We're the FourthLine of defence

Embedding risk culture is never an easy thing to do. By its very nature, it isn’t tangible and therefore requires thought and vision to be a real strategic enabler. What is clear, over the past few years at least, is that the topic is increasing in importance to Boards and Executive Management. There is little wonder in this really if we consider business risk and governance failings the have occurred in the recent past. What is Risk Culture? When I think of Risk culture, I always come back to three things which I feel define it – attitudes, behaviours and values, and how these influence and inform the management of risk within an organisation. Risk culture is a constant for any business – always in play because it reflects the shared values, goals and practices that embed risk into a business’s decision-making processes and risk management into its operating processes. The basics of risk culture I think there are two fundamental elements which underpin risk culture: Board and Executive ownership. By this, I mean that it is the responsibility of the Board and Executive to define their desired culture, to set and live the tone that they want to permeate throughout the organisation. To me, this is crucial, it isn’t something that should just be documented and communicated through management layers – tone should be effectively set at the top and modelled throughout middle management and the operational staff population. Robust Risk and Governance Frameworks. This includes corporate values, code of conduct and ethics programs, policies and procedures, the risk governance structure and processes (committees charged with management and oversight of risk) incentive programs and the risk management process (risk assessment, control testing, risk appetite, tolerance and key risk indicator reporting and assurance activity). Wrapped around these two elements are daily operating attitudes which drive risk culture. These include the belief systems and core values that drive behaviour and guide daily activities and decision making throughout the organisation, particularly with respect to strategic pursuits. These attitudes, behaviours and beliefs are rarely tangible but require careful attention. For example, behaviours around risk management and internal control often manifest in how people address audit issues and address control weaknesses and confidence in escalating and resolving issues. The timeliness with which these activities are carried out provides a powerful insight regarding risk culture. So, too, does executive management’s reaction to issues raised by independent risk management and audit functions. The influence of external factors, such as regulators, investors and customers should also not be overlooked. All will affect organisational risk culture to a degree as businesses attempt to align their operations to the requirements of multiple stakeholders.  Embedding Risk Culture The one key enabler to effectively embed risk culture in any organisation is vision. Once again, we look to the most Senior Levels to develop a desired state for its risk culture, a clear target which management can work towards. This is where risk management starts to interplay quite heavily with corporate strategy – effectively pinpointing the healthiest level of tension between the organisation’s entrepreneurial activities to create growth and enhance value and its activities to protect enterprise value. Basically identifying and working towards the environment which allows business growth and risk management to work together harmoniously. Once this target is known an assessment of the current risk culture should be completed. There are many ways this can be completed, through surveys (internal or external) targeted at a broad spectrum of the staff population for example, or assurance reviews (by independent risk management and/ or internal audit functions). I personally think the most valuable assessments are those where all elements of the business (all three lines of defence) are engaged in assessing risk culture. When you consider the data points available in any business it should be fairly straightforward for the first line of defence to conduct a risk culture self-assessment, which coupled with outputs from second and third line assurance activity can provide invaluable snapshots through different lenses. To facilitate effective assessments, there needs to be a defined framework in place. As a minimum, any assessment of risk culture ought to include the following: Tone - Level of Board and Executive Management ownership and discussion and escalation of risk issues. - Business ownership of risk management. Strategic / Decision-Making - Alignment and incorporation of risk into strategic planning. - Evidence of key business decisions taking risk into consideration, learning from failure and associated read-across across the organisation. - Use of risk appetite to inform decision making. Risk Management Framework - Effectiveness of risk management and governance processes. - Quality and availability of risk subject matter expertise (SME) skill and resource. However the assessment is conducted, what is critical is assimilating it all for Executive Management (and Board) governance. The key thing is for Executive Management to digest these assessments and develop actions (which they own!) which should form a part of the next assessment process. The desire here is not to make risk culture assessments ‘a thing’ which happens annually and then disappears. Rather it is an on-going process where management seek to hold themselves to account through assessing and implementing action as they move towards their desired state, improving and refining iteratively. Organisations should be constantly evaluating their risk culture and re-evaluating associated targets to allow them to proactively address downstream challenges. Written by Jon Johal Jon is an experienced risk professional who has worked across a number of sectors including Healthcare, Government and Financial Services. Jon currently holds a Senior Management role in the UK Insurance Sector with responsibility for oversight of Enterprise Risk Management. Find Jon on LinkedIn.  

Good governance is crucial to the continued success of the UK financial services industry.  So many of the high profile and expensive disciplinary cases brought against firms can be traced back to failures in governance and the FCA seems determined to do something about it. New requirements flowed from the FCA’s review of the industry and it sees this as part of its consumer-protection effort, as it declared when launching the final rules: “We think that the introduction of independent members to AFM boards will lead to better outcomes for investors….” - Policy Statement PS18/8, April 2018 PS18/8 Given that senior management responsibility has been a recurring theme for the different regulators over the past 25 years or more (since the Barings debacle at least), some might say tougher requirements are long overdue. In any event, significant new rules are on their way with authorised fund managers (AFMs) being required to appoint a minimum of two independent non-executive directors (INEDs) and for them to comprise at least 25% of the total board membership.  Even for firms not technically caught by this requirement, it is clear the way the “wind is blowing” and many will feel that best practice now demands more independent input at board level, in any event. This goes hand in hand with other initiatives, like the Senior Managers and Certification Regime (SMCR), coming later this year.  This will require a fresh look at who’s responsible for what in a firm’s senior management team, how the current approved persons map across and how everything is evidenced and signed off.  All in all, the heat is being turned up at board and senior management level and this will have consequences. One key consideration for the industry is the finite pool of appropriately qualified people from which to draw.  In some jurisdictions, it is not uncommon for an individual to sit on a dozen or more different fund boards. However, it is likely this would be difficult to justify in respect of asset management firms in the UK. Individuals must have sufficient time to devote to the role and potential conflicts of interest will inevitably rule out some people for some of the appointments.  Whilst it can be useful to have input from outside the industry, relevant experience will remain invaluable for an individual to provide effective input, challenge and support to the business.  The need for good governance, including the checks and balances brought by non-executive board members, is clearly not new for our industry. Principle 3 (Management and Control) and the SYSC (Senior Management, Systems and Controls) rules have been core requirements for many years. What is new, however, is the scale and nature of the new requirements. Many firms will need external help to get things right and, for those who have yet to prepare in earnest, time is of the essence. The regulator leaves us in no doubt that this is an area of the utmost importance and will have little tolerance for any firms taking governance less than seriously in the future. Written by Jason Gardiner Jason is an ex-regulator, board director and compliance officer now working as a freelance governance and compliance consultant. Find Jason on LinkedIn.  

