Podcast S8E12 | Demystifying Surveillance with Emily Wright

TRANSCRIPT

Kimberley Cole 0:01
This is Risky Women Radio, a show that connects, celebrates and champions women in risk regulation and compliance. We’re here to share the insights on the biggest issues in our industry and hear inspiring journeys from our global members. Sign up to our newsletter at riskywomen.org. I’m Kimberley Cole, your Chief Risky Woman.

Kimberley Cole 0:25
Welcome to Risky Women Radio. Today’s risky woman is Emily Wright. Emily is a managing director with 20 years financial services experience, including working for three leading investment banks, Standard Chartered JP Morgan and Lehman Brothers, and two global brokerages, ICAP and Newedge Group. Emily has over eight years experience leading and enhancing compliance surveillance programs in Asia Pacific and actually globally. She is also the author of Behind the Screens: Understanding Employee Surveillance in Financial Services, and now offers independent consulting to financial institutions in surveillance and monitoring regulatory compliance and culture and conduct issues. So welcome Emily.

Emily Wright 1:10
Hi Kimberley, thank you very much.

Kimberley Cole 1:13
Great to have you here. And you are sitting there in sunny Brisbane or just outside of Brisbane, and I’m here in London, so it’s lovely to speak to you.

Emily Wright 1:23
Great to be on the show. Thank you for having me.

Kimberley Cole 1:25
So I gave a snapshot of your career, which is fascinating, but I’d love to sort of hear more of the details of that journey, and what were those sort of highlights along the way that took you on the path that you went along.

Emily Wright 1:39
Of course, thank you. I guess my career has been anything but linear. So from university, I did head into the city and financial services, but I worked across recruitment, HR, diversity and inclusion. I moved into conduct, then into operational risk, and then into compliance surveillance. So it’s been a fantastic journey. It’s certainly given me the privilege of working globally, as you said, and I’ve been based in London, Hong Kong, Singapore and now Australia, and I’ve had senior roles across a number of really fantastic organizations.

Kimberley Cole 2:10
Amazing and so currently, then how are you using all those skills? And what’s the role now?

Emily Wright 2:17
So now I’ve become a founder, and so I’ve set up my own organization. I’m running Wright Consulting and Coaching, and I wear multiple hats, but by design, so I’m in control. That’s the nice thing about being on your own. So I’m an advisor to the board of Features Analytics, and I’m helping them to shape risk technology solutions for the industry. I provide advice and consulting to organizations to help them transform their compliance practices, maybe their surveillance programs, and certainly their non financial misconduct frameworks. I coach risk and compliance leaders on their leadership journeys, and last year, as you mentioned, I published my book. It’s the first book on employee surveillance in financial services, called Behind the Screens. But alongside that, I’ve also written a number of pieces for industry publications. I’ve had one published in the FT, which is very exciting, and I’ve been moderating at industry events, leader networks, conferences and roundtables. So it’s a real mix.

Kimberley Cole 3:13
That’s really interesting. And it looks like you’ve got a good portfolio and how you’re managing technology, as well as, obviously, all the behavioral stuff that you’ve experienced in your career to date. So what do you see as the kind of impact of, I guess, the current role that you’re having in but maybe even some of the things that you’ve done throughout your journey?

Emily Wright 3:35
Yeah, well, and technology is a great way into that, because I think the impact you can have working through technology, the opportunity to change the way risk tools are developed can impact not only what can, but what really does happen with risk management in organizations, particularly when you’re dealing with organizations that maybe don’t have the scale to develop all of their own in house solutions. They’re very dependent on those third party providers, and so that’s a fantastic way to impact a really broad portion of the industry. I think also my impact comes from just everything I’ve learned, and I joke with people, it’s mostly what I learned, what not to do, and then sharing that across institutions and with individuals, particularly when it’s pitfalls, things to avoid, but then hopefully also sharing the playbook and the best practices that have worked. And I just really enjoy spending time either speaking or writing, but sharing my stories and the stories of other people, particularly where you’ve got successes and wins or those lessons learned. Because I think with a wide audience, we can all help each other as practitioners in risk.

