1. Background

The Business Conduct Compliance Department of IIROC initiated a review of business location supervision processes at selected Dealer in the period January-March 2009. The objective of the review was to determine the effectiveness of Dealers’ business location supervision processes by conducting testing at head offices and a selection of business locations. The focus of the review was to identify and report on weaknesses or deficiencies in the business location supervision process, and to identify and develop some guidelines for business location supervision. IIROC developed a questionnaire to facilitate the selection of a representative sample of full-service retail business locations. All Dealers were required to respond to the questionnaire for each of their business locations. IIROC selected and reviewed 10 Dealers’ head offices and 28 business locations across Canada, and reported to the Dealers their specific results.

1. Guidelines for Business Location Supervision

All Dealers with business locations apart from their head office are required to conduct business location compliance audits. It is the Dealer’s responsibility to exercise sound judgment when determining the frequency and extent of supervision of business locations. 

1. Scope

The audit programs must be appropriately designed to test that supervisory staff are properly reviewing the activities at their business location, to ensure that the appropriate tests are undertaken and that adequate records are maintained.

1. Planning

Business location audits require adequate planning to ensure they function effectively. An important part of the audit occurs before the actual business location visit through a review of material available at the head office level, such as monthly trade supervision reviews, registration files, outstanding client complaints and correspondence with other departments, such as credit and marketing. Many Dealers also require the completion of a pre-audit questionnaire used as a risk based tool to determine the scope and priority of the business location review.

1. Audit Program and Training

Compliance audits should be standardized so that all business locations are subject to the same level of review and compliance standards. All compliance officers conducting the examinations should be properly trained. The scope of the audit program should be comprehensive and cover all aspects of the Dealer’s business lines and all applicable laws, rules and requirements. The programs should be reviewed periodically and updated to include new rule changes, revisions to internal policies and procedures and new lines of business.

1. Risk Identification

Specific risk factors should be identified for each business location and tested during the course of the audit. These include, for example the review of:

• producing versus administrative only business location managers,
• experience level of business location manager,
• experience level of sales and support staff,
• past disciplinary actions of sales staff,
• sources of business location revenue (retail, institutional, managed, corporate finance),
• number of client accounts,
• percentage of revenue derived from low to high risk tolerance investments,
• findings from prior business location compliance audits, and
• number of client complaints.

1. Audit Report and Follow-up

An audit report should be provided within a reasonable time. The report should request a written response addressing any deficiencies noted. The Chief Compliance Officer (CCO), in conjunction with management, should determine the implications of the audit reports, particularly in respect of serious or repeated deficiencies. Under certain circumstances, surprise examinations in retail business locations may be appropriate, especially where there is an indication of inappropriate behavior or inadequate controls. Serious issues and significant deficiencies should be included in the CCO report to the Board.

Dealers should have a robust process for appropriate follow-up to audit concerns and findings, and are required to maintain adequate records.

1. Common Concerns Identified in Business Location Reviews

IIROC identified some common concerns about the ten Dealers’ business location audit programs. Each of these areas of concern is identified below and some best practices are presented for each.

1. Inadequate follow-up procedures

Most Dealers examined had extensive compliance audit programs in place, but either lacked or had inadequate follow-up procedures to ensure the compliance audit findings were tracked and corrective action taken.

Where a Dealer identifies specific areas of concern, an important part of the head office oversight process is to take reasonable steps to ensure that the business location properly addressed the deficiencies by taking corrective action.

Recommended best practices include:

• establish and document expected timelines for audit responses and follow-up actions,
• ensure inadequate responses are addressed,
• conduct follow-up reviews (audits) and ensure all deficiencies were corrected within the established timeframes, and
• ensure that there is an appropriate escalation procedure within the Dealer for issues of concern.

1.  Inadequate oversight procedures for fee-based accounts

IIROC found that most Dealers had inadequate procedures in place to oversee both the account opening process and the suitability assessment for fee-based accounts. Often this account type was not always readily identifiable on the supervisory reports of the Dealer making supervision and oversight of the trading activity in the accounts difficult to identify and track.

Dealers must ensure that they can identify all account types, including fee based accounts, to ensure the appropriateness of the type of account for the client and for the purpose of appropriate post trade monitoring.

Recommended best practices include establishing supervisory reports with appropriate filters to identify the account type and investment suitability.

1. Lack of Evidence of Supervision

Many Dealers did not record or maintain adequate evidence of daily and monthly supervisory reviews at either the business location or head office levels. These deficient records included supervisory testing records, records of inquiries made, responses received and records of action taken. In some cases, supervisors (e.g. business location managers) conducted only random reviews, and cited either oversight, time constraints or a lack of understanding of their regulatory supervisory obligations. In addition, there was often a lack of evidence of supervision during absences of the designated supervisors. In some cases, Dealers were unable to produce written delegation of supervisor’s duties.

