Compliance Risk Assessment


Published on

CEI Compliance is the UK's fastest growing regulatory consultancy and provides associate opportunities to consultants and cost effective value to financial services and other regulated companies.

We show you the methodology for conducting the Compliance Risk Assessment and how to provide meaningful action plans.

Published in: Business, Economy & Finance
  • Be the first to comment

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Compliance Risk Assessment

  1. 1. Steps for ComplianceRisk AssessmentIdentification and mitigation of controlsAuditing your Compliance Risk Areas can be daunting and time consuming unlessyou have a planned and agreed methodology. CEI Compliance Provide you withthat strategy in this document CEI Compliance
  2. 2. COMPLIANCE RISK ASSESSMENT2010 has seen a number of new rules and changes to old rules following the Walker Review andthe publication of PS10/15. The role of good governance in financial services firms continues tobe high on the international and domestic agenda.Internationally, since January, the Basel Committee on Banking Supervision issued a set ofprinciples in March 2010 for consultation. These principles are for enhancing sound corporategovernance practices within banking organisations. In June, the European Commission publishedits Green paper on Corporate Governance.Domestically, the Financial Reporting Council has now published a new (May 2010) edition ofthe UK Corporate Governance Code and in July 2010, published The UK Stewardship Code. TheFinancial Services Authority (FSA) Chief Executive Hector Sants’s made a speech on 17 June tothe Chartered Institute of Securities and Investments (CISI) conference drew attention to theimportance of a firm’s culture in developing good regulatory outcomes and the role thatgovernance plays in this.Sir David Walker’s Review made several recommendations including the role of the Chief RiskOfficer and the establishment of Risk Committees and the temptation of many firms will be tosay “we are too small to consider risk officers or committees”, or using the FSA’s term of appropriate and proportionate would claim that they are not of significant size, turnover or risk rating to In 2010, 10 individuals warrant such attention. In some cases this may be true but in many it could be a false assumption. There and companies were could be a number of items that get overlooked fined over £3,500,000 because you have been running the business for years and are “on top of everything.” Unfortunately a for “failing to have number of firms have found that they are often lacking adequate systems and in Systems & Controls (SYSC) requirements, even Article 3 Exempt firms, which quickly become apparent controls” or “failing to after a themed visit from the FSA and a Section 166 have suitable Report demand dropping into their inbox. This can be avoided and our eBook, A General Guide to S166 compliance and risk Reports, available from the CEI Compliance website. management processes Risk assessment can be difficult to anyone who is too in place”. close to the business. However, that said, it is not impossible and often a good 75% can be done effectively in this way. It is often best to get a thirdparty overview of the work done, just as you would expect a quality assurance check on peoplewho check files.If you plan your activity and spend time using each step properly and thoroughly then you willform the basis of a Compliance Risk Register (CRR), supporting document to your ManagementInformation (MI) and provide a dashboard for presenting/reporting to the other seniormanagers within the firm. This also provides a handy tool (historic and contemporary) for anyregulatory visits and keeps you focussed on the higher risk elements and any that are nearingyour Compliance Risk Appetite (CRA). This not only makes good business sense but also helps toshow you have considered the elements to demonstrate that you are Treating Customers FairlyWhitepaper by CEI Compliance Jan 2011Author: Lee Werrell Page 1 of 7
  3. 3. COMPLIANCE RISK ASSESSMENT(TCF), specifically Outcomes 1 & 2. A free guide for TCF self-appraisal is available from the CEICompliance website.PHASE 1 – Data CollectionStep One: Products and Services, employment and production environmentMake a list of all products and services that are offered. These could include any Mortgage,General Insurance as well as Life and Pensions or Investment products, Will writing referrals, TaxPlanning, Debt Counseling or any areas that your firm is involved in.Step Two: Systems and ControlsIf necessary, meet with Departmental Management or the Office Manager (depending on size)to identify what types of company or department policies, procedures, systems, and automationare in place? List these carefully as they form your controls.  Interview Department Management to identify controls o Policies and procedures to maintain compliance o Degree to which processes are centralised or decentralised o Degree to which processes are automated or manual o Location where these products/services are sold o Location where the customers of these products/services are located o Degree of staff turnover o Training to maintain compliance o Are there plans for new products/services? o Have there been any changes in the product/service/controls in the past year?  