Efficient Internal Policies
We are all, from international groups to boutique advisors, required to have internal rules that govern our activities. These internal rules must be formalized, distributed (easily available to employees), and enforced. In terms of content they are expected to be efficient, in adequation with the company’s activities and risks, and to incorporate the relevant minimal legal requirements.
Their purpose is to prevent and detect criminal conduct, and to organize the corporate activities within the legal framework.
When creating or reviewing internal procedures, we must first assess which regulations apply based on all the activities conducted by the firm, including geographically. Then, we should understand how these activities are conducted in each area by consulting with the business. Finally, we shall implement proper monitoring and enforcement, as well as an annual assessment of their efficiency.
Formalization
Whether we call them policies, directives, guidelines, procedures, codes, or manuals matters little. There must be a defined set of formal written documents, approved by the management or the board of directors, that regulate the company’s activities by establishing an adequate organization, determining the duties and responsibilities, laying out the risks and their management, setting the applicable principles and rules (including operational), and listing the consequences of non-compliance.
There are two main structural approaches. The first is to have a multitude of stand-alone policies, each covering an area of activity: anti-money laundering, trading, portfolio management, operations, human resources, etc. They establish the applicable general principles, maybe listing relevant regulation, and the work directives (dos and don’ts) to the adequate level of operational detail. This would be a horizontal approach. A vertical approach is when there are “master” directives holding the applicable principles, concepts, high-level rules, and separate sub-directives, or procedures, describing further the operational, detailed processes.
The advantage of a horizontal approach is that everything is in the same place, so if you are a trader joining the trading desk, you can read the trading directive and have (mostly) everything you need to start working and be compliant. The downside is that the complete set of such directives can be massive, and employees may be tempted to only read what directly concerns their activity (and miss some important guidelines incorporated in other directives). Also, this requires excellent organization: some principles or information have to be repeated in each stand-alone directive, so any change must lead to the review of all directives to avoid contradictions. I have seen many times such contradictions among rules within large entities having many standalone directives.
The advantage of a vertical approach is that the “master” set of directives is shorter as it holds only the high-level principles and rules, leaving aside the detailed operational instructions. Therefore, it is easier for each employee to read the whole set before focusing on the “sub” procedures applicable to their own activities. Reviews and updates are also easier and more efficient with this framework.
The choice between the two frameworks depends on each organization’s preference, size, and the complexity of its operations. Generally, smaller firms will favor a horizontal approach where everything is at the same place and staff are sometimes multi-hatted, while bigger and more complex firms will favor a vertical approach as it is more structured. But what matters most in the end is that the set of rules is clear, adapted to the firm’s risks and organization, and easy to use.
Content
Considering you know which regulations apply and you are familiar with them, you need to understand thoroughly the business and operations. Take the time to sit with the various teams and examine what they do and how they do it. It is absolutely essential for a compliance officer to be familiar with the firm’s daily activities, and that includes the technical part (systems used and their capacities, types of services, investments, geographic impact, strategy, etc.). It also includes understanding the surrounding universe such as financial markets, trading venues, financial products, counterparts, and clients.
At times, the activities of a firm can get very complex and internal compliance officers cannot be expected to know all the details of every area (and every applicable regulation). In such cases, you should get external specialized compliance help.
Business and operations must be fully integrated. While the rules cannot be modified or compressed, they can be used at an advantage by providing an adequate and user-friendly work process. Try to find the right balance between flexibility and precision, in times of turmoil it will make a difference.
It may be comforting and therefore tempting to paraphrase (or even simply copy and paste) the law. But depending on the applicable jurisdiction, legal texts are difficult to grasp, to say the least, for people from a different background, and so it can defeat the purpose. If you want employees to adhere to the rules, you must adapt the rules to them. Speak their language, put yourself in their shoes and try to make their life easier by establishing policies that are easy to understand and focused on their tasks.
Distribution and training
An essential part of any rules set is how they are known and understood by the people who must comply with them. This is where clear information and adequate training are key. Make sure employees (including management) know what the rules are and where to find them, and that they have read and understood them. Training can be done live or online. It is important to follow up on each employee ensuring they all attend training, ideally with some form of testing (it always grabs people’s attention). Staff should be made aware that they will be liable for non-compliance whether they knew the rule or not.
Monitoring and enforcement
So now the rules exist and people know them. The next step is to monitor their application. Monitoring does not necessarily fall entirely under the compliance department’s responsibility. As long as no one monitors their own activity, some monitoring tasks can be delegated to the business or operations.
This second line of defense is essential. Two principles should apply. First, if the monitoring you have set in place does not or rarely highlight any breaches, you might want to question its efficiency and think about what could be falling through the cracks. Second, when there is a (material) breach of compliance, you should review whether it could have been prevented either by better rules or controls, or through systems improvements.
Monitoring should be organized to permit the detection of non-compliance and the improvement of the internal control system. Use a risk-based approach to create a monitoring program that focuses on the sensitive areas.
Non-compliance should have consequences. It is sometimes difficult where feelings or rank are involved, but it is necessary to establish the consequences of non-compliance in the rules and then apply them strictly. Any decision should be documented as to why the sentence was applied (or not).
Review
At least once a year, take the time to review your policies with a critical eye. Reassess your risks and take into account new activities or developments of the business. Draw conclusions from incidents and client complaints. You can request the feedback from the business on how to improve ease of use and training. Consult with management, they are ultimately responsible for the policies so they need to be involved in their making and improvement. Get their formal approval after review.
Conclusion
I too often see policies that are created with an approach to “please” the regulator or the auditor, to the detriment of properly regulating the day-to-day life of the company. They read like legal texts and have little concrete use. A compliance resource, whether internal or external, is best positioned to implement simple, efficient rules adapted to your activities. The policies should be implemented keeping in mind who the audience is, resisting the temptation to cover all grounds but rather focusing on the firm’s activities. Extensive documents full of unnecessary legal gibberish must be avoided as they discourage people to read and use them. Management and staff must be involved when creating or reviewing the rules. They are the end users, and the policies should be elaborated as a guide for them to navigate the rules.
April 2020