Every organisation has suppliers, of all shapes and sizes. But do we consider the risks of using suppliers when we look at our cyber security stance. Perhaps you have a full business process outsource, perhaps you have a supplier that provides software updates. Both of those suppliers are a risk and should be considered. Let’s look at some important supply chain attacks to understand why we must work with our suppliers to better protect our estate. A large business process outsourcer based offshore was recently in the news for finding its estate had been compromised for “a few months” before the signs were seen. The attackers were able to traverse the suppliers estate to attack the customers of that outsourcer. Additionally we have seen direct attacks on software updates, meaning that will little to no effort, a back door has been placed into multitudes of machines. With these facts in our minds, we are forced to consider that maybe our suppliers are the easiest way into our estate. Perhaps they are easier targets and, especially in the case of managed service providers, offer a much larger reward than access to one single estate. One of the biggest questions I am often asked is where do I stop? We all have so many suppliers that performing audits and checks on each one would be a logistical nightmare requiring a large team and an even larger budget. Those resources are more often aligned at defence of one’s own estate. My advice to people who ask this question is to start a journey, it is not a one off tick box exercise but an ongoing practice. If you start with your critical suppliers, or perhaps your suppliers that maintain a logical connection to your estate you will find that you start to address the issue sof supply chain security, and your suppliers, by working with you, will be able to offer you far greater reassurance that they won’t be the reason for a breach. In my role, as the information security officer for a very large oil refinery, the estate I work to protect is covered by NIS regulations as we are considered an “Operator of Essential Services” and therefore must show our cyber defences according to a framework published by the NCSC called the Cyber Assessment Framework or CAF. The CAF offers a framework that is outcome focussed and covers all areas of a mature and robust cyber defence system. It is freely available to everyone, and in my opinion is a priceless tool to drive cyber security across an estate. By following the CAF and going that stage further of asking your suppliers to adopt it, providing the output to yourself, you will be in a very strong position to make clear informed choices on where your gaps are, what suppliers should be focussing on and how you can work in partnership with your supply estate to ensure a good level of cyber security. Written by John Wallworth John is the Information Security Officer for Essar Oil UK ltd, who own and operate the second largest oil refinery in the UK satisfying over one sixth of the UK's fuel demands on a daily basis. John has over 25 years’ experience working in IT, in both technical and management capacities. Having worked as an MSP to over 350 organisations on projects both large and small, John is now an in-house CISO who is extremely passionate about making security invisible to end users, but effective for an organisation. Find John on LinkedIn.

As the DPO of a global retailer, what are the main challenges you currently face in your role? The biggest challenge I see in this role is – the fast paced continuously moving target. When you work for a business where the growth appetite is 3 times in 5 years (i.e. growing from £350m to £1Bn), every single piece of the business is changing on a daily basis. Learning about the changing environment and guiding the business teams as well the Board on various decisions can be the most challenging part. Another challenge is to get business teams to own the risk for any of the decisions they take. Most business teams think their risk is only limited to the activity they are looking to do not with Data Protection. With every engagement, I make them realise it’s also the risk they own on the use of data that will be involved in that activity. At the end of the day, I am advisor so my role is to identify the risk of using the personal data in their activities, assigning a risk level, giving them options to risk treatment and help them choose the right risk decisions. Then they are responsible to the Board for any risks they own. How do the challenges of your role differ from your previous experience gained across other sectors? Honestly, not so much because most of the business I have worked in the past few years have been fast paced businesses which I am so used to now. One of the challenges in my previous role in Pharma was learning their language and terminology. Each team would talk so differently when asked about the data they hold or process. Terms such Pharmacovigilance and TMF’s would just go over my head in the start and took me a little while to get used to it but it was very rewarding to learn different things in a new environment. How do you overcome the challenges of being a Data Protection Officer whose responsibilities sit across several different markets and jurisdictions, ensuring that different areas of the business take responsibility and understand data related risks? This is the most interesting part of the role according to me. What may be completely acceptable to do in terms of marketing in the UK, may not go down so well in France and may completely unacceptable in Germany. And it may be easier to do it in the US due to less restrictive laws. But as a DPO, I have to ensure that most restrictive the laws are applied across the business and markets to ensure some consistency as well be more conservative about Privacy in general for all consumers irrespective of their location. Again, you have to balance this very carefully with the business interests in the commercial sense. You do not want the business to suffer solely because the laws do not allow any flexibility. So this is where you have to work with the lawyers ensuring we balance the privacy rights of the individuals against the things that the business would like to do with their data. When it comes to assigning responsibility to the business teams, I think I have learnt very well on how to deal in the past few years. How did you go about getting the buy-in from senior leadership and the board required for a long-term cultural shift and process changes required for ongoing GDPR compliance? This is a very good question and I think this requires a good support and Governance on the Data Protection programme. Firstly, I ensure we have a regular monthly update to the Board on the Data Protection challenges across the business highlighting any support required for the next steps in the programme. This is chaired by me with the Board and very well attended which itself shows a good support from the Senior Leadership and the Board. Secondly, I ensure any new risks have been identified and highlighted to the Board with a view to get steer on the risk treatment options. Generally, these would have been already been discussed with the Business Risk owner including the treatment options thus gaining their support in advance. In the meeting, they support the case as they own the risk and thus take on the responsibility of the risk. The Board takes the decision on whether they are within the acceptable levels for the business and whether there is ownership of it. Thirdly, since I report directly to the Board, it becomes easier to manage the change that I am looking to achieve in the business. What do you think are the best methods for embedding a culture of compliance and best practice around data privacy within an organisation? What role does training have to play? When it comes to changing culture, I have always taken a slow and steady approach depending on where the organisation stands in the curve. If the organisation has a privacy culture programme, I assess whether it’s compliance oriented or beyond. Many organisations start with a standard eLearning methods which more or less are tick box oriented. I focus on starting with a compliance oriented method to going to building privacy in everything they do. It’s all about embedding privacy in the mindset of the people. It’s a cultural shift as you mentioned. The tone has to come from the top. I have always focussed on engaging with staff on a 1-to-1 basis within teams, champions, etc. I believe if you have to change culture you have to work with the individuals in understanding their challenges. Once you understand their role and challenges in their role, you interwind Data privacy requirements into their role that do not hinder their role. You guide them through the process and help them so they understand why you want to bring those changes. Once you have their acceptance, you are on to a winning programme. Training plays a huge role and not just eLearning but giving them an opportunity to talk and share about their experiences so others can learn from them. For example, I engage with all staff in their team meetings that give them an opportunity to ask questions as well as to share their experiences with colleagues. This makes it more lively for all staff as they learn from their own peers rather than just the DPO. When it comes to training, do you think there is a benefit to bespoke training being delivered in-house, or can a more ‘off the shelf’ model provide value? It depends on the size of the business. I have always been a huge supporter for bespoke and have built Data protection training programmes right from the scratch. But if the size of the business is 75,000 employees, you cannot do these completely bespoke. So you have to build in a mix of materials – off the shelf as well as bespoke content. The idea of training has to be that you have to connect with everyone across the business who have different backgrounds, different roles, different scope and understanding of Data privacy. With so many elements in the picture, you cannot be using just one tool to enable that cultural shift. I have worked with standard eLearning packages, created bespoke content for various teams, engaged with staff in team meetings, brought different teams together to share their experiences, created newsletters and posters to target audience, etc. You have to try various methods to connect with all types of audience. Luckily, I have had great success with building security and privacy culture programmes. What role does the DPO have to play in a rapidly expanding business? Many roles- The DPO is first an Advisor to the Board and the Business teams; The DPO has to be a very good Risk Manager, someone who not only understands Data Privacy and risks associated with using personal data in particular business activity but also can translate the risk into business sense and give them a view of risk treatment options. That also means a DPO has to be a good communicator/translator to ensure risks can be translated in a commercial aspect and assigned to the Risk owners. The DPO also has to be a good people person as this role really involves working with people at all levels in the organisation. The DPO has to be a good mentor so he/she can mentor champions across the business for building a first level of defence in the business and also work with peers/colleagues to get buy-in for risk ownership. Thank you Tarun! Tarun Samtani is the Global Data Protection Officer for Boden. Boden is a British clothing multi-channel retailer selling online, by mail order and with a high street presence. Boden sells in several markets across UK, Europe, US, Asia and Australia. Tarun holds over 20 years of experience across various sectors like Telecommunications, ISP's, Financial Services, Gambling, Retail and most recently Pharmaceuticals. He has a wealth of experience in Information security & Data Privacy His specialisations include strategic board advisory, roadmap planning through delivery of security / privacy programmes including building a security / privacy aware culture. Find Tarun on LinkedIn or Twitter.

What has been your experience of training in relation to improving risk culture, and how beneficial have you found this? There has been great progress over the past decade in developing risk cultures, effective tools and techniques for managing risk within firms, and acceptance that boards need to be mindful of the risks inherent with strategic objectives. However, as Compliance and Risk professionals continually experience, embedding risk management into a firm to the extent that it reliably makes a difference is still a difficult task, the main challenge continues to be people and their willingness to improve and adapt. Every firm, Compliance and Risk teams has its own approach to risk - its risk culture. The risk culture will influence the mechanisms and techniques that the firm employs to manage risk but is also in turn influenced by them. Well-constructed training can make a massive difference, however in my experience Computer Based Training only works if it is used in conjunction with more interactive learning activities How much of a priority do you think risk culture training is for firms, and do you agree with this? With so many areas for learning and development, how highly would you rank risk culture training? In “The FCA and UK Banking Culture” by Peter Andrews (2016), former Chief Economist of the FCA, he suggested that “poor culture played a significant part” in the financial crisis and that it is “a root cause” of many organization’s failings. Andrews identified culture as “both a major driver and potential mitigate of risk.” He concluded that he would like to see that “firms’ senior management lead and foster a culture that has the fair treatment of customers and market integrity at its core.” I personally think there is a slight blind spot across the industry in relation to Culture as a whole, most people will agree it’s a vital component of risk management and it’s taken seriously within the firm, but when it comes to training, culture is focused on Myers & Briggs (Which to be clear I like, it just isn’t risk), and shallow mission statements. The only way risk culture training works is when its clearly linked to strategic objectives. Do you think risk culture training is something that is better delivered in-house and made bespoke to the specific requirements of a firm, or there more value in attending external workshops or courses? If you keep employee training in house, you ensure you retain control over the development of that training and ensuring it can be tailored to the firm’s specific processes and procedures. On the other hand, by outsourcing, you gain access to people who have proven expertise in educating employees in specific areas, i.e. Risk Culture across many firms, which can be a good eye opener. I’m indifferent to either, the key is the message and again how it all links together. Who should risk culture and conduct training be delivered to within a firm? Easy, all staff. The induction of all employees is a great place to share the risk appetite and culture of the firm in a bite size session that draws out the key behaviours the firm is looking for in its staff. If this can be delivered by a senior member of staff that doesn’t sit in the Risk & Compliance teams even better. What do you think is the best method for delivering training and development on this topic? As noted above, the key is less in the delivery, i.e. CBT, interactive workshops etc, but much more about making it relevant. It sounds obvious, but content can only be engaging when it’s written for a specific group of people. With endless content at their fingertips, your time-poor audience won’t stick around reading boring content that they feel is a timewaster. And nor would you want them to! So, it’s worth taking the time to create specific learning objectives for each section of your audience. This doesn’t have to involve completely new content or wholesale rewrites; simply using appropriate terminology, referring to people roles correctly and removing pages that aren’t relevant for certain people can go a long way. If a firm was looking to transform their risk culture, what elements do you think need to be considered for a successful transformation? This requires a clear understanding of the current culture and the desired ‘target’ culture. It requires recognition that this is a major change programme and requires discipline to see it through. The process must start with someone at a very senior level taking ownership, the sponsor must win support across the top of the firm among executive and non-executive leaders, whilst commitment must be conspicuous to all and backed up by funding and resources. The culture change should be treated as a change management project, with appropriate allocation of board time and resources. A culture cannot be rewritten simply by mandating that the values or ideology of a firm have changed. The firm must approach the risk culture change as a project, with a set of objectives, a design for intervention and with regular reviews of both progress and outcomes. Change can be implemented by pulling on certain ‘levers’ to make noticeable change in important areas. Risk and Compliance functions will need to work closely with HR and other key departments on several key change areas. How can progress and the positive effects of risk culture training be evaluated? The effectiveness of how a firm responds to issues, risks or opportunities can be strongly influenced by their risk culture and governance. Effective risk governance, through use of objective measures and wider participation in decisions, should shine a spotlight into all areas of the business and make it difficult to hide or bury risks. Conversely, a failure of risk governance and risk oversight can have dramatic consequences for firms. In short, its difficult to measure in quantitate terms the impact that training can have in risk culture, however if your firm works collaboratively when things go wrong, and have a good mix of people at the table to help, the chances are the risk culture is where you want it to be!  Thank you Martyn! Martyn O'Connor is an experienced, commercially minded risk professional who has worked across a range of financial services organisations including Alternative Finance, P2P, stockbroking, advisory, wealth management and pensions. Martyn currently works for Wellesley, an established alternative property investment platform, that issues Bond investments to the UK retail market. Find Martyn on LinkedIn or find out more about Wellesley. FourthLine Learning offer a range of performance advisory workshops and in-house learning solutions to help risk professionals and teams improve performance, navigate market complexities and make critical decisions more effectively. Click here to find out more.  

During 2018, I wrote several posts about FinTech, Artificial Intelligence (AI) and risk management.  I was kindly invited to present to the Network of Consulting Actuaries, I chose to use this opportunity to consolidate my views on the subject.   There were several ideas flowing through my mind. Firstly, informal evidence suggests that, for all the hype, FinTech and AI have not yet become mainstream in insurance or in financial services more generally. Secondly, the largest business transformation arising from FinTech and AI is the adoption of these technologies by incumbents.  Indeed, I explored this in the context of banking through the group project at the Oxford FinTech Programme I completed in December 2018. Thirdly, someone who works for a multinational insurer made the observation during an InsurTech event in London that as a regulated entity, the insurer has responsibilities and obligations towards their customers and must follow due process before they roll out new technologies.  There was a hint of an apology in this observation to the nimble start-ups in the audience. Putting all these thoughts together led me to see the main challenge to the adoption of FinTech by incumbents as governance, including how risk management is applied in practice.  If the aim of risk management is to ‘protect’ or block, then the incumbent does not have an obvious lever to support the introduction of AI tools and FinTech.   If, on the other hand, the aim of risk management is perceived as to ‘protect and enable’, then risk management can be part of the solution.  Risk management can lead to the creation of necessary infrastructure to ensure that AI tools achieve their transformational potential.  This includes articulating a vision of how a control framework should be leveraged, considering the impact of FinTech and AI on risk management frameworks, focusing on explainable AI, and articulating the implications for the target operating model.  This will facilitate incumbents’ adoption of FinTech and AI.   Take a look at the presentation I gave (here) for a more detailed articulation of these points. Written by Isaac Alfon, Managing Director, Crescendo Advisors This article originally appeared here and has been reproduced with permission. Text © Crescendo Advisors, 2013 - 2018 Isaac is an independent consultant with extensive experience of risk management in financial services. His expertise includes enterprise risk management, governance, risk transformation, stress testing, assurance, capital, risk appetite and risk policies.He has worked in industry, including start-ups, consulting, financial regulation and HM Treasury covering the development and implementation of risk and capital insurance regulation. For further details please go to www.crescendo-erm.com.

For the average user the steady diet of news about hacking and data breaches can be overwhelming. Within an enterprise context this can become even more acute due to the wide array of technologies that are in use and the abundance of ‘threat feeds’ bringing in the latest and greatest vulnerabilities that might affect you and your company. When trying to cut through the noise on issues of cyber security many companies can adopt a few baseline rules to make the job easier. Don’t forget your threat model Every company should have a threat model which maps out who your enemies or potential enemies are. For example, if your company has any political affiliations then you may be targeted by Hacktivists. If you work with governments then nation-state attackers may take an interest in you, and this may also be the case if you deal with intellectual property. All entities will be affected by ‘non-targeted’ attacks – this refers to automated bots that crawl the net looking for specific vulnerabilities, such as exposed databases, without caring much for who you are or what info you have. ‘Script kiddies’ also fall into this category – these are individuals who have no hacking skills whatsoever but have learnt to use one or two automated tools that can exploit vulnerabilities without understanding how they work or what they are doing. Learn how ‘exploitability’ works If you based your decisions on what is safe or what isn’t solely on the mainstream press you would be forgiven for thinking that ‘Cyberpocalypse’ is upon us and that we are all doomed and can be hacked at the drop of a hat. Nothing could be further from the truth. First of all, there is no correlation between the amount of news coverage a ‘threat’ receives and how likely it is to happen. Back in 2015, anyone with an Android device was deemed ‘hackable’ because of a vulnerability called ‘Stagefright’ that affected 99% of all Android devices. When the dust, settled, the total number of infections cause by this threat was zero. Exploiting a vulnerability requires many steps to happen in a specific order, and for vulnerabilities where a specific individual is targeted then those steps become even more contrived. This is why your threat model is very important. If you have any vulnerabilities that require someone to be in physical proximity (for example, to take over your wi-fi network) then you can discount these almost instantly because only nation-state attackers will invest in the resources required to pull these off. They are high-risk and can often fail – the incident in the Hague attempted by some Russian nationals last year ended in catastrophic failure as they attempted (allegedly) to attack the wi-fi networks of the UN OPCW. They were rounded up, had all their equipment confiscated and sent back to Russia – the only thing that saved them in the end being their diplomatic passports. Map your technology to threat intelligence The last piece of the puzzle is knowing which threats affect you. To evaluate this effectively you need to map out which technologies you have and then be able to filter the new threats that appear and map them to your technologies. If you have your threat model inline and understand exploitability then this third piece will come naturally, and you can effectively operate a ‘triage’ of new threats to see if you will be affected, and if so, how likely it is to cause you trouble. Once you’ve filtered these you can plan remediation activity on the threats that are more serious, which usually involves updating systems or putting in more mitigating controls to protect your assets. It goes without saying that the above can be automated to an extent but this is completely dependent on resources and budget, since there is already a plethora of tools and vendors that can do the above for you at a cost, or you can just bring this in-house and do it yourself, but this would require more manpower and thus more resources. Once you have these pillars in place, you can evaluate cyber security risk more efficiently and cut through the torrent of news that won’t do you any harm, and cut through to the threats that you should really be focusing on. Written by Alex Haynes Alex Haynes is a former pentester with a background in offensive security and is credited for discovering vulnerabilities in products by Microsoft, Adobe, Pinterest, Amazon Web Services, IBM and many more. He is a former top 10 ranked researcher on Bugcrowd and a member of the Synack Red Team. He is currently CISO at CDL. Alex is a regular contributor to various cyber security publications and speaks at security conferences on topics related to offensive security. To read more from Alex click here.

In my previous post I commented on the importance of adding a “Target” risk position to the traditional "Inherent" and "Residual" risk assessments, and the linkage to the Risk Appetite. More importantly, the “Target” level for any risk provides a focus on the future. Let me explain. Inherent to Residual: Inherent risk is the level of risk before remediation. This is important to ensure that we are focusing on the areas of risk that represent this greatest threat or opportunity for the entity. Inherent risk scoring is subjective, but then so is almost all risk scoring. Yet an assessment, subjective or quantified, of the risk before controls or other remediation ensures that we invest our limited resources on the areas that pose the greatest to achievement of the entity's objectives. So we’ve assessed the Inherent risk, and we have applied controls for remediation, mitigation, etc. Now we have our “Residual” or “Net” risk position. Again, this is by nature subjective, and fraught with assumptions. But it does provide an assessment of our current state of risk and the level of risk that is being taken by or accepted by the entity. But this is subjective. And it will be wrong. There will be too many missing controls, controls that are functioning ineffectively, mitigation that is unfocused or not in place. The assessment of the Residual risk position provides a snapshot of the current situation, with no insights into either the level of risk that is acceptable, the actual level of risk being taken, or the level and type of risks that the entity wants to take. Target: And so we get to the “Target” risk level or assessment. What level of risk does the entity want to take, and what level of risk is acceptable. This is fundamentally an assessment of the desired future-state of the risk environment that the entity wishes to work within. And yes, this too shall be subjective. It will also probably be achievable. As Risk Managers we need to consider and advise on the level of acceptable or desirable risk to be taken or accepted by an entity, across the spectrum of risks. This means that we need to assess not only the raw (Inherent) risk environment and support the allocation of resources to highest or least desirable risk areas, and of course allocation of resources to those areas where we want to take risk.  We also need to work with management to objectively assess the desired, or acceptable level of risk to take; the Risk Appetite. This should be done globally, and should be done at the level of each identified and recorded (and managed) risk. This is our Target risk level for each risk. Now, and only now, can we meaningfully assess our “Residual” level or risk, and determine if that level of risk is appropriate.  If our current (“Residual” or “Net”) equals our Target, then we are running at our desired level of risk. And if we are not, then we now know that our desired future state does not equal our current risk managed state for this, and all other risks where Residual does not equal Target. In the example above, a number of interesting observations can be made, including that the Residual and Target risk assessments change, as risks are reviewed by the Risk Owners. It is also clear that Residual are Target are not the same. Within the data there will probably be a number of individual risks where the Residual assessment equals the Target assessment; the current risk situation for those risks equals the entity's Risk Appetite for those specific risks. So why does Residual not equal Target? There are three possibilities: Our control environment is ineffective and or does not include all the controls that are already in place to manage the risks (and these then need to be identified). Our aspirational level of risk management for risk is too high. Conversely, we are over-controlled (where Residual is lower than Target for specific risks) and we are potentially stifling the business through excess controls. And when we determine that our Residual risk position does not equal our Target risk position, we have four option: Accept that it will not be possible to achieve the desired Risk Appetite for this risk, and, through a Delegation of Risk Authority process, change our Risk Appetite and therefore our Target level for this risk to equate to the current Residual risk level. Subtly different, but we may determine that the Risk Appetite is not right, and that we do want to accept, or take, more of this risk, and therefore change the Target. Identify the controls that are not effective and implement improvement programmes or introduce new controls. Confirm that we are over-controlled and look at which controls are not actually required, or are burdensome and should be replaced with monitoring controls. What is the role of Internal Audit in this? The Internal Audit function provides some assurance that the system of internal controls is effective. This requires Internal Audit to determine what areas of business activity they will review. This selection should be risk-based, which means starting with the risk register and consider a balance between this Highest “Inherent” risk areas, and the highest “Residual” risk areas. As part of each Internal Audit, the assessed level of Target risk should be considered, and Internal Audit should then perform an audit programme designed to confirm (or otherwise) that management’s assessment of the effectiveness of controls is accurate. If the controls are effective, and these controls have been determined to bring the entity to within Risk Appetite, than Internal Audit’s role is limited to questioning the appropriateness of the Risk Appetite. (Note I say question, not set, as that is the role of senior executives and the Board, other others within their Delegation of Risk Authority). Where the Residual risk level does not meet the Target, Internal Audit should be determining if this is because the controls are ineffective, or because the control environment provides inadequate coverage of the risk. In which case, new controls may be appropriate. In all cases, Internal Audit should be determining if Management's assessment of the effectiveness of the control environment matches the evidence provide to Internal Audit. If management's assessment is correct, and there remains a delta between the Residual and Target, and senior management and/or the Board are aware, then there is no Internal Audit finding other than the fact that senior management and/or the Board are aware of the difference, and are aware of and support management's plans for remediation. It's all about the Future The core message however is that the Inherent risk position represents a “past” with no controls, the Residual risk position represents the present (as assessed by management), while the Target risk represents the future, or desirable control and risk management state, and is one of the enunciation of the entity's Risk Appetite. The question we ask of Risk Owners is: What are you doing to get from the Residual risk position to the Target risk position, and when will you get there? Written by Daniel Roberts This article originally appeared here and has been reproduced with permission. Daniel has over 30 years experience in Risk Management, Internal Audit and Innovation, Information Systems Audit, Information Technology, Consulting in E&E, Corporate Governance and XBRL. Daniel has worked in North America, New Zealand and the UK, and has undertaken assignments in Australia, Ireland, Malaysia, Thailand, UAE and France, and has been an FCA Approved Person. Daniel is the founder of Governance and Risk Management Services international, a boutique consultancy who deliver a range of Governance, Risk and Internal Audit consulting and XBRL services. Find Daniel on LinkedIn, find out more about GRMSi or read more of his articles here.

