CIRO Director and Executive Exam Blueprint

Last revised: June 29, 2026

Practical exam blueprint for the Canadian Investment Regulatory Organization CIRO Director and Executive Exam, exam code Director & Executive Exam.

How to Use This Exam Blueprint

Use this checklist as an independent study map for the Canadian Investment Regulatory Organization CIRO Director and Executive Exam. The official exam code is Director & Executive Exam.

This page is not an official outline and does not assign exam weights. Treat each area as a readiness area: you should be able to explain the concept, apply it to a director or executive scenario, identify the compliance risk, and choose a practical governance response.

A good final-review rhythm:

Read each topic row.
Mark weak areas.
Practice scenario questions that force a decision.
Revisit current CIRO rules, course materials, and your firm’s policies for exact rule language and required procedures.
Confirm that you can distinguish board oversight, executive management, compliance, supervision, and operations responsibilities.

Exam identity and readiness focus

Item	What to know
Official provider	Canadian Investment Regulatory Organization
Official exam title	CIRO Director and Executive Exam
Official exam code	Director & Executive Exam
Checklist purpose	Translate likely governance, supervision, compliance, and conduct areas into practical readiness tasks
What “ready” means	You can apply director/executive judgment to facts, not just define terms
What to avoid	Memorizing slogans without knowing escalation, documentation, accountability, and control expectations

Topic-area readiness table

Readiness area	You should be able to review	“Ready” looks like
Regulatory framework	CIRO’s role, member obligations, securities regulatory environment, internal policies, and firm-level accountability	You can identify which issue belongs to CIRO rules, securities law, firm policy, compliance supervision, or board oversight
Director and executive accountability	Oversight duties, senior management responsibility, delegation limits, tone at the top, escalation expectations	You can explain why delegation does not eliminate accountability
Governance structure	Board committees, reporting lines, independence, minutes, charters, risk dashboards, management reporting	You can identify missing evidence of effective oversight
Compliance system	Written policies, compliance testing, monitoring, exception reporting, remediation, issue tracking	You can spot when a compliance program exists on paper but is ineffective in practice
Supervision	Branch supervision, trade review, account review, exception handling, escalation, supervisory evidence	You can choose the correct supervisory response to a red flag
Registration and proficiency	Registered individuals, approved roles, permitted activities, conditions, outside activities, role changes	You can identify when a person may be acting outside their registration or approval
Know Your Client and suitability	Client facts, risk profile, investment objectives, time horizon, concentration, leverage, updates	You can determine whether a recommendation or account action is suitable based on the client profile
Know Your Product and product due diligence	Product approval, risk classification, target market, costs, liquidity, complexity, ongoing monitoring	You can tell when a firm should pause, escalate, or strengthen product review
Conflicts of interest	Identification, avoidance, control, disclosure, compensation conflicts, proprietary products, referral arrangements	You can distinguish disclosure-only responses from situations needing stronger controls
Client communications	Advertising, performance claims, social media, misleading statements, supervision of communications	You can identify communications that are unbalanced, promissory, incomplete, or not adequately reviewed
Trading and market conduct	Fair dealing, order handling, prohibited practices, manipulative conduct, trade errors, best-execution concepts where applicable	You can recognize conduct that creates market integrity or client fairness concerns
Complaints and dispute handling	Intake, classification, acknowledgment, investigation, response, documentation, escalation to regulators where required	You can choose the proper governance response to a serious or recurring complaint pattern
Books and records	Required records, retention, audit trails, approvals, supervisory notes, client files, committee minutes	You can identify what documentation would prove a decision was reasonable
Financial and operational controls	Capital awareness, liquidity, segregation/custody concepts, reconciliations, finance reporting, operational risk	You can interpret warning signs and know when senior escalation is needed
Risk management	Enterprise risk, compliance risk, operational risk, cyber risk, third-party risk, model or technology risk	You can connect business strategy to control expectations
AML, sanctions, and financial crime	Client due diligence, suspicious activity indicators, escalation, reporting logic, staff training, recordkeeping	You can recognize red flags and avoid “business pressure” shortcuts
Privacy, cybersecurity, and data governance	Client data protection, incident response, access controls, vendor controls, breach escalation	You can identify when a technology incident becomes a governance and reporting issue
Outsourcing and third parties	Due diligence, contracts, service levels, monitoring, concentration risk, access to records, exit plans	You can explain why outsourcing a function does not outsource accountability
Business continuity	Continuity plans, testing, critical functions, communications, remote work, vendor disruption	You can assess whether a plan is documented, tested, and updated
Ethics and culture	Fair dealing, client-first judgment, conflicts culture, whistleblowing, remediation, disciplinary tone	You can choose an ethical response even when the commercial incentive points elsewhere

Can you do this?

