Underpinning better decision-making by using effective Management information for conduct risk
The principle of “conduct risk” has risen to the top of firms’ and regulators’ agendas recently. In the UK, the FCA assumes conduct risk management to be embedded into firms’ risk management frameworks, assisted by relevant management information (MI).
Building on latest regulatory and supervisory requirements and our prior experience of what works well in practice at firms, ten principles of strong conduct risk MI have been identified that we believe form an intelligent foundation for conduct risk MI across all of the financial services firms and sectors.
The 10 principles of strong conduct risk MI are;
- Linked to strategy, culture and risk management framework
- Holistic and used to support analysis of trends
- Efficient and proportionate
- Accurate and timely
- Measured and reported on at an appropriate frequency
- Comprehensible and traceable
- Supports open communication and challenge
- Acted upon and recorded
Connected to strategy, culture and risk management framework
Conduct risk MI is considered when the firm reviews its strategy and the organisation implements a process to examine the conduct risk MI it gathers, if the strategy or business environment should evolve (e.g. due to the economy, developments in policy and regulation, or technology).
A stable of indicators are used to inform senior management on how productively the firm’s culture has been embedded. Conduct risk MI is used as part of performance appraisals and in looking at staff remuneration and promotions, for instance, as a part of a balanced scorecard.
Firms go on to cultivate conduct risk appetite statements for key risks and report MI against conduct risk appetite limits and triggers.
As part of the product governance approach, firms articulate what a good outcome would most likely be for the target end client, along with the inherent risks of the product and services, and distinguish the MI they need to observe this.
MI enables an appraisal of whether good outcomes are achieved routinely, such as, through monitoring whether the product offers value for money, rather than just focusing on whether poor outcomes are avoided.
Deep-dive probes, mystery shopping, customer sales reviews, branch visits and other activities are often used to strengthen an image of the product or service from the client’s point of view.
Definitely not all conduct risk metrics must be outcomes-focused, as firms need a package of metrics to gather an overall image of conduct risk. For example, it is still necessary to receive MI on customer satisfaction, despite the fact that, by itself, this does not always demonstrate a good customer outcome.
Holistic and in support of trend analysis
Enterprises use a suite of MI, formed on an evaluation of what is needed, as opposed to what is readily obtainable through existing systems and processes, to ensure a combination of indicators is measured and used to identify potential problems to be investigated further. Using existing risk or control indicators may only provide a skewed view of the situation. We always encourage firms to set an ideal scenario and employ back from the future thinking.
MI is analysed in different ways to identify trends:
– Over a time period (consistent on a period-to-period basis) e.g. to identify increases in complaints over time for a product;
– Across products e.g. to identify products with comparatively low claims ratios or low investment returns;
– Across business lines e.g. looking at breaches of conflicts of interest policies in different operations in the business; and
– Focusing on one team or individual e.g. assessing a variety of indicators from a trading desk to identify patterns.
MI reports on potential and emerging conduct risks, alongside crystallised risks, for instance, monitoring whether a product is promoted to the target market.
The company takes into account the emerging conduct risks and trends from the FCA, e.g. those highlighted in the Risk Outlook, as well as lessons learned from previous mis-selling scandals or other regulatory enforcement action, and examines whether any changes are needed to MI and whether present MI suggests there may be challenges that require additional investigation. For instance, when the FCA’s Risk Outlook for 2014 highlighted that house price growth may trigger conduct issues, firms that provide mortgages should have concentrated on, for instance, affordability and equity release loans.
The company is starting to use analytics tools to link data and enable identification of underlying conduct risks, for example, linking post codes with types of mortgages sold and house price growth in the area to understand the risk of customers falling into arrears or the risk of customers being sold an unsuitable product. Many firms will already have this data for credit risk purposes.
Efficient and proportionate
The business takes a risk-based approach to reporting MI to steer clear of a flood of information; information that would not provide value to senior management is not included in MI.
There is a clear delineation of the purpose of conduct risk MI from other MI to eliminate duplication and overlap.
Accurate and timely
Decisions are made built upon the right information, received sufficiently quickly after the relevant business activity has come about, to enable action.
The second and third lines of defence are participating in open conversations with the business on expectations relative to the quality and timeliness of data and what is obtainable.
Internal Audit reviews the process governing how MI is collected, analysed and reported, and managers review and sense-check information on a sample basis.
Measured and reported on at an appropriate frequency
To allow active, in lieu of just reactive responses, conduct risk MI is provided to senior management as an aspect of monthly, quarterly and annual reporting (as agreed with senior management), and on an ad hoc basis e.g. where risk appetite triggers are breached.
The firm’s resources, systems and processes allow adequate overall flexibility in the frequency with which MI is measured and reported; if necessary, data might be aggregated quickly.
Comprehensible and traceable
Senior management is given clear and concise MI that accentuate the key messages and risks in an easily digestible format; it is possible to drill down into the information for more detail and to trace where the information was derived.
Conduct risk MI includes a mix of both quantitative and qualitative analysis, which is accompanied by remarks that explain what the MI means, why any conduct risk issues have developed and how important they are, how MI was measured (including any limitations), and the proposed actions.
Supports open communication and challenge
Senior Managers explore and confront ratings across the ‘Red Amber Green’ (RAG) rating spectrum, instead of just focusing on ‘red’ ratings, and drill down into the analysis to support risk ratings.
Firms ensure robust thresholds to avoid just ‘green’ and ‘amber’ ratings being reported, giving an untrue sense of comfort.
Anomalous or unexpected results are challenged and verified e.g. more than expected sales volumes in certain products, or continued successful market predictions from a certain trading desk.
Senior management openly reviews and seeks to understand weaknesses in how MI is collected and analysed.
Acted upon and recorded
Once inherent, emerging and crystallised conduct risks are identified, the source are investigated and actions are tracked and studied to ensure they addressed the risks.
Conduct risk MI includes reporting on agreed remedial action and whether the action addressed the conduct risk properly.
An audit trail is maintained detailing how areas of concern detected within conduct risk MI have been acted upon and monitored.
If you have any queries, please call us on 0207 097 1434
Lee Werrell Chartered FCSI