“Did he talk about silos?”.....“of course he did,” I said.  “We have to break down the silos that separate the academic side of the house from the Student Retention Office apparently.”....Emma wrinkled her nose: “ why is it a good thing to break silos? All that happens when you break a silo is that the grain spills out.  Or the missile falls over.” (Frankie Bow, The Musubi Murder (Professor Molly Mysteries #1) Admittedly, not the most conventional prelude to an article that otherwise lacks any such frivolity in addressing one of the financial services industry’s greatest foibles. Silos: Towering constructs that dotted the landscape of a childhood spent around farms now replaced by the equally pervasive “business as usual” constructs which have become somewhat endemic to today’s financial services industry: “necessary evils” in the name of industrialisation, efficiency, cost cutting and “doing more with less”. Siloed ways of working which, in fact, are the complete antithesis of that which they seek to achieve. Constructs, not dissimilar to those found on a farm, that whilst indeed preservative in nature only serve to obstruct, stagnate and impede progression, thwarting collaboration and interconnectivity between departments, teams and systems. Silos that are the preservers of legacy ways of thinking and doing; of legacy systems that have been bastardised far beyond those purposes for which they were ever designed; of knowledge ascribed to the sole domain of key individuals. Preservers that have engendered a culture of “button-pushing” operators who lack the inclination to understand the “whys” or the “wherefores” of what they do on a daily basis or the ramifications of their actions or any concept of what the bigger “front-to-end picture” actually looks like. If we are to believe, as Emma does in the above excerpt, that all that happens when you break a silo is that a “little grain falls out”, why are we so persistent in our quest to protect, promote and indeed somewhat nurture the existence of such silos within our organisations?  What, after all, is a little spillage amongst friends?  Why is the opportunity to get rid of the old and replace with new, fresher content met with such aversion?  Perhaps it is not so much the spillage per se that concerns us when a silo is broken, but rather the content of that spillage and how, or what it will expose about our respective organisations: Inefficiencies, inaccuracies, misassumptions, outdated knowledge, disregard for regulatory obligations; indifference to clients; a mismatch between technical solutions and operational reality and a clear position of the “left hand not knowing what the right hand is doing” being left painfully bare. With an ever-increasing focus on robust governance that sees regulators increasingly demand transparency around decision making, processes and controls and increasingly holds responsible individuals accountable, how is this to be realistically achieved when many organisations lack such internal transparency or clarity around roles and responsibilities, not to mention any sense of the upstream and downstream ramifications of certain activities within those said organisations. To achieve this and meet regulatory expectations and true optimisation of their respective business models, organisations and the individuals tasked with ensuring their success will have to demonstrate a decisive move away from such siloed methodologies of working. Instead, the focus needs to be on achieving true integration and interconnectivity between individuals, departments, functions and systems; adopting an holistic “front-to-end” approach where internal transparency and “talking” is the order of the day. With that, let’s return silos to where they rightfully belong: on farms, fulfilling the purpose for which they were designed: “Silos are for Holding Grain in” (Greg Hobbs) That way we need not concern ourselves with spillages or the contents thereof! Written by Jo Parkhill Graduating in Law from Trinity College Dublin, Jo has 18 years experience working within top-tier Global Financial Institutions within Investment Banking, Investment Management and Asset Management, and across Front Office, Compliance, Risk Management and Operations. Since 2009, Jo has facilitated the implementation of many regulatory change programmes: Lehman Supreme Court Ruling, FSA Disclosure Annex, CASS RP; PS 14/9; MiFID II CASS impact; FRC Assurance Standard; CASS Audits) as well as conducting major CASS remediation programmes of work. Jo is currently a CASS and regulatory specialist consultant to a top-tier French Investment Bank and Cashfac.  She is also external CF10a to a leading Peer-to-Peer organisation. In recent years, Jo has been the CF10a & UK Head of Transfer Agency for UBS AM and led an in-depth Transformation programme at Emirates NBD. Jo has also managed Prime Brokerage Client OnBoarding and has facilitated regulatory change programmes of work around EMIR, Dodd Frank, legal Entity Identification, MiFID I & II; PSD I & II, and GDPR. A wealth of experience and expertise, Jo focuses on eliminating silos in favour of holistic solutions that combine commercialism, pragmatism, interconnectivity and regulatory knowledge. Jo facilitates solutions that are strategic and scalable in nature, focusing on root causes, as opposed to quick fix tactical solutions that quickly become unfit for purpose. Find Jo on LinkedIn.

Anonymous data are not personal data. In the words of GDPR, identification would not be achievable through any “means reasonably likely” (Recital 26). Determining what really is anonymised or not therefore depends on who can access the data and the context in which they work. The environment in which data exist helps shape whether they are anonymised: a freely downloadable dataset is harder to anonymise than one that is held in a secure archive for use only by approved and trained specialists (Elliot et al. 2016). Data that have been pseudonymised are sometimes referred to as if they are anonymised. When GDPR talks about pseudonymisation it is as a privacy enhancing technique for personal data (Recital 28 and elsewhere). Pseudonymised data might not be directly identifiable (Article 4(5)) but can still be indirectly identifiable (Recital 26). Simply replacing identifiable data with pseudonyms does not make data anonymised; records would not be anonymised to anyone who knows the method whereby pseudonyms were created, can refer to identifiable data, or is able to find combinations of values unique to individuals. For example, imagine an entry in an insurance claims dataset about a collision involving a certain make of four by four driven by a certain elderly male; I’ve not given you any specifics in my description of it, but you might hazard a fair guess as to whose insurance claim information it could be and with an age, location or date you would be able to judge whether your guess were correct by reference to recent British media coverage. Pseudonymisation is one method as part of anonymisation (for others see the ICO (2012) Code of Practice on Anonymisation). Anonymisation involves more processing beyond pseudonymisation, for example masking, aggregating, and contractual limits to data processing. Such processing to produce anonymous data must comply with data protection law. Processors can therefore only perform anonymisation under contract from the controller(s). Controllers must undertake a risk assessment to manage any high risks to data subjects, such as re-identification and the disclosure of otherwise confidential details, and must also be transparent with data subjects about the processing that is taking place. Guidance on these matters is available from two freely downloadable books: For how to assess anonymisation processes, perhaps as part of your Data Protection Impact Assessment, see the Anonymisation Decision-making Framework written by Mark Elliot and colleagues (2016). A new handbook has also been developed for assessing whether the results of data analysis, such as graphs and tables, are anonymous (Greci et al. 2019). Written by Emily Griffiths Dr. Emily Griffiths specialises in data protection at the intersection of healthcare and research. At The University of Manchester she is part of a team in the Centre for Health Informatics that has achieved ISO 27001 certification, and delivers a suite of training courses in Disclosure Control, Safe Research, and Privacy by Design. Find Emily on LinkedIn.