Use these prompts for active recall. If you cannot answer without notes, add the area to your final-review list.

Governance and accountability

Explain the difference between board oversight and day-to-day management.
Identify when directors should challenge management rather than simply receive a report.
Describe how senior executives demonstrate “tone at the top.”
Explain why undocumented oversight may be treated as weak oversight.
Identify when a matter should move from management reporting to board or committee escalation.
Distinguish a policy deficiency from an execution deficiency.
Explain why growth, new products, or new technology should trigger a reassessment of controls.
Identify the evidence that shows an issue was escalated, considered, remediated, and followed up.

Compliance and supervision

Map a compliance issue from detection to escalation to remediation to testing.
Recognize when exception reports are not being reviewed effectively.
Identify weak branch supervision indicators.
Determine when a repeated minor issue becomes a systemic issue.
Distinguish a one-time employee error from a control design failure.
Explain how compliance, supervision, internal audit, finance, legal, and business management should interact.
Recognize when a firm policy is stricter than a minimum regulatory requirement and still must be followed.
Identify the documentation needed to support supervisory review.

Client and product conduct

Apply client facts to suitability concerns.
Identify missing or stale Know Your Client information.
Recognize product risks that must be understood before approval or recommendation.
Identify concentration, leverage, liquidity, complexity, and cost concerns.
Determine when a recommendation may be unsuitable even if the client requested it.
Recognize when disclosure is not enough to manage a conflict.
Spot misleading or incomplete client communications.
Explain why high compensation, proprietary products, or referral benefits can create conflict risk.

Operational and financial control awareness

Identify warning signs in finance, operations, reconciliations, custody, segregation, or liquidity reporting.
Explain why unresolved reconciliation breaks require escalation.
Recognize when a technology outage affects client service, trading, supervision, or books and records.
Identify vendor concentration and outsourcing risks.
Explain the governance importance of business continuity testing.
Determine when operational incidents should be reported upward.
Recognize when rapid business growth creates control strain.
Distinguish financial performance metrics from regulatory financial condition indicators.

Director and executive decision-point checks

Scenario cue	What the exam may be testing	Strong response
Management says an issue is “immaterial” but cannot provide analysis	Challenge, documentation, materiality judgment	Request supporting analysis, document the basis, and escalate if unresolved
A branch has repeated exceptions but strong revenue	Supervisory independence, conflict pressure	Strengthen review, investigate root causes, and avoid revenue-driven tolerance
A new product is profitable but complex and illiquid	Product due diligence, KYP, conflicts, suitability	Require documented product review, target market analysis, training, supervision, and client disclosure controls
A senior producer resists compliance oversight	Culture, accountability, supervision	Escalate through management; do not permit production status to override controls
Complaint volume is low, but trade corrections are rising	Hidden client harm, weak complaint classification	Review whether issues are being misclassified or resolved without proper complaint handling
An outsourced vendor handles critical client data	Third-party risk, privacy, business continuity	Confirm due diligence, contract controls, monitoring, incident response, and access to records
A cybersecurity incident may have exposed client information	Incident governance, privacy, communication, escalation	Activate response plan, assess impact, preserve evidence, escalate, and follow required reporting procedures
A compliance report lists overdue remediation for several quarters	Board oversight, management accountability	Require timelines, owners, severity assessment, and follow-up reporting
A finance report shows unusual variances or unresolved breaks	Financial controls, operational risk	Ask for root-cause analysis, impact assessment, and escalation to appropriate control functions
Staff use unapproved communication channels with clients	Recordkeeping, supervision, communications controls	Stop the practice, preserve records where possible, train staff, and test controls
A client insists on a high-risk strategy inconsistent with their profile	Suitability, documentation, client instructions	Reassess client facts, warn clearly, document, and decline if the action cannot be supported
A director receives informal notice of a serious issue before the board meeting	Escalation duty, timing, governance response	Do not wait passively; confirm escalation path and ensure the matter is properly addressed

Governance artifacts to recognize

You do not need to memorize every possible document name. You do need to know what evidence should exist when directors and executives are exercising oversight.

Artifact	Why it matters	Weakness to spot
Board or committee minutes	Shows questions asked, decisions made, and follow-up assigned	Minutes only record presentations, not challenge or decisions
Risk dashboard	Summarizes key compliance, financial, operational, and conduct risks	Metrics are stale, unexplained, or not tied to action
Compliance report	Communicates issues, testing results, trends, and remediation status	Reports list issues without severity, owners, or deadlines
Exception report	Identifies transactions, accounts, or activities requiring review	Exceptions are generated but not reviewed or escalated
Product approval record	Supports KYP, due diligence, target market, and risk assessment	Approval focuses on revenue, not product risk or client impact
Supervisory review notes	Evidence that supervision occurred and red flags were addressed	Reviews are generic, late, or unsupported
Complaint file	Documents intake, investigation, response, and resolution	Complaint is treated as a service issue to avoid formal handling
Incident report	Tracks operational, cyber, privacy, or trading incidents	Root cause and remediation are missing
Training records	Show that staff were informed of policies and changes	Training is not role-specific or not completed by relevant staff
Policy exception log	Tracks approved deviations from standard policy	Exceptions become routine without reassessment
Outsourcing due diligence file	Shows vendor risk was assessed and monitored	No exit plan, service monitoring, or access-to-records assurance
Business continuity test results	Prove continuity plans work in practice	Plans are documented but never tested or updated

