Chapter 8 - Monitoring (v1.2)

Compliance Department Role & Operations

• The Chief Compliance Officer (CCO) is responsible for building, implementing, and supervising monitoring systems to ensure the compliance department oversees all business activities.
• Both the compliance department and business line supervisors monitor adherence to internal and external standards
• Operational policies and procedures are implemented as part of the overall control environment
• The compliance department conducts specific monitoring through reviews and audits to check the effectiveness of supervisory procedures and adherence to policies and procedures
• These procedures prevent or detect violations through surveillance mechanisms.
• Client conduct is also monitored to prevent and detect issues like insider trading.
• The objectives of any monitoring or surveillance process are to escalate and resolve both actual and potential violations.
• A failure identifies and takes action against potential violations from client activity can lead to regulatory discipline.
• CCOs must ensure the compliance monitoring system aligns with the firm's business, is effectively implemented and periodically audited.

Risk-Based Monitoring

• Regulators prioritize risk-based compliance, conducting annual assessments and issuing risk trend reports.
• Firms use this approach to identify key concerns and allocate resources accordingly.
• This involves ranking a dealer member's most significant compliance risks based on internal and external factors:
  • Inherent risk associated with the activity
  • Regulatory expectations and emerging issues
  • Previous compliance concerns and control weaknesses
  • Consequences of a compliance failure
  • Size or significance of the activity
• These risks can be identified by business unit, office location, individual employee, type of activity, product, transaction, or security, and specific client types or profiles.
• Effective monitoring systems require adequate resources to be allocated to the risk.
• Commission levels can be used to identify high-risk areas, but it's important to consider other factors like the commission-to-equity ratio.
• Risk-based methodology can be applied to resource allocation for activities with discretionary timing and extent of commitment.
• Dealer members can rank business locations based on risk profile and prioritize resources accordingly.
• Resource allocation involves considering the cost of compliance, for example, private client options trading having higher compliance costs than retail mutual fund activities.
• Dealer members should ensure data is electronically captured, accessible, correct, and current to produce reliable exception reports.
• The goal is to minimize false positives (indicating a violation when none exists) and false negatives (missing a violation when one is present).

Inquiry, Research, and Independent Verification

• The first step when an actual or potential issue arises is to document the issue.
• Additional inquiry or research may be necessary to confirm or deny the presence of a risk or violation.
• This may require asking relevant business-line personnel for information.
• The CCO must follow up diligently, avoiding unnecessary inquiries that could undermine the compliance department’s credibility.

Follow-Up and Resolution

• Corrective action should be taken promptly after issues are identified.
• A recording and tracking system should capture identified issues to ensure timely resolution.
• If a matter is not resolved within a reasonable time, it should be escalated to senior management.
• A formal escalation policy should outline how the dealer member and CCO should handle unresolved issues.
• The CCO cannot delegate responsibility for compliance functions, but tasks and procedures can be delegated.
• CCOs must ensure that delegated functions are performed properly, which may involve periodic reviews.
• The effectiveness of monitoring and surveillance procedures should be reviewed continuously or periodically.
• Regulatory discipline and court decisions should be viewed as opportunities to identify and correct issues.

Internal and External Examinations

• Internal audit and risk management findings can contribute to both day-to-day and broader systemic control assessments.
• Best practice is to periodically review the compliance department through an internal audit or independent assessment process.
• External auditors provide an independent and objective view of a dealer member’s control environment, which may identify compliance control deficiencies.
• Regulatory reviews and examinations provide valuable information for compliance monitoring.