Our fourth virtual event was the 19th GRC Supper Club in total and began with our host Lee raising a toast with a glass of his homebrew cider. He’s clearly embracing the country life and would love you to try some, so give him a shout – although no one is quite sure how strong it is.

Rather than waiting for Boris to relax the lockdown rules further, so we could chew the GRC fat in person again, we decided to jump on Zoom one last time. The title might sound a little over-engineered, so here’s what we were trying to achieve in a nutshell: to understand if a combination of Sox-lite, combined assurance and self-demonstration will help you reduce regulatory pain.

Suzanne Calcagno – Global Head of Regulatory Response and Oversight, HSBC
Suzanne began by highlighting a common trend that has gathered pace over the last couple of years: the evolving sophistication of the regulators is increasing their expectations for business to comply and respond. They automatically expect that GRC models are mature and that firms can identify, escalate and remediate issues as they arise.

Regulators are now using reporting submissions beyond just validating compliance with reporting requirements; they are also using them to drive their market surveillance and prudential supervision and to explore market trends. The focus has subsequently shifted to improving the quality and utility of the data being reported.

To demonstrate the effectiveness of their processes and oversight, banks are establishing frameworks that define minimum standards for the individual controls they operate that can be measured and validated – promoting continuous monitoring. These standards typically address the scope of the control, the frequency it’s run and how they manage the output in terms of escalation and resolution. The framework also allows banks to identify what they don’t do, so when the auditing process occurs, they can be completely transparent.

The use of a common assessment framework across all regimes lets them gauge the relevant risk posed by each regulation and provide a consistent assessment of whether their operational control environment mitigates that risk. This has enabled them to create a set of central data quality controls for use across the organisation.

Such a framework takes time to develop, socialise and launch, meaning Financial Services Institution’s (FSI’s) need to stay nimble to absorb and respond to the regulator guidance and trigger enforcement actions in a way that lets them embed recommendations.

Sonja Jackman – 1LOD Controls Office, BNY Mellon / member of WiR&C
Sonja kicked off with a spot of attendee participation, by conducting a poll.

Question 1: Where in your organisation is regulatory pain experienced most acutely?
a)In the compliance department (2LOD) = 10%
b)In the front office and supporting operations and technology functions (1LOD) = 25%
c)In your change and project teams = 25%
d)All the above = 40%

To overcome this, she highlighted the importance of the 1LOD and 2LOD working together, having agreed and clearly defined their roles and responsibilities. This makes it clear where one starts and the other stops, preventing overlaps and inefficiency.

Question 2: At which stage of the regulatory change life cycle do you experience the most regulatory pain?
a)During horizon scanning – identifying relevant upcoming changes in time = 10%
b)During implementation – meeting regulatory deadlines = 45%
c)Post-implementation – embedding and evidencing compliance with the regulation = 45%

Sonja expected to see a larger response for post-implementation as the most painful stage in terms of regulatory change. Each stage presents unique challenges. For example, it’s easy for things to slip through the net at the horizon scanning stage, due to exposure to multiple jurisdictions. Some companies have recently addressed this by implementing triaged approaches, which offer greater collaboration using different SMEs to help with horizon scanning interpretation.
There are benefits to be gained from integrating Sox-lite within risk and control environments and frameworks. The Senior Managers and Certification Regime (SMCR) has helped drive ownership and accountability in the UK market and other jurisdictions that have rolled out Sox-lite. Risks and controls are naturally aligned to processes and IT systems, providing an understanding of regulatory compliance.

Paul Thomas - Assurance SME currently working for a prominent public service body
Paul kicked off by explaining the catalyst of the Brydon Report: an independent review into the quality and effectiveness of audit was born out of the failure of Carillion and BHS, which raised questions about the role of external auditors and caused the public to lose faith in the audit process. These concerns were recognised by the Institute of Chartered Accountants who commissioned Donald Brydon to conduct a review.

Brydon concluded that audit had lost its way and the actors in the process bear some of the responsibility. While he was mainly referring to external auditors, he was also speaking to internal audit functions and compliance departments. The resulting report advocates the concept of UK Sox and directors taking more responsibility around controls within their business.

Brydon highlights five key factors that he believes will promote a more informative audit report that goes beyond just commenting on the numbers in the financial statement:

• Better independent disclosure on risk.
• Fraud – making it more formalised so businesses can highlight the steps they’re undertaking to prevent fraud and auditors can assess if they are appropriate.
• Better commentary about the resilience of the business.
• The external auditor should comment on the culture of the company.
• Better use of technology by auditors, encouraging the business to share their data with the auditors to improve the process.

The report is currently undergoing consultation and it’s expected that many of the recommendations will come to fruition in some form.

Lee then revealed his TMS wheel – not Test Match Special for all you cricket fans – which represents the Team Management Systems approach. This highlights the personas – such as Creator Innovator and Concluder Producer – that you should use across your teams and how they interact to ensure you communicate correctly and achieve the desired results. When it’s not the TMS wheel, it’s Lee’s Barbecue lid minus a few colourful magnets.

Panel Q&A
Still deprived of a proper networking session – which we carefully disguise as a good old knees-up – after the event, we concluded by bringing all three speakers together on screen for a virtual Q&A session with our enthusiastic audience. They were joined by two more special guests: Dhrupal Shah (Financial Services Optimisation and RegTech Lead, Capco) and Ian Max Ewart (Climate Risk Lead, Acin).

Q - Ian was asked: have we reached the tipping point regarding ESG, and is society ready to hold companies accountable and drive that cultural shift?

There are moments when corporate culture catches up with society. For example, when city workers walked past climate activists in the City of London, they began to sympathise with their message – but then we were blindsided by the Covid-19 pandemic. From plastic bags to people thinking creatively around a better way of living, society began to set boundaries and rules through new legislation – which is ongoing and will be expanded on via COP26. We are subsequently putting together a series of societal tendencies – which companies are becoming increasingly aware of – and distilling them so we can better implement relevant legislation.   

Q - Dhrupal was asked: how can you prove what you have done around regulations, and how can you meet the new requirements to an acceptable level?

When the regulatory landscape first started, it was a prescriptive box-ticking exercise. Since then, regulations have become more complex, yet the systems and processes that work in that space have maintained the status quo. As organisations evolve and become more sophisticated, they are realising that the burden of proof is the hardest part of regulation. We are subsequently seeing these organisations address this through emerging regulatory technology like Qserve. This allows them to meet horizon scanning requirements and provides them with the ability to use tools that identify what regulation is coming down the pipe and what impact it has on the organisation. As you go further down the stack, they have tools that enable them to assess how they respond to regulation, making their assurance processes more effective.

Q - How can companies leverage the risk & compliance synergies that already exist within the organisation to strengthen their approach to regulatory challenges?

Lee introduced this question by explaining his past Big 4 consulting experience and how all companies find it difficult to manage their Risk & Control ecosystem. Having the ability to optimise is imperative in today’s fast-moving world e.g., being able to test once and comply to many regulations and the mitigation of your risk universe with a rationalised control framework (based on internal risk exposure tolerance etc).
 
Sonja explained that traceability and regulatory mapping are essential and making sure the one-to-many associations are fully understood. There is no luxury here, you need to demonstrate sustainability and evidencing. She is unsure how you could begin to achieve this without enabling technology.
 
Suzanne built on this mentioning that using market and regulator recognised solutions demonstrates that the business is making an effort. You’re not always going to get it right and you don’t get points for trying – like in 3rd grade baseball - a great American analogy which I hope the UK audience could attribute to their primary school lunch time rounders games :)  
 
However, mitigating credit is given for having proper processes in place or when attempts have been made to comply and continually improve.

Q- Societal developments / expectations are indeed likely to drive regulation, regulation however is still merely an external driver for companies it could be argued regulations are relevant to maintain level playing field but fall short of making material changes to ESG and other areas. That is likely only to come from internal drive i.e., compliance v self-motivation. Has the panel any thoughts?

Sonja – the FCA have really focused on purpose and how this underpins a company’s culture, value, behaviours and outcomes. If you get the underlying purpose right it is much more effective than the stick approach. The FSI is on a journey, focusing on how to align the purpose for shareholders, society, how to link to this to company values and how to drive behaviours.
 
Dhrupal – chose to address the internal versus external driver part of the question. He believes that if you gave organisations were given the option to be compliant most wouldn’t choose to be. Therefore, he sees the majority of drivers being external e.g., reputational damage. He also pointed out that shareholders are now asking questions of boards on ESG and effect on the balance sheet.  

Ian – Interesting the question came from the Netherlands where bankers take an oath in terms of conduct. Creating the culture that embraces the controls and the conduct will determine whether you as a company are just ‘getting away with it for now’ or you have ‘truly embraced climate risk’.
​
Paul – non-financial companies are marketing to directly to consumers and they are now more important than their shareholders e.g., due to vapes and related scandals across social media.
 
Thank you for continuing to engage with the GRC Supper Club and thanks to all our speakers for the time and effort.

If lockdown easing remains on track, we hope to see you at our next live event in October.

