Securities Industry Essentials (SIE) Study Guide

Who Regulates What, and Where Trades Happen

The Knowledge of Capital Markets section — 12 scored questions, 16% of the exam — leans heavily on two skills: matching a regulator to its authority, and naming the market segment where a trade occurs. The SEC is the federal regulator created by securities law; FINRA is a self-regulatory organization overseeing broker-dealers; the Federal Reserve controls monetary policy (and margin credit under Regulation T); state regulators enforce blue-sky laws. Exam questions typically describe an action and ask whether the named actor could have taken it.

Market structure divides by who is selling and where the trade prints. In the primary market the issuer sells new securities and receives the proceeds. In the secondary market, investors trade with each other and the issuer receives nothing. Within the secondary market: the first market is exchange trading of listed securities, the second market is over-the-counter trading of unlisted securities, the third market is exchange-listed stock traded over the counter through broker-dealers, and the fourth market is institutions crossing trades directly with no dealer at all.

Worked example: A pension fund buys 50,000 shares of an NYSE-listed stock, but the trade executes dealer-to-dealer, away from any exchange. The stock is listed, yet the print is over the counter — that is the third market. If the same fund had traded directly with another institution through an electronic crossing system with no dealer, it would be the fourth market. If the shares had come from the company itself in a new offering, it would be the primary market, because the issuer receives the money.

Exam trap: "Listed stock" does not automatically mean "first market." The question hinges on where the trade executes, not where the security is listed. Likewise, a founder selling a large personal stake in the open market is a secondary-market trade even if it happens shortly after the IPO — the issuer gets nothing.

• Primary market: issuer sells, issuer receives proceeds.
• Secondary market: investor to investor; issuer receives nothing.
• Third market: listed stock traded OTC via dealers; fourth market: institution-to-institution, no dealer.
• Match the actor to the authority: SEC (federal law), FINRA (broker-dealers), Fed (monetary policy and margin), states (blue sky).

Underwriting Commitments and the Registration Process

When an issuer raises capital, the underwriting arrangement determines who bears the risk of unsold shares. In a firm commitment, the underwriter buys the entire issue from the issuer and resells it — the issuer's proceeds are locked in at signing, and any loss from weak demand falls on the underwriter. In a best efforts deal, the underwriter acts only as an agent, sells what it can, and returns the rest; the issuer bears the shortfall. An all-or-none deal is a best-efforts variant with a condition: either the whole issue sells or the deal unwinds and escrowed subscriber funds are refunded. Selling group members are one tier further removed — they sell for a concession but never own inventory, so the risk of unsold shares stays with the syndicate.

Registration under the Securities Act of 1933 imposes a cooling-off period between filing and effectiveness. During that window, a representative may discuss the issue only through the preliminary prospectus (red herring) and may record non-binding indications of interest. No sales, no accepted funds, no supplemental sales literature. A tombstone advertisement may announce that an offering is coming, but it is deliberately not an offer — the prospectus remains the only offering document.

Worked example: A startup with an unproven track record signs a best-efforts, all-or-none deal for $20 million. Investors subscribe for only $14 million by the deadline. Because the condition failed, the offering is canceled and every subscriber's escrowed money is returned. Had the same issuer secured a firm commitment, it would have received the full $20 million at signing and the underwriter would have owned the unsold balance.

Exam trap: During the cooling-off period, "holding a customer's check until effectiveness" sounds like a safe compromise. It is not — accepting funds is accepting an order, which converts a permitted indication of interest into a prohibited pre-effective sale.

• Firm commitment: underwriter buys the issue; issuer's proceeds are guaranteed.
• Best efforts: underwriter is an agent; issuer keeps the risk. All-or-none adds a sell-everything-or-refund condition.
• Cooling-off period: red herring and indications of interest only — no sales, no funds, no research reports.
• A tombstone announces; only the prospectus offers.

Monetary Policy, the Business Cycle, and What Yields Signal

Monetary policy belongs to the Federal Reserve; fiscal policy — taxing and spending — belongs to Congress and the executive branch. The Fed's day-to-day tool is open market operations: when the Fed buys Treasury securities, it credits dealers' bank reserves, expanding lending capacity and the money supply and pushing short-term rates down (easing). Selling securities drains reserves and tightens. Raising the reserve requirement is also contractionary but is used sparingly because it hits every bank at once. Distinguish the two headline rates: the discount rate is administered — the Fed sets it and charges it to banks borrowing from the Fed — while the federal funds rate is a market rate banks negotiate among themselves for overnight reserves, steered toward a target through open market operations.

