Skip to content

Series 24 Written Supervisory Procedures Practice Questions

Official outline
FINRA Series 24 Content Outline
Questions on this page
8
Updated
Nov 3, 2026

  1. Question 1, easy

    The CEO asks a principal to sign an annual compliance certification even though the firm has not completed the required supervisory-control testing. What should the principal recommend?

    • A.Sign the certification with a written caveat noting that testing is incomplete, and finish the supervisory-control testing once the certification has been executed.
    • B.Rely on last year's testing for the business lines rated low risk, and perform new testing only on the lines that changed since the prior certification.
    • C.Sign based on management's written assurance that controls are operating, and schedule the remaining testing and remediation for the next review cycle.
    • D.Complete a defensible compliance assessment and supervisory-control testing, remediate findings, then follow the required certification process.
    Show answer and explanationHide answer

    Correct answer: D. Complete a defensible compliance assessment and supervisory-control testing, remediate findings, then follow the required certification process.

    A certification must rest on completed testing and a reasonable basis for the statements made. The principal should recommend finishing the assessment and remediation before certifying.

    • A. A caveat does not fix the problem. The certification states that processes are in place to establish, maintain, review, test and modify compliance and supervisory controls. Signing before the required testing is done leaves the statement without a reasonable basis.
    • B. Carrying forward prior-year results for some areas does not replace the current-year testing the certification relies on. Risk ratings and controls can change, so the earlier results do not show that today's processes work.
    • C. Management assurance is not a substitute for completed testing. Postponing testing and remediation until the next cycle means the certification is signed without verified controls and leaves known gaps open.
    • D. Completing the testing and remediation gives a reasonable basis for the certification.

  2. Question 2, hard

    Under FINRA Rule 3110(f)(2), which of the following is NOT one of the functional criteria used to determine whether a location is an Office of Supervisory Jurisdiction (OSJ)?

    • A.The location where the member's order execution or market-making occurs
    • B.The location where the member structures public offerings or private placements
    • C.The location's average daily equity trading volume exceeds $10 million
    • D.The location where the member maintains custody of customer funds or securities
    Show answer and explanationHide answer

    Correct answer: C. The location's average daily equity trading volume exceeds $10 million

    Rule 3110(f)(2) defines an OSJ by function, not by trading volume: order execution/market-making, structuring public offerings or private placements, custody of customer funds/securities, final approval of retail communications, responsibility for supervising one or more branch offices, and the location where a person with proprietary interest exercises sole discretion over hiring/firing/discipline. A dollar-volume trading threshold is not one of the listed criteria. The rule is functional, not size-based.

    • A. This is one of the actual Rule 3110(f)(2) functional criteria. A location where order execution or market-making occurs qualifies as an OSJ, so it is not the exception being asked for.
    • B. Structuring public offerings or private placements is explicitly listed as an OSJ-qualifying function under Rule 3110(f)(2), so this is a valid criterion, not the odd one out.
    • C. Correct. There is no dollar-volume trading threshold in the Rule 3110(f)(2) functional test; OSJ status turns on the specific supervisory/business functions performed at a location, not a trading-volume metric.
    • D. Maintaining custody of customer funds or securities is one of the enumerated functional criteria for OSJ status, so it doesn't belong as the excluded answer.

  3. Question 3, hard

    Under FINRA Rule 3110's inspection requirements, absent a risk-based schedule adjustment, an Office of Supervisory Jurisdiction (OSJ) must generally be inspected on what cycle?

    • A.At least annually (every calendar year)
    • B.At least every two years
    • C.At least every three years
    • D.At least every five years
    Show answer and explanationHide answer

    Correct answer: A. At least annually (every calendar year)

    FINRA Rule 3110(c) generally requires firms to inspect each OSJ (and each branch office that supervises one or more non-branch locations) at least annually. Non-supervisory branch offices must generally be inspected at least every three years, and non-branch locations are inspected on a regular periodic schedule, presumed reasonable if at least every three years, subject to the firm's risk-based approach.

    • A. Correct. OSJs must generally be inspected at least annually under Rule 3110(c).
    • B. Two years is not a recognized inspection cycle under Rule 3110 for any location type.
    • C. Three years is the presumptively reasonable cycle for non-supervisory branch offices and non-branch locations, not OSJs. A common mix-up.
    • D. Five years is longer than any permitted default inspection cycle under Rule 3110.

  4. Question 4, hard

    FINRA Rule 3130 requires each member firm to designate one or more principals to certify annually that the firm has processes in place to establish, maintain, review, test, and modify its WSPs reasonably designed to achieve compliance. Under the rule, this annual certification must be executed by:

    • A.Any registered principal designated by the Chief Compliance Officer
    • B.The registered representative with the highest production in each branch
    • C.The Financial and Operations Principal (FINOP) responsible for net capital computations
    • D.The Chief Executive Officer (or equivalent officer) of the firm
    Show answer and explanationHide answer

    Correct answer: D. The Chief Executive Officer (or equivalent officer) of the firm

    Rule 3130 specifically requires the CEO (or equivalent officer) to sign the annual certification, based on a process the firm's designated principal(s) establish, following consultation with the CCO. The certification cannot simply be delegated to any principal. The accountability is placed at the top of the organization.

    • A. Incorrect. While principals are involved in establishing the underlying processes, the certification itself must be executed by the CEO or equivalent.
    • B. Incorrect. Sales production has no bearing on who is authorized to execute this certification.
    • C. Incorrect. The FINOP's role relates to net capital and financial recordkeeping, not the Rule 3130 certification.
    • D. Correct. Rule 3130 requires the CEO (or equivalent officer) to sign the annual certification.

  5. Question 5, easy

    What is the fundamental purpose of a member firm's written supervisory procedures (WSPs) under FINRA Rule 3110(a)?

    • A.Documenting the firm's annual marketing budget and advertising spend for review and approval by the chief compliance officer
    • B.Establishing a supervisory system reasonably designed to achieve compliance with applicable securities laws, regulations, and FINRA rules
    • C.Providing registered representatives with a standardized script and talking points for cold-calling prospective retail customers and closing new account sales
    • D.Satisfying the state licensing requirements that apply to newly registered principals when they first join a member firm
    Show answer and explanationHide answer

    Correct answer: B. Establishing a supervisory system reasonably designed to achieve compliance with applicable securities laws, regulations, and FINRA rules

    FINRA Rule 3110(a) requires every member to establish and maintain a system to supervise the activities of its associated persons that is reasonably designed to achieve compliance with applicable securities laws and regulations and with FINRA rules. The written supervisory procedures under Rule 3110(b) document and carry out that system. A marketing budget, a cold-calling script, and state licensing for new principals are narrower or unrelated administrative matters, and none is the stated purpose of the rule.

    • A. Documenting a marketing budget for the CCO's review has nothing to do with the compliance purpose of WSPs.
    • B. Rule 3110(a) requires WSPs to establish a supervisory system reasonably designed to achieve compliance with applicable securities laws, regulations, and FINRA rules. This is their fundamental purpose.
    • C. WSPs are not sales scripts for cold-calling or closing sales; that mischaracterizes their compliance function.
    • D. WSPs address FINRA/securities-law compliance, not the state licensing requirements that apply to newly registered principals.

  6. Question 6, hard

    A firm's supervisory controls report reveals that a branch's order-review procedures were not being followed consistently. Which statement most accurately describes the firm's related obligations under FINRA rules?

    • A.Rule 3120 requires the firm to establish, maintain, and at least annually test and verify its supervisory control procedures, while Rule 3130 requires the CEO to certify annually that the firm has processes in place to establish, maintain, review, test, and modify its WSPs
    • B.Rule 3130 is the provision that requires annual testing and verification of the firm's supervisory control procedures, while Rule 3120 concerns the designation of OSJs and the registration of the principals who staff them
    • C.Rule 3110 requires the firm to test and verify its supervisory control procedures each year, while Rule 3130 requires the chief compliance officer to certify that every branch inspection was completed on schedule
    • D.Rule 3120 requires the firm to file its annual supervisory controls report with FINRA, while Rule 3130 requires the CEO to certify that the firm has no outstanding supervisory deficiencies
    Show answer and explanationHide answer

    Correct answer: A. Rule 3120 requires the firm to establish, maintain, and at least annually test and verify its supervisory control procedures, while Rule 3130 requires the CEO to certify annually that the firm has processes in place to establish, maintain, review, test, and modify its WSPs

    Rule 3120 (Supervisory Control System) requires firms to designate one or more principals to establish, maintain, and enforce supervisory control procedures that test and verify that the firm's WSPs are reasonably designed, with the results documented at least annually. Rule 3130 requires the CEO (or equivalent) to certify annually that the firm has processes to establish, maintain, review, test, and modify WSPs reasonably designed to achieve compliance with applicable securities laws and FINRA rules. These are two distinct, complementary obligations.

    • A. Correct. Rule 3120 requires designated principals to establish, maintain, and at least annually test and verify the supervisory control procedures, and to report the results to senior management. Rule 3130 separately requires the CEO to certify annually that the firm has processes to establish, maintain, review, test, and modify its WSPs.
    • B. This swaps the rules. Rule 3120 is the supervisory control testing and verification rule, and Rule 3130 is the CEO certification rule. Neither rule is about designating OSJs and registering their principals.
    • C. This misattributes both duties. Annual testing and verification of supervisory controls comes from Rule 3120, not Rule 3110, which governs supervisory systems and inspections. The Rule 3130 certification is made by the CEO and concerns the firm's compliance processes, not whether branch inspections were completed on schedule.
    • D. This misstates both rules. The Rule 3120 annual report goes to senior management and is not filed with FINRA. The Rule 3130 certification states that the firm has processes in place to establish, maintain, review, test, and modify its WSPs. It does not certify that no deficiencies exist.

  7. Question 7, medium

    A firm's designated principal under Rule 3120 conducts independent testing to verify that the firm's supervisory procedures are actually being followed and are adequate, and prepares an annual report to senior management summarizing test results and any additional or amended procedures adopted. What is this activity best described as?

    • A.The firm's written supervisory procedures under Rule 3110 themselves. The day-to-day supervisory system that the annual testing report replaces
    • B.A branch inspection program under Rule 3110(c). Periodic reviews of the firm's office locations that satisfy a separate inspection requirement
    • C.The annual CEO certification under Rule 3130. A attestation that the firm has processes to establish, maintain, review, test and modify its compliance policies
    • D.The Rule 3120 supervisory control system. An independent testing and verification function layered on top of, and reporting on the adequacy of, the firm's Rule 3110 WSPs
    Show answer and explanationHide answer

    Correct answer: D. The Rule 3120 supervisory control system. An independent testing and verification function layered on top of, and reporting on the adequacy of, the firm's Rule 3110 WSPs

    Rule 3120 requires a firm to designate one or more principals to establish, maintain, and enforce a system of supervisory controls that tests and verifies that the firm's WSPs (required under Rule 3110) are reasonably designed and actually followed, and to report the results. Including any additional or amended procedures. To senior management at least annually. This is a distinct testing/verification layer on top of the WSPs themselves, not a replacement for them. It is separate from branch inspections (3110(c)) and from the annual CEO certification under Rule 3130, which attests that the firm has compliance processes in place rather than performing the testing itself.

    • A. Incorrect. The Rule 3110 written supervisory procedures are the procedures being tested. The testing and the report to senior management do not replace them. They check whether those procedures are followed and adequate.
    • B. Incorrect. Branch inspections under Rule 3110(c) are on-site reviews of office locations. They are a separate obligation, and testing the supervisory procedures and reporting annually to senior management does not satisfy it.
    • C. Incorrect. The Rule 3130 CEO certification is a separate annual attestation about the firm's compliance processes. It is related but distinct. It is not the principal's testing and verification of the supervisory procedures, and the report to senior management does not replace it.
    • D. This describes the Rule 3120 supervisory control system precisely: independent testing and verification of the adequacy and effectiveness of the firm's WSPs, with results reported annually to senior management.

  8. Question 8, medium

    A firm wants to inspect certain lower-risk non-supervisory branch offices less frequently than others, using a risk-based approach permitted under Rule 3110(c). What must the firm do to support this approach?

    • A.Little beyond adopting the schedule, because risk-based approaches are left to the firm's discretion and documentation of the underlying factors is expected after FINRA raises a deficiency in an examination, with the minimum frequency waived for lower-risk offices
    • B.Publish its risk-based inspection methodology to the public on its website and update it each calendar quarter so that investors can review how branch offices are scheduled and tiered
    • C.Obtain FINRA's prior written approval for every branch's individual schedule before conducting any inspection, and resubmit each schedule for approval whenever the firm's business changes
    • D.Document the factors considered (e.g., size, complexity of business, disciplinary history, products offered) supporting its risk assessment and resulting inspection schedule, and still meet the applicable minimum frequency
    Show answer and explanationHide answer

    Correct answer: D. Document the factors considered (e.g., size, complexity of business, disciplinary history, products offered) supporting its risk assessment and resulting inspection schedule, and still meet the applicable minimum frequency

    While Rule 3110(c) allows firms to use a risk-based system to determine which offices are inspected more or less frequently within the applicable minimums, the firm must document the factors it considered in establishing that risk-based schedule so that both its own testing function and examiners can evaluate whether the approach is reasonable. It does not eliminate documentation, does not require FINRA pre-approval of individual schedules, and does not require public website disclosure of internal risk methodology.

    • A. Risk-based schedules are not unfettered discretion, and the minimum inspection frequency is not waived for lower-risk offices. Rule 3110(c) expects the firm to document its risk assessment and still satisfy minimum frequencies.
    • B. There is no requirement to publish the risk-based inspection methodology publicly or to update it for investors; it is an internal supervisory and compliance document.
    • C. FINRA does not pre-approve individual branch inspection schedules or re-approve them as business changes; the firm designs and documents its own risk-based methodology subject to exam and enforcement scrutiny after the fact.
    • D. Correct. The firm must document the factors it considered (size, business complexity, disciplinary history, products offered, etc.) supporting the risk-based schedule, while still meeting the rule's minimum frequency requirements.

Sources

Questions are drafted with help from AI and published only after a person reviews and approves them. How these questions are made

More Written Supervisory Procedures questions

Practice Written Supervisory ProceduresCustomize Series 24 practice

Keep going

More Series 24 topics

Already working in the field?

Learn about Parsonex