Podcast S5E2 | Compliance & Risk Challenges for Small Asset Management Firms: Amy Aubin

TRANSCRIPT

Kimberley Cole 0:01
This is Risky Women Radio – a show to connect, celebrate and champion women in risk, regulation, and compliance. Sharing insight and perspectives from the most influential members of our global Risky women network on the latest developments, we need to think about, the challenges we should all talk more about and the innovation we are most excited about governance, risk, and compliance. Bringing together the hundreds of senior women professionals already connected with a new emerging group of leading women and men. I’m Kimberley Cole, your chief risky woman.

Jackie Sanz 0:38
Welcome to today’s Risky Women Radio episode, where we will be talking about compliance and risk challenges faced by compliance professionals of smaller firms in the asset management industry, where innovation and access to compliance networks are of importance in the management of risk. I’m Jackie Sanz, Managing Director Risk and Compliance at Protiviti. And I have the great pleasure today to introduce today’s risky woman Amy Aubin. Amy is the Chief Compliance Officer of Waypoint Investment Partners Inc, an independent wealth management firm and also of true exposure investments Inc., and investment fund manager, formerly the Chief Compliance Officer at Gluskin Sheff + Associates Inc., and CFO and CCO at AGF Trust Company, and an auditor and consultant with PriceWaterhouseCoopers. She has breadth and depth of experience in the financial services sector in Canada. A fan of continuing education, Amy has accumulated several professional designations throughout her professional journey, and taught audit and accounting at a local university. Amy is a chartered accountant, a Certified Information Systems Auditor, a Certified Anti-money Laundering specialist and a Chartered Financial Analyst charterholder now working for two startup companies she has taken on broad roles, including most of the back office and accounting functions as well as compliance roles. Welcome, Amy.

Amy Aubin 2:10
Thank you, Jackie, for that intro.

Jackie Sanz 2:13
You’re welcome. Look, tell us about some of the biggest risks you’ve taken in your career.

Amy Aubin 2:19
Okay, biggest risk, I think I am generally a risk averse person. That’s my personality. I’m an accountant. I’m a compliance person now, and I fit many of the stereotypes, I think that go along with that. I’ve left jobs, and those are risky things to me. So any sort of change, to me feels like a risk. And I think I’ve gotten better at that as I go through my career moving from a CA firm to industry, banking, and now securities. And I think one of the biggest risks I took, which I hope is not as big a risk today, was having children. So I was only a couple of years into my employment at a CA firm in Canada. And even now, I think there can be negative consequences for women who choose to have children in professional environments. This was now over 20 years ago. And at the firm I work for I was in the consulting area. And I had seen other women ____ assignment, sidelined for the better part of their pregnancies. So for me, I was 24 years old or actually 23. And it was a risk for me, but I knew I wanted to have my children earlier. So luckily for me, this risk paid off, I did not experience these sorts of negative consequences. The partners that I worked for, all almost met at that time still, were wonderful partners. I had this worry that I was torpedoing my career right at the beginning and it didn’t work out that way. So that, to me was a big risk. I hope my children to appreciate it. I have many children now, had more children along the way. And it’s been one of the best things of my life. So far. I’m glad I took that risk. But it was it was a stressful time. I have to admit. Another risk that I took a little more recently was when I left one of the bigger firms to take on these two. Well, at the time, it was only one part time role that I knew I would be _____ small, less than 10 people Asset Manager. This is you know, it’s a financial risk at this point in your career and professional risks. So a lot of conversations with wonderful colleagues in the industry to get over my little bit of my imposter syndrome, which I will admit to having on occasion, convinced myself I can still enjoy professional satisfaction. I am knowledgeable enough to be of service to these smaller firms. And that’s really what I was looking for was some way to make a bigger impact and really help the smaller firms in the regulatory environment that exists in Canada today. And there have been recent changes in regulations that allowed somebody to be the CCO at more than one company. And I think I’m one of the first people in Canada, probably not the first. But there’s a handful of us who’ve done that. This has also worked out wonderfully. So I’ve given you two risks that worked out wonderfully, I will not say every risk that I have, my personal career has worked out great. Sometimes I trusted the wrong people or the wrong processes and got burned. But I think there is truth in that, you know, adage that you learn from all of your mistakes. So I think those are probably two notable highlights that worked out really well for me, but that were stressful at the time.

