Quick Answer
Segregation of duties separates functions and supervision among the firm's departments so control responsibilities do not concentrate. Procedures must bar self-supervision, reporting to subordinates, and subordinate control of pay or employment. When size or position prevents that, designated principals enforce controls that test the firm's supervisory procedures.
What Does Segregation of Duties Separate?
Segregation of duties separates functions and supervision among the departments of the broker-dealer. The purpose is to keep control responsibilities from concentrating in one person or one department, where an error or an unauthorized action can pass unnoticed.
The supervision requirements do not prescribe a fixed list of functions to separate. They require a supervisory system, procedures that prevent supervisory conflicts, and testing of the controls the firm designs. Each firm assigns responsibilities for its own business and states them in its written supervisory procedures.
Which Supervisory Duties Must Be Separated?
A firm's procedures must prohibit an associated person performing a supervisory function from:
- supervising that person's own activities; and
- reporting to, or having compensation or continued employment determined by, a person that the supervisor oversees.
Exam Tip: Gotchas
- The supervisory-separation rule has a documented exception. When firm size or the supervisor's position makes separation impossible, the firm documents why and how the alternative arrangement still provides compliant supervision.
How Must the Firm Review and Test Its Controls?
The firm's control structure must produce review evidence and test results.
| Control obligation | What the firm must do |
|---|---|
| Control testing | Designated principals establish, maintain, and enforce controls that test and verify whether written supervisory procedures are reasonably designed for the firm's and associated persons' activities to achieve compliance. |
| Corrective action | The firm creates or amends supervisory procedures when testing and verification identify a need. |
The related lesson on written supervisory procedures explains how the firm maintains those procedures. This lesson focuses on the control relationship: responsibilities are separated, principal reviews leave evidence, and designated principals test and verify whether the written supervisory procedures are reasonably designed for the firm's and associated persons' activities to achieve compliance.
How Do Information and Access Controls Differ?
Segregation of duties divides functions and supervision among departments. The other key controls answer different questions.
| Control | Core question |
|---|---|
| Information barrier | May information flow between departments? |
| Access control | May a person enter a building, office space, file, or system? |
| Entitlement policy | Which files and systems is a person authorized to use? |
| Information-access restriction | Who may access the information? |
Exam Tip: Gotchas
- Information barriers and entitlement policies control different risks. A barrier controls information flow between departments. An entitlement policy specifies a person's authorized files and systems.
What Should You Check on Exam Day?
- Read segregation of duties as separating functions and supervision among departments so control responsibilities do not concentrate.
- Require procedures that prohibit supervisors from supervising their own activities, reporting to people they supervise, or letting those people determine compensation or continued employment. If firm size or position makes separation impossible.
- Use designated principals to test and verify whether the written procedures are reasonably designed for the firm's and associated persons' activities to achieve compliance. Correct identified needs.
- Separate information flow controls from physical, file, and system access controls.