United States
Hong KongThe Management, Supervision and Internal Control Guidelines
The Management, Supervision and Internal Control Guidelines set out what the SFC expects of a licensed corporation's control environment. Senior management bears primary responsibility. The Guidelines cover management and supervision, segregation of duties, staff and training, information management, compliance, audit, operational controls and risk management.
Every enforcement notice about a collapsed brokerage reads the same way. One person had too many jobs, nobody checked their work, and the reconciliation that would have caught it was performed by the person who needed it not to be caught. The Internal Control Guidelines are the regulator's attempt to make that arrangement impossible.
- Issued by
- Securities and Futures Commission
- Status
- Guidelines, not subsidiary legislation
- Anchor obligation
- Senior management bears primary responsibility
- Applies to
- Licensed corporations, scaled to the size and nature of the business
- Most examined area
- Segregation of duties
What is the organising principle?
Responsibility sits at the top. The Code of Conduct places primary responsibility for maintaining standards of conduct and adherence to procedures on senior management, and the Guidelines are built on that foundation. A firm cannot hire a compliance officer, hand over the problem, and treat the matter as closed.
In practice the SFC looks for named individuals. Who owns this control? Who reviews the exception report? Who signs off on the reconciliation? A control with no owner is a control in a document rather than a control in a business.
What areas do the Guidelines cover?
| Control area | The expectation |
|---|---|
| Management and supervision | A clear organisational structure, defined reporting lines and active oversight of each business line |
| Segregation of duties | Incompatible functions split, so that no one person controls a transaction end to end |
| Personnel and training | Competent, properly trained staff, with fitness assessed before and during employment |
| Information management | Accurate, timely records and controlled access to sensitive information |
| Compliance | An independent compliance function with a direct line to senior management |
| Audit | Internal or external review that tests whether the controls actually work |
| Operational controls | Order handling, settlement, reconciliation, client asset handling and error correction |
| Risk management | Identification, measurement and monitoring of credit, market, liquidity and operational risk |
The Guidelines are scaled. A two-person advisory firm is not expected to run the control apparatus of a clearing participant, and the SFC says so. What does not scale is the requirement to have thought about each area and to be able to explain the answer.
Why is segregation of duties examined so often?
Because it is testable in a single sentence and it exposes whether you understand what a control is for. The principle: the person who executes should not also settle, reconcile and record. Split the chain and an error has to survive two people to become a loss. Leave it whole and it only has to survive one.
The classic stem describes a small firm where the dealer also performs the daily bank reconciliation because the firm is short-staffed. Being short-staffed is not a defence. Where full segregation is genuinely impractical, the answer is compensating controls and closer supervision, not an exemption.
Answer options that solve a control weakness by writing a policy are usually wrong. Options that solve it by having a second, independent person check the work are usually right. The Guidelines care about who does what, not about what the manual says.
What does the compliance function have to look like?
Independent of the business it monitors, adequately resourced, and able to reach senior management without going through the people it might have to report on. A compliance officer who reports to the head of dealing is not independent in any way that matters, however capable they are.
The function's job is monitoring and advice: keeping the firm's procedures aligned with the rules, testing whether staff follow them, and escalating what it finds. It does not absorb management's responsibility, which loops back to the anchor obligation at the start.
How do these guidelines connect to the rest of the syllabus?
- Fitness and properness - persistent control failures bear on whether the firm and its responsible officers remain fit and proper.
- Client assets - the operational controls area is where the client money and client securities rules are actually implemented.
- Anti-money laundering - the risk-based approach depends on the same governance and escalation structures.
- Electronic trading - system controls, capacity testing and access limits are internal controls applied to technology.
A worked question
In a small licensed corporation, the settlement clerk also performs the monthly client money reconciliation and updates the accounting records. Which response best meets the Internal Control Guidelines?
- No action is needed, because the Guidelines are scaled to the size of the firm
- Document the arrangement in the compliance manual and note the risk
- Have an independent person review the reconciliation and increase supervisory oversight
- Transfer the reconciliation to the firm's external auditors at year end
How much should you memorise?
The list of control areas, and one concrete example of each. That is enough to answer anything the paper is likely to ask, and it takes an evening. Trying to memorise the Guidelines line by line is a poor use of the time you have, because the questions test recognition of a control weakness rather than recall of the text.
The honest limitation of this heading is that it rewards work experience. If you have sat in a compliance function, the answers are obvious. If you have not, they can feel like guesswork, and the fix is to do enough Topic 6 questions that the pattern becomes familiar rather than intuitive.
Common questions
Are the SFC Internal Control Guidelines legally binding?
They are guidelines rather than subsidiary legislation, so breaching them is not an offence. Failure to meet them exposes the firm and its responsible officers to disciplinary action and bears on whether they remain fit and proper to hold a licence.
What is segregation of duties?
Splitting incompatible functions so that no single person controls a transaction from start to finish. The person who executes a trade should not also settle it, reconcile it and record it, because that combination allows errors and fraud to go undetected.
Do the Guidelines apply to very small firms?
Yes, scaled to the size and nature of the business. A small firm is not expected to build the control apparatus of a large one, but it must still address each control area and use compensating controls where full segregation is impractical.
Must the compliance function be independent?
It must be independent of the business activities it monitors, adequately resourced, and able to escalate directly to senior management. A compliance officer reporting to the head of the business being monitored does not meet the expectation.
Which control area does Paper 1 test most?
Segregation of duties. It states cleanly in one sentence, it produces realistic scenarios, and it shows whether a candidate understands that a control is about who performs a task rather than about what a policy document says.