Role distinction checklist

A common exam challenge is deciding who should do what. Use this table to test whether you can separate roles without assuming one function owns everything.

Role or function	Typical readiness focus	Exam trap
Directors	Oversight, challenge, governance, risk appetite, escalation, evidence of reasonable inquiry	Acting as if receiving reports is enough
Senior executives	Implementation, resources, accountability, control execution, culture	Treating compliance as separate from business management
Compliance leadership	Policies, monitoring, advice, testing, escalation, regulatory interaction	Assuming compliance can replace business supervision
Supervisors and branch management	Daily supervision, trade/account review, staff conduct, local escalation	Ignoring red flags because the representative is experienced
Finance and operations	Financial reporting, reconciliations, custody/segregation awareness, operational controls	Treating unexplained breaks as administrative issues only
Legal or risk functions	Interpretation, risk assessment, issue management, governance support	Relying on legal advice without implementing controls
Registered representatives or advisors	Client interaction, KYC updates, recommendations, disclosure, documentation	Treating client consent as a cure for unsuitable conduct
Internal audit or independent review	Independent testing and assurance where applicable	Confusing audit findings with remediation itself
Third-party vendors	Contracted services	Assuming outsourcing transfers regulatory responsibility

Client-facing conduct checklist

Know Your Client and suitability

Can you identify which client facts are required to assess a recommendation?
Can you spot stale, incomplete, or contradictory client information?
Can you explain how risk tolerance, risk capacity, time horizon, liquidity needs, investment knowledge, and objectives interact?
Can you identify concentration risk even when each individual investment appears acceptable?
Can you identify leverage risk and explain why it changes suitability analysis?
Can you distinguish a client-directed order from a recommended transaction and still assess supervisory concerns?
Can you determine when an account update should be required?
Can you document the rationale for a recommendation in a way another reviewer could understand?

Know Your Product

Can you explain the product’s structure, risk, cost, liquidity, and target market?
Can you identify who approved the product and what due diligence was performed?
Can you identify when product complexity requires training or enhanced supervision?
Can you spot a mismatch between product risk and client profile?
Can you explain why past performance or issuer reputation does not eliminate product due diligence?
Can you identify ongoing monitoring needs after product approval?

Conflicts and disclosure

Can you identify compensation, referral, proprietary product, outside activity, personal trading, and related-party conflicts?
Can you decide whether a conflict should be avoided, controlled, disclosed, or escalated?
Can you explain why disclosure must be meaningful, timely, and understandable?
Can you spot when disclosure is used as a substitute for fixing an unacceptable conflict?
Can you identify when a conflict affects supervision or product shelf decisions?
Can you document how the firm addressed the conflict and why the response was reasonable?

Compliance program readiness map

Compliance element	Questions to ask	Final-review cue
Policies and procedures	Are they current, specific, approved, and communicated?	A policy that staff do not follow is not an effective control
Monitoring	Are activities reviewed using risk-based methods?	Monitoring must detect actual issues, not just confirm forms exist
Testing	Does the firm test whether controls work?	Testing should lead to findings and remediation
Escalation	Are severity, timing, and reporting lines clear?	A serious issue should not stall at a low level
Remediation	Are owners, deadlines, and verification steps assigned?	Fixing the symptom is not the same as fixing root cause
Training	Is training role-specific and documented?	Annual generic training may not address new risks
Reporting	Do reports show trends, exceptions, and unresolved items?	Directors need decision-useful information
Independent challenge	Is there a way to challenge business decisions?	Control functions must have sufficient authority
Recordkeeping	Can the firm prove what happened?	If it is not documented, it may be difficult to defend
Continuous improvement	Are lessons learned incorporated?	Repeat findings suggest weak governance

Scenario workflow: when to escalate

Use this decision path to practice governance judgment. The exact escalation channel depends on firm policy and current regulatory requirements, but the logic is useful for exam scenarios.