Kimberley Cole 4:37
Absolutely, I love that learning what not to do. And so obviously there’s a lot there. And I love the fact that you’re doing the sort of coaching, specifically with your background of risk and compliance. But obviously, then you’ve written the book, lots of things going on. What are you most passionate about?

Emily Wright 4:56
I’ve got a few things, but I think there’s a theme. So partly, I’m really passionate about demystifying surveillance and showing that it can add real value in the financial services industry. That was really where the book came from. But I do think and this, this is almost the same idea, that influence and collaboration and relationships, not just controls and procedures, are really key to good risk management. So I love coaching professionals to become better leaders, but also working with organizations so that they can see that great risk management practices really come from understanding the human element behind the controls and behind potentially the misconduct or the challenges.

Kimberley Cole 5:37
And that’s going to become increasingly important now that we’re looking at AI solutions, etc, getting that human element and that technology to actually gel and give us the best solutions.

Emily Wright 5:50
Yeah, definitely. And I think there’s an even, maybe a bigger theme here around effective risk management, being about doing good business. I think quite often it’s seen as either or you’ve either got risk or you’ve got good business. And there’s a lot about the structure of financial organizations at the moment that sets these two up as opposing forces, but from my experience, they’re much more about balance and equilibrium and being done together to get the best results.

Kimberley Cole 6:17
Yeah, that’s a that’s a really good perspective on things. And given that we’re talking about risks, what risks do you think that you’ve taken in your career?

Emily Wright 6:27
I’ve taken a few. Actually. I’m not risk averse the way you might think a risk manager is. So I’ve taken a couple of big career risks that have shaped where I’ve got to. The first really, was moving from London my home with a one year old baby to go to Hong Kong to lead a regional compliance team. So it was my first jump into compliance. It was my first role in the second line of defense. It was my first role abroad. And I think even remarkably now looking back, it was the first time I’d been to Hong Kong was when I went there for the interview. So it was a lot of firsts. It absolutely paid up off. it’s it opened up this wonderful new global career path that I’ve really greatly enjoyed, I think probably the second big leap that it was maybe even bigger, but it came from a little bit of a practiced position. In late 2022 I took the massive leap of leaving my senior global banking role to return to Australia after 30 years abroad, to a country again where I had never worked professionally, and I didn’t have an established network or guaranteed income, and I had to learn to be an entrepreneur, as I built and founded Wright Consulting and Coaching. So I think the Hong Kong risk definitely paid off. The Australian adventure, I think, is still a work in progress. It’s one of those things. I think sometimes the biggest risks unfold slowly, and I feel like I’m still in the middle of seeing how this one plays out in full.

Kimberley Cole 7:51
Yeah, really, I think you’ve done some very interesting things, and we wish you luck on this next part of the journey.

Kimberley Cole 8:00
This episode is brought to you by Kroll. Stay ahead with Kroll. As the leading independent provider of financial and Risk Advisory solutions, Kroll leverages their unique insights, data and technology to help clients stay ahead of complex demands.

Kimberley Cole 8:18
We are super excited to jump in today to really understand a bit more around the book Behind the Screens. So obviously, it’s a really topical, interesting book coming at quite a critical time. There’s lots of major regulatory actions that have highlighted surveillance failures. I guess first, what really motivated you to write the book and then tell us maybe a bit more about what your thinking was around the audience, etc, as well?

Emily Wright 8:47
Yeah, of course. So the motivations are interesting. There’s probably quite a few of them. The timing was circumstantial, but also crucial. So stepping out of big, institutional employment gives you time and space to think. And I really did think about the function and then had to write it down in a structured way. So that took some space, but it also gave me the freedom to share candid observations about both the industry and some of the players in it, without being obviously linked to one of the brands. Another really important factor that motivated me was that I had seen the same problems in three different organizations over a decade, and these were consistent with what my peers were seeing across the industry from their institutions. And so it suggested a systemic industry challenge that we could really speak to, and a number of key things that could potentially be resolved together. And I felt like that was a big motivating force in putting it in one place. And then I think there was another thing I’d maybe call a niggle rather than a motive. It was how poorly sometimes surveillance is understood by senior decision makers who control budgets, they control resources, and the impact their decisions have on surveillance programs is really significant. And the other side of that, I wanted the chance to demonstrate to them that surveillance isn’t just expensive compliance theater, it really can deliver value when done properly as a risk management strategy. So they were the drivers.

Kimberley Cole 10:12
And so was there multiple audiences then, because obviously some of it you’re speaking to those senior decision makers, but you also said your peers had similar issues, so I guess summarizing them all for them as well. So there’s sort of multiple people that would be interested in the book.

Emily Wright 10:27
Yeah, I think it is multi layered. There are those senior leaders who hopefully want to know more about surveillance, but I think new practitioners in surveillance, this potentially gives them a broader vision than they might get from their one desk in the equities America’s coverage role, and then also you’ve got vendors and other industry stakeholders who it can be a little bit cloak and dagger the word surveillance, people don’t always like to ask about it, so hopefully this is a little bit of open kimono.

Kimberley Cole 10:51
Yeah, and I was going to say that, can you give us a quick summary of what surveillance is, and what are those risks that are generally covered by the compliance and surveillance programs?

Emily Wright 11:00
Yes. So what is surveillance? At the moment, we use automated strategies across data sets to try and detect employee conduct. So this is really about employees. When we’re talking about the kind of compliance surveillance that I do, we would look across all sorts of data sets, but primarily you would look at voice, written communications and trade surveillance activity. Predominantly the sell side is looking at market manipulation or market abuse. However, you will see that in other areas of banks that are really significant and have got wealth and private banking and asset management, that there are programs there around those risks. And that would be, you know, suitability. You’ll have investment banks information barrier surveillance, so there are very specific risk types using these same types of strategies.

Kimberley Cole 11:43
Interesting. And your book references obviously, a lot of the fines for trade surveillance failings that have happened in recent years by Citi, JP, Morgan, etc. And we’ve also seen Toronto Dominion enforcement, which I think happened after the publication of your book, what do these types of enforcements highlight of the ongoing challenges in trade surveillance and what are the key obstacles that you think institutions are facing in implementing trade surveillance programs?

Emily Wright 12:15
There are some really consistent, pervasive terms that we can speak to that are the reason that I say there’s consistency, and the first one, it’s almost a swear word in surveillance, is data. So data is fundamental to doing good surveillance, incomplete, inaccurate, data sets impact surveillance coverage really significantly. The process for remediating data used in surveillance is a journey. I would say that across the industry, many organizations are somewhere on that path, but hopefully we’re going to see more and more of the venues joining that movement, because they really are one of the challenges to overcome is their release of the right and appropriate data. I think another one of the really significant challenges is just the complexity of actual effective coverage, of finding true positive risks. It is still a work in progress for many organizations, most of the industry is still working, for example, on their coverage of related instruments, which means detecting cross asset risk. I think the flip side of those challenges, and this is a slightly different bucket, is that when you’re busy capturing all those true positives, there is a plague that is possible of false positives, that can be the side effect of doing good surveillance, which leaves teams drowning in alerts. It can distract from real risk identification, and it uses up valuable resources to really know better risk management. And then the final one that I would put in that cross industry set of challenges is the question of budget. The industry’s had several years now of reporting budget pressures around compliance surveillance programs outside of those who have been mandated with remediation requirements. Because obviously we’re talking about there’s been some enforcement action, but overall, the trend has meant that there’s been limited resources, reduced program investment, and that puts programs behind for a number of years. The function is very reliant on technology, which does require consistent investment over the medium and the long term.

