After the £44m Citibank fine firms may be taking a closer look at their compliance with Fundamental Rule 6 - organising and controlling their affairs responsibly and effectively.
This is because the regulatory thinking goes that if you can’t get the numbers right in the good times, then how will you cope in a stress and in a potential resolution scenario? ICAEW’s John Mongelard looks at the PRA’s Final Notice to pick out the 10 things you need to do.
- Capital, leverage and liquidity and very important. From a prudential perspective these are the big three to get right. They underpin whether you are financially sound so get these three right: if nothing else. The larger your firm is, the important it is for you to get them right as regulators have their so called ‘risk-based approach’ so look at whether you are a GSIB or DSIB – the bar is higher if you are.
- Listen to your regulator. If they feel they have already communicated the risks around an issue and you still make mistakes, then expect the next regulatory interaction to be more severe. Regulators do an annual stock take of the issues they have with firms (PSM – Periodic Summary Meeting) and write to the board with a list of actions. So, have a look again at that letter. Of course, it’s not easy to see Board level correspondence if you are in the regulatory reporting team but someone in your firm needs to join the dots and that’s their job as a Senior Manager (SMF).
- Check, re-check and check again. If your firm are having to make re-submissions to the regulator then that is a clue your processes may not be working effectively. If you make resubmissions and then the regulator finds further issues, then you really need to stand back and have a good look at how things are organised. You need to look at your reconcilation and validation processes, the quality and adequacy of your team and if your management information reconciles with your regulatory returns.
- Go beyond simple variance testing. Whilst it is useful to look at the changes compared to the last period, this check still may not pick up important issues. You may have embedded longstanding errors so looking for ‘the delta’ will not help you and does not comprehensively demonstrate you have undertaken ‘reasonable steps’ in the eyes of the regulator.
- Errors on multiple returns is a problem. This is true over time, so if you keep getting your capital returns wrong then that’s a problem but if a regulator doesn’t know if your capital or your liquidity is accurate then they can’t be comfortable that there could even be an orderly wind down or central bank support. If you have errors across multiple returns, then that is a wakeup call that fundamental changes will be required.
- Senior Management Functions (SMF) holders are on the hook. In a clear trend across S.166 reports we see the desire set out in the Requirement Notice to understand whether the responsible Senior Manager understood the issues around regulatory returns, prioritised actions accordingly, ensured the documentation was there and was able to manage the interactions appropriately with a parent or group. SMFs for regulatory returns definitely need to take a closer look at how they are discharging their responsibilities and the ownership of issues.
- Get the governance right. It is not unusual for the regulatory reporting team to rely on other departments and global systems, processes and data. It is therefore key to get the oversight working effectively to manage these different elements and to make sure the people providing the oversight have an understanding of the relevant rules.
- Unders and overs matter. It could be a matter of luck that the errors that lead to over-estimation are offset or nearly offset by the errors that led to underestimation. Therefore, don’t expect the regulators to give you credit for this happenstance. Ultimately the errors are showing that the regulator can’t rely on the return and they will be uncomfortable.
- Policy interpretation judgements need more scrutiny. The large banks have policy teams to look at the latest Basel and EU text in all their complexity, to see how it applies to their books and business model. But where appropriate, and given the potential impact, these issues may need to be escalated to the Board and rule changes in particular, may need more rigor than in the past. Make sure you have the skill set in your team to be aware and understand the impact of the latest Directives or regulations and formulae in the reporting template are pappropriate.
- Get the basics right like data quality and manual processes. Financial controls and a SOX framework can help to guard against some of the risks with manual controls. Do you have the same controls on your financial results as for your regulatory returns? Regulators expect the numbers coming to them to be just as accurate as those that are in the public arena. So are your documented processes actually followed and documented that assurance has been done?