FINRA Rule 4140

Where Rule 17a-5 establishes the baseline mandatory annual audit requirements applicable to all registered broker-dealers as a matter of routine, Rule 4140 provides FINRA with the specific authority to compel an ad hoc, targeted audit or examination at any point in time when financial integrity concerns arise, regardless of whether the member's annual audit cycle is underway or recently completed.

Rule 4140 sits within the 4100 Financial Condition subsection of the 4000 Financial and Operational Rules series. It was adopted by SR-FINRA-2008-067 effective February 8, 2010 as part of the consolidated financial responsibility rules. Regulatory Notice 09-71 announced its adoption. The rule has not been amended since its adoption and contains no supplementary materials, reflecting its straightforward enabling function within the broader financial oversight architecture.

The Annual Audit Requirement: SEC Rule 17a-5 as the Foundation

Rule 4140 cannot be understood without first appreciating the mandatory annual audit framework established by SEC Exchange Act Rule 17a-5 — the rule that governs the periodic financial reporting and audit obligations of all registered broker-dealers as a matter of routine. Rule 17a-5 requires every registered broker-dealer to file an annual report with the SEC and FINRA within sixty calendar days of its fiscal year end, though the SEC may grant extensions of up to ninety days in limited circumstances. The annual report package consists of a financial report containing audited financial statements — including a statement of financial condition, a statement of operations, a statement of cash flows, and a statement of changes in ownership equity — prepared in accordance with U.S. generally accepted accounting principles and certified by an independent public accountant registered with the Public Company Accounting Oversight Board.

The PCAOB registration requirement for the independent public accountant is significant. Following the Sarbanes-Oxley Act of 2002, which created the PCAOB to oversee audits of public companies, the SEC extended PCAOB oversight to broker-dealer audits as well, recognizing that the integrity of broker-dealer financial statements is systemically important in ways that parallel the public company context. All broker-dealer audit engagements must be conducted under PCAOB auditing standards, and the independent public accountant must be in good standing with the PCAOB throughout the engagement. Auditors that are not PCAOB-registered, or whose PCAOB registration has been suspended or revoked, cannot conduct broker-dealer audits — a restriction that FINRA examinations will verify when reviewing a member's annual audit compliance.

In addition to the financial report, Rule 17a-5 requires broker-dealers to file either a compliance report or an exemption report depending on whether they are subject to the customer protection requirements of Exchange Act Rule 15c3-3. A carrying firm that holds customer assets files a compliance report — signed by a senior officer — stating that the firm has established and maintained internal controls over compliance with the financial responsibility rules and identifying any material weaknesses identified. An introducing firm exempt from Rule 15c3-3 files an exemption report asserting its continued qualification for the exemption. The independent public accountant must examine the compliance report or review the exemption report and issue a separate report on those findings. This dual reporting structure — financial statement audit plus compliance or exemption report examination — produces the comprehensive annual financial oversight package that Rule 17a-5 envisions.

Rule 17a-5 also requires that broker-dealers notify the SEC and FINRA of their independent public accountant engagement by filing a Rule 17a-5(f)(2) Statement no later than December 10 of each year. Regulatory Notice 14-39 announced the availability of an electronic filing template through FINRA Gateway for this purpose. Where a broker-dealer changes its independent public accountant, the notification requirements are more detailed — the outgoing accountant must furnish a letter to the SEC stating whether any disagreements existed on accounting matters or financial statement disclosures during the most recent eighteen-month period. These change-of-auditor provisions mirror the requirements applicable to public company registrants and reflect the same concern about auditor shopping and suppression of adverse audit findings.

Beginning with reports filed on or after January 1, 2026, all Rule 17a-5 filings for the SEC must be submitted electronically through EDGAR — paper filings are no longer accepted under any circumstances. This modernization, implemented through 2025 SEC amendments to Rule 17a-5 and confirmed by FINRA guidance, applies to all annual audited financial statements, compliance reports, exemption reports, and associated accountant reports. Manual wet signatures and mailed submissions, which some firms had historically used through outside auditors, must be replaced with fully electronic EDGAR-compliant processes. Both manual and electronic signatures are permitted for reports filed on or after January 1, 2026, eliminating the prior ambiguity about whether electronic signatures were acceptable.

FINRA's Directed Audit Authority Under Rule 4140(a)

Against this backdrop of mandatory annual audits under Rule 17a-5, Rule 4140(a) grants FINRA a separate and independent authority to direct any member to obtain an additional audit or examination at any time when concerns arise about the accuracy or integrity of the member's financial statements, books and records, or prior audited financial statements. Three features of this authority deserve careful attention.

First, the authority is triggered by concerns about accuracy or integrity — a standard that encompasses both innocent error and deliberate manipulation. A member whose FOCUS reports show unusual fluctuations inconsistent with its apparent business activities, a member whose books and records show significant discrepancies during a FINRA examination, or a member whose prior audited financial statements appear to have contained material misstatements are all potential subjects of a Rule 4140(a) directed audit. FINRA does not need to establish that fraud has occurred — the existence of credible concerns about the reliability of financial information is sufficient.

Second, the authority extends to three distinct categories of financial information: the member's financial statements generally, its books and records, and specifically its prior audited financial statements. The explicit inclusion of prior audited financial statements is significant. An annual audit under Rule 17a-5 produces a snapshot of the firm's financial condition at fiscal year end, certified by an independent accountant. If subsequent information calls into question whether that certification was accurate — whether the financial statements as audited fairly presented the firm's condition — Rule 4140 enables FINRA to direct a fresh examination focused on the period covered by the prior audit, without waiting for the next annual cycle.