Jackie Sanz 5:51
That’s great. And quite frankly, your most recent risk is a great segway for our listeners, maybe you can explain sort of how and where risks differ between smaller and larger asset management firms?

Amy Aubin 6:08
Sure, I think I’ve had a variety of sizes, you know, I’ve worked at PwC Coopers & Lybrand, before the merger. And that’s an enormous firm. And just thinking about general risks that apply to firms and people working at firms. Some of those risks are universal, no matter what industry you’re in. So I’m in the asset management industry. Some risks are specific to that area. For example, if you’re in a small firm, you have, there’s just fewer resources, that’s the way it is, you’re also much more nimble. So you know, there’s a give and take in the benefits of being a small firm. But if you had to defend yourself from a claim or an investigation or a lawsuit, it’s a much bigger deal. If you’re in a small firm, you just don’t have the same resources to draw from. So I think that sort of risk can be much more significant for small firm, for example. Another area, I would say, is expertise. It seems obvious. But it can be very expensive to acquire expertise. But in a small firm in this industry, asset management, the firm itself is still the one on the hook for getting it right. So you have a CEO who’s wearing multiple hats, they may not be an expert in any one of the areas that they have to oversee. But the risks they’re taking are the same, just on a smaller scale. So they need to find ways to get that expertise in a cost effective manner, and still oversee those service providers to the best of their ability to make sure that it’s being done correctly. So I think that sort of balancing act is a risk for firms that something gets overlooked.

Amy Aubin 7:01
That’s a great point. And it kind of makes me think then are there less relevant, perhaps risks to the smaller firm? Because, you know, you talk about common risks, and how their scale or impact could be different, right, between the larger or smaller firms? Are there quite frankly, less relevant risks to a smaller firm?

Amy Aubin 8:27
I think so. Since moving over to the smaller environment, maybe just over a year ago, in the middle of a pandemic, I no longer have to worry about multiple regulatory regimes. So I can focus on one country, one regulator, one type of client, one type of product, so that multidisciplinary complexity just isn’t something I need to worry about any more. That being said, now, I have a much broader role. So for me personally, there’s still interesting things to do. But in terms of risks of the firm it’s much smaller. I think one of the big things I noticed was project risk. So in larger firms, I used to be involved in a lot of projects. And one of the big areas of project management is getting buy in. So this adoption risk, how do I make sure change management happens throughout this huge organization? In a small firm, you know, there’s five people so you just don’t have to worry. You don’t have the huge spend on training and getting buy in posters and all that stuff. You can just be like, Okay, everybody, Do we all agree and you can really move so fast. So that speed of implementation is a totally different ballgame. And a small firm I would say some other things that are less risky is silo. You don’t have the silos that happened in a large firm. One of the things I really noticed was what I call the IT spaghetti. I’m sure there’s a better term for it than that. The picture that big firms always have of their IT systems and all of the linkages, and it just looks like a big ball of mass. And it’s the legacy. It’s the our old system. And then half of it got moved to this new system, you have a link here and a link there, in that the one thing I’m loving, and I’m feeling no risk about is have these clean datasets, there’s no massaging of data. It’s just nice, simple. Everything from scratch. And you know, I’m an accountant at heart. I have many of the stereotypical traits of an accountant, I like things just so, I like order, I like numbers. And creating a reporting structure from scratch is just like music to my ears. You know, I can just see, here’s my file, here’s my attachment and everything matches and I don’t have that spaghetti, and the burden of a long legacy and multiple system changes and everything. Nothing’s ever simple when you have that IT spaghetti as I call it. I think that’s probably some of the things that I’ve noticed or less risky.

Jackie Sanz 11:14
Yeah, and just a comment on on your last point there, certainly, by having those risks missing when you do need to pull together something, be it for the regulator, be it for, you know, some kind of litigation or other sort of case investigation. It’s simpler, it’s easier, you have more control, and can certainly be more assured, although never 100%. But more assured that you have everything you need that I presume.

