A well-presented case and a timely warning.  First off, many firms simply patched together a supervisory system because some veteran left or someone was supposed to implement more specific policies (or hire another Principal) and, well, you know how those things tend to dribble away and get forgotten.  Next thing you know, FINRA comes in and -- OMG!, we forgot to take care of this!!

I urge all my clients to pick at least an annual date when they give their policies and procedures a "cold review;" i.e., you take a rule and literally go line by line through your WSPs, memos, and other policies and confirm that what's written is what is in effect.  Concurrent with that run-through, you should also confirm that you are up-to-date with any new or amended rules.  Similarly, confirm that all folks who require a specific registration are duly registered (you would be surprised how often it's "assumed" that a registration application went through only to learn the FINRA shows no record of the filing -- or that someone was supposed to sit for an exam but postponed it and never satisfied the requirement.

All of which leads to another punchlist item:  If you have set forth policies and procedures in writing, are they being observed?  It's bad enough to run afoul of a FINRA rule, but to impose upon yourself a given task (which FINRA staff will note in your WSPs) and then to not properly implement that task is idiotic.  Similarly, as so many in-house Compliance folks love to spend hours on the computer drawing up all sorts of fancy organizational charts showing who reports to whom, it's probably a good idea to actually look at those charts once in a while and make sure that everyone so listed is still working at your firm and still supervising or reporting to those designated.