CSI CCO: Application of Skills

Topic snapshot

Application checklist before the questions

This is the largest CCO topic. Treat each question as a short case: identify the risk, decide whether the current control works, and choose the action that creates the strongest defensible next step.

• Look for recurring exceptions; repeated failures usually need escalation or control redesign.
• Do not choose a policy memo when the facts require immediate containment or investigation.
• When two answers are both plausible, prefer the one that leaves better evidence and closes the root cause.

What to drill next after application misses

If your misses cluster here, sort them by failure type: governance, control design, complaint, product activity, investigation, or reporting. Then return to the matching topic page before attempting another full mixed set.

Sample questions

These questions are original Securities Prep practice items aligned to this topic area. They are designed for self-assessment and are not official exam questions.

Question 1

Topic: Application of Skills

A Canadian dealer’s CCO reviews the following draft supervision memo for the institutional equity desk.

Artifact: Draft memo excerpt

• Daily order-entry, price, and volume alerts are sent at 10:00 a.m. to retail branch managers.
• Branch managers decide whether to contact the trader involved.
• The desk head is notified only if an item is still unresolved after 5 business days.
• Compliance receives a monthly summary of unresolved items.
• The same escalation process applies to retail branches and the trading desk.

Which deficiency is best supported?

• A. A single firmwide path is enough for desk alerts.
• B. Desk alerts need desk-specific ownership and a timely escalation path.
• C. Compliance has no stated role in desk exceptions.
• D. Each desk alert should go directly to the board.

Best answer: B

What this tests: Application of Skills

Explanation: The memo applies a retail branch workflow to a trading desk. Because trading activity can create fast-moving order-entry, pricing, and conduct risks, desk exceptions should have desk-specific supervisory ownership and quicker escalation than a general branch process.

Trading-desk supervision requires distinct controls because trading risks can arise and escalate quickly, and they often need review by supervisors who understand desk activity and can act immediately. In the memo, alerts go first to retail branch managers, the desk head is not involved unless an item remains unresolved for 5 business days, and compliance sees only a monthly summary. That structure weakens oversight for desk-specific risks such as unusual order entry, pricing, volume, or market-conduct concerns. A stronger framework assigns primary review to the responsible desk supervisor, sets clear escalation triggers for the desk head and compliance, and supports timely intervention when needed. The closest distractor misreads the artifact by saying compliance has no role at all; the issue is that the role is too delayed and indirect.

• No compliance role misreads the artifact because compliance does receive a monthly summary, even though that involvement is too delayed.
• Board on every alert over-escalates; boards oversee the supervision framework, not routine real-time desk exceptions.
• One path fits all ignores that trading desks need faster, specialized controls than retail branch supervision.

The memo routes trading alerts through retail supervisors and delays escalation instead of using desk-specific oversight with prompt escalation triggers.

Question 2

Topic: Application of Skills

During daily surveillance at a Canadian investment dealer, compliance flags three retail corporate bond trades priced above both the firm’s internal exception threshold and an external pricing source. The fixed income desk supervisor says the bonds were illiquid and asks compliance to wait until month-end to review them with the trader. The dealer’s procedures require prompt investigation of material pricing exceptions. What is the best next step?

• A. Wait until month-end and review the trades with the desk supervisor.
• B. Open a documented review now, preserve records, and obtain pricing support.
• C. Rewrite the fixed income pricing policy before examining these trades.
• D. File a report with CIRO immediately, before validating the exceptions.

Best answer: B

What this tests: Application of Skills

Explanation: The best next step is a prompt, documented review of the flagged bond trades. In a fixed income pricing-exception case, compliance should preserve records and test the trader’s illiquidity rationale before deciding on escalation, remediation, or any regulatory reporting.

This tests the proper sequence for a trading-compliance review. When surveillance identifies material fixed income pricing exceptions, compliance should act promptly to preserve evidence and gather facts, including trade tickets, client instructions, trader and supervisor communications, pricing-source data, and the desk’s rationale for the execution level. A documented review allows the firm to determine whether the higher price was reasonably supported by market conditions such as illiquidity, or whether the trades point to a supervision, conduct, or fair-pricing concern.

A practical sequence is:

• confirm the exception;
• preserve records;
• obtain and assess pricing support;
• then decide on escalation, remediation, client impact review, and any required reporting.

Waiting until month-end weakens control execution, while reporting externally before validating the facts is premature unless an explicit immediate-notice requirement applies.

• Waiting for convenience fails because the firm’s procedures call for prompt review of material exceptions.
• Immediate regulatory reporting is premature before compliance confirms the facts and assesses the trading rationale.
• Policy revision first skips the urgent review of actual trades that may already present client or supervision risk.

Prompt evidence preservation and fact-finding should occur before deciding on any further escalation or reporting.

Question 3

Topic: Application of Skills

A dealer’s compliance testing has found for the third consecutive quarter that staff are not retaining required evidence of client instruction changes in the firm’s books and records. Previous reminders and refresher training reduced exceptions only briefly. A system upgrade is planned in six months, but account changes must continue in the meantime. What is the single best compliance response?

• A. Continue current monitoring and act only if complaints arise
• B. Issue another training reminder and wait for the scheduled upgrade
• C. Document the weakness and let internal audit handle it later
• D. Escalate to senior management and require accountable interim remediation with retesting

Best answer: D

What this tests: Application of Skills

Explanation: Recurring recordkeeping breaches should be treated as a control failure, not a one-time staff awareness issue. The best response is to escalate the matter, assign accountable remediation, put interim controls in place until the system fix arrives, and retest for effectiveness.

The core concept is effective remediation of a repeated control breakdown. When the same recordkeeping deficiency appears over multiple testing cycles, and prior reminders or training have not fixed it, compliance should move beyond awareness measures and require a formal, documented corrective action plan. That plan should be escalated to senior management, identify accountable owners and timelines, introduce interim preventive or detective controls while the longer-term system change is pending, and include follow-up testing to verify that the problem is actually resolved.

This approach addresses both governance and regulatory risk: the firm must maintain reliable books and records now, not only after a future project is completed. Waiting for complaints, relying on another memo, or deferring to a later audit review would leave a known control weakness unresolved. The key takeaway is that repeated failures demand root-cause remediation with ownership, escalation, and evidence of closure.

• Another reminder is too weak because training has already produced only temporary improvement.
• Wait for complaints is reactive because recordkeeping obligations apply even if no client harm has surfaced.
• Defer to audit fails because internal audit does not replace timely first-line and compliance remediation.

A repeated books-and-records failure requires formal escalation, accountable remediation, interim controls, and follow-up testing to confirm the control is working.

Question 4

Topic: Application of Skills

A dealer’s CCO reviews the following registration issue tracker. Assume a dealing representative may give solicited recommendations only if registered in the client’s province of residence.

Exhibit: Registration issue tracker

Which follow-up is most appropriate?

• A. Register in Saskatchewan before sending general product information.
• B. Update the client’s address and continue recommendations.
• C. Obtain Quebec registration before speaking with the travelling client.
• D. Pause recommendations and file Alberta registration for the representative.

Best answer: D

What this tests: Application of Skills

Explanation: The Alberta move changes the relevant service jurisdiction for ongoing solicited recommendations. Because no Alberta individual registration has been filed, compliance should escalate the file, stop recommendations to that client, and complete the registration process before the representative continues solicited servicing.

Registration is jurisdiction-based, so a representative must be properly registered before conducting registerable activity for a client resident in that province. In the exhibit, the only clear jurisdictional problem is the client who permanently moved to Alberta while the representative remained registered only in Ontario and British Columbia. Because the representative has continued to recommend trades, the firm should treat this as an immediate escalation, stop solicited advice for that client, and file the Alberta registration through NRD before continuing. The Ontario client’s temporary stay in Quebec does not, on these facts, change the home jurisdiction, and a Saskatchewan prospect receiving only general information has not yet reached a point that clearly requires individual registration.

Permanent residence plus registerable activity is the key test here.

