UK: Senior Management Responsibility – You Have Been Warned - Insurance Market Update -June 2005

Article by Mark Lehoucka and Michael Corrigan

The principles-based approach to regulation emphasises the personal responsibility of senior management in compliance – individuals as well as companies are accountable for failures. We review the guidance on senior management responsibility and the consequences of falling below its expectations.

For over three hundred years the insurance market has operated under the watchwords of utmost good faith. The principle of good faith is reminiscent of the FSA’s current principles-based approach to regulation. As well as emphasising the importance of its Principles for Business, the FSA is constantly reiterating how today’s senior executives are to be held accountable for the effective and responsible running of the firms under their control. In the light of external scrutiny in business practices and as the FSA embarks upon a new round of Arrow visits, we examine the regulatory role of senior management and provide a timely reminder of senior management’s significant responsibilities.

Much of the debate which took place at the time while the FSA’s regime was being developed focused around senior management accountability, and whether it is possible to design requirements for senior management which would reduce the likelihood of serious failures in the future. Thought leaders in the spheres of corporate governance and business ethics also stressed the importance of business leaders accepting responsibility for leading with strong principles. The Principles for Business underpin the FSA’s Handbook, and firms are expected to abide by the spirit as well as the letter of the rules. Enforcement cases have been undertaken on the basis of Principles alone, and the FSA has made it clear that it intends to move further in that direction in the future.

The Approved Persons regime demonstrates the importance which the FSA attaches to certain key "Controlled Functions" within firms. Under the Approved Person regime individuals performing Significant Influence and Customer roles, ie dealing respectively with the affairs of a firm and the affairs of customers, require specific approval from the FSA. Significant Influence functions include governing functions (such as the CEO, partners and directors), significant management functions (such as heads of business divisions and operations) and systems and controls functions (such as finance, risk and internal audit). Particular importance is assigned to the required functions, including the functions of apportionment and oversight, compliance oversight, and money laundering reporting.

The Apportionment and Oversight officer should be the person in charge of running the business, for not only is he most able to reduce the probability that problems will occur, but, in the eyes of the FSA, the buck stops with him. He should therefore have the authority to create and maintain robust controls, and to foster a control culture within the firm, such that a shortfall in compliance is a bonus-reducing or even career-shortening event, regardless of the offender’s seniority or talents.

Senior management needs to be sure that, where appropriate, all areas of their business have appropriate systems and controls, and that it is absolutely clear who is responsible for what. If there are any grey areas around who is responsible for what, these should be addressed; such gaps in an organisation’s governance structure are often only exposed when things go wrong, by which stage the damage has been done.

Underpinning the Approved Persons regime are the Statements of Principle and the Code of Practice for Approved Persons. The seven Statements of Principle cover the behaviour the FSA would expect to see by Approved Persons. Principles 5 to 7 apply specifically to those individuals performing a Significant Influence function and state that such persons must:

• take reasonable steps to ensure that the business of the firm for which he is responsible in his controlled function is organised so that it can be controlled effectively;

• exercise due skill, care and diligence in managing the business of the firm for which he is responsible in his controlled function; and

• take reasonable steps to ensure that the business of the firm for which he is responsible in his controlled function complies with the relevant requirements and standards of the regulatory system.

The Code of Practice provides guidance on what those Principles mean, along with the sorts of behaviour the FSA would not want to see. Persons performing Controlled functions are accountable to the FSA as well as to their firm’s Management Board.

They should ensure that they have a clear and up to date job description, that responsibilities and reporting lines have been clearly defined and documented, and that their monitoring of their team’s performance and compliance with regulatory requirements is clearly evidenced.

Of equal importance is the need for a good training and competence (T&C) regime. T&C is fundamental to the correct and efficient functioning of the systems and controls established by senior management – without competent and trained staff, senior manager’s responsibilities are only half fulfilled.

