Quick Answer
A separate FINRA requirement forces a firm to test and verify that its own written supervisory procedures (WSPs) actually work, then report the results to senior management every year. A companion certification rule goes further up the chain: the CEO must certify annually, after meeting with the Chief Compliance Officer (CCO), that the firm has processes to build, review, test, and update those procedures.
WSPs tell supervisors what to do. The supervisory control system and the CEO certification requirement check whether that system of supervision is itself working, first at the principal level, then at the CEO level.
How Is Supervisory Control Testing Different from WSPs?
- WSPs tell supervisors what to do to supervise the firm's business
- Supervisory control procedures (SCPs) test and verify whether those WSPs are actually reasonably designed and working
- This is a "supervision of the supervisors" requirement: an independent check on the supervisory system itself, not a replacement for it
Exam Tip: Gotchas
Do not confuse WSPs with supervisory control procedures. WSPs are the instructions; supervisory control procedures are the audit of whether the instructions work.
What Must the Testing and Verification Cover?
- Each firm must designate one or more principals to establish, maintain, and enforce a system of supervisory control policies and procedures
- Those principals must test and verify that the firm's WSPs achieve compliance with applicable securities laws and FINRA rules
- Testing must address the firm's specific business activities and the risks associated with each, not a one-size-fits-all checklist
- Where testing identifies a gap, the firm must create or amend supervisory procedures to close it
What Goes in the Annual Report to Senior Management?
The designated principal(s) must submit a report to senior management no less than annually, covering:
- A description of the firm's system of supervisory controls
- A summary of test results and any significant exceptions identified
- Any additional or amended supervisory procedures created in response to those results
This keeps senior management aware of supervisory weaknesses and what the firm did about them, rather than leaving that knowledge with a single compliance principal.
What Does the CEO Have to Certify Each Year?
A companion FINRA requirement adds a certification duty at the top of the firm.
- Each broker-dealer must designate a Chief Compliance Officer (CCO)
- The firm's CEO (or equivalent officer) must certify annually that the firm has processes to:
- Establish written compliance policies and WSPs
- Maintain those policies and procedures
- Review and test them
- Modify them as business, regulations, or circumstances change
- Before certifying, the CEO must have held at least one meeting with the CCO in the preceding 12 months to discuss these processes
- The certification is due no later than the anniversary date of the prior year's certification
Exam Tip: Gotchas
The CEO certifies that the firm has processes to build and test its compliance program, not that the program is flawless or that no violation will ever occur. The certification is about process, and it depends on a documented CCO consultation, not a solo CEO sign-off.
What Should You Check on Exam Day?
- Know the chain: WSPs set the rules, supervisory control testing checks whether the rules work, CEO certification confirms the whole process exists at the top
- The supervisory control report goes to senior management, at least annually
- The CEO certification requires a CEO-CCO meeting in the prior 12 months and is due on the certification anniversary date, not a fixed calendar date