The business cycle runs peak → contraction → trough → expansion → next peak. Two consecutive quarters of declining GDP is the conventional shorthand for a recession; a depression is a far more severe and prolonged contraction, not an automatic label for two weak quarters. Building permits and initial unemployment claims are leading indicators; measures like the average duration of unemployment lag and only confirm turns after the fact.

Worked example: A retiree's bond portfolio yields 4% while consumer prices rise about 5% per year. The real return is roughly negative 1% — the portfolio loses purchasing power annually even though every coupon arrives on time and the bonds will redeem at par. Par is a fixed number of dollars, and those dollars will buy less at maturity. Separately, if short-maturity Treasury yields rise above long-maturity yields, the curve has inverted, conventionally read as a forward-looking signal of expected weaker growth and eventual rate cuts.

Exam trap: Direction reversals are the classic distractor. Fed buying eases; Fed selling tightens. A higher reserve requirement makes reserves scarcer and pushes the funds rate up, not down. And an inverted curve is the reversal of the normal upward slope — do not pick the answer describing ordinary term-premium compensation.

• Fed buys = money in, rates down; Fed sells = money out, rates up.
• Discount rate: set by the Fed. Fed funds rate: set by the market, targeted by the Fed.
• Cycle order: peak, contraction, trough, expansion. Permits and claims lead; unemployment duration lags.
• Real return ≈ nominal yield minus inflation; par redemption does not protect purchasing power.

Debt Securities: Price, Yield, and the Risks That Move Them

A bond is a loan with a fixed coupon, and everything the exam asks about bonds flows from one relationship: when market interest rates rise, the prices of existing bonds fall, and when rates fall, prices rise. A bond paying 4% is simply less attractive when new bonds pay 6%, so its price must drop until its yield competes. Longer-maturity (longer-duration) bonds swing harder in both directions, and zero-coupon bonds — which pay nothing until maturity — are the most price-sensitive of all for a given maturity.

You must keep three yield measures straight. The coupon rate never changes. Current yield is annual coupon dollars divided by the current market price. Yield to maturity also accounts for the gain or loss from the price converging to par.

Worked example: A corporate bond with a $1,000 par value and a 4% coupon trades at 95, meaning $950. It pays $40 per year regardless of price. Current yield = $40 ÷ $950 ≈ 4.21%. Because the bond trades at a discount, current yield sits above the 4% coupon, and yield to maturity is higher still because the holder also collects the $50 pull to par. Flip the scenario to a premium bond and the ordering reverses.

Rate moves also trigger call risk. A bond callable at 102 with a 6% coupon becomes a prime call candidate when comparable new debt yields 3%: the issuer refinances cheaply, the investor's income stream ends early, and the proceeds must be reinvested at the new, lower rates — reinvestment risk. Meanwhile, holders of fixed coupons always carry purchasing power (inflation) risk; TIPS answer it by adjusting principal upward with the CPI while the coupon rate stays fixed, so dollar interest rises as principal grows.

Exam trap: Questions love the claim that holding to maturity eliminates interest rate risk. You do receive par at maturity, but the bond's market price still fluctuates along the way, and selling early locks in that gain or loss. Also watch for answers that have long-term bonds being less rate-sensitive than short-term bonds — that is backwards.

• Rates up → prices down; longer maturity → bigger swings
• Discount bond: current yield > coupon; premium bond: current yield < coupon
• Falling rates → call risk → reinvestment risk
• Zeros: no reinvestment risk, but annual "phantom" taxable accretion and maximum price volatility
• TIPS adjust principal, not the coupon rate

Equity Securities: Common, Preferred, Rights, Warrants, and ADRs

Common stock is ownership: voting power, growth potential, and last place in a liquidation. It is also the classic hedge against purchasing power risk, because a claim on corporate earnings can grow with prices while a fixed coupon cannot. Preferred stock sits between bonds and common: it pays a fixed dividend and stands ahead of common shareholders in a liquidation, but it generally lacks voting rights and meaningful capital appreciation, and it still ranks behind bondholders.

