How to Avoid Failure to Supervise

And not all supervisory procedures are created equal. They should be tailored to the adviser's actual business practices, reviewed no less frequently than annually, and updated as needed in response to new regulations or changes in the business. Think quality over quantity.

Each procedure should also establish how such supervision will be performed, and by whom. Contrary to popular belief, this is not necessarily the firm's chief compliance officer. Rather, the SEC has made it clear that:

"Having the title of chief compliance officer does not, in and of itself, carry supervisory responsibilities. Thus, a chief compliance officer […] would not necessarily be subject to a sanction by [the SEC] for failure to supervise other advisory personnel. A compliance officer who does have supervisory responsibilities can continue to rely on the defense provided for in section 203(e)(6) of the Advisers Act [the section cited above]."

The responsibility of an adviser's CCO is to administer the supervisory procedures, not necessarily supervise its personnel. This is not a distinction without a difference, but it is a whole other can of worms to be reserved for a later article. But for purposes of this article, the point is that a supervisory hierarchy (in which each supervised person is assigned to a supervisor) need not have the CCO at the top.

At the end of the day, how can an adviser establish a reasonable system of supervision?

1. Identify which individuals within the advisory organization qualify as "supervised persons."

2. Assign each supervised person a supervisor. Though it may seem ridiculous, this even applies to solo advisers that must supervise themselves. For established advisers reading this article, refer to your policies and procedures to determine if you are designated a supervisor; the answer may surprise you.

3. Draft a tailored set of supervisory policies and procedures that, at a minimum and to the extent applicable, address:

   1. Portfolio management;

   2. Accuracy of disclosures;

   3. Proprietary trading and personal trading of supervised persons;

   4. Safeguarding of client assets;

   5. Recordkeeping;

   6. Client privacy protections;

   7. Trading practices;

   8. Marking;

   9. Valuation;

   10. Business continuity plans

The above list is summarized from the SEC's "Information for Newly Registered Investment Advisers" website, which incidentally states that an update is currently in progress. Also, as emphasized above, the above list is the bare minimum; a reasonably designed set of policies and procedures will very likely contain additional discrete policies and procedures.

4. Regularly educate supervised persons on such supervisory policies and procedures (especially when they are updated or changed), and obtain a signed annual certification from each supervised person that he or she has read, understood and agrees to comply with such supervisory policies and procedures.

5. Create a compliance calendar that outlines how various supervisory activities are carried out, by whom, with what frequency and on what dates, as well as any findings and corrective action that result from such supervision (aka "testing" your policies and procedures). Documenting a compliance calendar can go a long way in demonstrating reasonable supervision, so long as it is consistently followed. If supervision isn't documented, it's basically impossible to prove (to a regulator) that it actually occurred. Consider building this into or around your CRM for consistency of recordkeeping.

6. To the extent an advisory firm employs an individual with a history of disciplinary events, plan to conduct "extra" supervision of that individual. The SEC released a risk alert on this very topic in September 2016, and announced that it would be examining the supervision practices at such advisory firms pursuant to its "Supervision Initiative." Firms subject to this examination initiative should expect a review of the firm's hiring processes, employee oversight, complaint reporting, disclosures, conflicts of interest, marketing practices and the overall "tone at the top."

RIAs of all sizes and complexities must have a robust supervisory regime in place, and those individuals that are designated supervisors would do well do ensure that they are practicing the time-honored tradition of CYA.