Kimberley Cole 14:11
Yes, some key challenges there. So it’d also interesting to understand the breadth of surveillance, because often that also encompasses communication programs. So things like, there’s been WhatsApp related fines. To off channel comms over the past few years have really been rising into the billions and affecting over 100 firms. In addition, we’ve seen the recent tele message hack, which has just taken place in May, which was refocusing scrutiny on how and what comms channels are captured and stored. So is all of this changing how institutions approach risk and view investment in communication surveillance?

Emily Wright 14:56
So we have seen really significant enforcement, and it’s been sustained over years, I think the actions have impacted both trade and comms surveillance programs, and what has followed in some instances where there’s been enforcement has been real investment in both of those areas of trade and comms, where they’ve committed to remediation plans. But I think before we look at maybe the industry wide, it’s worth maybe understanding what some of the themes are from those enforcements. The first is that you can have a surveillance only fine, so it means there’s no underlying misconduct that the organization is being fined for. It is just for program deficiencies. The other piece that’s come out over the last few years is the look back. Periods are significant. Regulators are looking for sustained inadequacy. These are not about isolated incidents. So I mean, the look back period for the JP Morgan fine was nine years of remediation that was targeted. Regulators on both sides of the pond have been active in driving these enforcement agendas and those really big fines you spoke to, they are targeting the e-communication surveillance programs. They’re hailing from the US regulators, and they’re particularly around the issue of unapproved channel use. So then to answer the question on firms response to this, I think I’ll come back very specifically to budgets. First, it’s been a tough few years for surveillance programs that have not had enforcement remediation funding. So if I look across the market, that really shows that not all firms are seeing this as a pivotal point in the development of surveillance or the investment in surveillance. For some firms, the enforcements have been pivotal, but for other firms that have been on the receiving end of enforcements, it has still just been seen as a cost of doing business. I do think, however, that there is one theme I’ve seen over the past 12 to 18 months in surveillance leadership that may have come from all of this activity, and that is that there’s a lot more talk about the optimization of surveillance programs, especially when it comes to teams in house developing tools that support or are in addition to the work that they’re doing through third party risk vendor platforms. So there’s been a move away from the discussion of finding one or only a few vendor platforms that would do everything in surveillance, that kind of Holy Grail of surveillance coverage, and many institutions are now really just seeking the very best technology they can find or afford for each aspect of their program. And many are viewing this as a hybrid model that will be a long term hybrid model, where their teams will need to develop and enhance alongside what they buy from third parties. And I do think that’s been a real pivot,

Kimberley Cole 17:35
Interesting. So I mean, when you think about the importance of technology, and of course, no conversation would be complete without bringing AI into it at the moment, but when looking at that technology of both surveillance, trade and comms. What do you see as the future direction and the potential for AI to really transform surveillance over the next, say, five years?

Emily Wright 17:59
And five years feels like a long time in the world of AI at the moment, doesn’t it? But in terms of budgets, it’s not a long horizon. So we should look at that time frame, I think, speaking broadly at the moment, with all the variety of AI available, AI is predominantly affecting the communication surveillance space for now, and it’s embedded in so many aspects of the communication surveillance programs. It’s in multi language translations. It’s in transcription, where people are converting voice files to text files for surveillance. It’s in the use of natural linguistic programming models to generate the alerts. And for many banks, they’ve got self developed large language models alongside their vendor systems to reduce false positives. So all of these different strategies are being honed and developed to continue to improve efficiencies and the effectiveness in some cases of communication surveillance and some of the improvements are flowing really quickly. However, I wouldn’t be representing the full market here if I didn’t say all surveillance practitioners will tell you it’s a work in progress. Many are actually committed to that long term view of a hybrid strategy, and most institutions are still looking at using lexicons alongside natural linguistic programming and llms, because we know that lexicons still have true positive hits that AI misses. And so I think there is an idea that people have got the tools they now need to work out how to benefit most from them and what’s available in trade surveillance, it’s a slightly different story. We’ve seen AI being introduced for alert generation by some vendor firms, but this is to some extent, polarized the market in a way it hasn’t in communications. So we’ve got some vendors that have stuck with traditional rule based approach to all that generation and others that have moved down the path of AI. Many vendors are using machine learning. If I can put that into the bucket of AI, I never quite know. And there’s potentially, I think, in trade surveillance still a real opportunity for AI to show how it’s going to provide a real impact on the efficiency and effectiveness of the pro. Programs the way it has in comms, everyone asks about Gen AI, generative AI, it’s really great fun. People are experimenting with it. I have not seen a real use case where it is impacting either the efficiency or effectiveness of a program, but I know there are teams that are using it for writing their dispositions. But I think the point we discussed about earlier, it’s worth flagging here for all of the AI deployments and all the transformations that we’re seeing. It has to be done with the humans as part of the process the industry really has to ensure, I think, against a couple of things, firstly, that we don’t end up with a skills gap developing, leaving surveillance talent really lacking that AI knowledge. And then the second piece is making sure that when we do deploy AI and it works, because we’ve got real use cases of that now that we restructure the teams to make sure they’ve got the right humans in there to work with the AI, not against it, or to try and compete with it. Because, again, if you’re a linguist in a surveillance team, and now you’re being translated by a machine instead, you’re no longer going to be productive in that team unless you’re found another role or re educated. So I think there’s some real ebbing and flowing to happen in the teams on the human side.