Two issuer-created purchase instruments look alike but behave very differently. Subscription rights go to existing shareholders so they can keep their proportionate ownership; they are priced below the current market, expire in weeks, and are transferable. Warrants are attached to another security (often a bond) as a sweetener that lets the issuer pay a lower coupon; they are struck above the market at issuance — no intrinsic value on day one — and run for years.

Worked example: A shareholder receives rights in an offering priced below market but wants no more shares. The rights have intrinsic value precisely because the subscription price is below market, and they are transferable — so the shareholder sells them and captures that value. What selling cannot prevent is dilution of the shareholder's percentage stake once others subscribe.

American Depositary Receipts let U.S. investors hold foreign shares in dollar-denominated form. The dollar price tracks the foreign share price translated at the exchange rate, so currency risk passes straight through: if a Japanese stock rises 8% but the yen weakens sharply, the ADR's dollar return can be well below 8% or even negative.

Exam trap: The rights-versus-warrants strike price is the classic snare. Rights are below market and short-term; warrants are above market and long-term. An answer that puts both below market, or that calls rights non-transferable, is wrong. On ADRs, do not fall for "it trades in dollars, so there is no currency risk" — dollar quotation is a settlement convenience, not a hedge.

• Liquidation priority: bondholders → preferred → common
• Preferred: fixed dividend, limited voting and upside
• Rights: existing holders, below market, weeks, transferable
• Warrants: sweetener, above market at issuance, years
• ADRs carry the underlying currency risk

Packaged Products and Options: Who Bears the Risk?

Pooled products differ mainly in how you buy and sell them and who is on the hook. An open-end mutual fund continuously issues and redeems shares at the next-computed net asset value (NAV), calculated once daily — you own shares of the fund, not the underlying securities, and you can never buy at a market-driven discount. A closed-end fund lists a fixed share count that trades all day between investors, so its price can sit at a premium or a discount to NAV. A unit investment trust holds a fixed, unmanaged portfolio with no board or adviser, which keeps expenses low. Exchange-traded notes add a different risk entirely: an ETN is unsecured debt of the issuing bank, so the holder bears issuer credit risk that an ETF shareholder, who owns portfolio assets, does not.

The same "who bears the risk" lens sorts annuities. In a fixed annuity, premiums enter the insurer's general account and the insurer bears investment risk. In a variable annuity, payments go to separate-account subaccounts and the owner bears the outcome — which is exactly why a variable annuity is a security sold with a prospectus.

Options are contracts of rights and obligations. A call is the right to buy at the strike; a put is the right to sell. Buyers risk only the premium; uncovered call writers face theoretically unlimited loss because a stock can rise without limit.

Worked example: An investor pays a $3 premium for a put with a $45 strike while the stock trades at $48. At expiration the stock is $40. Intrinsic value is $45 − $40 = $5; net profit is $5 − $3 = $2. Breakeven for a put buyer is strike minus premium: $42.

Exam trap: Inverse ETFs are built to move opposite their index — if the index gains 20%, expect roughly a 20% loss, and daily rebalancing makes them poor buy-and-hold vehicles. And do not credit a variable annuity with guaranteeing account value during accumulation; the insurance guarantees attach to mortality and the death benefit, not to investment results.

• Open-end: forward-priced at NAV; closed-end: trades at premium/discount
• UIT: fixed portfolio, no ongoing management
• ETN = issuer credit risk; ETF holds actual assets
• Fixed annuity: insurer's risk; variable: customer's risk
• Call = right to buy; put = right to sell; naked call writer has unlimited risk

Order Types, Trade Capacity, and Who Gets the Dividend

Every order has two dimensions the exam tests separately: what price behavior you want and what conditions you attach. A market order demands immediate execution at the best available price. A limit order sets a price boundary (a maximum for buys, a minimum for sells) and waits. A stop order sleeps until the stock trades at or through the stop price, then wakes up as a market order. A stop-limit wakes up the same way but converts into a limit order — which means it can be triggered and still never execute if the price gaps past the limit.

Qualifiers modify size and patience. Fill or kill demands the entire quantity immediately or cancels everything. Immediate or cancel demands immediacy but accepts a partial fill. All or none refuses partial fills but is patient and can rest on the book.

