Prepare now for custody rule's mandated surprise review
The Securities and Exchange Commission finalized amendments to Rule 206 (4)-2 (the Custody Rule) under the Investment Advisers Act of 1940 in December 2009. The final rule became effective as of March 12, 2010.
Recent fraud cases had propelled the SEC to amend its previous Custody Rule by providing “additional safeguards” under the Advisers Act. The amendments state that when a registered adviser has custody of client funds or securities, the adviser, among other things, is required to:
“Undergo an annual surprise examination by an independent public accountant to verify client assets; to have the qualified custodian maintaining client funds and securities send account statements directly to the advisory clients; and unless client assets are maintained by an independent custodian (i.e., a custodian that is not the adviser itself or a related person), to obtain, or receive from a related person, a report of the internal controls relating to the custody of those assets from an independent public accountant that is registered with and subject to regular inspection by the Public Company Accounting Oversight Board … These amendments … will provide for a more robust set of controls over client assets designed to prevent those assets from being lost, misused, misappropriated or subject to advisers’ financial reverses.”
Registered Investment Advisers (RIAs) are now required to begin the surprise examination on or before Dec. 31, 2009. If the RIA also acts as a qualified custodian, the first surprise examination must start no later than six months after the adviser receives the report of internal controls.
As the amended Custody Rule remains fairly new, and as implementation of the rule continues for RIAs, preparation soon is key to a smooth surprise examination by the independent auditors.
As the SEC has instructed, independent public accountants must perform custody audits without prior notice to the RIA, on a surprise date which must vary from year to year. Keeping that in mind, here are a few steps RIAs can take now to be better prepared for the surprise examinations, which are scheduled to begin on or before Dec. 31, 2009:
- Determine accounts you are deemed to have custody of under the amended rule. The scope of the surprise examination is limited to client accounts for which an RIA deems they have “custody” in accordance with the definition contained in the amended rule. RIAs should continuously assess the status of accounts held at qualified custodians to ensure whether they continue to meet the definition of “custody.”
- Begin sending out client statements. RIAs should make arrangements with their qualified custodian to be notified (e.g. via e-mail), when account statements are sent from the qualified custodian to clients. This notification will help form the basis of the RIA’s reasonable belief that the qualified custodian provides statements to their clients.
- Consider pooled investment vehicles. Early on, the RIA should identify those pooled investment vehicles where the expectation is that the audited financial statements will not be issued within 120 days (or 180 days for fund of funds) after the end of the entity’s fiscal year. These pooled investment vehicles should be included in the scope of the surprise examination and the RIA should ensure the qualified custodian sends a statement of holdings and transactions to each investor in the pooled investment vehicle at least quarterly.
- Enter into a written agreement with an independent public accountant registered with the Public Company Accounting Oversight Board (PCAOB) and subject to regular inspection. The RIA must enter into a written agreement for the surprise audit with an independent public accounting firm.
With regard to the annual audit of a pooled investment vehicle, surprise examination of an RIA that maintains client assets with a qualified custodian that is a related person of the RIA (or the RIA itself) and the preparation of the internal control report, it is particularly important for RIAs to inquire from their PCAOB-registered public accountant whether or not their firm is subject to regular inspection by the PCOAB. It is possible to be registered with the PCAOB, but not to be subject to regular inspection. (This requirement is meant to improve the quality of the audits performed by the independent public accountant.)
The written agreement must require the accountant to:
- File a certificate using Form ADV-E within 120 days of the unannounced examination date containing their report
- Notify the SEC of any material discrepancies noted during the exam within one business day
- Upon resignation, or dismissal, or other termination of the engagement, file a notice with the SEC within four business days and explain any problems encountered during the surprise examination
These requirements are meant to help the SEC identify any risks noted by the independent accountant in the investment advisers’ custodial practices that would require closer examination by the SEC. By making this filing available to the public, clients are also provided the opportunity to assess for themselves the reasons for the termination, or non-reappointment of the independent public accountant.
If applicable, the RIA must also enter into a written agreement for an internal control report to be provided by an independent public accounting firm, again required to be registered with both the PCAOB and subject to regular inspection for related qualified custodians. The internal control report should cover control objectives specifically related to custodial services.
- Notify clients of surprise examination. Although under the amended rule auditors are allowed to select a sample of accounts to be tested under the surprise examination, as a best practice the RIA should be sure their clients are up to date on the impact of the amended rule on the RIA and the possibility of their client account being tested as part of a surprise examination.
- Comply with policies and procedures. Other best practices to be included in your compliance policies and procedures include:
- Conduct background checks on employees of the adviser who have, or could have, access to client assets
- Require authorization from more than one person before moving assets, or changing ownership information
- Limit the number of people who interact with custodians and rotate those people
- If the adviser functions as qualified custodian, be sure to have appropriate segregation of duties between advisory and custodial personnel
Other means of notification include requiring that during the setup of a client account, the qualified custodian must send copies of the statements sent to the client to the RIA as well. For RIAs who still send statements to clients (even though not required to under the rule), they should include a notation in the statement asking the client to compare the statement received from the RIA to the statement received from the qualified custodian to better ensure all securities are accounted for.
With preparation and communication between RIAs and the independent auditors at all stages, surprise examinations can be completed within the 120-day period following the surprise audit date, in compliance with SEC amendments.
Colin Sanderson is a partner with RSM’s Financial Services Group.