Supervisors and their delegates must be knowledgeable of their responsibilities and they must properly execute their supervisory duties. Further, there must be documented evidence of supervisory reviews and approvals by the responsible individual(s) at head office and/or the business location. The supervisor delegating the task must ensure that these tasks are being performed adequately and that exceptions are brought to his/her attention.

Recommended best practices include:

• delegation of a qualified person to conduct supervisory review in the absence of the designated supervisor or business location manager,
• documentation of the delegation process including the scope of the duties to be performed, and
• developing a system for testing the adequacy of the delegated review including any escalated exception.

1. Inadequate control over the issuance of customized portfolio summaries

Certain Dealers were found to have inadequate oversight or a lack of control over the issuance of customized portfolio summaries to clients. This is of concern as a lack of control could lead to incorrect or misleading reports and lack of or incorrect use of disclaimers sent to clients of the Dealer.

Dealers are required to have written policies, procedures and internal controls to ensure that any customized portfolio summaries or portfolio reports provided to clients are accurate and complete. Appropriate supervision must also be implemented.

Recommended best practices include:

• hard coding templates for portfolio summaries which include applicable disclaimers rather than having advisors developing their own personal summaries,
• placing restrictions on the initial set-up of the portfolio summaries, limiting the fields that can be customized by the sales person without prior approval or oversight of the Dealer,
• conducting education and training sessions for all employees and/or agents as to the policies and procedures of the Dealer as to the limitations and disclaimers in the creation and issuance of client portfolio summaries, and
• verifying that the external data reported on the portfolio summaries originates from reliable sources.

1. Improper reassignment of accounts of terminated registrants

Some Dealers were found to have improperly assigned house account codes to accounts of recently departed sales persons. These accounts should have been reassigned to another registrant on a timely basis. Untimely assignment of these accounts can lead to inadequate supervision of client activity and could also jeopardize the Dealer-client relationship.

In some situations where the Dealer reassigned accounts after a registrant left the Dealer, there were no identifiable controls in place to ensure the new registrant verified the information on the New Client Application Form (NCAF) or that there was a signed acknowledgement by the new registrant and the business location manager that the NCAF had been reviewed.

It is a regulatory requirement that the Dealer ensures that the new registrant evidences they have confirmed with the client that information on the NCAF is current and accurate. The Dealer must have in place specific policies and procedures, along with controls over the reassignment of terminated registrants’ accounts.

Recommended best practices include:

• assigning a designated person responsible for the oversight and reassignment of client accounts,
• documenting procedures for actions required by the new qualified registrant, prompt transfer of accounts, follow-up processes to ensure reassignment of all client accounts, and enhanced supervision or restrictions on trading for those accounts which could not be readily transferred or where the client could not be contacted.

1. Poor control of client address changes

During the review IIROC found cases where the Dealer’s internal controls or procedures regarding address changes were not followed. In some cases there was no record of residential addresses, no record of the actions taken on any errors, omissions or where there were unauthorized changes to the client’s address.

Recommended best practices include:

• accepting only written address changes authorized by the client(s) in writing or in another acceptable form that can be validated,
• having changes entered by an employee independent of the sales function,
• conducting independent verification that the address is valid (i.e. not advisor’s or other employee’s home address),
• verifying that the advisor is registered in the applicable provincial jurisdiction of the client’s home address, and
• not permitting P.O. boxes without a full residential address of the client on file.

1. Inadequate control and review of advertising and sales literature

Most Dealers examined had an approval process for both advertising and sales literature that was controlled by head office. IIROC noted deficiencies such as incorrect disclosures and misleading information contained in material distributed to clients. In some instances where the responsibility remained within the business location, many business locations did not consistently maintain evidence of their approval by a designated person.

Dealers are required to establish robust processes to ensure that qualified persons properly review advertising and sales literature and maintain appropriate records of the approval process.

Recommended best practices include:

• developing policies and procedures that clearly delineate who is responsible for the approval process either at the business location, head office or both,
• developing procedures that provide sufficient guidance to adequately assess and approve materials,
• providing training tools provided to applicable staff (including supervisors) which include all related regulatory requirements and what type of evidence of approval that must be maintained, and
• maintaining a clear audit trail of the approval process.

1. Applicable rules

IIROC Rules this Guidance Note relates to:

• section 1402,
• section 1405,
• section 3904,
• section 3905,
• section 3906,
• section 3907, and
• section 3908.

1. Previous Guidance Note

This Guidance Note replaces Notice 09-0370 – Best Practices for Head Office Supervision of Branch Offices. 

1. Related documents

This Guidance Note was published under Notice 21-0190 - IIROC Rules, Form 1 and Guidance.