If so describe o What about your Disaster Recovery/Business Continuity plans? CEI can also help advise o How is your IT managed?  Summarise your controls you on your Disaster  Meet again to ensure that you have a complete and Recovery and Business accurate summary of controls (and not just your interpretation) Continuity Planning including PandemicStep Three: Applicable Regulations PreparationsWith the list of products and services, produce a tablewhere you can record any primary regulations that apply tothe products and services offered? This is known as mapping your regulatory universe and is notrestricted to just FSA rules. There are Advertising Standards Authority rules to consider as wellas new and existing legislation concerning the business right down to employment and otherobligations to consider.  Identify the primary regulations that apply to the list you have formed in Step One.Whitepaper by CEI Compliance Jan 2011Author: Lee Werrell Page 2 of 7
  4. 4. COMPLIANCE RISK ASSESSMENTPhase 2 – Inherent Risk AnalysisWhatever you do today there is risk. There is a risk of companies defaulting, there are risksconcerned with service level agreements not being honoured, and there are risks that clients maynot fully understand the range of products you advise on and it is important to redouble yourcontrols in these areas, for obvious reasons.Step One: Regulatory RiskThe regulator has “hot buttons” and these may be Unregistered Collective Investment Schemes(UCIS) or it may be Structured Products and the guarantees offered. You need to be aware ofthe regulator’s expectations for compliance in the areas you operate in? What issues are at thetop of their current list? What is the complexity of the regulatory requirements or is there a lackof specific regulatory guidance.Risk rating these areas will help you form a potential identifier for where you may need to concentrate your efforts in risk mitigation. The Financial Ombudsman Report (FOS) is a good indicator of things that people complain about. Check it out and relate it to The FSA fines in 2010 total your business, products or services. were over £89, 121,000. Although this is provided as guidance you could define The smallest was £5,000 – further levels and it is often useful to attach a monetary Riaz Ahmad – “For failing or number of customers value to them (as appropriate) so that you can start to form a risk appetite. to act with competence …. Failing to have suitable Risk elements to consider are; compliance & risk  Low – management”. o None or minor penalties or Details can be found on the FSA consequences; website o Not a current regulatory priority; o Noncomplex requirement ut/media/facts/fines o Not an area that we generally have issues with  Medium – o Potential for moderate penalties and/or consequences; o Currently a moderate focus or priority for regulators o Moderately complex with incomplete regulatory guidance o Periodic errors noted by examiners and testers  High – o Potential for significant penalties and/or consequences o Currently a high priority of regulatorsWhitepaper by CEI Compliance Jan 2011Author: Lee Werrell Page 3 of 7
  5. 5. COMPLIANCE RISK ASSESSMENT o Highly complex requirement with incomplete regulatory guidance o One of the leading areas where errors are notedStep Two: Reputation RiskWhat is the level of public and customer Warren Buffet said; “Itconcern/publicity over noncompliance? takes twenty years to  Low – No or low concern likely; build a reputation and  Medium – Moderate concern possible; five minutes to destroy  High – Significant concern or loss of customer it.” He also said “If you confidence likely lose dollars for the firm, I will be understanding:Step Three: Inherent Risk If you lose reputation, IUsing the regulatory risk and reputation risk identified will be ruthless.”in steps 1 and 2, what is the inherent risk in eachproduct and service? Inherent risk is defined as therisk before any controls are exercised or effected?Rank the risk by Regulatory Risk and Reputation Risk. High Regulatory Moderate High High Risk Moderate Regulatory Low Moderate High Risk Low Regulatory Low Low Moderate Risk Low Reputation Moderate Reputation Inherent Risk High Reputation Risk Risk RiskPhase 3 Residual Risk AnalysisStep One: Operational RiskAlthough this can often be subjective, we have found it best carried out with at least twopeople, preferably as a workshop. These are only guidelines and can be amended by you asrequired.Simply evaluate the risk associated with: the presence or absence of internal controls,processes, and procedures to maintain compliance; the degree of centralisation ordecentralisation; level of automation to eliminate human error; staff turnover that couldcontribute to errors; and existence of adequate training, annual testing or other competencemeasures.Whitepaper by CEI Compliance Jan 2011Author: Lee Werrell Page 4 of 7
