CSCP Internal Controls & Auditing 4 — Questions and Answers
Question 1: In the context of a securities firm's internal controls, 'compensating controls' are best described as:
- Controls that reward employees for identifying compliance breaches
- Alternative controls that mitigate risk when primary controls cannot be implemented (Correct answer)
- Controls mandated by regulators to compensate for past violations
- Financial reserves set aside to cover losses from control failures
Correct answer: Alternative controls that mitigate risk when primary controls cannot be implemented
Compensating controls are alternative measures that reduce risk to an acceptable level when the preferred primary control is not feasible due to operational or cost constraints.
Question 2: Which of the following would be considered a 'control deficiency' in a broker-dealer's trade surveillance program?
- The surveillance system generates too many false positive alerts
- Alert review is performed by the same trader who executed the flagged transactions (Correct answer)
- Surveillance rules are reviewed and updated annually
- Surveillance alerts are escalated to senior management when warranted
Correct answer: Alert review is performed by the same trader who executed the flagged transactions
Having a trader review alerts for their own transactions creates a conflict of interest and eliminates the independence required for effective surveillance, constituting a control deficiency.
Question 3: An auditor testing a securities firm's order management controls would most likely use 're-performance' as an audit technique when:
- Interviewing compliance staff about their understanding of trade reporting requirements
- Independently executing the same control procedure to verify it produces the same results (Correct answer)
- Observing a trader executing an order in the order management system
- Reviewing documentation of control exceptions identified by the first line of defense
Correct answer: Independently executing the same control procedure to verify it produces the same results
Re-performance involves the auditor independently executing a control procedure to determine whether it produces the same result as when performed by company personnel.
Question 4: FINRA's Annual Compliance Meeting requirement under Rule 3110 requires that each registered representative attend a compliance meeting or receive compliance information:
- Quarterly
- Semi-annually
- Annually (Correct answer)
- Every two years
Correct answer: Annually
FINRA Rule 3110 requires that each registered representative participate in an annual compliance meeting to ensure ongoing awareness of regulatory requirements and firm policies.
Question 5: A securities firm's internal audit charter should NOT include which of the following elements?
- The purpose and authority of the internal audit function
- Specific audit findings from the most recent examination cycle (Correct answer)
- The organizational independence of the internal audit function
- The scope of internal audit responsibilities
Correct answer: Specific audit findings from the most recent examination cycle
The internal audit charter establishes the function's authority, independence, and scope, but specific audit findings belong in individual audit reports, not the charter itself.
Question 6: In a risk control self-assessment (RCSA) conducted at a broker-dealer, business line managers are asked to:
- Undergo independent testing by the internal audit department
- Identify and evaluate risks and controls within their own business areas (Correct answer)
- Review the adequacy of the compliance department's policies and procedures
- Assess the performance of the external auditors
Correct answer: Identify and evaluate risks and controls within their own business areas
An RCSA is a process where business line managers identify key risks in their area and assess the adequacy of controls designed to mitigate those risks.
Question 7: During a gap assessment of a broker-dealer's AML controls, the auditor finds that the firm does not have a designated AML Compliance Officer. Under FinCEN regulations, this represents:
- A best practice gap that should be addressed in the next planning cycle
- A minor deficiency requiring a management action plan within 180 days
- A mandatory regulatory requirement violation that must be remediated immediately (Correct answer)
- A waivable requirement for broker-dealers with fewer than 50 employees
Correct answer: A mandatory regulatory requirement violation that must be remediated immediately
FinCEN regulations require all broker-dealers to designate an AML Compliance Officer as part of their mandatory written AML program; this is not optional regardless of firm size.
CSCP Internal Controls & Auditing 4
In the context of a securities firm's internal controls, 'compensating controls' are best described as: