Practice question, Branch and remote offices
Explain how safeguarding of customer information, vendor due diligence and supervision work at each branch or remote office, and where they differ from the main office.
Taft practice question: not an official regulator question. SEC Division of Examinations, United States (federal). For SEC-registered investment advisers, Broker-dealers. Evidence category: Supervision records.
Not legal advice. A practice prompt for rehearsing how your team explains its controls and evidence. No scoring, no model answer, no implication that a regulator will ask these words.
Authored by Taft. Last checked 2026-11-09. All questions.
Why it is relevant
A 2023 staff risk alert reported that many firms implemented safeguarding policies and procedures for their main office but often did not do so for branch offices, and that branch offices often did not perform the vendor due diligence the firm's own policies required.
Sources: [1] Section III, Vendor Management
Evidence to locate
Suggested, not mandatory. A regulator's actual request list governs.
The remote office or independent contractor oversight process.
Sources: [2] Attachment, Compliance Program and Oversight Process
Follow-up prompts
Which branch was reviewed last, and what did the review cover?
Applicability
- Applies to
- Firms with locations other than a main office, including offices of independent contractors.
- Does not apply to
- Not stated.
Cite
Cite the official source first. Then: Taft Compliance Group, Exam-prep toolkit (draft), question q-branch-office-controls, https://taftcompliance.com/resources/exam-prep-toolkit/questions/q-branch-office-controls, last checked 2026-11-09.
Sources
U.S. Securities and Exchange Commission, Division of Examinations, Risk Alert: Safeguarding Customer Records and Information at Branch Offices (staff statement). regulator guidance. Section III, Common Issues Related to Branch Office Governance, Vendor Management.
https://www.sec.gov/files/risk-alert-safeguarding-info-branch-offices-042623.pdf
Checked 2026-11-09; published 2023-04-26.
Supporting passage
In assessing compliance with the Safeguards Rule, staff observed that while many firms implemented policies and procedures for safeguarding customer records and information for their main office, they often did not do so for branch offices. Firms use vendors to provide services such as cybersecurity, technology operations, and business applications. In many instances firms did not appear to reasonably ensure that their branch offices performed proper due diligence and oversight of their vendors as required by the firms' own policies and procedures.
U.S. Securities and Exchange Commission, Division of Examinations, Risk Alert: Investment Advisers: Assessing Risks, Scoping Examinations, and Requesting Documents (staff statement). regulator guidance. Attachment, Typical Initial Information Examiners Request of Investment Advisers: Compliance Program and Oversight Process; Valuation; Information Processing, Reporting, and Protection.
https://www.sec.gov/files/risk-alert-ia-risk-and-requesting-documents-090623.pdf
Checked 2026-11-09; published 2023-09-06.
Supporting passage
Compliance policies and procedures in effect during the examination period. Tests performed (i.e., compliance reviews, quality control analyses, surveillance, and/or forensic or transactional tests performed by the firm). Annual and/or interim reviews of policies and procedures, including any reports prepared. Record of compliance exceptions. Inventory of compliance risks and conflicts of interest that forms the basis for policies and procedures and notations regarding changes made to the inventory. Valuation process. Fair-valued and illiquid securities held by clients. Advisory fee calculations. Pricing overrides. Safeguards for the protection of customer records and information. Business continuity plan. Cybersecurity incidents or breaches (e.g., incident description, impact, and remediation).
Changes to this question
No released changes.