ICI Releases Updated Framework for Financial Intermediary Controls and Compliance Assessment (FICCA) Engagements

[32658]

August 5, 2020 TO: ICI Members
Investment Company Directors
Accounting/Treasurers Committee
Bank, Trust and Retirement Advisory Committee
Broker/Dealer Advisory Committee
Compliance Advisory Committee
Operations Committee
Small Funds Committee
Transfer Agent Advisory Committee SUBJECTS: Audit and Attest
Compliance
Distribution
Intermediary Oversight
Operations
Recordkeeping
Transfer Agency RE: ICI Releases Updated Framework for Financial Intermediary Controls and Compliance Assessment (FICCA) Engagements

 

Today, the Investment Company Institute (ICI) is releasing an updated framework for Financial Intermediary Controls and Compliance Assessment (FICCA) engagements designed to assist mutual funds with their oversight of intermediaries providing shareholder and recordkeeping services.  This is the third update to the FICCA framework since its initial release in 2008.

2020 FICCA enhancements

A working group of ICI members, representatives of the national accounting firms and the American Institute of Certified Public Accountants (AICPA), and intermediaries reviewed the FICCA framework in response to AICPA’s introduction of its Statement on Standards for Attestation Engagements, Version 18 (SSAE-18). The working group’s review was intended to enhance the performance of future engagements for the benefit of intermediaries and practitioners and improve the reports issued to promote broader use by funds, while ensuring the framework aligned with AICPA guidelines.

The review of the FICCA framework did not alter the list of 17 previously-identified areas of focus, however, it did result in a variety of technical enhancements that have been incorporated into the 2020 framework as follows:

• All terminology was updated to align with AICPA definitions under SSAE-18, including identification of the applicable attestation standards as well as references to key parties of and reports resulting from various attestation examination engagements used to satisfy the FICCA framework.

• The framework more clearly separates areas of focus into two parts. The first part includes 14 “control” areas, where the service organization (financial intermediary) has implemented controls that are tested by the practitioner (independent auditor) to determine whether they were suitably designed and are operating effectively to achieve the related control objectives.  The second part covers three “information” areas where the service organization provides background information about its business environment. Information areas do not typically include controls so practitioner testing is not completed, and responses are not considered part of the practitioner’s final report. 

• Subservice organizations (third-party vendors) are increasingly important in delivery of services that are relevant to FICCA areas of focus. The “Third-party oversight” information area of focus reiterates the need, at minimum, to discuss oversight of all relevant subservice organizations—including identification of any significant situation whereby a subservice organization does not meet expected shareholder servicing standards.

• Language was added to the “Consideration for Response” (formerly “Points to Consider”) in the “Transaction processing – financial and nonfinancial” section (Control Area 9) to incorporate compliance with fund money market policies and guidelines under Securities and Exchange Commission (SEC) rule 2a-7.

• The “Sample Management’s Assertion” section now includes “Appendix A: Template for Describing Test of Controls and Results” to organize management’s documentation of controls for the 14 control areas of focus.

• The potential reporting mechanisms within the FICCA framework and related “Mapping Template for Control Reports” were updated to reflect reports from engagements under AT-C 205 (formerly called “FICCA report”) or Type 2 SOC 1 under AT-C 320 and the SOC 1 Guide report (formerly called “AT 801 report”). The column referencing “Third-party vendor AT 801 report” was deemed unnecessary and removed since the two reporting mechanisms remaining apply to service organizations and subservice organizations.

Retaining flexibility and efficiency

A key goal of the working group continues to be preserving flexibility for intermediaries when responding to the 14 control areas of focus of the framework (Areas 4-17) where controls are subject to practitioner testing. Because intermediaries may complete other examination attestation engagements under AT-C 205 or AT-C 320 in which certain controls that are applicable to the framework are already tested, an intermediary may cover the information and control areas of focus through one comprehensive report (e.g, a report resulting from an engagement under AT-C 205 addressing all FICCA control areas of focus), or a combination of reports (e.g., reports resulting from engagements under AT-C 205 and AT-C 320), where each control area of focus is fully addressed within one of the reports. The three information areas of focus (Areas 1-3) continue to be addressed outside of the practitioner’s reports under SSAE-18 guidelines or are treated as other information when provided with a report resulting from an engagement under AT-C 205.

Immediate adoption encouraged

Practitioners and intermediaries should begin using this updated framework to guide all new FICCA-related engagements. Any existing engagements initiated but not yet completed under the December 2015 framework, including any reports from the related examination attestation engagements, may be completed under either the 2015 or 2020 version.

We wish to extend our appreciation to the members of the ICI FICCA working group and AICPA representatives that contributed to this effort. Please direct any questions or comments about the FICCA documentation to Jeff Naylor, ICI Director, Operations and Distribution at jeff.naylor@ici.org or 202-326-5844 or Greg Smith, ICI Senior Director of Fund Accounting, at smith@ici.org or 202-326-58

 

Martin A. Burns
Chief Industry Operations Officer