendum A. Accordingly, the Division has determined to provide this interim modification. This will enable the DSROs to gain experience with risk-based auditing and to demonstrate to the Division that the risk-based auditing program has been designed and implemented to ensure that FCMs are in compliance with Commission and SRO financial, segregation and related recordkeeping and reporting rules, and applicable Commission and SRO sales practice and compliance rules. Therefore, DSROs must continue to comply with Interpretation 4-1 and the addenda in conducting financial and sales practice/compliance examinations of member-FCMs. However, in order to reflect risk-based auditing, the Division will deem any DSRO that fully implements the risk-based auditing procedures set forth in paragraphs 1 through 9 below in lieu of those required by paragraphs 26 through 32 and 44 of Interpretation 4-1 to be in compliance with Interpretation 4-1 and the addenda. All other paragraphs of Interpretation 4-1 and the addenda will continue to be in effect during the interim period. An SRO that implements the risk-based auditing approach will not be required to perform a biennial full scope financial audit of each of its member-FCMs that carry customer funds. Accordingly, that portion of paragraph 2.1 of Addendum A that provides that a sales practice/compliance audit is to be conducted during the biennial full scope financial audit will no longer be applicable. In-Field Examinations FCMs

1. Each DSRO must ensure that all FCMs that carry customer accounts are subject to
   periodic examination by the DSRO. An examination must be conducted within nine to eighteen months of the as of date of the previous examination. Only FCMs that have an adequate financial position and who have demonstrated a history of strong compliance and risk management procedures may be considered for an examination cycle that exceeds fifteen months from the as of date of the previous examination. In making this file:///S|/Website%20Management/LegacyDataCopyasof2010-04-21/tm/letters/99letters/tm99-32.htm (2 of 5) [5/6/2010 7:12:27 PM]

CFTC Letter No. 99-32 determination, a DSRO may consider, among other things, whether an FCM has ever breached the net capital early warning level, reported a material inadequacy in internal controls, failed to maintain books and records on a current basis, or violated the segregation requirements. While in most circumstances FCMs must be subject to an examination at least once every fifteen months, DSROs will be permitted to extend the cycle to a total of eighteen months in order to provide flexibility for unexpected events or to vary examination dates as provided in paragraph 6.
2. Each examination must be of a sufficient scope as to satisfy the DSRO that the FCM is
in compliance with applicable capital, segregation, recordkeeping, and reporting rules.4 The scope of the review of other audit areas may vary between examinations; however, each financial and sales practice/compliance audit area must be subject to a detailed examination pursuant to the JAC s Joint Audit Program at least once every three examination cycles. The initial examination of newly registered FCMs must be a full scope audit.
3. In the first phase of each examination and as part of the review and evaluation of
internal controls, sufficient testing must be carried out to permit the DSRO to conclude whether the FCM s records are current with regard to: daily segregation calculations; monthly net capital computations; daily reconciliations of open commodity positions and the settlement account; monthly reconciliations of other control accounts; and posting of transactions and adjustments to account balances. These tests must normally be performed on a surprise basis, since advance notice may impair the effectiveness of the examination in determining that the records are prepared on a current basis. The DSRO s assessment of the timeliness of the preparation of the above records, as well as the promptness of the resolution of reconciling items, must be taken into consideration in setting the scope of the examination.
4. For each examination, the areas selected for detailed review must be tested in
accordance with the uniform audit guide developed by the JAC. The JAC audit programs must be used unless other audit programs have been filed with Division staff that provide the same coverage. SRO rules that are related, directly or indirectly, to Commission regulations must be addressed by audit procedures subject to this guidance. SRO rules not directly or indirectly related to or required by Commission regulations are not subject to this guidance, for example, collection of registered futures association fees.
5. DSROs must carry out in-field examinations of FCMs as of the most recent month-end
for which a net capital computation should have been available at the time fieldwork commences. A DSRO must notify the Division of any examinations that are not completed within five months of the inception of fieldwork.
6. DSROs must strive to vary the examination dates. At a minimum, a DSRO must vary
file:///S|/Website%20Management/LegacyDataCopyasof2010-04-21/tm/letters/99letters/tm99-32.htm (3 of 5) [5/6/2010 7:12:27 PM]

