The philosophy of “conduct risk” has risen to the top of firms’ and regulators’ agendas lately. In the UK, the FCA presumes conduct risk management to be embedded into firms’ risk management frameworks, sustained by suitable management information (MI).
Building on latest regulatory and supervisory requirements and our prior experience of what works well in practice at firms, ten principles of strong conduct risk MI have been identified that we think serve as an intelligent base for conduct risk MI across each of the financial services firms and sectors.
The 10 principles of strong conduct risk MI are;
- Linked to strategy, culture and risk management framework
- Holistic and used to support analysis of trends
- Efficient and proportionate
- Accurate and timely
- Measured and reported on at an appropriate frequency
- Comprehensible and traceable
- Supports open communication and challenge
- Acted upon and recorded
Connected to strategy, culture and risk management framework
Conduct risk MI is taken into account when the firm talks about its strategy and the firm establishes a process to examine the conduct risk MI it accumulates, if the strategy or business conditions should shift (e.g. due to the economy, developments in policy and regulation, or technology).
Conduct risks are overseen with the same rigour, and given the same priority, as prudential risks.
A stable of indicators are adopted to inform senior management on how thoroughly the firm’s culture has been embedded. Conduct risk MI is used as a component of performance appraisals and in regarding staff remuneration and promotions, for example, as a part of a balanced scorecard.
Firms never cease to create conduct risk appetite statements for key risks and report MI against conduct risk appetite limitations and triggers.
As part of the product governance procedure, firms articulate what a good outcome would certainly be for the target end client, along with the inherent risks of the product or service, and distinguish the MI they need to keep an eye on this.
MI enables an evaluation of whether good outcomes are achieved routinely, for example, through monitoring whether the product offers value for money, rather than just focusing on whether poor outcomes are avoided.
Deep-dive inspections, mystery shopping, customer sales reviews, branch visits and other exercises are often used to build up an image of the product and services from the client’s frame of reference.
Not all conduct risk metrics must be outcomes-focused, as firms need a package of metrics to develop an overall understanding of conduct risk. As an example, it is still vital to receive MI on customer satisfaction, even when, on its own, this does not necessarily make evident a good customer outcome.
Holistic and in support of trend analysis
Companies use a suite of MI, based upon a consultation of what is needed, instead of what is readily obtainable through existing systems and processes, so that a combination of indicators is measured and used to identify potential problems to be investigated further. Using existing risk or control indicators may only provide a skewed view of the situation. We always encourage firms to set an ideal scenario and employ back from the future thinking.
MI is analysed in different ways to identify trends:
- Over a time period (consistent on a period-to-period basis) e.g. to identify increases in complaints over time for a product;
- Across products e.g. to identify products with relatively low claims ratios or low investment returns;
- Across distribution channels e.g. evaluating breaches of conflicts of interest policies in different operations in the business; and
- Concentrating on one team or individual e.g. reviewing a variety of indicators from a trading desk to identify patterns.
MI reports on possible and emerging conduct risks, besides crystallised risks, i.e.,, monitoring whether a product is marketed to the target audience.
The business thinks about the emerging conduct risks and trends from the FCA, e.g. those highlighted in the Risk Outlook, as well as lessons picked up from previous mis-selling scandals or other regulatory enforcement action, and reviews whether any realignments are needed to MI and whether present MI suggests there may be troubles that call for more investigation. For instance, when the FCA’s Risk Outlook for 2014 highlighted that house price growth may produce conduct issues, firms that provide mortgages should have concentrated on, such as, affordability and equity release loans.
The firm is starting to use analytics resources to link data and enable identity of underlying conduct risks, for instance, linking post codes with types of mortgages sold and house price growth in the area to understand the risk of customers falling into arrears or the risk of customers being sold an unsuitable product. Many firms will already have this data for credit risk purposes.
Efficient and proportionate
The business takes a risk-based approach to reporting MI to stay away from a deluge of information; information that would not provide value to senior management is not included in MI.
There is a clear delineation of the purpose of conduct risk MI from other MI to eliminate duplication and overlap.
Accurate and timely
Decisions are made founded on the right information, received sufficiently quickly after the relevant business activity has transpired, to enable action.
The second and third lines of defence are participating in open conversations with the business on expectations relative to the quality and timeliness of data and what is achievable.
Internal Audit reviews the process governing how MI is collected, analysed and reported, and managers review and sense-check information on a sample basis.
Measured and reported on at an appropriate frequency
To allow practical, as opposed to just reactive responses, conduct risk MI is provided to senior management as a part of monthly, quarterly and annual reporting (as agreed with senior management), and on an ad hoc basis e.g. where risk appetite triggers are breached.
The firm’s resources, systems and processes allow adequate overall flexibility in the frequency with which MI is measured and reported; if necessary, data could be aggregated quickly.
Comprehensible and traceable
Senior management receives clear and concise MI that spotlight the key messages and risks in an easily digestible format; it is possible to drill down into the information for additional detail and to trace where the information came from.
Conduct risk MI includes a mix of both quantitative and qualitative analysis, which is accompanied by commentary that explain what the MI means, why any conduct risk issues have come about and how significant they are, how MI was measured (including any limitations), and the proposed actions.
Supports open communication and challenge
Senior Managers review and question ratings across the ‘Red Amber Green’ (RAG) rating spectrum, instead of just working on ‘red’ ratings, and drill down into the analysis to corroborate risk ratings.
Firms ensure robust thresholds to avoid just ‘green’ and ‘amber’ ratings being reported, giving a false sense of comfort.
Anomalous or unexpected results are challenged and verified e.g. higher than expected sales volumes in certain products, or continued successful market predictions from a certain trading desk.
Senior management openly examines and seeks to understand weak points in how MI is collected and analysed.
Acted upon and recorded
Once possible, emerging and crystallised conduct risks are identified, the origin are investigated and actions are tracked and reviewed to ensure they addressed the risks.
Conduct risk MI includes reporting on agreed remedial action and whether the action addressed the conduct risk successfully.
An audit trail is maintained detailing how areas of concern discovered within conduct risk MI have been acted upon and monitored.
If you have any queries, please call us on 0207 097 1434
Lee Werrell Chartered FCSI