Description

A focused course, tailored for you

The Risk Operations Manager's Incident Triage Playbook

Run a brokerage risk operations desk where every escalation has a documented path, a named owner, and a defensible timeline before the regulator asks.

Your triage queue has three items that have been open longer than the operating model says they should be, and the supervisory record will not survive a reviewer's question about why.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

A Risk Operations Manager in a US broker-dealer custodian sits at the seam between branch supervision, custody operations, AML, and the second line. The work is not the alerts themselves. The work is the discipline: every incident has to land in a triage queue with a documented decision path, a named owner, a timestamp, an evidence trail, and a sign-off route that a FINRA examiner or an internal audit reviewer can reconstruct six months later. The failure mode is not missed alerts. The failure mode is alerts that were worked correctly but written up inconsistently, so two similar items ended up with two different dispositions and no narrative explaining why. This course teaches the operating discipline that makes the queue defensible: the triage log structure, the escalation matrix, the supervision exception register, the SAR-adjacent decision memo template, the monthly trend pack the CRO reads, and the audit-ready evidence bundle. It is built for someone who already runs a risk ops desk and needs to tighten the operating model, not someone learning what a risk function is.

What you walk away with

A documented triage path for every category of incident the desk handles, with owner, timeline, and evidence requirements written down.
A supervision exception register and SAR-adjacent decision memo template that produce consistent dispositions across the team.
A monthly trend pack the CRO and the committee actually read, with the four numbers that matter on page one.
An audit-ready evidence bundle the desk can hand to FINRA, internal audit, or the external auditor without a scramble.
An onboarding path so a new risk operations analyst can run the queue inside their first month without shadowing for six.

The 12 modules

Module 1. The brokerage risk operations operating model

The starting map. What sits with the first line in the branch network, what sits with the second line in risk and compliance, what sits with custody operations, and where the risk operations desk owns the seam. Includes a one-page operating model picture you can show the CRO and an exercise to mark where your own desk currently sits on each handoff.

Module 2. The daily triage queue structure

How the queue is built. Categories that map to FINRA and SEC supervisory expectations, fields that produce a defensible record, timestamps that survive a reviewer's question. Includes a triage log template, the rules for what gets logged versus what stays as a working note, and the disposition vocabulary the team uses so two analysts produce comparable records.

Module 3. Branch supervision exception handling

The supervision exception register. What goes on it, what stays off it, who signs off, and how it ties to the firm's written supervisory procedures. Walks through five common exception types in a wealth and brokerage context, including the disposition logic that holds up under a FINRA exam and the evidence each one needs in the file.

Module 4. Custody operations incident workflow

Vendor-feed anomalies, reconciliation breaks, transfer-agent errors, corporate-action mishandling. How custody-side incidents enter the risk ops queue, how they get categorised, and how the desk decides which ones get escalated to the operations risk committee versus closed at the desk. Includes a custody incident triage decision tree.

Module 5. AML and SAR-adjacent decisions

The triage and documentation discipline for alerts that may or may not become SAR-eligible. Decision memo template, escalation route to the BSA Officer, evidence requirements, and the language that survives a SAR look-back review. Covers the boundary between what risk operations handles and what AML investigations owns so the handoff is documented, not assumed.

Module 6. The escalation matrix that actually gets used

Most escalation matrices live in a binder and nobody opens them. This module builds one the desk will use under pressure. Thresholds tied to dollar amounts, client segments, and incident categories. Named owners at each tier. A 24-hour rule for the desk-to-CRO path. Includes a one-page matrix template and a rehearsal exercise.

Module 7. The monthly trend pack the CRO reads

The four numbers on page one. Volume by category, mean and 95th percentile cycle time, escalation rate, and recurring root causes. The two charts on page two. The narrative on page three that explains the two anomalies the CRO will ask about. Includes the pack template, the data pipeline notes for pulling the numbers, and an example trend pack from a brokerage operating model.

Module 8. Audit-ready evidence bundles

What the file looks like when FINRA, internal audit, or the external auditor asks for evidence on a sample of incidents. Structure of the evidence bundle, the index, the timestamp trail, the decision memo, the sign-off chain. Includes a bundle template and a self-audit checklist you can run on ten random incidents from last quarter.

Module 9. FINRA Rule 3110 supervisory documentation

How the risk operations desk's records sit inside the firm's Rule 3110 supervisory framework. What the written supervisory procedures should say about the desk's role. What the supervision review evidence has to show. Covers the handoff between risk operations records and the supervisory principal's review, with template language for the WSP and a record-retention map.