​Armed with his customary pint of bitter and a packet of Steak flavour pringles – not your typical Supper Club cuisine – our host Lee kicked off the final episode of our virtual trilogy:
​

• Does the path to greater resilience require a combination of increased regulatory compliance and trusted technology?  ​​

Nicola Anderson – Strategic Development Director FinTech Scotland
First on the virtual podium was Nicola Anderson, who in her role at FinTech Scotland – a strategic enabler of collaboration within the FinTech ecosystem – has been working with businesses to stay relevant during these challenging times. Nicola began by highlighting Fintech Scotland’s resilient community of around 140 SMEs; none of which have been forced to stop or pause by the impact of Covid-19 – an ingrained resilience that’s born out of the ability to problem solve and reinvent.

​This got Nicola thinking: can other sectors adapt in similar situations? To gain an insight, she posed the following question to the audience: will the incumbent FS sector truly be able to innovate using legacy systems? Just 19% of respondents said yes.

​Nicola concluded by identifying what she believes are the three key components of greater resilience:

• Technology – this is vital to achieving ongoing resilience, but we must be able to trust its efficiency and security.
• Data – our access to, and use of, data in a rapidly evolving world will help us to understand and maintain resilience – and support businesses through the Covid-19 crisis and beyond.
• People – organisations must look beyond technology and consider their people, without whom resilience is just a buzzword.

Chris Skinner – author, financial commentator and self-proclaimed troublemaker
Chris kicked off by examining the relationship between finance and technology. Finance is a marketplace that craves stability, security, reliability, resilience and risk avoidance. Technology, on the other hand, is inherently risky; it’s all about innovation, changing the game and doing things differently. Trying to bring these two opposing forces together can create friction that’s difficult to manage.

Technology is changing the financial landscape, due to the proliferation of granular financial solutions that involve hundreds or even thousands of companies in the process. This innovative technology is enabling financial inclusion on a massive scale. For example, in 2010 just 35% of the population in India had access to banking services that most of us take for granted; fast-forward eight years and this had risen to 82% by 2018 thanks to the rapid development of the technology stack there. But what about making a financial transaction on Mount Everest next time you pop to the summit? Don’t worry, someone has already proved that it’s possible.

With thousands of companies offering specialised financial services using technology, Chris believes that banks will become the trusted providers of these apps and APIs over the next decade – a move that will help to improve resilience. The Covid-19 crisis is dramatically accelerating the need for digital transformation across the financial services sector. Most notably in the large traditional institutions, many of which failed to implement digitally-focused contingency plans that mitigate the impact of lockdown restrictions.

Do we need increased regulation and compliance for trusted technologies? Chris doesn’t think so. What we need is fine tuned granular regulation that addresses trusted technologies at the level they’re operating at, rather than a framework that covers the whole supply and value chain of finance.

Georgios Samakovitis – University of Greenwich, Principal Lecturer in Computer Science (incl. AI)
Our third esteemed speaker was Supper Club veteran Georgios Samakovitis, who was eager to discuss how trusted technology is a prerequisite for compliance. Cybercriminals are unbound by operational bureaucracy, regulations and compliance, which enables them to utilise hot technologies such as AI, blockchain and machine learning in ways that legitimate organisations can only dream of. So, what can we do to mitigate this?

Any regulatory model is only as effective as the data you feed into it – if you put rubbish in, you’ll get rubbish out. To leverage the right data, we must consider its quality, resilience, availability, security and transparency. We also must remember that technology supports decisions, it doesn’t make decisions on our behalf – for now at least.

Technology supported decision making doesn’t just mean AI – a concept that is often bandied around more than it’s practically used. The challenge is for technology as a whole to become more precise. If organisations fail in this pursuit, the costs can be high – catastrophic even!

Explainable AI (XAI) relates to the development of efficient models that we can interpret and understand. This might sound obvious, but it’s often easier said than done. The motivation for developments in XAI is the need to balance efficiency (making the right decisions) with compliance (knowing why the decision is right or why things have gone wrong). This begs the question: how do industry and regulators value explainability versus efficiency – and what is the right balance?  

​If we accept that AI is useful in supporting compliance in a regulatory context, we need to know: What is it adding? Why is it required? Who is verifying it? Take blockchain and smart contracts: promising work has been conducted in the RegTech arena to embody rules into self-executable script to verify or manage compliance. We must also consider that these technologies are already being used to avoid regulatory jurisdictions that can be automatically identified.

The challenge for regulators is to strike a balance between facilitating innovation and developing a safe, ringfenced framework for profitable business – one that also guarantees security and integrity.

