Supervisory Control System

If the supervisory system requirement is the supervisory rulebook, the internal supervisory controls requirement is the audit of that rulebook. The exam pairs the two rules constantly: a firm that has written supervisory procedures (WSPs) but never tests them violates the testing duty, even if the supervisory system is fully satisfied on paper.

Required Testing and Verification

Each member must establish, maintain, and enforce a system of supervisory control policies and procedures that:

• Test and verify the firm's supervisory procedures are reasonably designed to achieve compliance with applicable laws and FINRA rules
• Create additional or amended procedures when testing or verification identifies the need

The rule does not prescribe a specific testing methodology. Firms have flexibility to choose how the testing is done, subject to two principles:

• Risk-based methodologies and sampling are permitted (a firm need not test every transaction or every supervisor)
• Self-assessments, internal audits, or inspection processes may satisfy the testing requirement in whole or part if they adequately verify the WSPs

Think of it this way: The internal supervisory controls requirement lets the firm pick its testing tools but holds it accountable for the result. A bank-style internal audit program satisfies the testing duty; a small firm's quarterly compliance review of a sample of trades also satisfies it. What a firm cannot do is skip testing and assert that the WSPs work because nobody has complained.

Exam Tip: Gotchas

• The annual report cannot stand in for the testing. A firm that runs no testing all year and then writes one summary report at year-end has not met the rule. The report must summarize test results, and without testing there are none. The rule sets no testing calendar; it requires the testing itself.

Annual Report to Senior Management

A designated principal must submit a report to the firm's senior management not less than annually. The report must detail:

• The firm's system of supervisory controls
• Summary of test results and significant identified exceptions
• Additional or amended supervisory procedures created in response to testing

The report goes to senior management, not to the board (the board and audit committee, or equivalent bodies, receive the CEO certification's supporting report, a different document, at their next scheduled meetings or within 45 days of the certification, whichever is earlier).

Exam Tip: Gotchas

• The internal supervisory controls report goes to senior management; the CEO certification report goes to the board and audit committee. The exam will sometimes test which document goes where. Senior management gets the operational testing detail; the board and audit committee get the CEO certification of process integrity.

Enhanced Content for Larger Firms

Firms reporting $200 million or more in gross revenue on the prior calendar-year FOCUS report must include additional specified content in the internal supervisory controls report. The threshold is the trigger for the larger-firm enhanced disclosure regime; smaller firms have a streamlined report.

The additional content comprises:

• A tabulation of customer-complaint and internal-investigation reports made to FINRA during the preceding year
• Discussion of the preceding year's compliance efforts, including procedures and education, in trading and market activities, investment banking, antifraud and sales practices, finance and operations, supervision, and anti-money laundering, to the extent applicable

Every firm's base report still includes testing results, significant identified exceptions, and responsive procedure changes. Those duties are not limited to larger firms.

Exam Tip: Gotchas

• The $200 million threshold is gross revenue, not net revenue or net income. It comes from the prior calendar-year FOCUS report. A firm that crosses $200 million in any year picks up the enhanced content requirement for the following year's internal supervisory controls report.

How the Three Supervisory Layers Fit Together

The three rules form a single supervisory program. The Series 24 exam treats them as a stack:

Think of it this way: The supervisory system requirement builds the supervisory machine. The internal supervisory controls requirement measures whether the machine still runs. The CEO certification requirement has the CEO sign their name to the maintenance log. Each rule depends on the layer below; no one rule satisfies any other.

Exam Tip: Gotchas

• A firm can satisfy the supervisory system rule and still violate the testing duty. Perfect WSPs that are never tested fail the testing duty. The exam favors fact patterns where the firm has the right written procedures but cannot show that anyone ever verified the procedures were followed.
• A firm can satisfy both the supervisory system rule and the testing duty and still violate the CEO certification requirement. Even a tested supervisory system fails if the CEO never signs the annual certification or never meets with the CCO. The certification is not just paperwork; it is the rule's enforcement hook.

What Should You Check on Exam Day?

• Do you know that the internal supervisory controls report must summarize actual test results, so a year-end report with no testing behind it cannot satisfy the rule?
• Can you distinguish the internal supervisory controls report, sent to senior management, from the CEO certification report, sent to the board of directors and audit committee?
• Do you know the gross-revenue threshold that triggers enhanced report content, $200 million or more on the prior calendar-year FOCUS report?
• Can you explain why risk-based sampling, rather than testing every transaction, satisfies the internal supervisory controls testing requirement?