• Address change only fails because KYC updates do not cure missing provincial registration for ongoing recommendations.
• Temporary travel does not, on these facts, make Quebec the client’s residence jurisdiction.
• Prospect contact is premature because the exhibit shows only general information, not a recommendation or opened account.

The client’s permanent move makes Alberta the relevant jurisdiction, so solicited recommendations should stop until the representative is properly registered there.

Question 5

Topic: Application of Skills

A dealer’s movement-of-funds control flags the following request. Firm policy requires a supervisory hold and compliance escalation when a new third-party transfer cannot be independently confirmed through pre-existing client contact information.

Exhibit: Issue tracker snapshot

What is the best compliance follow-up?

• A. Reject it as an operations exception and close the alert.
• B. Obtain a new signed instruction from the new email.
• C. Keep the hold, escalate, and investigate possible unauthorized transfer.
• D. Process the wire after documenting the renovation note.

Best answer: C

What this tests: Application of Skills

Explanation: The only supported response is to keep the transfer on hold and escalate. The request came through newly changed contact details, involved a large new third-party payment, and was contradicted when the client was reached through existing records. That combination points to possible account takeover, unauthorized activity, or financial exploitation.

The core compliance concept is independent verification of irregular funds movements. Here, several risk indicators appear together: recent contact-detail changes, a large wire to a new third party, and instructions coming from the newly added email address. The decisive fact is that the client was reached using pre-existing contact information and denied making the request.

• Do not release the funds.
• Preserve the email, profile-change records, and callback notes.
• Escalate to compliance and branch supervision for documented investigation.

The renovation note may explain why a legitimate payment could be requested in future, but it does not override a direct denial from the client.

• Renovation note does not authenticate the transfer or cure the client’s direct denial.
• New signed instruction still relies on a potentially compromised communication channel.
• Operations-only handling misses the need to investigate and escalate a possible fraud or exploitation event.

A direct denial from the client through pre-existing contact information means the transfer must stay on hold and be escalated as potentially unauthorized or exploitative.

Question 6

Topic: Application of Skills

A Canadian investment dealer wants to move Maya, currently approved only as a dealing representative in Alberta, into a role supervising retail accounts in Ontario. She has completed the firm’s internal management training, but compliance has not yet confirmed that her proficiency and individual approvals match the new role and jurisdiction. Branch management wants her access activated next week while filings are prepared. What is the best next step?

• A. Activate the role now because internal training is complete
• B. Treat existing Alberta registration as sufficient for Ontario duties
• C. Verify category and proficiency, file NRD changes, and restrict duties pending approval
• D. File the NRD change and allow supervised duties immediately

Best answer: C

What this tests: Application of Skills

Explanation: The firm should not let Maya start the new role based only on internal training or a pending filing. The proper next step is to confirm the required registration category, jurisdictional approval, and proficiency, submit the necessary NRD changes, and keep her within her current approved activities until approval is effective.

Individual registration, approval, and proficiency are related but distinct. Proficiency shows that an individual may be qualified for a role, but it does not by itself authorize that person to perform registered activities. The dealer must first map the proposed duties to the correct registration category and jurisdiction, confirm that the individual meets the required proficiency, submit the necessary NRD filing or amendment, and keep the individual restricted to currently approved activities until the new approval is granted.

Allowing the person to act before approval creates unregistered-activity risk, even if supervision is available or internal training is complete. The key point is that training and filing are prerequisites or evidence, not substitutes for the actual approval needed for the new role.

• Training alone fails because internal training does not replace required registration and approval.
• Pending filing is not enough because supervised performance of the new duties can still be unauthorized before approval.
• Existing province approval is not enough because registration and approval must match the jurisdiction where the new role will be carried out.

Proficiency, registration category, and jurisdictional approval must align before Maya performs the new role.

Question 7

Topic: Application of Skills

A dealer receives a written complaint from a retired client alleging that her registered account was moved into high-risk securities that were unsuitable for her stated objectives. The complaint includes a lawyer’s letter demanding compensation and alleges the representative changed KYC notes after the losses. The branch manager wants to keep the matter in the normal complaint queue while he interviews the representative next week. What is the best next compliance action?

