Conduct Risk White Paper Released

Conduct Riskrisk is concerned with the failure to uphold the interests of the consumer, market integrity and effective competition. The risk to consumer protection from a firm’s activities isn’t a new concept but is a topic that is currently of particular prominence within the financial services industries. In no uncertain terms it encapsulates “the risk that firm behaviour will result in poor outcomes for customers” as defined by the FSA before its reform in 2011. This is a broad and general definition of conduct risk and still beckons the question, what does Conduct Riskconduct risk really mean in practice?

We have been working with our clients to design and implement practical conduct risk frameworks and we thought it would be good to share our experience about some of the practical challenges we have faced.

Is this a new risk category?

We realised that our clients engaged us repeatedly in discussions about the nature of conduct risk.  Is it a subset of operational risk or something new? And if so,  what?  After our discussions we help our clients understand that conduct risk is a new risk category that aims to measure a lot more than operational risk factors impacting client service.  It aims to measure the risk associated with the culture and behaviour of your organisation and the impact it could have if your culture and behaviours do not support your client’s interests.  It is clear that the reason for this new push on conduct risk is the aftermath of the financial crisis but in our view, it makes sense to bring to the surface this element of the risk profile more clearly, where there is a potential detriment to clients and ultimately the market and its reputation.

Conduct risk is complex so it’s important to spend some time understanding its different components. There is a huge amount of information about what the definition of conduct risk is but what does it mean in practice?  The first thing we noticed working with senior management and NED was their demand to understand what the main drivers of conduct risk are.  Conduct risk is complex and it relates to a large number of factors.  We realised that providing meaningful but simple explanation about the different components of conduct risk was a key step to support senior management to create a practical framework.

So, where to start to create a practical conduct risk framework?

Our clients vary in scale and complexity.  They target different business lines and different clients.  However, all of them sharedshare a common point of contact with conduct risk, their strategy definition and the business plan produced as a result.

The business planning process (short strategy definition) presents a great opportunity for key stakeholders to discuss their commercial targets and how the culture and behaviour could impact targeted sectors.  This enables the business to understand their exposure to conduct risk and more importantly gives the opportunity to be able to influence it with clear decision making at senior management level.

We encourage our clients to write a paper prepared by the Head of Underwriting and the CRO about the exposure that the business plan represents in terms of conduct risk.  This paper can be presented to the Boardboard to support the approval of the business plan with a clear understanding of the exposure of conduct risk to the business.

How to make conduct risk part of the business as usual?

We wanted to design and implement a proportionate approach so that our clients’clients focus their efforts werewhere effort is due.  The conduct risk paper presented to the board mentioned before is a great starting point to enable the business to state and acknowledge their exposure to conduct risk.  More importantly, it provides a clear starting risk profile position from which they can monitor changes to the business environment that could impact the strategy from a conduct risk perspective over the year.

To monitor conduct risk in a business as usual mode, we helped our clients to develop risk appetite statements for each of the conduct risk sub-components, linking it with other indicators used to monitor risk profile, particularly, underwriting and operational (compliance, distribution, business continuity, remuneration, to mention a few) risk.

There is no need to re-invent the wheel so…

Take advantage of existing indicators to maximise interaction between committees within your organisation relating to conduct risk.  Existing KRIIR assessed from a conduct risk perspective can be very meaningful to identify trends behaviour and culture.  However, in some cases, where the exposure to conduct risk is high, it makes sense to develop additional indicators to provide clear visibility about the exposure to conduct risk.

Embedding conduct risk in the internal model

Our view is that any element that could impact the strategy of the business should be included within the scope of the internal model.  So, why should conduct risk be any different?  Our advice to clients is to treat conduct risk in the same manner than any other risk category. This means to identify its ownership within the governance structure clearly and clearly document the responsibilities of the committee responsible to monitor. Monitoring conduct risk in respect of the internal model (risk profile monitoring, stress testing, emerging risks, validation and model change) provides an effective BAU framework in which conduct risk can flow from the business activity, through the internal model into the ORSA framework.

Who should own conduct risk?

This was an interesting point of our discussions.  In our first round of conversations the immediate reaction was to allocate conduct risk to the committee responsible for insurance risk, at the end of the day underwriters are those trading.  However, as we continue our discussions, we all began to realise that conduct, i.e. behaviour and culture is a lot wider than the underwriting function and although underwriting is a significant component, it is not the only one. The goal of the underwriters may not always by accommodating for thoughts developed from a complete view of the company’s position with respect to conduct risk. If the underwriting function havefunction has responsibility of monitoring conduct risk, they may also not have the capacity to create and implement solutions to conduct risk problems that arise from outside of their business function. Are they in a position to affect the organisation-wide culture?

Conduct risk should be owned by an entity that is well placed to see the overall picture, with enough seniority and autonomy to be able to drive cultural change and manage the conflict of interests that will naturally arrive from the multiple business functions. Conduct risk presents a great opportunity to set the right tone at the top and for this reason, we are of the opinion that the executive committee is the best possible forum to own conduct risk. It has the right balance between having an overarching view of the business and across the board authority to influence behaviours and attitudes whilst still being slightly further removed from the direct interaction with the client and with a greater focus on strategy than an underwriting committee. The executive committee will also understand the behaviours of the different parts of the organisation.

Conduct risk can be tackled with various approaches and there is no definitive or correct approach for it. There is definitely a process or framework that looks at the workings of the business and understands the points at which conduct risk should be considered and in our experience working with clients, this allows for integration into current processes. These can be summarised in simple steps:

• Make your framework bring to the surface the exposureexpose your organisation has toorganisation’s understanding of conduct risk and the detriment itthat poor conduct can bring to clients.
• Allocate clear ownership within your governance structure
• Include conduct risk within the scope of your internal model
• Give conduct risk the right tone at the top
• Use as much information as you have currently available as possible
• Inform and educate your stakeholders about the main drivers of conduct risk.

If you would like any more information about conduct risk, or would like more help on creating a process or a framework for your business to consider conduct risk then please get in touch with us today.

Call us on 0203 741 9559 or email us: info@bravenconsulting.com