Conduct risk Developing and maintaining an effective framework

Transcription

1 risk Developing and maintaining an effective framework Background The of Business rules, (including COBS, ICOBS, MCOB and BCOBS sourcebooks) provide specific requirements which firms must meet; these requirements have a direct impact on the treatment of customers; however these rules cannot provide complete coverage of regulated firm s activity. The FCAs Principles for Businesses specify that A firm must pay due regard to the interests of its customers and treat them fairly. (PRIN Principle 6); this is a principle which, in theory does provide coverage of all aspects of a firm s activities which have an impact on customers. In 2006, the focus of TCF was in relation to six key outcomes that firms were expected to deliver, and these outcomes were used as a lens through which firms and the regulator assessed performance in relation to how customers were treated. It is now expected that TCF is fully embedded within firms; goes beyond what has been expected of firms in the past. was defined by the FSA in their 2011 Retail Outlook as the risk that firm behaviour will result in poor outcomes for customers. Over recent years, focus from the regulator and within the industry has intensified, with an increasing onus on firms to define and manage explicitly as part of their risk management framework. This focus is consistent with the way in which FCA is seeking to fulfil its objective in relation to consumer protection where they have stated that they are increasingly prepared to intervene earlier in the product lifecycle. In addition they are prepared to make judgements on the appropriateness of management decisions, even before these decisions have taken effect; for example through banning a specific product before the product has been launched. Three main drivers of conduct risk have been identified by the FCA: (i) inherent factors, such as information asymmetries, biases and inadequate financial capability; (ii) structures and behaviours, such as ineffective competition, culture and incentives, and conflicts of interest; and (iii) environmental factors, such as economic, regulatory and technological trends and changes. Thus, there is rising pressure on firms to adjust their strategic business models. is, therefore, focussed on risks to the delivery of fair customer outcomes, in addition to the outcomes themselves; The Outlook 2013 focuses on how firms are managed and structured to ensure that firms treat their customers fairly by having robust systems and controls, adequate skill, care and appropriate judgement, rather than through luck, circumstance or where it could be argued that delivering fair customer outcomes is a convenient secondary objective to support the firm s commercial priorities. Culture change within firms is essential if we are to restore trust and integrity to the financial sector and the FCA will continue to focus on how firms are managed and structured so that every decision they make is in the best interests of their customers. FCA Outlook 2013

2 The challenge In order to adequately manage and to maintain strong evidential standards, firms must ensure they have a well-defined and articulated framework that sets the correct tone from the top and is clearly communicated to internal and external stakeholders. There have been many recent examples of failures to deliver fair customer outcomes, resulting in potential detriment to customers, regulatory intervention and fines, and reputational damage for the firms involved. At the heart of these recent failures were a number of common factors: Unclear governance structures and unclear or poorly defined risk appetite without supporting conduct risk metrics or tolerances. Lack of clarity around roles and responsibilities across the 3 lines of defence (3LoD), resulting in: Lack of robust outcomes testing in the first line of defence. 2nd line assurance often undertaking 1st line activity. A culture that does not put the customer at the heart of the business, resulting in: A lack of understanding of the required behaviours across the firm. Not undertaking robust root cause analysis and addressing issues proactively. Poorly defined measures of performance in terms of the delivery of customer outcomes. Lack of focus organisationally on target market and the design of products. Inadequate skills, knowledge and experience within senior management teams. Each of these specific factors represents a potential weakness in a Firm s framework for the management of. A well-defined risk framework, must articulate the components a firm has in place to manage conduct risk, how the components interact with each other, who has responsibility over each component and how the three lines of defence model will operate. Lack of skills and capability. Metrics without clearly defined tolerances or clear audit trail back to source data. Figure 1. High level illustration of a Framework Strategy Appetite Framework Feedback Product Design Sales Process Post Sale Service Culture & Governance Metrics Customer Outcomes Testing Market Integrity A conduct risk framework is the means by which conduct risks are managed and controlled within the Strategy set by the firm.

