Compliance and Supervision: Building and Proving a Reasonable System
The supervisory obligation
Compliance in a CIRO Dealer Member is not a person but a system. Candidates must understand the layered structure: the Ultimate Designated Person (UDP) is accountable for the firm's culture of compliance; the Chief Compliance Officer (CCO) is responsible for the day-to-day compliance function and for reporting to the board or a board committee; and business-unit supervisors are responsible for the conduct of the people they oversee. A common trap is treating the CCO as personally liable for every representative's misconduct. Regulators ask whether the firm established, maintained and enforced reasonable policies and procedures, not whether the CCO personally caught every breach.
Core concepts to know
Know the distinction between policies (what is required) and procedures (how it is done and evidenced). Know the elements of an effective compliance program: written policies, designated responsibility, training, monitoring and surveillance, escalation, remediation, and independent review. Know the difference between pre-trade controls (restricted lists, new-product approval) and post-trade surveillance (exception reports, trade blotter review, complaint trending). Understand gatekeeper obligations, know-your-product due diligence, and the duty to supervise both employees and approved persons acting on the firm's behalf.
Traps in questions
Watch for answers that confuse detection with prevention, or that assume a single annual attestation satisfies ongoing supervision. Another trap: assuming a branch manager can be the sole supervisor of a producing representative with no independent oversight. Questions frequently test whether escalation was documented and timely, and whether the firm followed its own written procedures.
Rule of thumb
If a question asks whether supervision was adequate, test three things: was there a written procedure, was it followed, and is there a record proving it? A firm that can show all three usually has a defensible answer even if a violation occurred.
Worked example
A representative places unauthorized trades in a client account. The firm discovers it only when the client complains. The best answer is generally not "the CCO failed" but "the firm's monitoring failed to detect the pattern, and the branch supervisor did not review exception reports," because that identifies the control gap the regulator will examine.