The Compliance Gaps Tripping Up Small Broker-Dealers in 2026
In its 2026 annual report, the PCAOB reviewed 103 broker-dealer audits performed by 61 firms and still found the same handful of problem areas showing up year after year, even as overall deficiency rates edged down. Here’s the odd part. Inspections are getting cleaner in aggregate, yet small broker-dealers keep tripping on the same wires.
Picture a composite scenario pulled straight from the inspection files: a modest introducing firm with a shared services agreement, a few registered reps, and an audit engagement that looked routine until the auditor’s revenue testing collapsed under scrutiny.
That one thread is worth pulling, because it touches almost every gap regulators are flagging this year.
Revenue Testing Is Still the First Domino to Fall
Revenue has topped the deficiency list for years, and 2026 is no different. In the example firm, the auditor sampled commission runs but never tied performance obligations back to the underlying contracts, and never tested the accuracy of the inputs feeding the revenue schedule. On paper the numbers reconciled, but the procedures behind them fell apart the moment an inspector started asking questions.
Small firms get hit here more often than large ones because revenue looks simple: a few commission streams, some 12b-1 fees, maybe a markup or two. Simple is not the same as tested. If the auditor can’t show they addressed the assessed risks of material misstatement for each significant revenue account, the engagement fails whether the balance was right or not.
Related Party Arrangements Quietly Do the Most Damage
Pull the thread on the introducing firm and a bigger issue appears: it shares office space, technology, and a compliance officer with an affiliated adviser. Allocations flow both ways. The PCAOB has been direct that these arrangements are where auditors most often miss the mark, both in testing how revenues and expenses get split and in evaluating whether the affiliate can actually pay what it owes.
Disclosure omissions compound the problem. When the audited financials describe the relationship in vague terms, or leave out the mechanics of the allocation entirely, the audit file has to explain why that was acceptable, and in most of these engagements it doesn’t.
Cybersecurity and Reg S-P Are Now Audit-Adjacent
The 2026 examination cycle folds in new obligations that were not on last year’s checklist. A Kroll overview of the FINRA Forward initiative notes that smaller entities have to comply with the amended Regulation S-P by June 3, 2026, meaning a written incident response program with customer notification procedures is no longer optional. Auditors are asking about it, and the answer belongs in the compliance file, not in a slide deck.
Getting Ahead of the Findings Before the Inspector Does
The through line in the example firm isn’t incompetence. It’s a small team stretched across a growing list of obligations, doing the work but not always documenting it the way an inspector needs to see it. Bringing in an audit partner that focuses on this niche, rather than a generalist, is often the difference between a clean report and a finding letter.
Firms that treat their broker-dealer audit as a year-round conversation, not a spring scramble, tend to see fewer surprises when the PCAOB report lands next June.
