Developing on ongoing regulatory and supervisory expectancies and our years of experience of what works well in operations at firms, ten principles of strong conduct risk MI have been identified that our team believe serve as a stable basis for conduct risk MI across all financial services firms and sectors.
The 10 principles of strong conduct risk MI are;
- Linked to strategy, culture and risk management framework
- Outcomes-focused
- Holistic and used to support analysis of trends
- Forward-looking
- Efficient and proportionate
- Accurate and timely
- Measured and reported on at an appropriate frequency
- Comprehensible and traceable
- Supports open communication and challenge
- Acted upon and recorded
Associated to strategy, culture and risk management framework
Conduct risk MI is taken into consideration when the firm looks at its strategy and the business puts in place a process to evaluate the conduct risk MI it accumulates, if the strategy or business environment should evolve (e.g. due to the economy, developments in policy and regulation, or technology).
Conduct risks are managed with the same rigour, and given the same priority, as prudential risks.
A series of indicators are used to inform senior management on how productively the firm’s culture has been embedded. Conduct risk MI is used as a part of performance appraisals and in taking into account staff remuneration and promotions, for instance, as part of a balanced scorecard.
Firms continue to develop conduct risk appetite statements for key risks and report MI against conduct risk appetite limitations and triggers.
Outcomes-focused
As a part of the product governance approach, firms articulate what a good outcome might be for the target end client, as well as the inherent risks of the service or product, and identify the MI they need to oversee this.
MI enables a consultation of whether good outcomes are achieved routinely, for instance, through monitoring whether the product offers value for money, as opposed to just concentrating on whether poor outcomes are avoided.
Deep-dive inspections, mystery shopping, customer sales reviews, branch visits and other activities are often used to enhance an understanding of the product and services from the client’s perspective.
Not necessarily all conduct risk metrics must be outcomes-focused, as firms need a package of metrics to accumulate an overall image of conduct risk. Such as, it is still crucial to receive MI on customer satisfaction, despite the fact that, on its own, this does not necessarily indicate a good customer outcome.
Enterprises use a suite of MI, based on an appraisal of what is needed, rather than what is readily obtainable through existing systems and processes, so that a combination of indicators is measured and used to identify potential problems to be investigated further. Using existing risk or control indicators may only provide a skewed view of the situation. We always encourage firms to set an ideal scenario and employ back from the future thinking.
MI is analysed in different ways to identify trends:
- Over a period of time (consistent on a period-to-period basis) e.g. to identify increases in complaints over time for a product;
- Across products e.g. to identify products with comparatively low claims ratios or low investment returns;
- Across business lines e.g. looking at breaches of conflicts of interest policies in different departments in the business; and
- Focusing on one team or individual e.g. considering a variety of indicators from a trading desk to identify patterns.
Forward-looking
MI reports on possible and emerging conduct risks, in addition to crystallised risks, for instance, monitoring whether a product is promoted to the target audience.
The firm takes into consideration the emerging conduct risks and trends from the FCA, e.g. those highlighted in the Risk Outlook, and also lessons learned from previous mis-selling scandals or other regulatory enforcement action, and discusses whether any realignments are needed to MI and whether latest MI suggests there may be complications that call for additional investigation. As an example, when the FCA’s Risk Outlook for 2014 highlighted that house price growth may generate conduct issues, firms that provide mortgages should have focused on, as an example, affordability and equity release loans.
The firm is starting to use analytics tools to link data and enable identity of underlying conduct risks, for example, linking post codes with types of mortgages sold and house price growth in the area to understand the risk of customers falling into arrears or the risk of customers being sold an unsuitable product. Many firms will already have this data for credit risk purposes.
Efficient and proportionate
The business takes a risk-based approach to reporting MI to prevent a torrent of information; information that would not provide value to senior management is not included in MI.
There is a clear delineation of the purpose of conduct risk MI from other MI to eliminate duplication and overlap.
Decisions are made based upon the right information, collected sufficiently quickly after the relevant business activity has transpired, to enable action.
The second and third lines of defence are participating in open conversations with the business on expectations in connection with the quality and timeliness of data and what is obtainable.
Internal Audit reviews the process governing how MI is collected, analysed and reported, and managers review and sense-check information on a sampling basis.
Measured and reported on at an appropriate frequency
To allow practical, in lieu of just reactive responses, conduct risk MI is provided to senior management as a component of monthly, quarterly and annual reporting (as agreed with senior management), and on an ad hoc basis e.g. where risk appetite triggers are breached.
The firm’s resources, systems and processes allow satisfactory versatility in the frequency with which MI is measured and reported; if necessary, data can be aggregated quickly.
Comprehensible and traceable
Senior management is in receipt of clear and concise MI that feature the key messages and risks in an easily digestible format; it is possible to drill down into the information for further detail and to trace where the information was derived.
Conduct risk MI includes a mix of both quantitative and qualitative analysis, which is accompanied by remarks that explain what the MI means, why any conduct risk issues have developed and how substantial they are, how MI was measured (including any limitations), and the proposed actions.
Supports open communication and challenge
Senior Managers discuss and question ratings across the ‘Red Amber Green’ (RAG) rating spectrum, in lieu of just focusing on ‘red’ ratings, and drill down into the analysis to prove risk ratings.
Firms ensure robust thresholds to avoid just ‘green’ and ‘amber’ ratings being reported, giving an untrue sense of comfort.
Anomalous or unexpected results are challenged and verified e.g. higher than anticipated sales volumes in certain products, or continued successful market predictions from a certain trading desk.
Senior management openly examines and seeks to understand weak spots in how MI is collected and analysed.
Acted upon and recorded
Once prospective, emerging and crystallised conduct risks are identified, the source are investigated and actions are tracked and evaluated to ensure they addressed the risks.
Conduct risk MI includes reporting on agreed remedial action and whether the action addressed the conduct risk effectively.
An audit trail is maintained detailing how areas of concern acknowledged within conduct risk MI have been acted upon and monitored.
If you have any queries, please call us on 0207 097 1434
Lee Werrell Chartered FCSI
Compliance Doctor
