Quick Answer
Broker-dealer controls separate functions and supervisory responsibility so no inappropriate concentration of control can undermine compliance. Information barriers limit information flow between departments, while physical and systems access controls limit entry to buildings, spaces, files, and systems. Entitlement policies identify who has authorized access to particular information and resources.
An effective control framework puts the right responsibility, information, and access with the right people. The controls overlap in purpose but address different risks.
Separating Functions and Supervision
- Segregation of duties: Separates functions and supervision among broker-dealer departments so control responsibility is not concentrated inappropriately.
- A reasonably designed supervisory system assigns supervisory responsibility and uses written procedures to support compliance.
- Designated principals establish, maintain, and enforce supervisory-control policies and procedures that test and verify the firm's written supervisory procedures.
Control logic: concentrated authority -> weaker independent review -> greater compliance risk. Separating functions and supervisory responsibility creates a check on the process.
Think of it this way: A transaction should not depend on one person acting as both the worker and the checker. Separating the functions gives a second control point a chance to identify a problem before it affects the firm or a customer.
Exam Tip: Gotchas
- Segregation of duties addresses how work and supervision are divided. It is not the same control as limiting who can view a file or enter a system.
- A supervisory system needs assigned responsibility and written procedures. An informal expectation that employees will monitor one another is not the described control structure.
Information Barriers
- Information barriers: Controls that separate information among broker-dealer departments.
- Their focus is the flow of information between departments.
- They help keep information in the appropriate part of the organization rather than making it generally available across the firm.
Physical and Systems Access Controls
- Access controls: Controls over access to buildings, office spaces, files, and systems.
- Entitlement policies: Policies that specify authorized access to files and systems.
- Restrictions on access to information: Limits on who may access information.
| Control | Core question it answers |
|---|---|
| Information barrier | May information flow between departments? |
| Access control | May a person enter a building, space, file, or system? |
| Entitlement policy | Which files and systems is a person authorized to use? |
Exam Tip: Gotchas
- Information barriers control information flow. Entitlement policies and related access restrictions control who may access physical locations, files, and systems.
- A fact pattern about credentials, permissions, files, or system entry points to access controls, even if the information involved is sensitive.