This in-depth session was hosted by Shelly Davis, senior director at FINRA, and she was joined by Jennifer Szaro, CCO of XML Securities, Erica Green, CCO at Vanguard, and Joe Sheirer, VP, Member Supervision Examination Program at FINRA.
The panel set out to evaluate how members manage what is happening in their branch offices, and how they supervise their branch networks. They wanted to share what they tend to see in the branch review process.
In setting the scene, hybrid is the current buzzword in the new work environment. Consulting Merriam’s dictionary for hybrid reveals this definition: “Something that has two different types of components performing essentially the same function.” In applying this to the workplace, we get a blend of remote location (home?) or travel that allows for agility and change. Work is something that we do, not somewhere we go.
The panel set out to cover: supervision; inspection; guidance and help to members.
Remote inspections
Regarding two proposals that were filed in July 2022 covering remote inspections and residential supervisory, these were then withdrawn in March this year after extensive comments (most notably from NASAA) as it was felt that there would not be enough time (240-day shot clock was run down) to get an acceptable amended version through. The comments focused on recordkeeping and any issue around the control and safekeeping of gold copy records if held in a supervisory office.
The focus has been on the previous pilot and how this can be evolved for a workable approach that can be scaled for the future. FINRA has recognized it can be more flexible here.
Szaro analyzed how her team (of 51) have been conducting remote inspections and this has involved thinking creatively about the reps, their customers, and new threats. This has encompassed looking at tools, locations, activities and conditions. There is keen interest in being part of the pilot though this is not the case it seems at other firms that show no appetite for change.
The panel asked how often a rep needs to be in a location for it to be deemed a branch.
When the first proposal was originated before the pandemic, it was more narrow but supervision and inspection were evolving and this new proposal offers the regulator the opportunity to catch up.
The panel asked how often a rep needs to be in a location for it to be deemed a branch. The answer is being ‘regularly engaged’. Is eight hours twice a week regular? Some firms are considering some creative approaches but FINRA wants to be flexible here and not prescriptive in order to provoke thoughtful and meaningful interpretation.
Membership Application Program (MAP) considerations (at the time of the conference temporary relief was still in place) will require sequencing of registration and de-registration. As the MAP adapts, the regulator will ask if there is the right supervisory structure in place, the right technology, adjusted WSPs, and the right approach for someone working in two separate locations.
Crossing state lines
Szaro stated that as CCO she relies on state guidance and pre-approval forms, taking in location and conditions such as if securities transactions will be conducted from a certain location. She cautioned awareness of situations where a rep might cross a state line to meet a client as this would require a separate registration. State requirements differ and some are stricter than others, and this includes inspection requirements.
Green stressed that their business model drives the tools they use and their program and the way that they inspect. Pre-pandemic everyone was working in offices in Pennsylvania, Texas and North Carolina as well as an inbound call center and a back office. Vanguard has never had a big designated sales practice as such. The best way to leverage the same oversight model to account for the change is to use good technology. That system needs to be accessible, have sufficient controls and facilitate execution. The same system must also be used for testing. Inspection itself is basically a test of controls.
One of the best tools for doing inspections is the personal phone. This is what fire inspectors use to conduct safety checks on buildings.
Sheirer said that inspection is just a layer of the onion. His team chooses which branches to visit on a risk-based evaluation. The branch inspection itself is more a process than a test. The following are considered: controls; business model; activity; risks; how individuals apply each of these. They test policies and procedures at smaller firms. One of the best tools for doing inspections is the personal phone. This is what fire inspectors use to conduct safety checks on buildings. FaceTime is invaluable as are video tools such as Zoom.
How do inspection and supervision interact? Inspection is just a part of the supervisory process. Conducting both has its differences. As an example printing, data entry and recordkeeping are all different for inspection and supervision.
So what are the red flags that best drive inspection?
Data-driven
Sheirer confirmed that they try to be data driven and really understand the business, checking transaction volume and research report volume plus regulatory events, complaints, adverts and marketing volume. Individuals and any relevant history is also good to review based on the theme of any exam. Most of the work (90%) pre- and post-exam is done remotely. The key is to ensure that every moment spent on site at the branch is high quality.
Data analytics can help enormously to identify the red flags that need inspection. This will drive a risk view that can lead to effective risk mitigation.
Using a phone to test things off site is extremely valuable as it can replicate an unannounced visual inspection where an insecure drawer can be examined or it is obvious that a wifi password stuck on a noticeboard inside the office is clearly visible through a public window. Screen shots or photos that go into reports can be insightful too – a principal spotted something from these that the original inspector had missed. Or someone onsite was in the copier room and used their phone to take a picture of the letterhead on the top shelf of the room which was old but still being used. By using FaceTime remote inspectors can also ‘hear’ conversations that might not occur if they were on site, and this is powerful.
The most value inspections offer is a focus on the people and this is usually best established with a face-to-face approach.
Green added that people are generally more comfortable on video than they are in person. If early engagement has already been done via video it shortens the ‘get-to-know-you’. This can be supplemented by questionnaires ahead of an inspection – for example some social media searching can help for review of outside business activities, and public court documents searches as well as a look at Zillow property tax records. Another useful tip was to run through the Fedex shipping label records to reconcile any unusual destinations which can add nicely to an audit trail.
The most value inspections offer is a focus on the people and this is usually best established with a face-to-face approach.
On the whole firms usually do a good job complying but often they fail to actually follow their procedures. Common breaches include: record retention issues; cyber and wifi protocol breaches; safeguarding customer information in an open office or within systems.
The key concerns for anyone who works completely remotely are systems access and control over that access, as well as how they transact and also meet their customers.
Szaro got the audience laughing with her closing comments. She said that she can conduct an unannounced inspection if the circumstances are appropriate. She says she uses experiences gained from dealing with her teenage son and phone management as a guide! She can demand the phone (as she owns it) and conduct an audit at any time and this is always effective. She applies parenting principles to much of her approach to inspection and supervision.