Module 10. SEC Rule 15c3-5 market access controls

Where the risk operations desk fits into market access controls. Pre-trade limit breaches, post-trade exception reports, the escalation path when a limit fires, and the documentation a Rule 15c3-5 review will look at. Includes the exception report template the desk uses and the decision logic for which breaches get logged as incidents versus operating events.

Module 11. Onboarding a new risk operations analyst

The 30-day path from day one to running the queue solo. The five modules of internal training, the shadow rota, the first solo shift with a senior on standby, the checklist they sign off at day 30. Includes the onboarding tracker template and the competency rubric so the manager can evidence that the new analyst is ready before they take the queue alone.

Module 12. The annual operating model review

The once-a-year exercise that keeps the desk defensible. Walks through the review pack: incident category trend across four quarters, escalation matrix calibration, evidence-bundle sample audit, WSP alignment, and the operating model changes the desk recommends to the CRO. Includes the review pack template and the agenda for the operating risk committee session that signs off on the changes.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Monday triage queue with three open items from last week that need defensible dispositions before the afternoon committee.

A FINRA exam letter arrives asking for a sample of supervision exception records from the last six months.

Internal audit opens a review of the desk's SAR-adjacent decision documentation and asks for the decision memos behind ten specific alerts.

A new risk operations analyst joins the team and needs to be running the queue inside their first month.

What you get with this course

12 written modules in the Art of Service learning environment with worked examples for a brokerage and custody operating model.
Downloadable templates: triage log, supervision exception register, SAR-adjacent decision memo, escalation matrix, monthly trend pack, audit-ready evidence bundle, onboarding tracker, annual review pack.
A hand-built implementation playbook tuned to your desk's scale, your firm's regulatory perimeter, and your existing operating cadence, delivered alongside course access.
30-day money-back guarantee.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.

Week 1: complete modules 1-4 (operating model, triage queue, supervision exceptions, custody incidents).

Week 2: complete modules 5-8 (AML/SAR, escalation matrix, monthly trend pack, evidence bundles).

Week 3: complete modules 9-10 (FINRA Rule 3110, SEC Rule 15c3-5).

Week 4: complete modules 11-12 (onboarding, annual review) and run the self-audit checklist on a sample of recent incidents.

Before and after

Before

The desk works correctly but inconsistently. Two analysts produce two different dispositions on similar incidents and there is no written record explaining why. The monthly pack to the CRO is rebuilt from scratch every cycle. A FINRA exam letter would trigger a scramble.

After

Every incident category has a documented triage path. Every escalation has a named owner and a timeline. The monthly pack runs off a stable template. The evidence bundles are audit-ready before anyone asks. A new analyst is running the queue inside their first month.

What happens if you do not address this

The desk continues to work correctly but the operating discipline lives in three people's heads. The next FINRA exam, internal audit, or external auditor review surfaces inconsistent dispositions, missing timestamps, or evidence bundles that have to be reconstructed under time pressure. The finding lands on the desk manager, not on the analysts who worked the incidents.

Who it is for

A Risk Operations Manager or Senior Risk Operations Manager at a US broker-dealer, custodian, or wealth platform with branch supervision, custody operations, AML, and second-line oversight responsibilities. Has 5-15 years in financial services operations. Already runs a daily triage cadence and a monthly committee pack. Wants the operating discipline written down so the desk does not depend on three people remembering how it works.

Who this is NOT for. Not for someone new to risk operations who needs an introduction to the function. Not for a CRO or Chief Compliance Officer who needs board-level framing. Not for a generalist GRC consultant who does not work inside a brokerage operating model. Not for technology vendors selling risk platforms.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Roughly 90 minutes per module across four weeks, plus the time to run the self-audit checklist on the desk's current records. Built to be worked alongside a live operating cadence, not as a sabbatical.

Why $199 is the right number

GARP and SIFMA training cover risk concepts at a curriculum level. FINRA's own published guidance covers regulatory expectations at a rule level. A GRC platform vendor will sell a tool, not an operating discipline. This course covers what sits between those: the operating model, templates, and documentation discipline that make a brokerage risk operations desk defensible under examination.

FAQ

Is this US-specific?

Yes. The course is built around FINRA, SEC, and the operating model of US broker-dealers, custodians, and wealth platforms. The triage discipline applies internationally but the regulatory references are US.

Does it cover trading risk?

No. The course covers operational risk, supervision, custody incidents, and AML-adjacent decisions. Market and credit risk are out of scope.

Will the implementation playbook reflect my actual desk?

Yes. The playbook is hand-built after purchase based on a short intake covering your desk's scale, the categories of incident you handle, your regulatory perimeter, and your existing operating cadence.

Is the content recorded?

The course is written modules with downloadable templates and worked examples. No audio narration and no recorded lectures. The format is built to be read and applied.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.