What does the future hold for data and its governance? Georgios believes a move towards regulation as a service or privacy as a service could be the right direction; a path that is already being taken in the FinTech space, where the redefinition of services and a new ecosystem are being created and supported – making room for innovation without impeding the regulators.

Gareth highlighted that it was interesting to see how different panellist approached this topic in completely different but compelling ways. His own perspectives are shaped by clients who recently struggled to execute unwieldy business continuity plans, or have an eye on future FI regulations, necessitating prioritising, monitoring and maintaining service lines most critical to customers during a crisis. The PRA and FCA guidance says that we must think about regulatory compliance from a customer and market perspective. Therefore, we should ask: which of these processes are critical in any crisis and what can they not withstand? If we can prioritise the processes that matter most under the guidance of the regulations and limit our focus on the technologies, systems and people around those areas, we can make the contingency plans more manageable.

Georgios explained post event that 80-90% of AI related theoretical foundations were established in the 1970s. It's other parallel developments that revived AI: cloud, crowd, mobile comms, consumerisation, distributed architectures, parallel computing, platform economics. AI is not unlike any technological stream of innovations. Drawing from the banking tech history, it has similarities with the Holerith tabulating machines in banking in the 1920s, 'modern automation' in the 50s, ATMs in the 60s, mainframes in the 60, ERP in the 80s, e-banking in the 00s, Blockchain post-2016.

Fundamental and Technological uncertainty in then-newly introduced markets fuels innovation, funding flows in, and more complete understanding and appreciation of the affordances of each technology (AI included) comes later. With that, comes more stability, with opportunity then fuelled by market uncertainty. This is where I think we're at with AI, and exploring the limits and limitations is both a commercial exploitation exercise, as well as one of regulators wishing to maintain and ring-fence the balance and safety of the frameworks wherein business happens.
​
Lee summarised his thoughts post event by explaining that prosperous, agile and innovative companies exist at the ‘Edge of Chaos’.​Informed decision making allows proactive enablement of regulatory and compliance rules e.g. automation leads to reduced chaos and improved efficiency:

The reality is that you – the esteemed reader – will need to review the evidence provided and draw your own conclusion. We will see you all at the next GRC Supper Club, be it in the real or virtual world! 

​Stay safe one and all.

How might the pandemic impact the future and what will the ‘new normal’ be? Whether it’s shopping online more than ever before or working from home full-time, the global health crisis has changed how we live our lives in the blink of an eye. Chris reinforced the notion that because criminals thrive on confusion, they will be rubbing their hands together at the opportunities enforced homeworking presents – and the potential for it to become the norm. Consequently, social engineering threats like phishing attacks could become an even greater threat than they already are.

Homeworking poses many questions in terms of a business’s duty of care. For example, when does its responsibility to remote workers begin and end during the working day? What happens if they’re working from home and suddenly require first aid? These types of issues must be addressed as soon as possible to ensure a safe and effective homeworking environment. Businesses must, therefore, provide employees with the knowledge, support and equipment required to achieve this.
​
Any business’s weakest point is its people. So, what about insider threats? Employees are suddenly accessing sensitive company data at home from various devices. The amount of information people can access on their PCs/laptops needs to be considered and controlled differently if working from home. The rise of homeworking could also see a shift towards remote offices, where people will be accessing sensitive data within the vicinity of people external to the organisation.

Interestingly, SAI Global’s research also revealed a 50/50 split between businesses that are relying less on ethics and compliance programmes in the current climate and those that are speeding up their use of this valuable function. While this is a concern, plenty of people (58%) believe the pandemic has made their organisation stronger and is bringing its employees together, despite being apart physically.
​
How will the events of today impact the way regulators view our compliance programmes? It’s dangerous to assume there will be leniency or flexibility going forward. Compliance programmes shouldn’t compromise their integrity just so they can meet the challenges of the moment.

The risk posed by bribery and corruption has been elevated by the Covid-19 pandemic. People are still under pressure to perform from home. Unfortunately, some might choose to compromise their integrity and values to achieve their goals, because of a lack of oversight in the home working environment.  

The fall-out from Covid-19 has meant teams are being reduced in size, budgets are being slashed and investments in technology are being paused – but the risks still exist. These conditions mustn’t compromise the hard work that has gone into developing and implementing strong anti-bribery and corruption programmes. By using Covid-19 as an excuse to pause these efforts, businesses will expose themselves to increased risk.
​
Ethics and compliance programmes must focus on data privacy: training, awareness, relaying best practices and reframing them from a homeworking context. The decisions that organisations make today will impact their culture for months or years to come.