While not entirely new, the role of DPO has certainly seen a meteoric rise in visibility since being enshrined in the GDPR. What was your path to the position? I have been with Lexmark for fourteen years serving in both Finance and Legal positions. In my role as a customer-facing attorney supporting Enterprise Sales, I became very familiar with Lexmark’s business, how we interact with our customers and vendors, the services we provide, and the systems that support those services. In the process of negotiating complex service and software agreements, I was able to create strong relationships across the business in every department and around the world. The technical side of the business was always of great interest to me and I became very focused on how we were exchanging data with our customers, meeting confidentiality obligations, and solving those complex technical problems for Lexmark and our customers. The combination of this experience with my international background – I spent over eight years prior to my time at Lexmark studying and working abroad, am fluent in French and dabble in several other languages – positioned me well for the role of DPO. For me, it was the unique requirements and challenges of the position that sparked my interest. The combination of business process, legal, and technical issues that we see we see every day make DPO a great job – it is certainly never boring. Many people like yourself come to the DPO role with a legal background. Do you feel it is a requirement to be DPO? Is it a requirement? No. But it is a very helpful background to have, especially at this point in time. Even with the long history of the [Data Protection] Directive behind us, the GDPR is a new and complex piece of legislation and we are just now beginning to see how it is going to operate in the real world; take CNIL and Google for example. Given that the responsibilities of the DPO include advising on compliance with the regulation, supervising the PIA process, and acting as a point of contact with both data subjects and supervisory authorities, a legal background is a strong foundation for a DPO. The ethics training one receives as an attorney lends itself to understanding and helping meet the intent of the GDPR.  As I alluded to earlier, however, the role is a lot more than a traditional ‘lawyer-job’ and the right person for the role at a particular company could certainly come from other disciplines such as privacy, audit, compliance, or contract management. The role is certainly not just a normal compliance role either. To be a truly effective DPO, you have to be an advocate for the concept of privacy. What other skills do you think are valuable to look for in a DPO? Passion for the work and for the opportunity to make valuable changes to your organization are vital - not everyone will believe in what you are doing and there can be some very difficult conversations. Personally, I am genuinely ADHD and my natural propensity to multitask is a benefit to the role of DPO. I have the privilege of working across every business and area across every geography and to be very creative and innovative in our problem solving. There is also (ironically?) a very social / interpersonal component to privacy, given the necessary interactions with business leaders, product owners, customers, employees and regulators. I completely understand and respect those who prefer being the expert on one specific issue or who enjoy staying in a narrow lane, but in my experience that is the antithesis of the DPO role. Lexmark is a U.S.-based company and you are a U.S.-based Global DPO, Lexmark was early in appointing a DPO and seems to be somewhat unique in placing the position in the U.S., can you comment on the decision process? I mentioned the CNIL Google decision; one of the very interesting discussions there revolves around the concept of main establishment and the idea of the one-stop shop mechanism – that decision makes it clear that there is still a long way to go before we have a true understanding or consensus on the way those concepts will be applied. What has always been a certainty, in my opinion, is that to be truly effective the DPO must be located near the decision makers and the decision making. As I mentioned, I was an expat for many years and would move back to Europe in a heartbeat but to represent the best interests of the individuals whose data we collect, externally and internally, and do the best job for Lexmark there was no question that our corporate headquarters in the U.S. is where I needed to be based, at least at the outset. Having said that, I am in constant contact with members of the team around the world and spend as much time on the ground in Europe as possible. I am highly accessible to all parts of the organization. What are the more interesting things you have seen since GDPR became effective? Aside from the specific decisions that have come out, one of the more interesting issues I have seen is in Italy between the Supervisory Authority and the Tax Agency related to the latter’s electronic invoicing requirement.  As of January 1st the eInvoicing obligation, requiring all B2B and B2C invoices to pass through a government portal, became applicable outside of the public sector but the Supervisory Authority issued a decision that indicates the portal and its implementation are not compliant with the GDPR.  The ultimate outcome will be interesting to watch as privacy requirements certainly apply not only in the private sector but to government organizations as well. The other development that we are paying attention to is the DSAR [data subject access request] as a security threat vector. We have already seen a few instances of the DSAR process being used for marketing purposes and a few where we believe the request may have been a form of pretexting. It is potentially very dangerous – not to mention ironic – as Controllers work hard to respond to legitimate requests.  Are their specific practices or accomplishments at your organization that you can share? I am very proud of our awareness program – we have actually been recognized with an industry award for our efforts – it is a good example of the opportunity to be creative within the role. We have a branded program, [email protected] with a mascot in the form of a German shepherd puppy, [email protected], that is on everything we do including laptop stickers, whiteboards around the world, everything. He is the face of the program and has been well received around the world. It is our way of reaching out on a daily basis and keeping our commitment to the program top of mind.                         Privacy by Design is fundamental to any privacy program and our efforts there have been substantial. Lexmark has been able to not only formalize our PbD activity in every one of our development frameworks but we have coupled PbD with our enterprise and product level security offerings to become a true leader in our industry. Switching gears, there seems to be a lot of movement in the US in terms of privacy legislation – what should European or UK based practitioners know or be aware of? There has been a lot of focus on the introduction of new laws at both the state and national level as well as an uptick in visible enforcement actions. The Federal Trade Commission has been involved in large privacy-related settlements with OATH and the social media service directed at children, Musical.ly (now TikTok). States have been active before and after the passing of the California Consumer Privacy Act of 2018 (CCPA); Colorado, New York, New Jersey, Oregon, North Carolina, South Carolina, Massachusetts, and Vermont, to name just a few, have passed or are considering privacy-related laws. It is hard to tell if this will be the year that the U.S. sees a uniform privacy law but there is certainly a lot of movement in that direction. Several draft bills have already been tendered for consideration and there are many other proposals on the table from both the industry and [privacy] advocate side. I have had some involvement in one of those initiatives and there is a lot of attention being paid to both the language of the new California law, the GDPR, and the balance between meaningful protection and operational challenges. Interestingly, I have seen more than one call for the eventual investigation or enforcement levelled at individual corporate officers; Intel’s proposed bill contains the potential for both civil and criminal penalties. Eventually, a new federal privacy law will get passed and it is interesting to watch the development. Hopefully the drama of the CCPA is not repeated.  Possibly, the biggest question to be resolved will be that of preemption, that is, how any new federal law will affect existing state laws and what the interaction will be with federal laws such as COPPA and HIPAA-HITECH. Peter Swire has written an excellent two-part article on the issue which is available on the International Association of Privacy Professionals website,  IAPP.org. Thank you Greg! Greg Anderson is an attorney with over twenty years of experience, Greg is CIPP-E certified and earned his J.D. from the University of Georgia School of Law and a D.E.S.S. in European Competition Law from Université Jean Moulin in Lyon, France. He is fluent in French and conversational in German and Swedish. A life-long SCUBA diver and weekend athlete, Greg spends as much time as possible with his wife, two boys, and their overly-expressive collie, Loki. Find Greg on LinkedIn.

From your experience, what have been the biggest challenges, both as an individual and as a firm, working in the CASS space? How have you dealt with these? When first coming into the CASS space I hit the ground running so to speak as there was such little industry knowledge and documentation available on the subject.  Firms were getting fined by the FSA later the FCA for CASS breaches for millions of pounds.  In addition, after the Lehman’s and Man Global collapse, clients both professional and retail didn’t trust placing their funds into UK based companies. There was a lot of pressure on CF10a’s to make sure that their firms CASS compliance and governance was in line with the rules and FCA expectations or woe betide.  Mercifully those days have now passed although still I hear some scary stories of firms not getting their CASS compliance and governance right from time to time. Interpreting the CASS handbook and how the rules fit into the firms business is what I believe is one of the biggest challenges. The CASS handbook is a ‘one size fits all’ which can be tricky when new rules are applied. I generally implement what I believe is the best solution to ensure CASS compliance then try to find out what the business norm is. Thankfully I haven’t made any errors of judgement. What role does technology have to play in maintaining CASS compliance? CASS compliance is heavily dependent on technology across the board, especially given the level of detail that’s required.  However, it also can hide a magnitude of sins if not monitored closely. My top tip is, if you are looking at full automation, perform ‘checks and balances’ to ensure that all your underlining data ties back. What significance does training and continuous learning and development have to play in maintaining CASS compliance? CASS is not a one person nor team effort but the involvement of a whole firm. From the on-boarding of a client until the discharge of fiduciary duty. CASS training is fundamental for all authorised firms to maintain compliance with the rules. What affect do you think SM&CR will have on the role of the CF10a? There are two schools of thought here given that the FCA has advised that CF10a role should be considered under the certification regime. The first is that it may reduce the importance of the CF10a’ s role by reporting into a Senior Manager and diluting the accountability element, the second is that it may provide the CF10a with more gravitas.  A senior manager allocated with the overall responsibility of CASS is more likely to want to be involved with CASS compliance and the CF10a if they are also accountable. Although I’ve noticed that some firms are moving their CF10a’s into the SMF18 – Overall Responsibility Function. What does the future hold for CASS compliance and the role of a CF10a? I would like to say that the CF10a role will become easier over time but with our ever changing regulatory landscape I don’t really see that happening. New products and business lines are always in development, keeping the CF10a forever on their toes, for example, the firm I’m currently working at is the first UK broker to have CASS segregation up at the Moscow National Clearing Centre. What advice would you give to someone looking to pursue the CF10a pathway? Gain as much operations experience in the financial services industry as you can. Understand all the different financial products and settlement flow.  My background is in both operations and finance which is so valuable when making informed decisions. Thanks Elaine! Elaine is a senior manager who has worked in the financial industry for over 25 years. Elaine has both a finance and operations background, and has been working in the CASS space for seven years - two years at a third party outsource provider and the past five years at Sova Capital Limited, a Russian Brokerage House. Elaine has been CF10a for three years now. Find Elaine on LinkedIn.  

