"A firm should design its compliance system based upon its own business operations, structure, customer base, size, complexity, product mix, geographic dispersion, and other factors related to the firm." . . . . . . . .