3 Key areas of focus for firms Firms must focus on ensuring their overall framework for the management of is fit for purpose. The specific design of a framework will vary and management must ensure that what is implemented takes into account the scale, scope and complexity of their firm s activities. Figure 2. Good practice considerations for firms We have provided good practice considerations, in which firms should take into account when developing the key components of their framework for managing. Action Defining the firm s Strategy Develop and document the firm s management framework Developing a Board approved Policy Develop a Appetite for the firm Good practice consideration The Strategy should summarise the corporate strategy for the firm in terms of growth areas, priorities regarding existing customers, its distribution model and organisational competencies. The risks which emanate from the firm s strategy are shown. The target outcomes in relation to each are clearly specified what does good look like? Measures of whether the Strategy is successful or not are defined. A gap analysis of current arrangements and a tangible plan for improvements is incorporated. The framework clearly references and appropriately considers the s faced by the firm (i.e. people, process, systems and external events). The components of the framework are clear across the three lines of defence and have been communicated appropriately. Roles and responsibilities in relation to the implementation of and compliance with the framework are made clear and are appropriate. The Policy makes clear reference to the firms Strategy and objectives. Roles and responsibilities across the three lines of defence in the context of are made clear. Senior management clearly articulate the organisations Universe in the context of the Group. Senior management clearly articulate the Groups key tools and processes for the management of. The Policy clearly articulates the governance arrangements that are in place and associated reporting requirement. The policy sets out clear outcomes which the Board mandates in relation to and these appear appropriate and due consideration is given to the profile of each entity. The Appetite gives consideration to the whole customer lifecycle. Each statement is specific enough so that it is not open to misinterpretation. The Appetite that is set takes into account the strategy of the Group. The Appetite takes into account the key outputs from the framework. Appetite is defined through reference to both qualitative and quantitative measures and covers all key sub categories of. Metrics and tolerances are developed in order to allow performance against Appetite to be monitored and tracked. It is clear how it will be determined whether the firm is within or outside its Appetite. The Appetite considers product types and features which are specifically outside the appetite of the firm.

4 Appetite The Appetite should consider the full customer journey and conduct risk lifecycle, with each of the appetite statements specific enough, so that it can be accurately measured and is not open to misinterpretation. Firms are traditionally taking one of two approaches to including within their existing Enterprise Management Framework (ERMF): 1. Establish as a Key Driver, alongside Credit, Market and Operational risk, for example; or The decision on the most appropriate approach needs to take into account the size and complexity of the firm, but more importantly the view of the Board on how fits into the overall Enterprise Management Framework (ERMF). Irrespective of the decision around the classification of, it will remain a key risk objective with the elements of the lifecycle as the Dimensions (Product design, sales process, after-sales and culture in the example below). 2. Establish as a sub-risk of Operational risk. Figure 3. Hierarchy of Appetite statements example An example of how should fit into an overall ERMF is shown below; This demonstrates how following a structured approach to establishing as a separate Objective and as part of your Key Drivers can help firms define effective appetite statements, that provide a more accurate understanding of the culture and performance across the Dimensions. Objectives Financial Operations & People High Level High Level dimensions Concurrent development Continuous interaction and communication Financial strength Profit volatility Process People Technology Credit Culture Product Design Sales Process After-Sales Process Product Design Sales Process After Sales Process Culture xx xx xx Culture Operational xx xx xx Business xx xx xx Directional Key Drivers Regulatory & Legal Operational Credit Insurance Market Liquidity Business

