Recordkeeping and Internal Controls: Make, Keep, and Protect
Make and keep
Rule 17a-3 tells a firm which books and records to create; Rule 17a-4 tells how long to keep them. Core records include the blotter, general and customer ledgers, order tickets, confirmations and statements, customer account documents such as new account cards and margin agreements, correspondence and communications, and complaint files. Electronic records must be preserved in a non-rewriteable, non-erasable format, indexed, and readily available for examination; a designated third party may store them if the firm can produce them on demand.
Retention periods
Blotters, ledgers, corporate records, and customer account records are kept six years, with the first two years readily accessible. Order tickets, correspondence, and communications are kept three years. Complaint records are kept four years. Records under subpoena or regulatory request cannot be destroyed even after the retention period has run.
Internal controls
The FINOP relies on controls such as segregation of duties, reconciliations, supervisory review, exception reports, and access restrictions to ensure records are accurate. The annual audit includes a report on internal accounting controls, and material weaknesses must be addressed.
Traps
The exam tests six versus three versus four years and the first-two-years-accessible rule. Another trap is assuming email is exempt; it is a communication subject to preservation. A third is thinking retention ends when an account closes; customer account records run six years after closure.
Worked example
A customer closes an account in 2020; the account records must be kept until 2026.