Proving the Exchange Can Access Reserves
To prevent an exchange from claiming the balances in arbitrary wallets as their reserve, we need to prove access. This can be done through a satoshi test or the generation of a custom transaction with invalid inputs.
Satoshi Test
The exchange announces a date in the future, an address, and an amount of money. If the transaction occurs, it shows spending control (or influence) over the wallet. It will generally be a small amount (like a satoshi), and the "to" address could also be one they own. Only the transaction fee is the cost for the exchange. This can be done once per wallet, with a repeat or requested modification to the payment anytime there is sufficient scepticism.
Custom Transactions
It's also possible to create a transaction which can prove ownership without enabling the spending of money, by leaving some of the inputs in the transaction invalid. Experienced cryptographers will be able to validate the legitimacy of the transaction. In this case, the exchange would be able to keep the transaction fees. However, this method is much harder for people to validate as it requires specialized knowledge. This opens the possibility that the transaction might not be properly checked, and may not work to convince less technical users.
Note: Neither method proves that the exchange is the only one with access to the wallet. It's possible that the true owner of the wallet is someone else they have influence over, the wallet is shared, or the private key is already compromised. Wallet access should already be secured by methods such as air-gap, multi-sig, and/or controlling access to information.