Amy Aubin 11:47
Certainly from a compliance point of view, there is a reassurednace, I don’t even know if that’s a word, to knowing everything that’s going on. So I know, that’s it. There’s one GL, there’s one system, there’s 50 clients or however many there are. And yeah, I can pull together that report myself, I don’t even need help from anybody because everything is new and pretty and off you go. There are some some risks to smaller firms, I mean, one person can have a big influence on a large, firm or small firm. But if you’re the compliance person, in any firm, you always have to worry, does this person’s level of risk tolerance, match my own. So as a compliance person, several people have told me lawyers and others, like you’re the one with the bull’s eye on your forehead related to compliance. So there is a level of personal liability to a compliance type role. And you have to make sure you match up well, style wise, with the people that you’re working with. So I’m pretty straightforward right off the bat. And after a few mis-starts, I guess that’s one of the questions I would ask, what is your approach to risk taking? What is your approach to compliance? I’ll label where I am on the spectrum in terms of highly risk averse to highly risk seeking, do you match up with my approach? Because otherwise, it’s a recipe for a ton of stress and conflict. You don’t want somebody who’s exactly like you, because you want to have that counterbalance. But if you have somebody diametrically opposed to your approach, it’s gonna be a very stressful place to be.

Jackie Sanz 13:35
Absolutely. I guess, going back to your comment on the new and shiny and great sort of environment of the smaller firm, what would you say, or can you say that there has been a lasting impact arising from, you know, the last two years of the pandemic experience for compliance practitioners of the smaller firms?

Amy Aubin 14:01
I think so. I mean, I started the pandemic in a larger firm, and then I’ve moved to a smaller firm during the lockdown. One big difference is I never need to go to the office anymore. if I don’t want to. So I have two part time roles right now, one of my companies doesn’t even have an office. It only has a virtual office that takes the mail and there’s no other bricks and mortars associated with that company. So I don’t know it seems pretty avant garde in a way for a pretty conservative type of industry. So this move to remote work, I think, has been a change and I think it will last in compliance. I don’t know about every compliance department, but certainly, we were doing a lot of things manually that can be handled electronically, much more efficiently. So I think the pandemic has spurred on why are we getting this by mail, when at the beginning during the pandemic, there was concerns about mail delivery, there was concerns about touching mail. And it really has spurred that change to let’s get a feed. And why can’t you provide the feed this is the 21st century? At the beginning of a lockdown, I have daily meetings with staff, I don’t have staff anymore. But you know, are you are you more productive at home? What is hindering you? And at the beginning, I would get no, I’m 70% of where I used to be in the office. I think after a year, nobody was at 70% people were at 100 or more, probably, I would say I was more productive during the pandemic, no lineup of people outside my door. But I think there’s something lost in that movement as well, where a casual drop in doesn’t happen. And it feels, so if I used to have often, you know, compliance intelligence network of just people who would come and say, you know, what this is, this doesn’t seem good. Or I wonder if there’s a way to improve this, and is that something Compliance would be interested in, and you don’t have that anymore. It feels much more important, or like you’re tattling on somebody, if you have to call or set up a Team’s meeting, to talk to the compliance person about it, it feels like a bigger deal than a casual office conversation. So I think there is something that’s been lost a little bit that I hope we can get back. But I think the efficiency and the wonderfulness for me any way of working from home will continue.

Jackie Sanz 16:34
I would echo that sentiment, I personally feel that the last two years, were the most productive of my 30 plus year career as crazy as that sounds.

Amy Aubin 16:48
Yes, I could agree with that. I mean, I had some big changes, obviously. So it’s more difficult to measure but but definitely it’s been…I used to commute an hour a day each way. And it’s amazing how much more productive you are in your life and in your work without losing those few hours everyday.

Jackie Sanz 17:09
Agreed!

Kimberley Cole 17:13
This episode is brought to you by Protiviti. Protiviti is a global consulting firm with deep expertise in transformation, risk management and compliance. Partner with Protiviti and face the future with confidence.