• A. Review the suitability issue first and address the altered KYC allegation only if a lawsuit is filed.
• B. Seek a quick branch-level settlement to reduce the chance of formal escalation.
• C. Escalate immediately to compliance and legal counsel, preserve all relevant records, and treat the matter as both a complaint and a potential civil claim.
• D. Leave the file in the normal complaint process until the branch manager completes his interviews.

Best answer: C

What this tests: Application of Skills

Explanation: This complaint is not just a routine service or suitability matter. The lawyer’s demand letter and allegation that KYC records were changed after the losses indicate possible civil litigation and potential misconduct, so the firm should escalate immediately and preserve evidence.

The core concept is recognizing when a complaint creates litigation exposure in addition to ordinary regulatory risk. Here, the complaint includes two strong warning signs: a lawyer is already demanding compensation, and the client alleges records were altered after the losses. That means the firm should not handle the matter as a routine branch complaint or wait for a formal statement of claim.

The appropriate compliance response is to escalate promptly to compliance and legal counsel, preserve documents and communications, and investigate with both regulatory and civil consequences in mind. That helps protect evidence, supports a defensible review, and allows the firm to manage privilege, governance, and potential reporting or disciplinary implications. A branch-only or delay-first approach is inadequate once litigation exposure is reasonably apparent.

• Normal queue delay fails because a lawyer demand and record-tampering allegation require faster escalation than an ordinary complaint workflow.
• Suitability only fails because the altered KYC allegation can be as important as the investment loss itself from both a regulatory and civil perspective.
• Quick settlement fails because informal resolution does not replace legal review, evidence preservation, and proper escalation.

A lawyer’s demand letter plus an allegation of altered KYC records creates clear litigation exposure as well as regulatory risk, requiring immediate legal escalation and record preservation.

Question 8

Topic: Application of Skills

A retail client submits a written complaint alleging unsuitable trades and asks to be reimbursed for losses. Head office compliance completes the firm’s internal investigation and decides not to offer compensation. The client says she wants an independent review, but the dealer’s complaint policy only describes internal escalation steps and does not clearly distinguish them from external dispute resolution. What is the best next step for the CCO?

• A. Continue internal escalation until the client accepts or sues.
• B. Issue the final response and explain independent external dispute resolution.
• C. Send it to external review before issuing a final response.
• D. Refer the client to CIRO as the compensation forum.

Best answer: B

What this tests: Application of Skills

Explanation: Internal complaint handling is the firm’s own investigation and response; external dispute resolution is a separate independent process for unresolved matters. Because the internal review is complete here, the best next step is to issue the firm’s final response and tell the client how to access the outside process if still dissatisfied.

The key concept is the boundary between a dealer’s internal complaint process and an independent external dispute-resolution process. Internal handling means the firm investigates, supervises, documents its findings, and gives the client a formal response. External dispute resolution is not just another internal appeal, and it is not the same as sending the client to the regulator.

Here, the firm has already finished its internal investigation and decided not to compensate the client. That means the CCO’s best action is to ensure the final response is delivered and that the client is informed about the available independent external process for unresolved disputes. This shows proper complaint governance, clear client communication, and a correct distinction between firm-led handling and outside dispute resolution.

The closest trap is treating a regulatory referral as the client’s compensation route, but regulator oversight and dispute resolution serve different purposes.

• More internal escalation fails because repeated in-house review does not replace access to an independent outside process once the firm’s review is complete.
• Regulator referral fails because CIRO is a regulator and oversight body, not the client’s compensation forum for resolving the dispute.
• Skip the final response fails because the firm should communicate its own concluded position before directing the client to external review.

The firm should complete its internal complaint process and then direct the dissatisfied client to the available independent external dispute-resolution process.

Question 9

Topic: Application of Skills

A CCO reviews the latest control-testing snapshot for a CIRO-regulated investment dealer’s trading department. Desk supervisors say procedures are being updated, but no remediation has been tested. Based on the exhibit, what is the best compliance follow-up?