Worked example: A customer is short a stock sold at $48 and fears a rally. Protection sits above the market: a buy stop at, say, $52. If the stock trades at or through $52, the order becomes a market order and covers the short — a guaranteed exit, not a guaranteed price. A buy limit at $52 would be immediately marketable (the limit is above the current price) and would just cover the short right now, offering no protection at all.

Capacity matters on every trade. A firm acting as agent (broker) executes for the customer and earns a commission. A firm acting as principal (dealer) trades from its own inventory and earns a markup or markdown. It must disclose its capacity on the confirmation and can never charge both a markup and a commission on the same trade. Finally, dividend entitlement turns on the ex-dividend date: buy before the ex-date and you get the declared dividend; buy on or after it and the seller keeps it. The payable date is just when the checks go out.

Exam trap: When a stock gaps down overnight through both the stop and the limit of a sell stop-limit order, the order is elected but unexecuted — the customer still holds the falling stock. If the question wants a guaranteed exit, the answer is a plain stop, not a stop-limit.

• Stop = trigger, then market order; stop-limit = trigger, then limit order (may never fill).
• FOK = all + now; IOC = now, partials OK; AON = all, patient.
• Short-seller protection is a buy stop above the market.
• Principal earns a markup, agent earns a commission — never both on one trade.
• Ex-dividend date, not payable date, decides who receives the dividend.

Customer Accounts: Authorization, Registrations, and Margin Paperwork

The exam's account questions almost always come down to who is allowed to decide what, and what paperwork makes it legal. Before any account activity, the firm must collect know-your-customer information — identity, address, financial situation, investment experience — and identify beneficial owners. If one spouse's name is on the account but the other supplies the money and directs the trades, the firm must know that relationship for anti-money-laundering and customer-protection purposes.

Discretion means choosing the security, the size, or the action (buy vs. sell). Any of those choices requires written authorization from the customer and heightened supervision by the firm. But if the customer fixes all three and leaves only when and at what price to execute — "buy 500 shares of ABC today at the best moment" — that is time-and-price discretion, which needs no written authorization and is good for that business day only.

Worked example: Two unrelated business partners open a joint account as joint tenants with rights of survivorship (JTWROS). One dies; the survivor automatically owns the whole account, bypassing the estate. Had they chosen tenants in common (TIC), the decedent's fractional share would pass to their estate instead. The registration chosen at opening — not the relationship between the owners — controls the result. Similarly, an UTMA custodial account is an irrevocable gift to one named minor: the custodian may spend the assets only for that child's benefit and cannot redirect them to a sibling or a family vacation.

Margin accounts add their own documents. The credit agreement (interest terms) and the hypothecation agreement (pledging securities as loan collateral) are mandatory; the loan consent, which lets the firm lend the customer's shares to short sellers, is optional. Conceptually, equity equals market value minus the debit balance, and the ongoing maintenance requirement is measured against market value — not against the debit, and not the same test as the initial requirement. When a representative makes a recommendation to a retail customer, Regulation Best Interest applies through four obligations — disclosure, care, conflicts, and compliance — at the moment of recommendation.

Exam trap: Time-and-price discretion is the classic distractor. If the customer named the stock, the amount, and the action, the representative may pick the moment without written authority — but only through the end of that day. Any answer that stretches it into standing authority is wrong.

• Discretion over security, size, or action requires written authorization; time-and-price alone does not (one day only).
• JTWROS: survivor takes all; TIC: decedent's share goes to the estate.
• UTMA gifts are irrevocable, one minor per account, spending only for that minor's benefit.
• Margin: credit and hypothecation agreements required; loan consent optional.
• Equity = market value − debit; maintenance is tested against market value continuously.

Prohibited Activities: Recognizing the Violation by Its Fingerprint

Prohibited-practice questions are pattern recognition: each violation has a distinctive fingerprint, and the distractors name violations with similar fingerprints. Learn the differences, not just the definitions.

Account abuse. Churning is excessive trading in a customer's account primarily to generate commissions — look for heavy activity with no account growth. Unauthorized trading is executing any trade without the customer's consent; even a non-discretionary account requires per-trade authorization. Unsuitable recommendations mismatch the product to the customer's objectives — complex derivatives for a capital-preservation retiree, or a one-size-fits-all allocation applied to every client regardless of circumstances. Suitability is individualized by design.

Information abuse. Trading on material nonpublic information is insider trading; passing that information to someone who trades on it is tipping, and both tipper and tippee are liable. Distinguish this from front running, where a trader exploits advance knowledge of a customer order by trading ahead of it. And distinguish both from matched orders / painting the tape, where colluding traders fabricate prints to create a false appearance of volume and rising prices with no real change in ownership intended.

Worked example: A firm holds afternoon customer sell orders, executes a large proprietary sell first, and the customers fill at depressed prices. The fingerprint is self-dealing / failure to prioritize customer orders — not insider trading (no nonpublic information) and not necessarily manipulation (the intent was self-interest, not moving the market). Customer orders come first.

Conduct away from the account. Selling away is participating in securities transactions outside the firm without prior notice — and with compensation, without prior written firm approval. Structuring is breaking cash deposits into pieces to dodge currency-reporting thresholds; the representative escalates internally and must never tip the customer that a suspicious activity report may be filed. For suspected financial exploitation of a senior customer, the firm may place a temporary hold on the disbursement and reach out to the trusted contact — the issue is deception by a third party, not the customer's mental capacity. Gifts tied to the recipient's employer's business are capped at a per-person annual dollar limit regardless of who pays, and borrowing from a customer is prohibited unless firm procedures allow it and the relationship fits a defined exception.

Exam trap: Tipping vs. misappropriation vs. front running is a favorite triplet. Sharing inside information with someone who trades is tipping; taking confidential information for your own trading is misappropriation; trading ahead of a known customer order is front running. Match the fingerprint, not the vibe.

• Churning = excessive trades for commissions; unauthorized trading = no customer consent.
• Tipping = sharing inside information; front running = trading ahead of a known order; matched orders = fabricated prints.
• Customer orders take priority over the firm's proprietary trades.
• Selling away requires prior notice — and written approval if compensated.
• Structuring is itself a crime; never warn a customer about a possible SAR.
• Senior exploitation: temporary disbursement hold plus trusted-contact outreach.

The Regulatory Pyramid: SEC, SROs, and the States

U.S. securities regulation is layered. At the top sits the SEC, the federal agency with ultimate authority over the securities markets. Below it operate self-regulatory organizations (SROs) such as FINRA, which write and enforce rules for their member broker-dealers — but always under SEC oversight. FINRA is not independent of the SEC and does not outrank it; the two have distinct, complementary roles. Alongside the federal layer, each state maintains its own "blue-sky" laws, which impose state-level registration and anti-fraud requirements on securities professionals doing business within that state's borders.

The foundational federal statutes divide the territory chronologically. The Securities Act of 1933 governs new issues: it is built around registration and prospectus disclosure when securities are first sold to the public. The Securities Exchange Act of 1934 turned to the trading markets: it created the SEC itself and imposed requirements on exchanges, broker-dealers, reporting companies, and market conduct. A useful memory hook is that securities must be issued before they can be traded, so 1933 covers issuance and 1934 covers trading.

Worked example. A startup wants to sell shares to the public for the first time, and a broker-dealer wants to make a market in those shares afterward. The initial offering — registration statement, prospectus delivery — falls under the 1933 Act. The subsequent secondary-market trading, and the conduct of the broker-dealer handling it, falls under the 1934 Act and FINRA's rulebook, with the SEC supervising both. If the firm's representatives solicit customers in Texas, Texas blue-sky law also requires state-level registration.

Exam trap. The classic distractor simply reverses the two Acts, describing the 1933 Act as governing exchanges and the 1934 Act as governing new issues. A second trap claims FINRA and the SEC are co-equal or that FINRA can overrule the SEC — remember that an SRO always operates under SEC authority. Finally, the purpose of the whole framework is investor protection and market integrity through disclosure and anti-fraud rules; it never eliminates investment risk or guarantees returns.

• SEC: federal agency, top of the pyramid.
• FINRA: SRO for broker-dealers, operating under SEC oversight.
• 1933 Act: new issues, registration, prospectus.
• 1934 Act: trading markets, created the SEC.
• Blue-sky laws: separate state-level registration and anti-fraud regime.

Getting and Keeping a Registration: SIE, U4/U5, and Disqualification

The entry point to the industry is the Securities Industry Essentials exam. Under FINRA Rule 1210, individuals who are not associated persons are eligible to take the SIE — no firm sponsorship and no prerequisite exam are required. But passing the SIE alone does not qualify anyone for registration with FINRA. It is a co-requisite: to register in a representative capacity, a candidate must also pass a representative-level exam such as the Series 7. A passing SIE result remains valid for four years.

