Series 99 Operational Risk & Controls 4 — Questions and Answers
Question 1: A broker-dealer's net capital drops to 120% of its minimum required level. Under SEC Rule 15c3-1, the firm must:
- Immediately cease all operations and liquidate
- Notify FINRA and the SEC and may be restricted from expanding its business (Correct answer)
- Continue normal operations since it is still above minimum
- File a Form BD amendment within 90 days
Correct answer: Notify FINRA and the SEC and may be restricted from expanding its business
When net capital falls to early warning levels (typically 120% of minimum), the firm must give immediate notice to regulators and faces operational restrictions.
Question 2: Which of the following is an example of a 'process failure' operational risk event?
- A flood damaging a firm's data center
- A trader committing securities fraud
- Failure to send customer trade confirmations within required timeframes (Correct answer)
- A cyberattack by an external hacker
Correct answer: Failure to send customer trade confirmations within required timeframes
Failing to send confirmations on time is a process failure — a breakdown in a required operational procedure — rather than a people, systems, or external event failure.
Question 3: Under FINRA Rule 4370, broker-dealers are required to create and maintain a business continuity plan that addresses:
- Only technology recovery procedures
- A broad range of disruptions including data backup, communication protocols, and critical business constituent contact (Correct answer)
- Only natural disaster scenarios
- Solely the recovery of customer margin accounts
Correct answer: A broad range of disruptions including data backup, communication protocols, and critical business constituent contact
FINRA Rule 4370 requires BCPs to address a wide range of business disruptions covering data backup, alternative communications, customer access to funds, and critical business operations.
Question 4: The three lines of defense model assigns which role to the compliance and risk management department?
- First line — direct ownership of operational risk
- Second line — oversight and monitoring of controls implemented by the first line (Correct answer)
- Third line — independent assurance provided through auditing
- Fourth line — external regulatory examination
Correct answer: Second line — oversight and monitoring of controls implemented by the first line
In the three lines of defense model, compliance and risk management serve as the second line, providing oversight and challenge to the first line's risk-taking activities.
Question 5: Which of the following BEST describes the operational risk associated with 'model risk' at a broker-dealer?
- The risk that a financial model used for pricing or risk measurement is incorrect or misapplied (Correct answer)
- The risk of losing a key employee who built the trading model
- The risk that regulators will disapprove of the model
- The risk that customers will not understand the pricing model
Correct answer: The risk that a financial model used for pricing or risk measurement is incorrect or misapplied
Model risk is the risk of loss arising from errors in the development, implementation, or use of financial models for pricing, valuation, or risk measurement.
Question 6: A broker-dealer receives a FINRA 8210 request for information during a routine examination. The operations department's MOST appropriate response is to:
- Ignore the request until legal counsel arrives
- Promptly provide all requested documents and information within the specified timeframe (Correct answer)
- Notify the press of the regulatory inquiry
- Cease all operations pending the outcome of the inquiry
Correct answer: Promptly provide all requested documents and information within the specified timeframe
Firms are obligated to promptly respond to FINRA Rule 8210 information requests; failure to cooperate can result in disciplinary action including suspension or expulsion.
Question 7: Which of the following operational controls addresses the risk of data entry errors in the back office?
- Using a single employee to input and approve all transactions
- Dual-entry verification requiring a second person to confirm data input (Correct answer)
- Storing records only in paper format
- Delegating all data entry to external vendors without oversight
Correct answer: Dual-entry verification requiring a second person to confirm data input
Dual-entry or maker-checker controls require a second person to verify data input, significantly reducing the risk of uncorrected data entry errors.
Series 99 Operational Risk & Controls 4
A broker-dealer's net capital drops to 120% of its minimum required level.
Under SEC Rule 15c3-1, the firm must: