Building, Documenting, and Testing the Supervisory System
The supervisory infrastructure
Rule 3110 requires a supervisory system, written supervisory procedures (WSPs), and a designated principal responsible for each office of supervisory jurisdiction (OSJ). An OSJ is where one or more supervisors are located or where supervisory duties are performed. WSPs must be reasonably designed and updated when rules or the business change; 'borrowed' procedures that do not match actual practice are a recurring exam trap.
Internal inspections: each OSJ at least annually, and every other branch office at least every three years. Inspections must cover the activities actually conducted, be documented, and be reported to senior management, with evidence of follow-up on deficiencies. Rule 3120 requires an annual report on the supervisory control system to senior management, and Rule 3130 requires the CEO to certify the firm's compliance processes annually - the certification covers processes in place, not a guarantee of compliance. Rule 4530 requires reporting to FINRA of specified events (certain legal and regulatory actions, customer arbitrations, internal findings of violations), generally within 30 days.
Other anchors: Rule 4511 books and records (SEC Rules 17a-3 and 17a-4; generally three years readily accessible, six years total); Rule 3310 anti-money-laundering program with a designated compliance officer, annual independent testing, CIP, and SARS filed within 30 days of detection; Rule 4370 business continuity plan; net capital under Rule 15c3-1 and the customer protection reserve formula under Rule 15c3-3.
Rule of thumb: annual for OSJs and the AML test, three years for other branches, 30 days for Rule 4530 reporting. Worked example: a firm opens a small satellite office where two registered representatives take orders but no supervisor sits. It is a branch office subject to a three-year inspection cycle, not an OSJ - but a supervisor must still be assigned oversight responsibility.