With the registration framework and exemptions covered, the final piece is the adviser's obligation to supervise the people who actually deliver advice to clients: the investment adviser representatives (IARs).
Quick Answer
Registered investment advisers (state- or SEC-registered) must establish, maintain, and enforce written supervisory procedures reasonably designed to prevent and detect IAR violations. Adopting a policy is not enough; it must actually be enforced. An adviser can be liable for an IAR's violation even without personal knowledge of it, since failure to supervise is the issue.
What Is the Supervision Obligation?
Registered investment advisers (state- or SEC-registered, under the applicable compliance rule) are responsible for supervising the activities of their IARs. This is not optional; it is a fundamental regulatory requirement.
Core supervisory duties:
- Establish written supervisory procedures
- Maintain those procedures on an ongoing basis
- Enforce the procedures through regular oversight and review
The supervisory system must be reasonably designed to prevent and detect violations of securities laws. "Reasonably designed" does not mean the system must catch every violation, but it must represent a genuine, thoughtful effort to oversee IAR conduct.
Think of it this way: The adviser is like a restaurant owner who hires servers. If a server gives a customer bad advice about allergens, the owner can be held responsible for not having proper training and oversight in place. The owner does not need to watch every table, but there must be a real system to catch problems.
What Must Written Policies and Procedures Cover?
Under the NASAA Model Rule for Written Policies and Procedures, state-registered advisers must:
- Adopt written compliance and supervisory policies and procedures, designate a chief compliance officer, and review them at least annually
- Implement those policies in day-to-day operations
- Ensure policies address the model rule's minimum categories, including:
- Proxy voting
- Physical security, cybersecurity, and client privacy safeguards
- A code of ethics, including handling of material nonpublic information
- Business continuity and succession planning
- Portfolio management, trading, advertising, and custody procedures are also commonly tested as part of a firm's broader compliance grid, though they are not separately enumerated minimum categories under the rule
Exam Tip: Gotchas
- Written procedures must be both adopted AND implemented. Simply having a policy on paper is not enough; the adviser must put those policies into practice in day-to-day operations.
When Is the Adviser Liable for IAR Conduct?
| Scenario | Adviser Liability |
|---|---|
| IAR violates securities laws | Adviser may be liable for the IAR's actions |
| Adviser had adequate supervisory procedures in place and enforced them | May provide a defense against liability |
| Adviser failed to establish or enforce supervisory procedures | Increases exposure to vicarious liability |
Exam Tip: Gotchas
- Having written procedures on file is not enough. The adviser must also enforce them. A compliance manual sitting in a drawer with no reviews or follow-up on red flags does not meet the supervision standard.
- Advisers can be held liable for IAR violations even if they did not know about them. Failure to supervise is the issue, not personal knowledge of the violation.
- "Reasonably designed" is the standard, not perfection. The system must represent a genuine effort to prevent and detect violations.
What Should You Check on Exam Day?
- Can you name the three supervisory duties: establish, maintain, and enforce written procedures?
- Do you know why "reasonably designed" does not mean the system must catch every violation?
- Can you list what a state-registered adviser's written policies and procedures must cover under the NASAA model rule?
- Do you know why adopting a written policy without implementing it fails the supervision standard?
- Can you explain why an adviser can be liable for an IAR's violation even without personal knowledge of it?