The conception of “conduct risk” has risen to the top of firms’ and regulators’ agendas recently. In the UK, the FCA expects conduct risk management as being embedded into firms’ risk management frameworks, promoted by proper management information (MI).
Building on ongoing regulatory and supervisory requirements and our knowledge of what works well in practice at firms.
Ten principles of strong conduct risk MI have been identified that we believe provide a sound bedrock for conduct risk MI across all of financial services firms and sectors.
The 10 principles of strong conduct risk MI are;
- Linked to strategy, culture and risk management framework
- Holistic and used to support analysis of trends
- Efficient and proportionate
- Accurate and timely
- Measured and reported on at an appropriate frequency
- Comprehensible and traceable
- Supports open communication and challenge
- Acted upon and recorded
Attached to strategy, culture and risk management framework
Conduct risk MI is regarded when the firm talks about its strategy and the firm puts in place a process to check the conduct risk MI it gathers, if the strategy or business conditions should modify (e.g. due to the economy, developments in policy and regulation, or technology).
Conduct risks are supervised with the same rigour, and given the same priority, as prudential risks.
A stable of indicators are employed to inform senior management on how proficiently the firm’s culture has been embedded. Conduct risk MI is used as a component of performance appraisals and in taking into account staff remuneration and promotions, as an example, as an aspect of a balanced scorecard.
Firms continue to design conduct risk appetite statements for key risks and report MI against conduct risk appetite limitations and triggers.
As a component of the product governance procedure, firms articulate what a good outcome would most likely be for the target end client, including the inherent risks of the product and services, and identify the MI they need to oversee this.
MI enables an examination of whether good outcomes are achieved consistently, such as, through monitoring whether the product offers value for money, as opposed to just highlighting whether poor outcomes are avoided.
Deep-dive inspections, mystery shopping, customer sales reviews, branch visits and other exercises are often used to expand a picture of the product and services from the client’s viewpoint.
Definitely not all conduct risk metrics must be outcomes-focused, as firms need a set of metrics to build up an overall image of conduct risk. Such as, it is still vital to receive MI on customer satisfaction, even if, by itself, this does not automatically make evident a good customer outcome.
Holistic and in support of trend analysis
Companies use a suite of MI, built upon an examination of what is needed, as opposed to what is readily available through existing systems and processes, so that a combination of indicators is measured and used to identify potential problems to be investigated further. Using existing risk or control indicators may only provide a skewed view of the situation. We always encourage firms to set an ideal scenario and employ back from the future thinking.
MI is analysed in different ways to identify trends:
– Over a time frame (consistent on a period-to-period basis) e.g. to identify increases in complaints over time for a product;
– Across products e.g. to identify products with remarkably low claims ratios or low investment returns;
– Across business lines e.g. evaluating breaches of conflicts of interest policies in different operations in the business; and
– Focusing on one team or individual e.g. evaluating a variety of indicators from a trading desk to identify patterns.
MI reports on potential and emerging conduct risks, besides crystallised risks, as an example, monitoring whether a product is promoted to the target audience.
The company considers the emerging conduct risks and trends from the FCA, e.g. those highlighted in the Risk Outlook, as well as lessons learned from previous mis-selling scandals or other regulatory enforcement action, and talks about whether any changes are needed to MI and whether latest MI suggests there may be problems that call for further investigation. Such as, when the FCA’s Risk Outlook for 2014 highlighted that house price growth may trigger conduct issues, firms that provide mortgages should have targeted, for instance, affordability and equity release loans.
The business is starting to use analytics resources to link data and enable identity of underlying conduct risks, such as, linking post codes with types of mortgages sold and house price growth in the area to understand the risk of customers falling into arrears or the risk of customers being sold an unsuitable product. Many firms will already have this data for credit risk purposes.
Efficient and proportionate
The business takes a risk-based approach to reporting MI to stay clear of a deluge of information; information that would not provide value to senior management is not included in MI.
There is a clear delineation of the purpose of conduct risk MI from other MI to eliminate duplication and overlap.
Accurate and timely
Decisions are made based on the right information, collected sufficiently quickly after the relevant business activity has occurred, to enable action.
The second and third lines of defence are participating in open conversations with the business on expectations in connection with the quality and timeliness of data and what is attainable.
Internal Audit reviews the process governing how MI is collected, analysed and reported, and managers review and sense-check information on a sample basis.
Measured and reported on at an appropriate frequency
To allow active, rather than just reactive responses, conduct risk MI is provided to senior management as a component of monthly, quarterly and annual reporting (as agreed with senior management), and on an ad hoc basis e.g. where risk appetite triggers are breached.
The firm’s resources, systems and processes allow adequate versatility in the frequency with which MI is measured and reported; if necessary, data might be aggregated quickly.
Comprehensible and traceable
Senior management is given clear and concise MI that spotlight the key messages and risks in an easily digestible format; it is possible to drill down into the information for additional detail and to trace where the information originated.
Conduct risk MI includes a mix of both quantitative and qualitative analysis, which is accompanied by remarks that explain what the MI means, why any conduct risk issues have developed and how important they are, how MI was measured (including any limitations), and the planned actions.
Supports open communication and challenge
Senior Managers discuss and challenge ratings across the ‘Red Amber Green’ (RAG) rating spectrum, rather than just targeting ‘red’ ratings, and drill down into the analysis to verify risk ratings.
Firms ensure robust thresholds to avoid just ‘green’ and ‘amber’ ratings being reported, giving a misleading sense of comfort.
Anomalous or unexpected results are challenged and verified e.g. greater than anticipated sales volumes in certain products, or continued successful market predictions from a certain trading desk.
Senior management openly discusses and seeks to understand weakness in how MI is collected and analysed.
Acted upon and recorded
Once potential, emerging and crystallised conduct risks are identified, the root causes are investigated and actions are tracked and reviewed to ensure they addressed the risks.
Conduct risk MI includes reporting on agreed remedial action and whether the action addressed the conduct risk proficiently.
An audit trail is maintained detailing how areas of concern detected within conduct risk MI have been acted upon and monitored.
If you have any queries, please call us on 0207 097 1434
Lee Werrell Chartered FCSI