The FCA has made its direction of travel clear. It wants to be a smarter, more proportionate regulator, rebalance attitudes to risk and support economic growth. It has also said that firms seeking to do the right thing should experience less intensive supervision.
But there is another side to that bargain. For the regulator to step back, it needs to be able to trust firms to step up.
Why governance, risk and compliance matter more as FCA supervision evolves
Greater freedom places more, not less, importance on firms having effective governance, mature risk management and compliance functions capable of identifying and addressing problems before the regulator does.
That is particularly important when businesses grow quickly. The FCA’s recent work with high-growth firms found instances where governance, risk management and organisational systems/controls had not kept pace with changing businesses. It has encouraged growing firms to consider whether their arrangements remain appropriate for their size, scale and complexity.
These themes are also evident in Skilled Person work, with an increasing focus on whether firms have effective governance, risk management and compliance arrangements in place, alongside their implementation of Consumer Duty.
The challenge is not simply whether firms have governance, risk and compliance (GRC) frameworks, it is whether those frameworks remain appropriate, proportionate and effective for the business they have become, and whether they genuinely add value.
The real test is whether the arrangements work for the business: whether responsibilities are understood, risks are identified and managed, effective challenge takes place and better decisions result.
Good GRC should be designed around the business, and the business should not be forced to fit the framework, even if that framework is perfect from a theoretical perspective.
Governance effectiveness: does the Board have the insight it needs?
Good governance should help those running the business understand what is changing, where problems may be emerging and where decisions need to be made. Some revealing questions might be:
- What does the Board know today that it didn’t know six months ago, and what has it done differently as a result?
- Does the Board receive insight, or simply information? More pages, dashboards and RAG ratings do not necessarily produce better decisions.
- When did effective challenge last cause the business to change course? If the answer is difficult to identify, how effective is the challenge?
- If the Board pack were half as long, would the Board govern the business any less effectively?
The FCA has similarly emphasised good quality data, effective Board challenge and translating information into action, rather than simply producing more reporting.
Risk management: does the framework help the business make better decisions?
Effective risk management should help a business anticipate what might happen and understand where risk can be taken with confidence.
- What risks are growing faster than the controls designed to manage them?
- Which risks is the business deliberately taking, and which is it simply living with because nobody has made a decision?
- What does the risk framework tell management that it would not otherwise know?
- Is Risk helping the business decide which risks are worth taking, or mainly explaining why risks shouldn’t be taken?
Managing emerging risks, including AI and innovation
AI provides a good example. Businesses are increasingly making difficult decisions about where and how AI should be deployed while the technology, its uses and associated risks continue to evolve. GRC arrangements need to keep pace. If they can identify the risks, establish appropriate boundaries and provide effective oversight quickly, they can give the business confidence to innovate and take informed risk. If they cannot, they risk either exposing the business to unacceptable risk or unnecessarily holding it back.
Compliance effectiveness: identifying risks before they become regulatory issues
Compliance should provide confidence that regulatory obligations translate into effective controls and good outcomes. That means looking beyond whether processes operate as designed and testing whether they are delivering the outcomes intended. But, to have real influence, compliance also needs to demonstrate value.
A compliance function perceived primarily as an administrative burden or known mainly for regurgitating rules is unlikely to be one that management instinctively turns to when difficult decisions need to be made.
So perhaps the harder questions are:
- What does compliance know about the business that the business doesn’t yet know about itself?
- If compliance monitoring keeps finding the same issues, is the problem really the control, or the organisation’s ability to fix things?
- Do apparently isolated issues remain isolated when complaints, QA, monitoring, incidents and customer outcome data are looked at together?
- Does the business seek Compliance’s input before difficult decisions are made, or wonder where Compliance was after something has gone wrong?
- Does Compliance listen to the business and help it work out how to achieve its objectives safely and compliantly, or mainly explain why it cannot?
Can your business identify risks before the FCA does?
This is perhaps the most uncomfortable question.
Who knows more about what is happening in your business: you or the regulator?
The FCA is increasingly data-led. Through regulatory reporting and other information, it has an increasingly detailed picture of firms and markets that it can use to identify emerging risks and target supervisory attention. Its recent high-growth work is one example, using firm data to identify businesses for earlier engagement.
That raises a question for every firm: are its own GRC arrangements capable of spotting deterioration as quickly as the regulator can?
If the FCA spots a worsening trend or potential customer issue first, the initial question may be about the issue. The questions that follow could be more revealing.
- Did the Board know?
- Did management information identify it?
- Did the risk framework anticipate it?
- Did compliance monitoring, QA or outcomes testing find it?
- And, if not, why not?
This is where independent assurance becomes particularly valuable. Internal Audit can help Boards assess whether the GRC frameworks on which they rely remain appropriate for the business they have become, and whether they are genuinely influencing decisions, identifying emerging risks and adding value.
While it cannot prevent every problem, it can help firms identify weaknesses before somebody else does and provide confidence that GRC arrangements remain fit for purpose.
Effective GRC should not simply provide evidence that an organisation is controlled. It should help the organisation make better decisions.
Because when the FCA identifies an issue, asks why it happened and starts peeling the proverbial onion, the important question is: What will it find?
How we can help
We are seeing numerous FCA regulated businesses looking to develop their frameworks as regulatory challenge evolves. If you would like to discuss your governance, risk or compliance framework, contact Marc Ireland or Jess Wills.
Explore the latest edition of Insurer Update to discover expert insights, articles and industry updates from our Insurance Carrier team.
