| Everyone, shared core |
Professional responsibility and the firm's code of conduct, the standards of commercial honor, and the escalation path when something looks wrong |
Professional responsibility is named in the rule text itself. Leaving it to a single generic slide is the most common gap in an otherwise decent plan. |
| Registered representatives with public contact |
Suitability and Reg BI care and disclosure obligations, communications with the public, and the specific products they actually sell |
A rep who can recite Reg BI in the abstract but cannot apply the care obligation to their own product mix. Scenario items expose that; definition items do not. |
| Principals and supervisors |
Their supervisory procedures, the reviews they are responsible for, and what escalation and documentation their sign-off requires |
Supervisors trained on the same module as the people they supervise, when their obligations are a different chapter of the manual entirely. |
| Operations and back office |
The controls their function owns, error escalation, and the parts of AML and recordkeeping their workflow touches |
The team whose registration is permissive but whose function controls settlement, treated as out of scope when 1240(b)(1) reaches permissively registered persons too. |
| Investment banking and research |
Information barriers, conflicts, the specific rules governing their activity, and the recent enforcement themes in their line |
A high-consequence function that a firmwide retail module barely touches. The needs analysis is supposed to surface exactly this. |
| Newly registered and permissively registered |
The firm-specific procedures a new hire has not absorbed yet, plus the professional responsibility core |
The 2023 amendment pulled permissively registered persons into scope. A plan that still filters on public contact is scoping to the old rule. |