Third, the authority is exercised by FINRA's Executive Vice President charged with oversight for financial responsibility, or their written officer delegate. This senior-level authorization requirement ensures that Rule 4140 directed audits are not initiated on a casual or routine basis — they represent a considered exercise of supervisory authority by the FINRA official with primary responsibility for member financial condition. The requirement for written delegation of authority means that any exercise of Rule 4140 authority by an officer delegate is documented and traceable.

The form of the required examination is flexible. Rule 4140(a) allows FINRA to direct either a full audit by an independent public accountant or an examination in accordance with attestation, review, or consultation standards prescribed by the American Institute of Certified Public Accountants. The flexibility to direct a review or consultation engagement rather than a full audit allows FINRA to calibrate the scope of the required examination to the nature of the concern — a targeted review of specific account reconciliations or specific transactions may be more proportionate and timely than a full annual-scope audit when the concern is focused on a particular area of the firm's records. The audit or examination must be conducted in accordance with such requirements as FINRA may prescribe, giving FINRA authority to specify scope, methodology, and reporting format for the directed engagement.

The Late Filing Penalty

Rule 4140(b) provides the enforcement mechanism for the timely filing obligation: any member failing to file an audited financial and operational report or examination report under this rule in the prescribed time is subject to a late fee as set forth in Schedule A Section 4(g)(1) to the FINRA By-Laws. The late fee provision applies to reports required under Rule 4140, not to the routine annual FOCUS report filings under Rule 17a-5, which carry their own penalty provisions. However, in practice the late fee consequences of Rule 4140 are rarely the primary concern when a member fails to comply with a directed audit — a member that has been directed to obtain an audit due to financial integrity concerns and then fails to do so promptly faces the more serious risk of examination escalation, Rule 9557 proceedings, and potential business restriction under Rules 4110 and 4120 if the financial condition concerns that prompted the directed audit remain unresolved.

Connection to the Financial Responsibility Framework

Rule 4140 fits within the 4100 Financial Condition subsection alongside Rules 4110, 4120, and 4130 as part of FINRA's layered financial oversight architecture. The relationship between the rules is sequential and complementary. FINRA Rule 4521 — Notifications, Questionnaires and Reports — provides FINRA with the routine FOCUS report data from which financial condition monitoring occurs between examinations. When that monitoring identifies concerns, FINRA's examination program provides the first-line investigative response. When examination findings raise more serious questions about the accuracy or integrity of a member's financial reporting — questions that go beyond what a regulatory examination can resolve — Rule 4140 provides the authority to require independent professional verification through an audit or accountant examination.

The interaction with FINRA Rule 4110 is particularly important in practice. A member whose net capital adequacy is in question — whose capital position may be misrepresented through inaccurate financial records — presents exactly the type of concern that Rule 4140 is designed to address. An accurate net capital determination is the foundation of every obligation in Rules 4110 and 4120. If the financial records underlying that determination are unreliable, the entire financial responsibility framework rests on a compromised base. Rule 4140's directed audit authority enables FINRA to restore confidence in the accuracy of a member's financial reporting before making consequential determinations about business restriction or suspension.

The independence requirement for the accountant performing a Rule 4140 directed audit is governed by SEC Rule 17a-5(f)(3), which requires compliance with the independence standards of Rules 2-01(b) and (c) of Regulation S-X. An accountant that has a financial interest in the member, is employed by the member, or has other relationships that compromise independence cannot conduct a Rule 4140 directed audit. This independence requirement ensures that the verification function of the directed audit is genuine — a compromised auditor could validate inaccurate financial statements just as readily as the firm's own personnel, defeating the purpose of the independent examination.

Examination Relevance and Key Takeaways

FINRA Rule 4140 is tested on the Series 27 Financial and Operations Principal examination as part of the financial responsibility and audit compliance framework. Series 24 General Securities Principal candidates encounter the rule in the context of supervisory oversight of financial reporting and the broader relationship between FINRA's examination authority and members' annual audit obligations. The rule's connection to SEC Rule 17a-5 makes it relevant to any examination covering broker-dealer financial reporting requirements, including the annual audit obligation, the PCAOB registration requirement for auditors, and the compliance and exemption report framework.

The key points to retain are these: FINRA Rule 4140 grants FINRA authority to direct any member at any time to obtain an independent audit of its accounts or an AICPA-standard examination when FINRA has concerns about the accuracy or integrity of the member's financial statements, books and records, or prior audited financial statements; the authority is exercised by FINRA's Executive Vice President for financial responsibility oversight or a written officer delegate, and the audit or examination must be conducted in accordance with FINRA's prescribed requirements; Rule 4140 operates alongside and supplements the routine mandatory annual audit obligation of SEC Exchange Act Rule 17a-5, which requires all registered broker-dealers to file annual audited financial statements and either a compliance report or an exemption report within sixty calendar days of fiscal year end, with the independent public accountant required to be registered with the PCAOB and the engagement conducted under PCAOB auditing standards; beginning January 1, 2026, all Rule 17a-5 filings must be submitted electronically through EDGAR with no paper filings accepted, and both manual and electronic signatures are permitted; broker-dealers must notify the SEC and FINRA of their independent public accountant by filing a Rule 17a-5(f)(2) Statement no later than December 10 of each year; any member failing to file an audited report or examination report under Rule 4140 in the prescribed time is subject to a late fee under Schedule A Section 4(g)(1) of the FINRA By-Laws; and the directed audit authority of Rule 4140 is most significant in the context of financial condition concerns that implicate the accuracy of the net capital determinations underlying Rules 4110 and 4120, where independent verification of a member's financial records is essential before FINRA can make reliable determinations about business restriction or suspension requirements.