Cybersecurity, Outsourcing And FINRA Regulatory Compliance

The Financial Industry Regulatory Authority (FINRA) published in January a 16-page list of regulatory and examination priorities for 2012. Of particular note for FINRA member firms interested in outsourcing, offshoring or third-party relationships, there are three particularly important priorities:

Integrity of Supervision and Internal Controls; Information Technology and Cybersecurity; and Outsourcing Integrity of Supervision and Internal Controls is the foundation for any compliance program. Effective internal controls are the result of a broker-dealer's reflective analysis of its business, operations and technology, and the risks associated with opening the doors every day. The Cybersecurity priority in conjunction with the Outsourcing priority introduce a new slant on a company's approach to preparing for the annual FINRA exam this year. A company's risk assessment with regard to cybersecurity must take into account both its own internal cybersecurity risks and those cybersecurity risks that may derive from any third-party contracts (outsourcing and offshoring). It is important to note that considering third-party cybersecurity risks must address explicitly the third party's ability to fulfill its contractual obligations, and also assess risks to the third party's ability to continue in business in the face of cybersecurity threats. Consistent with and in addition to the company's regulatory compliance obligations...