MiFID Controls: Test Effectiveness and Resolve Findings

The engagement examines selected controls in securities business. We agree the business area, period, criteria, test steps and evidence before testing control design and operation against actual cases. The deliverable is a report with findings and actions. Staff training, an independent internal audit and a statutory examination are separate assignments. Where we helped design a control, the required separation of roles must be assessed before any later independent review.

The ESMA guidelines on the MiFID II compliance function link the monitoring programme to a compliance risk assessment. For the engagement, we translate this into review priorities considering the business model, products, clients, channels and known findings. Selection decisions and limitations are recorded. Business changes or new evidence may require an update to the plan.

Design assessment considers whether a control is suitable for its objective. Effectiveness testing examines whether it operated during the review period and could detect relevant exceptions. An approved procedure alone does not establish this. For example, we can compare the prescribed review of advisory records with completed checks and the evidence supporting their results.

We define the population, period and available data first. Selection can combine higher-risk cases with other cases covering agreed characteristics. The method, exceptions and limitations are recorded. A small or targeted sample is not described as statistically representative. Incomplete data is reported as an evidence gap and may require further work before an assessment can be made.

Depending on scope, the review can cover controls over client information, suitability documentation, cost information, product governance or conflicts of interest. Each control needs a specific objective and agreed applicable criteria. A detailed best-execution assessment or implementation of a business process requires its own defined scope. A list of topics is not a complete review programme.

The finding records the observation, supporting evidence, affected control and potential consequence. The responsible team agrees priority and required action. Each action receives an owner, deadline and verifiable closure criterion. A statement that implementation is complete does not automatically close the finding: suitable evidence or a follow-up test must demonstrate the agreed result.

For automated controls we record the data source, rule version, expected result and exception handling. Test cases should include known failures. AI-supported analysis needs suitable reference cases and subject-matter assessment, with false alarms and missed exceptions kept visible. An accuracy figure without a traceable evaluation dataset is not accepted as evidence. Sensitive working papers are used only in approved tools.

Reporting shows the reviewed areas, material findings, evidence gaps and outstanding actions. Measures such as overdue actions include a definition, data source and period. Passing test counts are shown alongside the scope and sample selection. Savings or avoided losses are not presented as achieved results without a supportable measurement. This allows managers to see both results and unresolved exposure.

Training develops and assesses staff knowledge. A control review examines whether a defined business process and its controls work within the agreed scope. Knowledge gaps may trigger follow-up training, while system or ownership problems need different actions. The two services can exchange findings but retain separate objectives, evidence and acceptance criteria.

Useful inputs include the control inventory, relevant procedures, previous reports, a product and process overview, and sample control records. We agree contacts, access boundaries and handling of confidential data. For cross-border scope, the relevant entities and local assessment criteria must also be identified. A pilot confirms the test instructions and report format before wider testing; effort depends on scope and available evidence.