Kimberley Cole 21:08
Yeah, it’s interesting. I think that’s one of the, I’d say common themes that we hear through the podcast is that that whole what is the future, compliance, risk professional look like, and how their role is changing, but also the breadth of all of the areas that they have to be across is increasing as well.

Emily Wright 21:29
Oh, definitely. What I haven’t said is all of those potential risks that come with using AI as well as understanding the risks you’re already looking for. And that’s also another piece of the puzzle.

Kimberley Cole 21:40
So obviously, beyond technology transformation, what do you see is that broader direction for surveillance, and what are those other drivers that we should be thinking about, like regulatory change, risk management? You know? What are those other change factors that you see that will transform the area of risk management?

Emily Wright 21:59
So I think the direction the FCA is going is a really interesting one for surveillance, this evolution from market misconduct into non financial misconduct, and we’re seeing organizations really pick up on that and embed it in the way that they’re thinking about risk, financial risk and non financial risks, I think, for surveillance, if we just sort of follow the breadcrumb trail a little bit after the Sexism in the City investigations, it was very clear that conduct outside the workplace was affecting what happened inside the workplace. Now that’s not rocket science for any of us who have worked in the industry for a long time, but I think it was very important that was embedded in cases and it was being looked at through a regulatory lens. And what that does is it now broadens the view of what types of conduct are potentially presenting an issue for the industry in the way the industry does business, if you step from that then into looking at what the FCA own survey found last year when they did their non financial misconduct survey, the shockingly few number of cases where organizations had found non financial misconduct and had then done nothing in terms of creating real outcomes, which means we’re talking about an industry that isn’t responding to misconduct in any way to try and get different or hopefully better outcomes. We’re in a place now with surveillance programs where we’ve got pretty good detection of compliance misconduct. So you could take these programs and expand them, could we use, with some additional data that exists within firms, these same strategies and potentially systems for looking at that broader non financial misconduct? And I think many organizations are saying yes, but, and there’s still a lot of problems to solve on that path, but it’s a really interesting direction of travel.

Kimberley Cole 21:59
And you mentioned the FCA and that broadening focus beyond misconduct to non financial misconduct. So what do you think that impact of the change might mean for surveillance?

Emily Wright 21:59
So it could mean the broadening of these programs, I think, market misconduct, into non financial misconduct, with the data sets we’re working with and the tools we’re working with, could mean that surveillance actually ends up broadening its risk coverage. Or we take those strategies, and you end up with surveillance teams that look at different types of misconduct, and we end up proliferating, perhaps what employee surveillance looks like. And I think those questions are yet to be answered.

Kimberley Cole 22:42
Does the evolution in this approach affect the three lines of defense model and how these risks are covered?