Since 2009 I seem to have been mostly occupied working on various platform projects, from creating new platforms with inevitable FCA applications, to various CASS projects and most lately platform transformation. In many cases the alarming behaviour of some executives borders on the delusional. In at least one case the entire executive team departed from the business, as platform transformation also resulted in total leadership transformation.  Clearly, it is critical to listen to the project managers and people working on the ground to come to a realistic view on what the full extent of the work means in terms of time and resources and then bury some pride and the urge to make ever more ridiculous market statements, in place of a true and purposeful reality check. Experience also matters a great deal. How often have I come to projects where the programme manager is determined to reject suggestions in the most vigorous manner only to be forced into an embarrassing volte-face after many months of wasted effort? In the end it's a simple matter of chipping away and realising that common sense will prevail as the dead end is finally reached and a brick wall comes slamming into view. Of course, learning comes from experience and we all pick things up along the way, especially when making a mistake. However, sometimes those mistakes have unintended consequences and so the project trundles on infinitum. The other challenge often comes from so-called 'out-of-the-box' solutions.  Adopt not adapt is the mantra but then the team goes about changing everything and also finding that 'out-of-the-box' is not quite as it seems and other regulatory and legal change and interpretation, requires extensive adaption or even the dreaded 'change requests'. The inevitable de-scoping and phased approach usually overtakes and 'big bang' goes out of the window. In the meantime the costs rise as expensive project managers and other contractors have to be retained for longer than originally planned, with some essential staff leaving prematurely, which leads to more delays. In the end the transformation is complete. If it takes longer and causes less disruption then that is better for the adviser and end consumer. If it launches at risk then we all know the consequences and lack of confidence, which ensues. Whether it was all worth it is a matter of debate and had the cost and timescale been known at the outset it is possible the whole thing would never have been started in the first place. It is important to have experienced project management, which will inevitably have to be brought in. Internal project management is usually woeful. Listen to the experts and create a realistic plan then decide based on the facts. Allow for contingencies and expect changes, as every platform is different and not everything will come off the shelf.  Be prepared to compromise and adapt. For the wider market it is better to launch successfully and late, than to go early and risk disaster. Written by Anthony Smith Anthony Smith is a Fellow of the Chartered Insurance Institute (FCII), Associate of the Personal Finance Society (APFS), and Chartered Insurance Practitioner Anthony has extensive experience working with many leading financial services firms from investment firms to life and pensions, mortgages and general insurance, and he is the Director of AJS Consultancy Services.  He has worked with a number of firms setting up new investment companies and with leading platform providers to ensure compliant CASS processes including changing a bank into a pure investment firm with client money.  Anthony has led a number of Part IV applications for platform providers and developed platform strategies for RDR and direct to customer propositions, as well as acting as interim head of risk and compliance.  He has also worked with the offshore industry in Dublin and on many strategic compliance projects. Anthony has also developed a number of Risk and Compliance Solutions with Mettis based in Cape Town, south Africa. To find out more about AJS Consultancy Services click here, or find Anthony on LinkedIn.

Could you tell us about your background and journey to becoming a Head of Compliance? My background is in retail banking and financial services, initially in operational roles and latterly moving to compliance. Several of my operational roles, particularly at managerial level, had compliance or quality management responsibilities which led to an interest in taking this interest to the next level. How do you define the value that a risk and compliance manager brings to their organisation? A risk and compliance manager can bring an independent point of view to a project or the overall business. You can see the value or benefit that a project or process looks to deliver for the business and layer risk management and compliance requirements on top to try to deliver the best solution that meets the business needs. How would you define the current state of risk management and compliance? The importance of the risk management and compliance function is ever growing. Regulators are increasingly putting the onus on businesses to be self-policing with significant consequences both at business and individual level for failure to implement adequate systems and controls. What are the main challenges that you face as a Head of Compliance within the consumer credit space? Pace of change, growing influence of technology resulting in new, innovative products and services, and globalisation of the market. These challenges are interconnected. Consumers have changed the way they wish to engage with their financial services providers and the products they use, as evidenced in the scale of bank branch closures due to reduced footfall. Financial service providers have recognised the need to innovate and leverage the benefits of technology to help drive results, increase customer satisfaction, and manage costs. All of these changes when combined demand that regulatory requirements are regularly reviewed and revised to ensure they remain relevant and fit for purpose. Do you think there a defined set of skills or attributes that make for a successful modern risk and compliance manager? Yes, the modern risk and compliance manager must be a business enabler that engages openly with the business to find suitable solutions and encourages collaboration from colleagues. How do you ensure that you stay up to date with the latest regulatory and/or technological developments? This one is definitely a challenge as there is no simple solution. A broad range of activities and resources are important, such as alerts on relevant topics (lexology.com is a good source), notifications from some of the larger corporate firms and the ICA, regular review of regulator websites, and attendance at industry seminars. It is important to make time in your busy schedule to try to keep up-to-date and to consider the impact of developments for your firm. What do you think new risk managers would be most surprised to find out about the role of a Head of Compliance? The range of questions you can be asked keeps the job interesting and challenging. In a smaller business the risk and compliance function should operate across the whole business so in any day you could be considering questions or issues in IT, Operations, Marketing, etc. What are your priorities as a Head of Compliance? To support the business to achieve its objectives whilst ensuring risks are considered and managed and compliance is endemic in the processes. In what ways have you seen the role of a risk and compliance manager change over the last 10 years, and how much has regulation played a role in this? In the past the risk and compliance manager was seen as the person who told you what you couldn’t do or got involved when things went wrong whereas now they are much more engaged in business processes and seen as a resource to help the business strive to get it right from the outset. What are your main concerns for the future? That regulators continue to strike a balance between allowing business and enterprise to flourish whilst recognising the requirement for regulation and protection for consumers and other stakeholders. How do you see the role of a risk and compliance manager evolving from here? The role of the risk and compliance manager will continue to grow as a key business hire, someone who can support a business to build its reputation as an ethical operator and in turn contribute to the profitable trading of the business. Are there any other interesting perspectives you’d like to add? I hope people continue to see risk and compliance as a career choice where they can positively influence business results. A background in other business disciplines will help your perspective to consider the task at hand and guide the business to the right outcome. Thank you George! George McNaughton is a compliance professional with over 25 years experience in the financial sectors, having held a number of management positions in operational and compliance roles across a wide range of retail lending products. George recently joined Sharein Ltd as Head of Compliance and is based in Edinburgh. Find George on LinkedIn.