  6. 6. COMPLIANCE RISK ASSESSMENT  Low – o Presence of good internal controls, processes, and procedures to maintain compliance o Centralised o Partially or fully automated o Low staff turnover o Adequate training has been provided o Account opened Face-to-Face on site (no distance sales) o Client is local, (lives/works)  Medium – o Some weaknesses or soft areas in internal controls, processes, or procedures o Partially decentralised o Some automation o Moderate staff turnover o Minimal training provided infrequently o Account opened Face-to-Face off site (no distance sales) o Customer located relatively local (within 100 miles) and is maintained adequately  High – o Weak or no internal controls, processes or procedures o Decentralized o Not automated o High staff turnover o No training provided o Account not opened Face-to-Face o Customer located over 100 miles away Probability of error can be and much business is done by phone/fax/email. described as frequency of event. By estimating theStep Two: Probability of Error Risk frequency (1:20Evaluate the risk that error will occur due to prior history operations pa is 5%, 1:100of error and changes in regulatory requirements, operations is 1%) and youproducts, and/or services. can work out your comfort  Test/Audit/Exam Results level or risk appetite and o Low – No errors in last review; o Moderate – Minor errors in last review; likely impact of costs if left o High – Significant errors in last review to run their course.  Change in regulatory requirements o Low – No changes since last monitored; o Moderate – Minor changes since last monitored; o High – Significant changes since last monitoredWhitepaper by CEI Compliance Jan 2011Author: Lee Werrell Page 5 of 7
  7. 7. COMPLIANCE RISK ASSESSMENT  Change in product / service o Low – No changes since last monitored; o Moderate – Minor changes since last monitored; o High – Significant changes since last monitoredStep Three: Residual RiskUsing the information gathered in steps 1 and 2, what is the residual risk in each product andservice? That is, what is the risk after controls? Rank the risk by Operational Risk andProbability of Error Risk, which is the likelihood that an error will occur. High Operational Risk Moderate High High Moderate Operational Low Moderate High Risk Low Operational Risk Low Low Moderate Low Probability Moderate Probability High Probability of Residual Risk of Error Risk of Error Risk Error RiskPhase 4 Overall Risk Analysis and Follow-upStep One: Overall RiskAt this point, the risks can be charted on a sliding scale by product or service. For example: High Inherent Moderate High High RiskModerate Inherent Risk Low Moderate High Low Inherent Low Low Moderate Risk Low Residual High Residual Overall Risk Moderate Residual Risk Risk RiskWhere the words Low, Moderate and High Appear, will be the product or service name(s). Atthis point, the chart can be color coded so that cells that show Low Risk are Yellow, cellsshowing Moderate are Orange and cells showing High are Red. This provides information “at aglance” for management, the business lines and regulators.Step Two: Management Tolerance of Compliance RiskWhat is management’s tolerance (risk appetite) of compliance risk? Are there instances whereoverall risk can be high, despite controls, and still be acceptable to management? If so,document why. If management’s appetite for risk is low, the adequacy of controls must berigorously monitored to ensure that residual risk is low. Note that the risk may be different byproduct or service. Take that into consideration along with management’s overall view ofcompliance risk.Whitepaper by CEI Compliance Jan 2011Author: Lee Werrell Page 6 of 7
  8. 8. COMPLIANCE RISK ASSESSMENTStep Three: Direction of RiskConsider the direction of risk and probable change in risk over the next twelve months.Categorise this for each product and service using the definitions listed below. Management should take additional action through more controls or increasedIncreasing review.Stable No additional action is required. Management may want to consider decreasing controls and improvingDecreasing efficiencies. The directions of risk can be monitored as part of the annual Compliance Monitoring Plan eitherby auditors, compliance or departmental responsible in conjunction with management on amore regular basis. There are alternative methods to use such as bottom up and top downassessments with Worst Case Scenarios and most likely occurrences to gauge and demonstratethe range of controls and their effectiveness. This is only a very generic guide and if you need aspecific assessment please call us on 0800 689 9 689 or CEI Compliance can help provide a full compliance support service, reducing required management time, ensuring all areas are up to date and working for your firm’s long term benefit. Call 0800 689 9 689 today or go online at This whitepaper was written by Lee Werrell FInstSMM Chartered MCSI Cert PFS, founder of CEI Compliance Limited. Lee is contactable at any time and welcomes enquiries from all businesses. Call 0800 689 9 689Whitepaper by CEI Compliance Jan 2011Author: Lee Werrell Page 7 of 7