Exhibit: Control-testing snapshot

• A. Escalate the recurring control weaknesses, add interim controls, assign deadlines, and retest before closure.
• B. Open misconduct files on the traders first and assess the control environment later.
• C. Limit the response to restricted-list monitoring because the other findings are only supervisory issues.
• D. Accept the draft procedure updates and revisit the desk in the next routine review.

Best answer: A

What this tests: Application of Skills

Explanation: The data shows repeated failures in supervisory controls across more than one trading activity, not a one-off exception. With missed remediation dates and no tested fix, the strongest response is escalation, interim mitigation, and retesting before the issue is closed.

This is a control-effectiveness problem, not just a documentation gap or a single trader event. The same exceptions appear across two quarters in equity order corrections and fixed income price overrides, and the remediation tracker shows missed dates with no accountable owner. That pattern supports treating the matter as an unresolved supervisory weakness within the trading department.

A risk-based compliance response would be to:

• escalate the issue beyond the desk level
• require interim compensating controls while remediation is built
• assign a clear owner and deadline
• retest the controls before closing the matter

Waiting for a routine review, focusing only on one exception type, or assuming misconduct before assessing the weak control framework would be insufficient.

• Wait for routine review ignores the repeated exceptions and the missed remediation dates.
• Discipline first jumps to trader misconduct when the exhibit primarily shows weak and inconsistent supervision.
• Focus only on restricted-list checks misreads the exhibit because unsupported corrections and override reviews are also material control failures.

Recurring exceptions across key trading controls, combined with missed remediation dates and no tested fix, support immediate escalation and formal remediation tracking.

Question 10

Topic: Application of Skills

A branch manager receives an email from a 74-year-old client alleging that her representative changed her KYC from balanced to aggressive without permission, placed a concentrated mining stock position, and relied on e-signature pages she says she never reviewed. The client reports a $62,000 loss and asks the firm to reverse the trades. The representative says the client is simply upset about market performance. What is the single best compliance response?

• A. Treat it as a market-loss complaint and let the branch manager resolve it.
• B. Treat it as an informal concern until the client files a signed complaint letter.
• C. Treat it as a reimbursement request and send it to finance first.
• D. Treat it as a serious written complaint, preserve records, and escalate to compliance.

Best answer: D

What this tests: Application of Skills

Explanation: This is more than dissatisfaction with market performance. The client makes a written allegation of unauthorized KYC changes, unsuitable trading, and questionable e-signature use, which creates elevated conduct, supervisory, and litigation risk and calls for immediate compliance involvement and record preservation.

Complaint classification turns on the substance of the allegation, not the representative’s characterization. A written complaint alleging unauthorized changes to KYC, unsuitable recommendations, or possible misuse of signatures is higher risk because it may indicate misconduct, supervision failures, and exposure to civil claims or regulatory scrutiny. The firm should promptly take the matter out of the representative’s hands, preserve the account-opening and KYC record, trading notes, approvals, and e-signature evidence, and escalate to compliance for an independent review. By contrast, a lower-risk service complaint usually involves delays, administrative errors, or communication issues without allegations of unauthorized activity. Market losses do not reduce the seriousness of a complaint that raises possible unauthorized conduct.

• Market-loss framing fails because the complaint alleges unauthorized KYC changes and possible document misuse, not just poor returns.
• Signed-letter requirement fails because the client’s email is already a written complaint that must be handled.
• Finance-first approach fails because reimbursement may be considered later, but classification and investigation belong with compliance first.

The email alleges unauthorized KYC changes and questionable documentation, creating elevated conduct and litigation risk that requires immediate compliance escalation.

Continue with full practice

Use the CSI CCO Practice Test page for the full Securities Prep route, mixed-topic practice, timed mock exams, explanations, and web/mobile app access.

Related focused pages

• Free CSI CCO Full-Length Practice Exam
• CSI CCO: Compliance Role and Structure
• CSI CCO: Canada Regulation and Dealer Risks
• CSI CCO: CCO Skill Requirements
• CSI CCO: Regulatory Investigations and Reporting

Free review resource

Read the CSI CCO guide on SecuritiesMastery.com, then return to Securities Prep for timed practice.