Jackie Sanz 17:31
So what then are some of the key challenges, specifically for compliance practitioners, and for those that are actually trying to hire them?

Amy Aubin 17:41
So hiring is one of the things that I think has become more difficult during the pandemic. And I think it’s a tricky balance anyway, I feel like it’s hard to find a good person, people are in high demand, good people are in high demand. And really for a compliance role, particularly in a small or medium sized firm, getting a person that fits properly into your environment matters. So what do I mean by that? What are you good at? What services do you already have that are working well, and what can a new person bring to help fill that gap? I mean, time and money. Anything’s possible with time and money. But I think we want to minimize time and the money, particularly in smaller firms. So if you need somebody who can stay up to date on all the new regulations, decide what’s important, proactively create content, write your policies, educate your staff, if that person has traditionally been a doer, rather than a researcher, or whatever it is you need, you might unintentionally have the wrong person who’s a really great person for whatever it is they’re good at, but just not for what exactly you need. I’ve seen that happen. Or you might hire a consultant instead of a staff person. And maybe that consultant is well versed in security, compliance, and your manual processes, and oversight, and in that area, KYC is beautiful. But your AML is years behind. If you’re this, you know, the sole Portfolio Manager or CEO of a two person team, you’re not an expert in AML either. So finding those right people is a challenge. More so for a small firm, I think because you need to be selective with how you spend your money. But you still need to follow all of the rules that are big firm needs to follow. And I think what I found too, is trying to hire people, not everybody needs to be a compliancer in compliance. I’m a big fan of hire for attitude and train for the rest. I do love teaching I used to teach in university and I, one day, I’ll get back to that. So training somebody or talking to somebody who’s interested in what you have to tell them, and wants to learn what you have to say is a great feeling. So I like finding those sorts of people, you don’t have to be a compliance person to be able to learn about the parts of compliance that I need you to do. I don’t need everybody to come in and be a compliance expert. There’s a lot of transferable skills from other departments. Having people who understand the sales cycle, for example, is one of the best things I ever did in terms of hiring. Because they just had knowledge that I was not familiar with, I’ve never been in sales. And they really had that practical knowledge. One thing that I find in job requirements is I never write up a job requirement that says you need to know how to use a certain piece of software. I see that a lot in accounting jobs, sometimes in compliance for rule building. I think anybody that I would want to hire is going to be able to learn that. Software has become so easy to use, so trainable. If you hire somebody who’s interested and has the right attitude, I think they can learn to use that software. And, frankly, we might decide to change our software tomorrow. So having that five years of experience with that piece of software might irrelevant in the future. So I think for a small firm, summing up this long rant, small firm is really trying to find that person who complements your company’s GAAP is the challenge. And you really need to think about all the things that need to be done. And then what are the highest value items that you need to try to bring in?

Jackie Sanz 21:52
That’s a good philosophy to follow for sure. Particularly in today’s market, where as you said previously, you know, hiring is more challenging in the pandemic, but also, everybody wants the good people. And while there may be many good people out there, they’re hard to find, and certainly hard to procure when everybody wants them. So that’s very sage advice. I guess, what would you say then, at the moment, if you could take now as a point in time as we come out of the pandemic, all the sort of crazy things going on in the world in terms of economic sanctions, regulatory reform and the speed at which regulations are changing? What would you say, are the top risks that you personally with both the firms that you’re working with, are dealing with?

