The Supervisory Framework: Rules, Roles, and the Compliance Function
How the framework fits together
A CIRO supervisor must be able to explain, in plain terms, who makes the rules and who enforces them. At the top sit securities regulators (in Canada, the provincial commissions acting through the Canadian Securities Administrators), which delegate self-regulatory functions to CIRO. CIRO's rules are organized as dealer-member rules, universal market integrity rules, and investment-dealer rules, supplemented by guidance notices that explain how the rules are interpreted. Below the rulebook sits the firm's own policies and procedures manual, which must be at least as strict as the rules and must be reviewed and updated on a defined cycle.
The three lines of defence
Understand the division of responsibility: the business unit owns the risk, the compliance function monitors and advises, and internal audit provides independent assurance. A supervisor sits in the first line but carries a second-line duty to escalate. Questions often test whether a supervisor may simply defer to compliance. The answer is no: supervisors must act on red flags and cannot contract out their obligations.
Traps to expect
Watch for questions that confuse registration with approval of an activity, or that treat guidance as optional. Guidance is not binding in form, but exam questions treat departures from guidance as evidence of an inadequate control environment. Another trap is the assumption that a firm's internal policy overrides a CIRO rule; it cannot be more permissive.
Worked rule of thumb
When a new product or process is proposed, run the "higher bar" test: identify every applicable requirement (CIRO rule, securities legislation, firm policy) and apply the strictest one. If the firm's policy is silent, the regulatory requirement governs; if the policy is stricter, the policy governs.
Documentation
Every supervisory decision should be recorded with the date, the issue, the person responsible, and the resolution. Undocumented supervision is, for practical purposes, no supervision.