Risk Control Assessment Frequently Asked Questions (FAQ)

  1. What is the Risk Control Assessment (RCA)?
  2. How do I access the survey?
  3. What if my firm does not receive the survey?
  4. Why doesn't FINRA already have this information?
  5. Is my firm's data secure?
  6. What if my firm does not receive the survey?
  7. Who at the firm is responsible for responding to the RCA?
  8. How long should the RCA take to complete?
  9. How will the responses be used?
  10. What changes have been made to the 2016 RCA?
  11. Does the RCA contain questions that relate to specific rules or compliance issues?
  12. The pre-selected sections listed on the Introduction page are not reflective of the material aspects of my overall business. What should I do?
  13. Should all potential business activities and or products sold be disclosed even if they are not material to the overall business?
  14. How should we answer questions that could have multiple interpretations?
  15. I am unable to obtain the exact distribution of my firm's revenue by brokerage business or investment banking activity. What should I do?
  16. Can I amend or revise the RCA after it has been submitted?

1. What is the Risk Control Assessment (RCA)?
The RCA is an integral part of FINRA’s risk-based examination and surveillance program. FINRA sends the RCA to firms to collect information about the risks associated with the business models and activities of member firms, the products and services they sell, and the kinds of clients and counterparties with which they deal. FINRA uses the information collected to inform its risk-based surveillance and examination programs, with the goal of streamlining examinations.
2. How do I access the survey?
Each firm's executive representative will be sent an email around June 1, 2016, with a unique link to the survey. Individuals who serve as executive representative to multiple firms will receive multiple emails, with each one listing the name and CRD number for the firm for which the survey is intended, along with the link to that firm's survey. More information, including how to complete the survey, is included in the RCA instructions.
3. What happens if my firm does not complete the survey?
This is a voluntary survey. There will be no negative repercussions should your firm choose not to participate. However, in most instances, examinations will take longer to complete since FINRA examiners will plan the examination and arrive onsite at your firm without the benefit of important information needed to complete a risk-based assessment. Feedback from firms that have experienced examinations after participating in the RCA survey process revealed that examiners were better prepared to understand firm-specific risks.
4. Why doesn't FINRA already have this information?
FINRA does not capture and maintain the type of information across all member firms that the survey seeks to discover. Moreover, business models, product and service offerings, and risk control processes change over time. The survey is designed to capture these changes.
5. Is my firm's data secure?
Your survey responses will only be accessible to authorized FINRA employees. Your responses are transmitted and stored using both server authentication and data encryption, thereby ensuring the data is safe, secure and available only to authorized persons. No one outside FINRA and no unauthorized FINRA employees will have access to your responses.
6. What if my firm does not receive the survey?
The emails containing your firm's unique survey link will be sent from RCA@finra.org. Some firewall rules and Internet security systems may block messages from CVENT. If your firm has this level of security, please have your IT department grant access to ‌www‌.cvent.com and allow all of its sub-domains.
It is also possible that your firm's network automatically routed the RCA message to a spam or junk folder. Please check the spam or junk folder of your mailbox and look for the email with the subject "2016 FINRA Risk Control Assessment" from RCA@finra.org. If you still cannot find it, please email RCA@finra.org.
7. Who at the firm is responsible for responding to the RCA?
The firm's executive representative should serve as the primary point of contact for the RCA. Depending on the firm's size and nature of its business, the executive representative may need to identify others who can respond to the survey. The survey can be saved and the link can be forwarded to others within the firm to help with this process. If multiple contributors will be responding within the firm, only one person should edit the survey at a time to avoid inadvertently overwriting responses.
8. How long should the RCA take to complete?
The RCA survey content is dynamically built based on the responses given to an initial set of questions about the firm's business model. Firms with a simple business model will complete a shorter survey. Firms that are engaged in multiple business lines will complete a longer survey. As a result, the total time commitment required to complete the survey will vary.
9. How will the responses be used?
FINRA will use the results of the RCA to better understand the specific business models of individual member firms, the attendant risks of those business models, and the controls intended to manage those risks. We will also use this information to benchmark controls and get a better sense of industry-leading practices as they relate to risks and controls. FINRA will use this information to enhance the quality of our regulatory programs-particularly our surveillance and onsite examinations.
10. What changes have been made to the 2016 RCA?
The 2016 RCA has been further streamlined to target key business areas and ease overall completion of the survey. This was accomplished by incorporating pre-filled data for firms that completed the 2015 survey, and using updated revenue data from firms' Supplemental Statement of Income (SSOI) filings to drive the survey sections to which firms will be asked to respond.
Prior enhancements that remain include more opportunities to provide optional comments where available answer choices do not necessarily fit, and an improved print functionality to allow for a single-click print option at the end of the survey, allowing respondents to print all of their responses at once.
11. Does the RCA contain questions that relate to specific rules or compliance issues?
No. The survey does not seek to test for compliance with specific rules.
12. The pre-selected sections listed on the Introduction page are not reflective of the material aspects of my overall business. What should I do?
The pre-selected survey sections are driven by revenue line items as reported in firms' Supplemental Statement of Income (SSOI) filings from the last 12 months. You are encouraged to select additional business areas (i.e. survey sections) on the Introduction page of the survey if they represent a material aspect of your overall business. Alternatively, you are requested to please de-select any business line that does not represent a material aspect of your overall business.
13. Should all potential business activities and or products sold be disclosed even if they are not material to the overall business?
No. We are interested in responses regarding business activities that represent a material component of your overall business. If these activities are not a regular part of your business or are not material, they should not be disclosed.
14. How should we answer questions that could have multiple interpretations?
Although we've taken every effort to use common financial services industry terms, you may identify words or phrases that you feel are open to interpretation. In all cases, we mean the commonly accepted uses of terms. As a general rule, use your best judgment and experience, considering interpretations from the perspective of the financial services industry.
15. I am unable to obtain the exact distribution of my firm's revenue by brokerage business or investment banking activity. What should I do?
For questions in the survey that ask you to enter the approximate percentage of revenue for different business lines, please provide your best estimate rounded to the nearest whole number. Please see the RCA Instructions for additional guidance.
16. Can I amend or revise the RCA after it has been submitted?
It is not possible to re-open the survey to make changes to your firm's responses after the survey has been submitted. However, if you discover a material inaccuracy in your submission, please contact the FINRA RCA team, and we will make sure that the survey properly reflects your views.

If you need any additional help, please contact the FINRA RCA team.