Series 99 Operational Risk & Controls 2 — Questions and Answers
Question 1: Which of the following BEST describes a 'key risk indicator' (KRI) in broker-dealer operations?
- A metric that measures past losses already incurred
- A forward-looking metric that signals potential operational risk before a loss event (Correct answer)
- A regulatory filing submitted after a control failure
- A performance benchmark used only for compensation purposes
Correct answer: A forward-looking metric that signals potential operational risk before a loss event
KRIs are forward-looking metrics that provide early warning signals of rising operational risk exposure before losses materialize.
Question 2: A broker-dealer discovers that a back-office employee has been processing trades without proper supervisory approval for three months. This is BEST classified as:
- Market risk
- Credit risk
- Internal fraud risk (Correct answer)
- Regulatory risk
Correct answer: Internal fraud risk
Unauthorized transactions by an internal employee without supervisory sign-off fall under internal fraud or unauthorized activity, a core category of operational risk.
Question 3: Under FINRA rules, a firm's supervisory control system must include which of the following?
- Annual reviews of trading profits only
- Testing and verification that supervisory procedures are being followed (Correct answer)
- Quarterly dividend payments to all registered persons
- Monthly margin calls to retail customers
Correct answer: Testing and verification that supervisory procedures are being followed
FINRA Rule 3120 requires firms to test and verify that their supervisory procedures are in place and being followed at least annually.
Question 4: Which control type is designed to DETECT an operational failure after it has already occurred?
- Preventive control
- Directive control
- Detective control (Correct answer)
- Corrective control
Correct answer: Detective control
Detective controls identify problems or failures that have already occurred, such as reconciliations, audits, and exception reports.
Question 5: A broker-dealer's reconciliation process reveals a $50,000 discrepancy between the firm's books and the DTC's position records. The FIRST step the operations department should take is:
- Write off the discrepancy as a trading loss
- Investigate the source of the break and escalate per the firm's escalation policy (Correct answer)
- Notify the SEC immediately without further review
- Suspend all trading in the affected security
Correct answer: Investigate the source of the break and escalate per the firm's escalation policy
The first step is always to investigate the discrepancy to determine its cause and then escalate according to established firm procedures.
Question 6: Separation of duties in securities operations PRIMARILY serves to:
- Increase the speed of trade settlement
- Reduce the risk that a single employee can perpetrate and conceal an error or fraud (Correct answer)
- Allow one person to control the entire trade lifecycle for efficiency
- Eliminate the need for supervisory review
Correct answer: Reduce the risk that a single employee can perpetrate and conceal an error or fraud
Segregation of duties ensures no single individual controls all steps of a transaction, reducing the risk of undetected errors or fraud.
Question 7: A firm's business continuity plan (BCP) for its order management system should include which of the following?
- A list of all customer margin balances
- Procedures for maintaining critical operations during a system outage or disaster (Correct answer)
- The firm's quarterly earnings projections
- Instructions for calculating customer net worth
Correct answer: Procedures for maintaining critical operations during a system outage or disaster
A BCP must document how the firm will maintain critical business functions, including order management, during disruptive events.
Series 99 Operational Risk & Controls 2
Which of the following BEST describes a 'key risk indicator' (KRI) in broker-dealer operations?