Pursuant to Section 76 of the Investment Firm Act (Wertpapierinstitutsgesetz – WpIG), small and medium-sized investment firms, as defined in the WpIG, are required to have their annual accounts audited by an external auditor. The audit report must be submitted to BaFin and the Bundesbank immediately after the audit has been completed. Pursuant to Section 78(6) WpIG, BaFin has adopted a regulation that contains, amongst other things, more detailed requirements regarding the subject of the audit by the external auditor, when it is to be conducted, and the form and content of the audit reports. The auditor must comply with these requirements.

The Investment Firm Audit Report Regulation (Wertpapierinstituts-Prüfungsberichtsverordnung – WpI-PrüfbV) stipulates that, in addition to the audit report, the auditor also submits four annexes that form an integral part of the audit report. These annexes contain specific information, structured as follows:

• Annex 1 provides a data overview with organisational and financial information on the institution.
• Annex 2 documents the business activities and processes outsourced by the institution to external service providers.
• Annex 3 contains information on risk factors resulting from the risk analysis pursuant to Section 27 WpI-PrüfbV as well as information on the classification of findings pertaining to money laundering/terrorist financing and criminal activity pursuant to Section 33 WpIG that were identified during the audit.
• Annex 4 comprises all other audit findings not already listed in Annex 3.

The annexes must be completed carefully by the auditor and must be attached to the audit report so as to ensure complete and rule-compliant documentation.