The Evolving Role of Compliance
PricewaterhouseCoopers recently conducted an international survey in the area of compliance. The survey, which covered banks, insurers and securities firms in 17 countries, was undertaken through face-to-face interviews with senior compliance executives of 73 internationally active and major domestic institutions. Respondents expressed concern about the increasing complexity of the regulatory environment – which they said is severely exacerbated when operating across borders and across businesses. It would appear that compliance functions can find themselves stuck between management’s belief that the function plays a pivotal role in managing reputational risk and a rising expectation bar on the part of regulators and other stakeholders
Given this, compliance functions could be forgiven for attempting to rein in the scope of their responsibilities. Instead the study showed that the role of the compliance function is perceptibly expanding along a spectrum ranging from a ‘police officer’ to a trusted advisor to business and management. Generally speaking, compliance officers seem prepared to rise to the challenge: but there are some issues on which they will need to focus.
‘Compliance risk’, in its broadest sense, encompasses anything from tax, through health and safety, to conduct of business rules. Non-compliance in any area could damage an organisation’s reputation with stakeholders, including the public at large. Management needs to gain an holistic view of the organisation’s risks – business, market, operational and compliance risks – within the context of prevailing regulations, and put in place policies, internal control processes and procedures to manage these risks effectively.
A clear delineation of its responsibilities within the overall control framework – an effective mandate from the board and senior management – is essential for the compliance function. For example, it is important to clarify who monitors transactions on a daily basis, who then checks that this process is working effectively, and who ultimately determines whether it operates well in the context of overall compliance activities?
Clearly, an understanding of what differentiates the compliance function from other functions is also important. Its role needs to be both ‘real-time’ – monitoring transactions as they occur – and forward looking.
As with other risks, managing all compliance risks to an equivalent extent would be unnecessary, costly and inefficient. 41 per cent of study respondents indicated that their organisations are increasingly adopting a risk-based approach to compliance risk management.
There was limited evidence, however, of organisations undertaking a comprehensive assessment of the compliance risks they face – throughout their operations – in order to implement effective risk-based compliance management processes. Furthermore, a risk-based approach requires initial risk assessment and iterative reassessment. On this point, the study revealed several potential causes for concern, including:
A risk-based approach recognises that breaches are not totally avoidable in complex regulatory environment(s), but that it is essential to reduce the chances of such incidents occurring, and to mitigate their impact when they do. The study revealed that many organisations are focusing on one key mitigating factor – taking steps to ingrain and/or strengthen their compliance culture.
To do this, some organisations are relying heavily on global compliance policies to promote common appreciation of their internal compliance requirements. However, such policies, often derived from home office regulations, can seriously downplay the intricacies of local regulatory requirements. Recognising this, other organisations are now rationalising their approach, keeping global, generic policies in only a few selected areas (such as anti-money laundering, conflicts of interest and know-your-customer requirements), and encouraging significant tailoring to local rules. The approach of the compliance function here, though, has to be balanced against local societal and business receptivity to the compliance culture. In certain business areas, or geographic locations, the compliance function needs greater emphasis on ‘policing’ than ‘counselling’.
A compliance culture is good but compliant behaviour is better. These are not necessarily the same thing. People may want to do the right thing, but be hindered by practices and processes not designed to be inherently compliant. With changing regulations and indeed ethical expectations, practices and processes that were compliant in the past may no longer comply. A patchwork of legacy systems, and business processes and internal controls geared towards outdated ways of doing business, cannot achieve optimal compliance results, however strong the compliance culture.
The growing role of the compliance function as a trusted advisor in new business ventures, albeit transactions, products, markets or acquisitions, suggests increased recognition of the benefits of being compliant from the outset. Nevertheless, the extent of the compliance function’s involvement ranged from a veto possibility to just being informed. Concerns were sometimes raised about the pragmatism the compliance function displayed – business was better at finding workable compliant solutions. Also, the study showed that only 30 per cent of respondents were systematically involved in IT systems development or upgrades, raising the question of how many projects have to go back to the drawing board when they are found to be non-compliant.
Helping the organisation to avoid mistakes is the key role of the compliance function. However the majority of respondents stressed the difficulties of measuring the potential damage of events that did not happen.
Compliance officers realise that not quantifying the value – the return on the investment in effect – could relegate the compliance function (and compliance generally) from management’s priority list. Some organisations have been using generic performance indicators for some time, but are looking to improve their granularity. The survey highlighted certain measures currently being used: both ‘logical measures’ and ‘inverse logic measures’, but this is an area where more work is needed.
The role of the compliance officers and functions is likely to continue to evolve in the coming years. One can anticipate ongoing convergence in terms of the goals and modus operandi of the compliance function – internationally and cross-sectors – with growing recognition of its potential benefits as both a ‘counsellor’ and a ‘police officer’. Compliance functions can play a critical and unique role in helping management ensure the safety and soundness of operations. However, determining the responsibilities of the compliance function will remain a question of balance: weighing the ‘police officer’ and ‘counsellor’ roles against the organisation’s increasing ability to operate compliantly.