Registration itself runs on two forms. Form U4 is the application for registration and carries ongoing disclosure duties: customer complaints, criminal charges, judgments, liens, and similar events must be reported promptly by amendment, and reportability turns on the allegation being made — not on whether it is later proven. Form U5 is the firm's filing when a representative leaves; it must state the reason for termination and be furnished to the departing representative. Critically, regulatory jurisdiction over a person survives termination for a period, so resigning does not close an open investigation into prior conduct.

Some events go beyond disclosure. A recent felony conviction — securities fraud, for instance — is a statutory disqualification: it bars association with a member firm unless the firm seeks relief through the eligibility process, typically with a heightened supervision plan that regulators must approve. Registered persons also face continuing education in two halves: a Regulatory Element delivered by the regulator and tailored to each registration held, and a Firm Element the firm designs after an annual needs analysis.

Worked example. A college senior passes the SIE with no firm affiliation. Eighteen months later a broker-dealer hires her. Her SIE result is still valid (four-year window), but she cannot act as a General Securities Representative until she also passes the Series 7 and her firm files her U4.

Exam trap. The tempting wrong answers claim that passing the SIE by itself confers registration, or that a representative escapes FINRA jurisdiction the moment she resigns. Both are false: the SIE is only half of the qualification, and jurisdiction deliberately outlives the U5.

• SIE: open to the public, no firm required, valid four years.
• SIE alone never equals registration — a representative exam like the Series 7 is the co-requisite.
• U4: disclosure on the way in and while registered; U5: the firm's filing on the way out.
• Statutory disqualification is a rebuttable bar with a defined relief path, not automatic permission and not a lifetime ban.

Conduct Rules in Practice: Suitability, Communications, and Safeguarding Assets

Once registered, a person's daily obligations cluster around three ideas: know your customer, tell the truth in public, and keep client property safe.

Suitability and KYC. Recommendations must have a reasonable basis in the customer's circumstances — objectives, finances, risk tolerance. The framework is risk-based: institutional customers, presumed more sophisticated, receive different (not zero) protections than retail investors, but both channels remain fully regulated. Related to this is the line between registered and unregistered staff: an unregistered assistant may perform only clerical and ministerial tasks. Taking a phone message is fine; accepting a securities order — even an unsolicited one — or prequalifying a prospect by gathering financial information is a registered function.

Communications. Advertising must have a reasonable basis for every assertion and may never be fraudulent or misleading. A claim that a product is "guaranteed to outperform" a benchmark cannot be substantiated and violates anti-fraud standards on its face. If a firm learns — say, through its own customer survey — that customers do not understand a product's risks, the regulatory expectation is stronger disclosure and controls, not silence.

Safeguarding assets. Customer securities must be segregated from the firm's own capital. Commingling client assets with firm operating funds violates fundamental custodial rules designed to protect customers from a firm's insolvency or misuse. And when any violation is discovered, the playbook is consistent: stop the non-compliant conduct, review, notify regulators and affected customers, and remediate. Employees who spot misconduct — a colleague churning accounts, for example — must report it internally through compliance channels rather than ignore it.

Worked example. A representative notices a colleague executing rapid, commission-generating trades in an elderly customer's account with no apparent strategy. The correct first move is to escalate to the firm's compliance or supervisory staff so the matter is documented and investigated — not to confront the colleague quietly, and not to do nothing because "it's not my account."

Exam trap. Watch for answers suggesting institutional business is unregulated, that an unsolicited order can be accepted by unregistered staff because no advice was given, or that a firm may keep operating a non-compliant process while it "studies" the problem. Each contradicts a core principle: tailored-but-universal regulation, registered functions, and prompt remediation. Investors can independently check any professional's disciplinary history through BrokerCheck, which publishes registration and disciplinary records drawn from the CRD system free of charge.

• Suitability = reasonable-basis recommendations grounded in KYC.
• Unregistered staff: clerical only — never order-taking or prequalifying.
• Advertising: reasonable basis required; performance guarantees are prohibited.
• Segregate customer assets; never commingle with firm capital.
• Report suspected violations internally; remediate discovered breaches promptly and transparently.