The FSA’s Senior Management Arrangements, Systems and Controls rules (SYSC) contain specific directions as to the responsibilities of directors and senior management. The SYSC rules aim to encourage directors and senior managers to take appropriate practical responsibility for their firm’s arrangements, and to encourage firms to vest responsibility for effective and responsible organisation in specific directors and senior managers. SYSC creates an obligation for the appropriate apportionment and allocation of all significant responsibilities among directors and senior managers, and appropriate systems and controls to be established and maintained.

The requirements are high-level obligations which leave firms with flexibility about how to implement them – what type of systems and controls will be appropriate will depend on the nature, scale and complexity of the business, but what is not in question is the necessity for all firms to comply with Principle 3 of the Principles for Business by ensuring that appropriate and adequate arrangements have been put in place.

The requirements broadly cover the following areas:

• firms must clearly allocate responsibilities;

• the business and affairs of the firm must be adequately monitored and controlled by the senior management of the firm;

• firms must record these arrangements.

• systems and controls must be appropriate to the business;

• firms must have clear reporting lines;

• the governing body of the firm must receive sufficient information to allow it to play its part in identifying, measuring and controlling risks – this information must be relevant, reliable and timely.

The FSA’s objectives relate to market confidence, public awareness, the protection of consumers and the reduction of financial crime. These objectives are reflected in recent FSA initiatives in areas such as anti-money laundering, misleading financial promotions and treating customers fairly. In order to fulfill their responsibilities and ensure compliance in these areas, senior management needs to ensure that they have adequate procedures, systems and controls in place for record keeping, remuneration, risk management and internal audit, as well as for the broader issues around business strategy and organisation. Not only does management need to establish effective systems and controls, they need to ensure that they are working, that they are actively monitored, and that they provide the relevant, reliable and timely management information necessary to control the risks faced by the business.

The types of issues which the FSA look closely at in assessing how well firms’ managements are fulfilling their responsibilities include the following:

• the extent to which control and compliance is part of the culture of the firm – or does pressure to "deliver numbers always" interfere with the duty of "right behaviour always"?

• does the firm adequately resource its audit and compliance functions?

• does the firm have independent non-executive directors on its Board who challenge the management effectively?

• how strong a voice do the Approved Persons have in determining how the business is run, or are they discounted?

• if a breach of the rules occurs, how does the firm handle the situation? Does the firm ignore the breach, or even attempt to hide it?

• alternatively, does the firm report the breach, discipline those responsible, and take measures to lessen the probability that such breaches will occur again?

Firms should bear in mind that the FSA places significant emphasis on firms taking a holistic approach to establishing a sound compliance culture. The compliance environment within a financial institution is a fundamental protection against the spread of poor standards of conduct. As well as providing sufficient resource to the compliance function, senior management should endeavour to embed compliance into areas such as strategy and ethics, remembering that, in the light of the FSA’s statutory objectives and principles, compliance is more than just a set of rules.

Recent enforcement activity has provided a timely reminder of the difficulties faced by senior management in ensuring compliance with the FSA’s regime. The starting point involves issues of whether the FSA’s trust in respect of senior management is justified, and whether breaches have occurred despite the reasonable efforts of senior management. If a firm identifies and reports a problem to the FSA this, together with significant efforts from senior management to undertake remedial action, is seen as a genuine effort to comply. However, where breaches arise which are aggregated by a poor T&C regime, poor systems and controls and a poor compliance culture, firms should expect FSA enforcement.

The FSA will intensify its focus on how senior management manage the implementation of the Market Abuse Directive. Another priority will be how firms manage conflicts of interest; senior management should be asking itself how it knows that the conflicts it faces are being sufficiently addressed.

Senior management bears the responsibility for ensuring adequate systems and controls are in place. However, in the past, senior managers themselves have not always been taken to task over such failures. This is changing. The FSA intends to take very direct action against the senior management responsible for the failure to put in place a proper compliance culture, proper training and proper standards of competence. When breaches occur, the focus on responsible individuals will lead the FSA to ask whether or not there is evidence that the senior management failed to make a serious effort to put in place an adequate compliance regime. The FSA will then consider whether to take that individual through enforcement. Senior management have been warned.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.