    flowchart TD
	    A[Issue or red flag identified] --> B{Client harm, rule breach, financial risk, privacy/cyber impact, or market integrity concern?}
	    B -- Yes --> C[Escalate promptly to appropriate supervisor, compliance, risk, legal, or executive channel]
	    B -- No or unclear --> D[Assess facts, materiality, pattern, and control impact]
	    D --> E{Is the issue repeated, unresolved, senior-level, or systemic?}
	    E -- Yes --> C
	    E -- No --> F[Document review and handle under normal procedure]
	    C --> G[Assign owner, action plan, timeline, and documentation]
	    G --> H{Requires board/committee attention or regulatory handling?}
	    H -- Yes --> I[Escalate through governance and reporting process]
	    H -- No --> J[Monitor completion and test remediation]
	    I --> J

Common weak areas and traps

Trap	Why it is dangerous	Better exam habit
“The CCO owns compliance, so directors do not need to know details.”	Directors and executives still need effective oversight and escalation	Ask what information leadership received and what they did with it
“No complaints means no client harm.”	Complaints can be misclassified, suppressed, or hidden by informal corrections	Look for trends in errors, reversals, exceptions, and staff conduct
“Disclosure cures every conflict.”	Some conflicts require avoidance or controls beyond disclosure	Ask whether the client can reasonably understand the conflict and whether the conflict is acceptable
“A top producer deserves flexibility.”	Revenue pressure can undermine supervision and culture	Apply controls consistently and escalate resistance
“A policy exists, so the firm is compliant.”	Implementation, testing, and evidence matter	Look for monitoring, training, exception handling, and remediation
“The client agreed, so suitability is solved.”	Client consent does not automatically make conduct suitable or fair	Apply client facts and product risk objectively
“Outsourcing means the vendor is responsible.”	The firm remains accountable for outsourced functions	Check due diligence, monitoring, contracts, and exit planning
“Minor exceptions can be ignored.”	Repeated minor issues may indicate systemic weakness	Review trends and root causes
“Board packets are enough.”	Oversight requires challenge, follow-up, and documentation	Look for questions, decisions, action items, and closure
“Technology incidents are only IT issues.”	Cyber, privacy, trading, records, and client impact may require broader escalation	Activate incident governance and assess regulatory implications

Calculation and data interpretation readiness

The CIRO Director and Executive Exam is primarily a governance and applied-judgment exam for directors and executives, but finance candidates should still be ready to interpret numerical or control information when it appears in a scenario.

Review your materials for any formulas, ratios, thresholds, or reporting concepts they expressly provide. Without relying on unsupported numbers, make sure you can:

Interpret a trend table showing rising exceptions, complaints, trade errors, or unresolved reconciliations.
Identify whether a metric is a performance metric, risk metric, compliance metric, or regulatory indicator.
Explain why unusual variances require inquiry.
Recognize that “within budget” does not mean “within risk appetite.”
Distinguish absolute dollar impact from pattern, frequency, client impact, and control significance.
Identify when management needs to provide root-cause analysis rather than only a status update.
Explain why capital, liquidity, custody, segregation, and reconciliation issues may require urgent escalation.
Avoid inventing thresholds in an exam response unless the question or study material provides them.

Final-week review checklist

Rules and vocabulary

Re-read the current exam materials for CIRO terminology.
Review key terms related to member firms, approved or registered individuals, supervision, compliance, complaints, conflicts, and records.
Confirm you know which terms are regulatory terms and which are internal firm governance terms.
Create a one-page glossary of terms you confuse.

Governance judgment

Practice identifying who should act: director, executive, compliance, supervisor, finance, legal, operations, or third-party manager.
Practice distinguishing oversight from execution.
Practice explaining why documentation matters.
Practice deciding when escalation is required.
Practice spotting systemic issues from repeated facts.

Client and conduct scenarios

Review KYC, suitability, KYP, conflicts, disclosure, communications, and complaint scenarios.
Practice with cases involving senior clients, vulnerable clients, leverage, concentration, illiquid products, high-risk strategies, and complex products if covered in your materials.
Practice identifying the most client-protective and regulatorily sound response.
Review why commercial pressure is not a valid reason to weaken controls.

Firm controls

Review compliance program elements.
Review supervisory evidence and exception handling.
Review financial and operational red flags.
Review privacy, cyber, outsourcing, and business continuity scenarios.
Review how remediation is tracked and verified.

Exam technique

Read each fact pattern for role, timing, materiality, client impact, and escalation clues.
Avoid answers that do nothing, delay without reason, or rely only on informal conversations.
Prefer responses that document, escalate, remediate, test, and follow up.
Be cautious with absolutes such as “always,” “never,” or “only,” unless clearly supported.
If two answers seem plausible, choose the one that better protects clients, market integrity, regulatory compliance, and documented governance.

Practical next step

Turn this Exam Blueprint into a scorecard. Mark each row as confident, review, or weak. Then practice scenario questions that require you to choose the best director or executive response, explain the control failure, and identify the documentation or escalation step that should follow.

Study Plan

Scenario Guide