Amy Aubin 22:53
I would say, some of the things that I’ve been working on for the last decade, though, cyber risk, it’s a very different ballgame. So I have a bit of a history with auditing IT systems. But we’re talking now, we have three laptops, and we use Office 365. What are the cyber risks related to that? What are the basic things that we need to put in place? And when I was at a big firm, there was an IT department that would set up all of our security. And I can go and ask them, you know, have you done penetration testing? Have you set up dual factor authentication, and now it’s the same thing on a very small scale. And you just need to go back to basics. So how do I protect my system from people getting in? How do I protect the data while it’s at rest? How do I protect the data in transit? And all of the things are there, but sometimes you have to know to turn them on. So that’s one area that I’ve been learning about since I’ve been at a smaller firm. What are the basic items in Office 365 on you know, people’s laptops, that are just the standard things you should have? Which if I had an IT department, they would be able to tell me. So that’s one area that is always interesting. Every time the government itself has a cyber breach, I think, you know, it’s just a matter of time. So it gets kind of reenergized to look at cyber risks and think of ways to protect our clients’ data. I think to new regulations you mentioned it in your question, it’s unbelievable the number of new regulations! In Canada, we just had an introduction of what’s called Client Focused Reforms and it had a big impact on firms, law firms, big firms, everybody, a lot of attention has been paid to getting this right. We’re now turning our heads to Okay, we’ve created all these lovely policies on paper are now we’ve had a couple of months trying to implement them in practice, is what we thought would work on paper work in practice? Is that the most efficient way to do it? So now it’s a little bit of that feedback loop to make sure that what we said we would do worked, so that by the time the regulators come in a year, or in months or whatever, we’ve actually got a system that we can actually use and doesn’t just look good on paper. So that’s another area of focus, I would say. And then I think it is the asset management industry, so valuation and liquidity, and making sure, you know, I deal with some funds, so making sure those funds, protection policies match the liquidity, the underlying assets, those portfolio types of risks. I think, with asset management firms, small ones, the one area, you’re almost always going to have expertise in the portfolio management. So it’s often a portfolio manager who starts a small firm. So they know how to find the assets, buy the assets, do all that good sort of stuff. But I’m looking at some of the emerging risks in private credit, and valuation, and how these longer term assets are as a trend going into more retail type products. So I think it’s a trend across the globe. I know in the UK, they’ve introduced a new retail funds structure that allows you to get access to private credit, for example. So we have no capability in that area, we have expertise in that sort of asset, how can I adapt that sort of structure for a small, firm without spending a million dollars on legal fees? So that sort of emerging risk, but it’s also really an opportunity to get this sort of structure correct. And be first out at in some cases are one of the first firms to have this sort of product. Because we can move very quickly.

Jackie Sanz 27:09
Excellent. So I have to say you’ve given all kinds of great insights to common risks and unique risks between the larger and smaller firms. But I guess, now, I would ask, if you could give sort of one big solid piece of advice to risk and compliance practitioners that are in the smaller or medium sized firms? What would that be?

Amy Aubin 27:39
Sage words of advice…I would say, enjoy the variety. So I still have the chance to do research and analyzing things at a fairly high level, you know, private credit and new structures. But I’m also the person who opens up the envelopes to review personal account statements, because I’m compliance in all of its forms. I personally love that. So I do enjoy the variety. And I think there’s opportunity in a smaller firm, literally sitting right next to you, the portfolio manager might be sitting right next to you. They can bring you into whatever it is they’re doing, because they’re literally right there. So I would say take advantage of your smaller firms threat on a small scale, to just get everything you can out of it.

Jackie Sanz 28:31
Excellent and sage advice. Because you are right in the larger firms, and you said it earlier, everything is quite siloed. And quite literally siloed and so far is physical proximity and who you easily can sort of bump into when walking the halls. So I take your advice as quite sage because it is true, in the smaller firm, you probably fit all on one floor or maybe in one room, and have that opportunity to learn, observe, share dialog, research and just, quite frankly, personally grow. That’s great advice. Thank you, Amy. So I would say to our listeners, this brings this episode to an end it was a very interesting discussion on risks, and certainly on Amy’s interesting journey. Thank you, Amy, for joining us today and for sharing your thoughts, perspectives and quite valuable insights. I have no doubt that our listeners have come away with some pretty practical considerations as they continue through their own career journeys. And more importantly, maybe now more will join smaller firms after that great insight. Thank you, Amy.

Amy Aubin 29:47
Thank you Jackie.

Kimberley Cole 25:24
Thank you for listening to this exciting episode of Risky Women Radio, to connect, champion and celebrate women in risk, regulation and compliance. I’m Kimberley Cole, based in Hong Kong. For more information on the Risky Women global network, head to our website, and the episode notes and please be part of the ongoing conversation by subscribing to this podcast, connecting with us @RiskyWomen on Twitter, or even reaching out to me directly by email.