CSCP Compliance Programs & Risk Management 2 — Questions and Answers
Question 1: Under SEC Rule 38a-1, what is the primary role of a mutual fund's Chief Compliance Officer (CCO)?
- Approve all trade executions above a threshold
- Administer the fund's compliance policies and procedures (Correct answer)
- Report directly to shareholders on compliance matters
- Conduct independent audits of the fund's financials
Correct answer: Administer the fund's compliance policies and procedures
SEC Rule 38a-1 requires registered investment companies to designate a CCO who administers the fund's policies and procedures designed to prevent violations of federal securities laws.
Question 2: Which risk management framework, developed by COSO, is most widely referenced in securities compliance programs for enterprise-wide risk assessment?
- ISO 31000
- COSO ERM Framework (Correct answer)
- NIST Cybersecurity Framework
- Basel III Accord
Correct answer: COSO ERM Framework
The COSO Enterprise Risk Management (ERM) Framework is the most widely adopted framework for integrating risk management with governance and strategy in financial services compliance programs.
Question 3: A broker-dealer's written supervisory procedures (WSPs) must be reviewed at minimum how frequently under FINRA rules?
- Quarterly
- Semi-annually
- Annually (Correct answer)
- Every three years
Correct answer: Annually
FINRA rules require broker-dealers to conduct an annual review of their written supervisory procedures to ensure they remain current and effective.
Question 4: What is 'residual risk' in the context of a securities compliance risk assessment?
- Risk that cannot be quantified in monetary terms
- Risk remaining after controls and mitigating measures are applied (Correct answer)
- Risk arising from third-party vendors only
- The highest-rated risk before any controls are implemented
Correct answer: Risk remaining after controls and mitigating measures are applied
Residual risk is the level of risk that remains after an organization has implemented its risk controls and mitigation strategies, as opposed to inherent risk which exists before controls.
Question 5: Which element is NOT typically required in a broker-dealer's annual compliance report to senior management?
- Assessment of the adequacy of the compliance program
- Identification of material compliance matters
- Recommendations for changes to the compliance program
- A detailed audit of each registered representative's trades (Correct answer)
Correct answer: A detailed audit of each registered representative's trades
Annual compliance reports to senior management address program adequacy, material issues, and recommendations — not individual trade-by-trade audits of all registered representatives.
Question 6: In a compliance risk matrix, 'likelihood' combined with 'impact' is used to determine which of the following?
- The cost of implementing controls
- The risk rating or priority score for each identified risk (Correct answer)
- The timeline for regulatory examination
- The number of compliance staff required
Correct answer: The risk rating or priority score for each identified risk
A compliance risk matrix uses the intersection of likelihood and impact to assign a risk rating, which helps prioritize which risks require immediate attention and resource allocation.
Question 7: A firm's compliance program fails to detect a pattern of unsuitable recommendations due to gaps in supervisory review. This scenario best illustrates which type of compliance failure?
- Operational risk crystallization
- Control environment deficiency (Correct answer)
- Market risk breach
- Liquidity risk event
Correct answer: Control environment deficiency
When supervisory reviews fail to catch violations, it reflects a deficiency in the control environment — the internal controls designed to detect and prevent misconduct are inadequate.
CSCP Compliance Programs & Risk Management 2
Under SEC Rule 38a-1, what is the primary role of a mutual fund's Chief Compliance Officer (CCO)?