5 The Appetite that is set takes into account the strategy of the firm and is defined through reference to both qualitative and quantitative measures, covering all key sub categories of (as shown in Figure 4). Metrics and tolerances should be developed in order to allow performance against appetite to be monitored and tracked, to determine whether the firm is within or outside its appetite, which subsequently helps inform decision making. An example of how this could look is set out in figure 4 below: Fig 4. Example High Level Appetite Statements High Level Objectives Dimensions Statements & Measures Appetite We have a zero appetite for systemic unfair outcomes arising from any element of the conduct risk lifecycle, which includes product design, sales or after sales processes and culture. However where we identify Operational s that may result in potential s for customers, we will be proactive in escalating, agreeing appropriate actions and communicating clearly with our customers to ensure a fair outcome is achieved. Product Design Appetite Statement We will have a clearly define target market for each product (live and legacy), by customer segment and by business unit, which will define a clear and compelling proposition (product and/or service) for our customers, and will deliver a proposition that generates value for money. We will undertake regular reviews and actively manage our portfolio of products to ensure that they continue to deliver value for our customers, identify areas of potential detriment and where appropriate we will take proactive action to mitigate any impact to our customers. Sales Process Appetite Statement Post-Sales Service Appetite Statement Culture Appetite Statement Product Design Appetite Measures Lead Indicators Proportion of products assessed as higher risk. Products Approved outside of standard criteria. Value for money assessment. Number of products withdrawn in rolling 12 months. Lag Indicators Proportion (%) of sales outside of the defined target market. Complaints (by product). High margin products (top 10). Sales Process Appetite Measures Post-Sales Service Appetite Measures Culture Appetite Measures The level of detail of the Statements would increase when describing key risk driver appetites How Deloitte can help Deloitte has market leading experience in relation to the design, implementation and embedding of frameworks for managing. We have assisted established firms in the enhancement of their existing frameworks and approach to assessing outcomes, in addition to assisting new entrants develop a framework for the management of. Our work has spanned all key industry sectors, including Banks, Building Societies, Insurance firms, Financial Advice firms, Wealth Managers, Investment Managers and Wholesale firms. Below we have highlighted some of the key areas where we can provide assistance to firms as they focus on this area. Figure 5. Selected areas where Deloitte can provide support Industry leading practice Provision of insight in relation to industry leading practice relevant to the areas within scope, through the delivery of briefings, workshops with management and assistance with, or leading the production of key deliverables. Framework design The design of the Management Framework, including the key components, agreeing how the components interact with each other and defining roles and responsibilities. Governance The arrangements in place in relation to the framework, including committee roles, reporting structures, individual and functional accountability and responsibility and documentation standards for the framework. Design of Components The detailed content of specific components of the framework, such as the Appetite, including in relation to their scope, level of detail and appropriateness for their specified purpose. Embedding and oversight The design of the means of embedding and maintaining oversight of the framework, training material, training and competence arrangements and Compliance Monitoring, including the methodology for assessing and monitoring of customer outcomes).

6 Our team of experts Cindy Chan Partner and Regulation Nikki Lovejoy Partner Financial Services Stephen Williams Partner Financial Services Tim Thompson Partner Quantitative Measurement It is essential that senior executives understand that incentivising revenue over risk is a dangerous folly. Growth is a sound ambition for any business but risk must be properly managed and robust controls are imperative to ensure growth is achieved in a way that is both stable and sustainable. Tracey McDermott, director of enforcement and financial crime Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited ( DTTL ), a UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent entity. Please see for a detailed description of the legal structure of DTTL and its member firms. Deloitte LLP is the United Kingdom member firm of DTTL. This publication has been written in general terms and therefore cannot be relied on to cover specific situations; application of the principles set out will depend upon the particular circumstances involved and we recommend that you obtain professional advice before acting or refraining from acting on any of the contents of this publication. Deloitte LLP would be pleased to advise readers on how to apply the principles set out in this publication to their specific circumstances. Deloitte LLP accepts no duty of care or liability for any loss occasioned to any person acting or refraining from action as a result of any material in this publication Deloitte LLP. All rights reserved. Deloitte LLP is a limited liability partnership registered in England and Wales with registered number OC and its registered office at 2 New Street Square, London EC4A 3BZ, United Kingdom. Tel: +44 (0) Fax: +44 (0) Designed and produced by The Creative Studio at Deloitte, London A