Emily Wright 22:42
So I think what’s interesting in the three lines of defense structure is that we potentially don’t have the second line as clearly defined as I would perhaps like it if you take a non financial misconduct approach. And what do I mean by that? I’m going to call out I do have a risk and compliance background, but before that, I actually have an HR background, and for me, there is no difference between those two. They’re all looking at human conduct in organizations when you look through the lens of non financial misconduct. So could we see a world where some of HR, or most of HR, moves into the second line of defense, and we start to look at the second line as financial risk and non financial risk, where non financial risk looks at all of those conduct related risks that you could have alongside a number of other really big non financial risks that would be significant.

Kimberley Cole 22:42
Excellent. So I think we’ve covered a lot there, but I want to bring it back to the book. So there’s a whole range of different people and different audiences that could read the book. But if you were going to encourage our listeners to take a look at the book, what are those sort of key things that they’ll get out of it?

Emily Wright 22:42
So it is a little bit of a, like I say, open kimono. It’s a sneak peek at the things that surveillance officers use big words to describe sometimes, but it gives you a real sense of what actually happens. I think it unpicks, hopefully, some of why we do what we do. I think quite often people feel that I said compliance theater earlier. Sometimes people think that these big compliance programs are just there to check the box. Actually, if surveillance has done well, it’s incredibly exciting, it’s incredibly powerful, and I think it has a real use case and can contribute significantly to the risk agenda. So hopefully it demonstrates that, and I give a little bit towards the end of the book of what I think the direction of travel might be for the industry and some of the developments that may happen.

Kimberley Cole 26:26
Excellent. All right. Well, we encourage all of our listeners to read Behind the Screens, which I think is quite a intriguing title. So understanding employee surveillance in financial services, so make sure that you go out and grab yourself a copy of that. So to wrap up, we’ve got a few kind of fun questions. If you could change anything, so this is your magic wand question, if you could change anything in our industry, what would that be?

Emily Wright 26:56
I think this might be the coach in me, but I feel like the word team has somehow lost its meaning. We were so siloed, and I don’t think the three lines of defense model has maybe helped that separation, but I feel like a greater emphasis on building teams on teamwork. And I know that sounds a little glib, but I just think of all the people I’ve seen where you say, Oh, that’s a team, because they all report to the same person, and we all know that’s not a team. And so I think as old fashioned as it may be, return to teams and making them work really

Kimberley Cole 27:26
Interesting. I think that’s great. Maybe some of the remote working and how we operate now is also mean that the teams have not as strong as they used to be. What’s the next innovation or positive change that you see coming?

Emily Wright 27:41
I think I’m going to come back to that idea of non financial misconduct coming into the world of surveillance. I think that’s going to potentially be a huge and very positive change for the function.

Kimberley Cole 27:50
Great. And we always love to get some recommendations. So a book to read, something to watch, or a podcast you recommend.

Emily Wright 27:58
Oh, okay, so I have just finished reading a book I could not put down, Stolen Focus by Johann Hari and anyone who hasn’t read it, it was fantastic, and I’m about to reread it. So that’s my definitely something to read. In terms of watching, I’ve actually just been watching the Chelsea Flower Show non stop for the last week. It’s completely off topic. I know it’s not everyone’s cup of tea, so maybe if I share my favorite podcast at the moment, it’s The Rest Is Politics, and it didn’t used to be. But I think at the moment, with all the geopolitical risks that we’re seeing and just the impact it has on the markets, these guys make a very entertaining job of speaking to some of those risks and understanding them.

Kimberley Cole 28:35
I agree. I love all of those too. So thank you, Emily, it’s been an absolute pleasure. I’m glad we got to talk about your book Behind the Screens as well as get some recommendations from you. So thank you for joining us on Risky Women Radio.

Emily Wright 28:51
Thank you very much. Kimberley, thank you for having me on the show. It’s been great fun.

Kimberley Cole 28:54
Fantastic. Thank you.

Kimberley Cole 28:59
Thank you for listening to this episode of Risky Women Radio, be part of the ongoing conversation and learn more about our events and other programs at riskywomen.org