By Simone Martin
for the 2024 Risky Women Writing Competition, presented in partnership with Bovill Newgate
This article reflects on the importance of Governance, Risk, and Compliance (GRC) in the financial services industry, emphasizing the role of regulators in fostering effective governance. It discusses the critical balance regulators must maintain, the significance of compliance professionals, and the troubling signs of non-compliance across various sectors. By focusing on organizational culture and clear decision-making, firms can enhance their GRC frameworks and improve regulatory outcomes.
GRC Awareness
Over a decade ago, in the midst of my career as a financial services regulator, I was well aware of Governance, Risk (Management) and Compliance (GRC). GRC was not a primary driver for most of my engagements early in my career. The impact of Governance was a fleeting discussion point within the media during the unfolding of the PanamaPapers saga. At that time, the cascading impact of Governance on Risk (and Risk Tolerances) and Compliance was not unthreaded fully, as many news stories delved into the operations of Mossack Fonseca Group, but to my mind, it was as important as the other issues being reported. Those events set me on a course to ponder GRC more deeply. My position on GRC underwent a monumental shift in 2017.
One of the touchstones in my career was a presentation delivered by Mr. Simon Osbourne, former CEO of the Chartered Governance Institute (formerly, the Institute of Chartered Secretaries and Administrators). In his presentation, he recounted early events that shaped his career – a major tragedy, the response of the regulatory body (transportation industry) and the impact of their actions over years of engagement. The presentation highlighted that the role of the regulator being akin to a “second board” for the bodies that they regulate. I took careful notes. One statement about regulators resonated deeply with me.
Run well, they can provide a clear and stable framework within those organisations can operate. Run badly, they can keep changing direction and be tempted to micro-manage. – Simon Osbourne
Ruminating over the presentation, I mentally mapped the connections that are intrinsic to GRC in real life. Prior to that presentation, I had given remarks in different forums stating to the effect that there is no such thing as good or bad firms, just good or bad people. ‘Tone from the top’ is a common adage. But the role of the regulator in GRC? Another common adage is ‘context is for kings’; Mr. Osbourne delivered context that I felt every regulator should hear.
Regulators, GRC & Compliance Professionals
Balance in a Regulators’ engagement with the bodies it regulates is critical! This isn’t a controversial statement. Decisions cannot be arbitrary or irrational. The functions of regulatory authorities are many, and two critical functions are gatekeeping (i.e., approving applications) and enforcement (modifying firms’ behavior towards better compliance or exiting them from the market).
In the approval process, regulatory authorities apply the ‘Fit & Proper’ test to persons seeking to be directors and other senior managers/officers. This Fit & Proper test is embedded within international standards, and assesses the fitness (i.e., skills, knowledge and expertise) and probity (integrity, honesty, etc.), as well as the soundness of these persons. Every jurisdiction has this – as an example, the UK, the Financial Conduct Authority has the Senior Managers and Certification Regime[1]. Regardless of the jurisdiction, senior officers, including directors, Chief Compliance Officers, Chief Risk Officers and others are in direct scope of their regulators. These compliance professionals all have clear fiduciary duties to the firms they work with. Compliance professionals are integral to how a firm performs, and the outcomes achieved. That includes applied compliance!
Troubling Signs for GRC
News articles show troubling signs for GRC. A broad assortment of firms – from banks to cryptocurrency exchanges – are being fined for repeated non-compliance in core AML compliance requirements. A quick search will show penalties for poor KYC, sanctions busting, failure to file suspicious transaction reports and more. In short, compliance and risk management are not effective. In the post-mortem of many of these cases in the public domain, one common thread is often exposed – the lack of good governance. There is a knock-on effect from the regulatory side. Poor governance and repeated non-compliance in a firm will elevate the risk profile of a firm with a regulatory authority. By extension, that will trigger more inspections by your regulator.
One of the primary drivers of the inspection cycle is risk. The higher the risks posed by a firm, the more frequent that firm will be visited by their regulator. More inspections can extend to closer scrutiny of senior management. Where failings are detected after past actions that required remediation, the regulatory response through enforcement actions will likely expand beyond fines upon the firm, to censures and other penalties directly to directors and other senior staff. As the risk-based approach to compliance has focused on effectiveness, the analysis of senior staff fulfilling their duties will become more vital.
Refocusing GRC
Governance drives a firm’s culture and culture influences compliance! Peter Drucker’s quote that, “Organizational culture eats strategy for breakfast!” is apt. A corporate strategy that carefully develops its approach to GRC will not have positive results with a poor culture! Exposing unwritten policies can also shed light on the actual culture of compliance and attitudes to risk. To be truly effective, the GRC cogs must be in sync. The approach to risk management and the compliance culture must be driven by the Board and reinforced by the regulator!
To put this into practice, the Board must insist on clear and well-documented decisions (which can evidence effective oversight) that demonstrates sound risk management and governance. Compliance in any sector requires diligence and discipline from both the regulator and regulated. As a result, regulatory actions are evolving to focus supervision and enforcement on the people factor. The optics demand it.
Reference
[1] Visit the FCA’s site at https://www.fca.org.uk/firms/senior-managers-certification-regime for more information.