CFTC Letter No. 99-32 the as of date of a member-FCM after two consecutive as of dates are the same. Furthermore, an FCM s examination date must not be its fiscal year-end date except in unusual circumstances or where the objective of the examination is to ascertain the quality of the certified public accountant s examination. DSROs also must vary as of dates to ensure that they do not always coincide with quarterly reporting dates.
7. DSROs that have incorporated the Commission s segregation rules into their own rules
(either directly or by reference) and discover serious apparent violations of those rules must take appropriate remedial and/or punitive action against the FCM and must promptly notify the Commission of such violations and the actions taken. DSROs that do not have their own segregation rules must promptly notify the FCM and Commission whenever it discovers that a member-FCM committed an apparent violation of the Commission s segregation rules. Scope Setting
8. Complete documentation of the scope setting process must be included in the DSRO s
examination workpapers in the form of a scope memorandum and appropriate supporting documentation. The scope of each examination must initially be determined after taking into consideration all information available on the FCM, including particularly that obtained pursuant to the procedures specified in the Joint Audit Program Risk Based Scope Rationale. If material weaknesses or apparent violations of SRO or Commission rules are discovered during the course of the examination, the DSRO must modify the scope of the examination, where appropriate.
9. The scope of each examination may vary depending on the nature and extent of the
FCM s proprietary business, the nature and extent of its customer business, and the strength of its internal controls as identified through ongoing oversight by the DSRO and through the scope setting process. The examination should focus on those areas identified as potential exposures or weaknesses, and possible violations of SRO or Commission rules identified during the scope setting process, and should only defer detailed examinations of those areas identified during the scope setting process as unlikely to have exposures or weaknesses. The assessment of internal controls must include a review and evaluation of the procedures followed by an FCM in evaluating and minimizing the financial risk to the FCM and its customers. The assessment must take into account the types, size and concentration of customer, non-customer, and proprietary transactions, positions, and commitments the FCM carries, on exchange and off-exchange both domestic and foreign. Each examination must be of sufficient scope to satisfy the DSRO that the member-FCM is complying with the applicable capital, segregation, recordkeeping, and reporting requirements, and that the DSRO has carefully examined those areas identified during the scope setting process as potential weaknesses. file:///S|/Website%20Management/LegacyDataCopyasof2010-04-21/tm/letters/99letters/tm99-32.htm (4 of 5) [5/6/2010 7:12:27 PM]

CFTC Letter No. 99-32
FOR FURTHER INFORMATION CONACT: John C. Lawton, Deputy Director of the Division of Trading and Markets, Commodity Futures Trading Commission, Three Lafayette Centre, 1155 21st Street, N.W., Washington, D.C. 20581. Telephone (202) 418- 5490. Issued in Washington, D.C. on August 20, 1999, by the Division of Trading and Markets. 1 Financial and Segregation Interpretation No. 4-1 Advisory Interpretation for Self-Regulatory Organization Surveillance Over Members Compliance With Minimum Financial, Segregation, Reporting, and Related Recordkeeping Requirements, Comm. Fut. L. Rep (CCH) ¶7114A (Division of Trading and Markets, July 29, 1985). 2 Addendum to Division of Trading and Markets Financial and Segregation Interpretation No. 4-1 - RE:
Self-Regulatory Organizations Sales Practice Audit and Compliance Responsibilities, Comm. Fut. L. Rep. (CCH) ¶7114C (Division of Trading and Markets, September 3, 1993); and, Addendum B to Division of Trading and Markets Financial and Segregation Interpretation No. 4-1: Coordinating Financial Rule Enforcement Programs Conducted by Self-Regulatory Organizations Over Dually￾Registered Firms, Comm. Fut. L. Rep. (CCH) ¶7114D (Division of Trading and Markets, October 31, 1995). 3 The JAC is comprised of representatives of the audit and financial surveillance departments of the SROs. 4 In this context, the term segregation includes foreign secured amount as that term is used in Part 30 of the Commission s regulations. file:///S|/Website%20Management/LegacyDataCopyasof2010-04-21/tm/letters/99letters/tm99-32.htm (5 of 5) [5/6/2010 7:12:27 PM]