Root Cause Analysis

A firm's Rule 3120 testing identifies that one branch's correspondence review process has a specific gap, allowing certain electronic messages to bypass review entirely due to a system configuration issue. The firm fixes the configuration at that one branch and closes the finding, without checking whether other branches using the same messaging system have the identical configuration issue. What is the concern with this response?

1. A.There is no concern, since the specific deficiency identified during testing was fully corrected at the branch where it was found, which is the appropriate scope of any remediation.Wrong. Fixing only the single instance discovered leaves the firm without assurance the same root cause isn't present elsewhere.
2. B.A configuration issue causing a specific gap at one branch may well exist at other branches using the same underlying system, and fixing only the branch where it happened to be discovered without checking for the same root cause elsewhere leaves the firm without any assurance the identical gap isn't quietly present somewhere else.Correct. A root-cause configuration issue discovered at one branch needs to be checked for at other branches using the same system.
3. C.The concern is limited to whether the branch's correspondence review process should now be tested more frequently than other branches going forward, given its history.Wrong. Increased testing frequency at just that branch does not address whether the same root-cause issue exists elsewhere.
4. D.The concern is that the firm should switch to an entirely different messaging system firm-wide, regardless of whether the same configuration issue actually exists at other branches using the current system.Wrong. This overreaches into replacing the whole system before first confirming the actual scope of the underlying issue.

Why: A configuration issue causing a specific gap at one branch may well exist at other branches using the same underlying system, and fixing only the branch where it happened to be discovered without checking for the same root cause elsewhere leaves the firm without any assurance the identical gap isn't quietly present somewhere else.

A firm's supervisory control testing identifies that a particular review function has been consistently performed late or incompletely for months. The principal's response is to revise the WSP language describing the review's required timing, without ever asking why the review was being performed late in the first place, which turns out to be because the single person responsible for it is also handling several other full-time roles simultaneously. What is the concern with this response?

1. A.There is no concern, since updating the WSP language to reflect a more achievable timing standard is the appropriate response to a review function that has consistently been performed late.Wrong. Lowering the standard rather than addressing why it wasn't being met does not fix the underlying capacity problem.
2. B.The concern is limited to whether the revised WSP language was reviewed by a second principal before being finalized, regardless of the underlying staffing issue.Wrong. A second reviewer of the revised language does not address the actual resource problem causing the lateness.
3. C.Rewriting the procedural language addresses how the requirement is described on paper but doesn't address the actual underlying cause of the late performance, which is that the person responsible is stretched across too many roles to perform the function on time; without addressing that root cause, the same lateness is likely to continue regardless of what the revised WSP says.Correct. Rewriting procedural language doesn't fix an underlying staffing or resource constraint causing the actual lateness.
4. D.The concern is that the person responsible for the review function should be replaced entirely with a different individual, regardless of whether that new person would face the same competing role conflicts.Wrong. Simply swapping personnel without addressing the underlying overload does not fix the root cause either.

Why: Rewriting the procedural language addresses how the requirement is described on paper but doesn't address the actual underlying cause of the late performance, which is that the person responsible is stretched across too many roles to perform the function on time; without addressing that root cause, the same lateness is likely to continue regardless of what the revised WSP says.

A firm experiences a data breach exposing customer account numbers and Social Security numbers. Several weeks pass before the incident is escalated to compliance because the IT department was still investigating the root cause. What is the concern with this sequence of events?

1. A.None, since customer notification is required only after the root cause is fully understoodWrong. This again defers assessment of notification obligations unnecessarily behind the technical investigation.
2. B.None, because breach response is solely an IT function with no compliance involvementWrong. Compliance involvement is necessary to assess the firm's notification and remediation obligations arising from the breach.
3. C.None, since a thorough technical root-cause investigation should always be completed before escalating to complianceWrong. This is the exact sequencing error the question warns against; compliance escalation should not wait for the technical investigation to conclude.
4. D.The firm's incident response should require prompt escalation to compliance upon discovery, running in parallel with the technical investigationCorrect. Prompt escalation to compliance allows notification and remediation obligations to be assessed without waiting for the root-cause investigation to finish.

Why: Waiting for a complete root-cause investigation before escalating a known breach of sensitive customer information to compliance delays the firm's ability to assess its notification and remediation obligations. The principal should expect the firm's incident response procedures to require prompt escalation to compliance upon discovery of a breach, in parallel with the technical investigation, not sequenced after it.