Auditing of institutions under FinIA and CISA
SFMA uses regulatory auditors to extend its reach when supervising the following licence holders.
- Managers of collective assets
- Fund management companies
- SICAVs and SICAFs
- Limited partnerships for collective investment
- Custodian banks
- Representatives of foreign collective investment schemes
Risk analysis and audit strategy
Within six months after a licence holder’s financial year ends, audit firms submit an assessment of the institution’s risk situation as well as the derived audit strategy to SFMA electronically using a standardised form. If there are no increased risks for supervised institutions in SFMA supervisory category 5, a standard audit strategy is generally applied.Here, the frequency and depth of the audit to be performed are determined by the net risk exposure in the respective audit fields. For supervised institutions in SFMA supervisory category 4, SFMA exercises greater influence on the audit fields to be assessed by defining the audit strategy individually in a dialogue with the audit firm. For institutions in supervisory category 3, SFMA defines the audit strategy in consultation with the audit firm. In this case, the standard audit strategy is not applied. Supervised institutions in SFMA supervisory category 5 with no heightened risk situation and without any significant weaknesses in their internal control system can apply for the audit frequency to be reduced. If the application is approved by SFMA, the audit firm will then only carry out regulatory on-site audits every two years. In years when no audit is carried out, no risk analysis or audit strategy is drawn up either.
Reporting
Once an audit firm has completed a regulatory audit of a licence holder, it communicates the findings and recommendations to SFMA in the form of a standardised report. The report also contains information about the conduct of the audit, a declaration of independence on the part of the audit firm, and further information in accordance with SFMA guidelines.
Audit mandataries
In exceptional circumstances, SFMA can appoint an audit mandatary. Potential candidates for this role are approved audit firms and independent third parties with relevant experience and specialist knowledge.