Risk is every Information Security professional’s friend. A properly executed and documented Risk Assessment provides the basis for your company’s Information security framework, its continuous improvement and all your projects where Data Protection is key. Risk Assessments, (from all areas of the business where security and Data are vulnerable), should feed your Risk Treatment Plan (RTR) and you should be reviewing your RTR at least once per month. Whether you are a ‘standalone’ manager or have a security team, the process of risk treatment must be embedded into your daily practices and you must strive to embed the need for Risk Analysis into the very being of your project managers. This is easier said than done of course. What Project teams and Board-level Execs don’t like, is being told that they cannot do something because of the Risk. I’ve lost count of the number of whisperings I’ve overhead along the lines of “Don’t tell Security because they’ll just say No!” If you hear this then panic because something bad may be about to happen! My approach is always to say “Yes, of course you can use a free, unencrypted, on-line mail transfer system to send confidential information to a third party with whom we have no contract or NDA in place” And just as the Project Lead skips away with a happy smile I call them back with a “But let me carry out a Risk Assessment so we can see if the data being transferred is vulnerable to theft and what the impact on the business might be if that happened?” It always works. You haven’t said “No, absolutely not” and although the Project lead may eye you with hesitant suspicion they can see you may have a point. Once you have clearly shown that sending Confidential Data using an unencrypted third-party application sitting on a server in the Ukraine comes with a very high probability of data theft, then hopefully the Project Lead will ask your advice on a more secure solution. The golden rule here is never accept responsibility for the data. Despite the bleatings of “But you said it was okay”, your response must be to explain that you are not the Data Owner. You are there to advise what is secure and what is not. Should the Data Owner agree to use a free and insecure system then that is fine. You have calculated the risk, advised of the impact and duly noted this in your Risk Management documentation. Of course the Exec won’t know any of this until the brown stuff hits the fan and the first blood they’ll be calling for is yours. They are rarely interested in Risk Calculation, probability, threat and impact. They are interested in making a profit and Security is a drain on profit because the Exec can see no ‘Return On Investment’. So what you must do is to take your Risk Calculation and convert that into something the Exec will understand. Profit and Loss. This, for many Information Security Professionals, will not be an easy task. This is where identifying Key Stakeholders when you first joined the company comes into play. Engage with the Finance Manager, Head of IT, CIO, CISO etc; whomever you need to help you calculate the real cost of a data breach or DDoS attack or whatever the identified project vulnerabilities are. Telling the Execs that there is a high risk of data loss will drift over their heads like a ‘Wil-o-the-wisp’ but tell them that a data breach could cost upwards of £2000 per data subject in non-material claims plus a fine of 4% GDP from the ICO, loss of Reputation and loss of business will normally make them sit up and take notice. You then show them that by investing a small amount in, for example, a  secure data transfer system then they will be leading the way, securing customer’s data, improving their market standing and increasing revenue stream. Written by Andrew Denley With more than thirty years’ experience in technology, Andrew has worked in a variety of industries including Maritime, Research & Development, Central Government, Business and Consultancy. Trained as a Maritime Electronics and Radio engineer he has diversified as Information Technology has advanced and has spent the last ten years specialising in Information Security and Data Protection. He is a qualified Risk Practitioner, GDPR Practitioner and ISO27001 Lead Auditor and has considerable experience in CLAS-related Security, Cyber-Essentials and NIST Information Security. He has co-written a technical guide to GDPR aimed at the non-European market which is due to be published in late 2018. Andrew has co-written the recently published GDPR: How To Achieve and Maintain Compliance. Find Andrew on LinkedIn.

So, as we all know, on March 29, 2019, the UK might leave the European Union. For British residents who have lived their whole life in the European Union and take many situations for granted, it’s probably hard to imagine what it means to be part of a "third" country outside multiple European legal frameworks. To think that suddenly planes could stop landing in the UK due to the lack of legislation, or that British citizens might need a visa to travel to the European Union, or that trucks with goods could queue at customs for 5 days. As a person with Russian roots, who spent the childhood in the Soviet Union without the opportunity to go abroad at all, I remember such situations, and many of them still occur in third countries. As a result I can easily predict any worst case scenarios. But let's focus on the personal data and privacy issues: One of the things that was a part of the common set of rules of the European Union is that personal information was able to flow freely between organisations in the UK and European Union without any specific commitments. That’s because we have had a common set of rules - the GDPR. But this two-way free flow of personal information will no longer be the case after the UK leaves the EU. It is particularly relevant to UK businesses and organisations which: - operate in the European Economic Area (EEA), which includes the EU; or - send personal data outside the UK; or - receive personal data from the EEA. The Government has already made clear its intention to permit data to flow from the UK to EU countries. But transfers of personal information from the EU to the UK will be affected and the EU institutions will now have to decide whether they consider United Kingdom to be a country with adequate personal data protection (see Fig. 1). Figure 1 Depending on how the UK and the EU implement the withdrawal, there might be several scenarios: 1. Scenario (1) “Transition  Period”: The UK and EU preliminarily agree that from March 30, 2019 until December 31, 2020, there will be a Transition Period during which EU law, including EU data protection law, and the European Commission’s decision on the adequacy of the protection provided by the United Kingdom will continue to apply. Also, during the Transition Period, the United States will consider a Privacy Shield participant’s commitments to comply with the Framework to include personal data received from the UK in reliance on Privacy Shield with no additional action on the part of a participant required. This means, UK businesses will not need to follow the steps described in the Scenario 2 until December 31, 2020 and probably all the legal gaps in data protection legislation arising from the Brexit will be covered by December 31, 2020. 2. Scenario (2) “No Transition Period” or "No deal Brexit scenario": In the event that the UK and the EU do not finalise an agreement on the Transition Period, each UK business must take the steps below by March 29, 2019.   2.1 Review your data flows and identify where you receive data from the EU or whether you are sending any data to the United States. This includes your suppliers, processors, customers, contractors, employees and any software tools you are using. 2.2 If you only operate within the UK and with individuals in the UK. You may not need to do much to prepare for data protection after we leave the EU. 2.3 If your company is based in the UK, and not in any other EU state, but you offer goods or services to individuals in the EU, or you monitor the behaviour of individuals located in the EU, then you will need to comply with the EU regime.  Example: A marketing company established in the UK provides advice on retail layout to a shopping centre in France, based on an analysis of customers’ movements throughout the centre collected through Wi-Fi tracking. The analysis of a customers’ movements within the centre through Wi-Fi tracking will amount to the monitoring of individuals’ behaviour. In this case, the data subjects’ behaviour takes place in the Union since the shopping centre is located in France. The marketing company based in UK is the data controller. In such cases, to comply with the EU regime and GDPR you will need to do 2 things: 2.3.1 You will need to do appoint a suitable Representative in the EEA under article 27 of the GDPR: The EU Representative will act as your local representative with individuals and data protection authorities in the EU. This is separate from your DPO obligations, and your representative cannot be your DPO or one of your processors. You do not need to appoint a representative if you are a public authority, or if your processing is only occasional, low-risk, and does not involve special category or criminal offence data on a large scale. The EDPB (European Data Protection Board) confirms that the criterion for the establishment of the representative in the Union is the location of data subjects whose personal data are being processed. The place of processing where most of the data subjects are located is the relevant factor for determining the location of the establishment of the representative. Therefore, if you have customers, suppliers, contractors in the EU, or offer marketing or any analytic services about individuals located in the EU, this will be the case. 2.3.2 Appropriate safeguards: Currently there are several countries, territories or sectors about which the European Commission has already made an adequacy decision. This means personal data can be transferred and processed under such decision without any additional security or legal requirements. This includes: Andorra, Argentina, Canada (commercial organisations only), Faroe Islands, Guernsey, Isle of Man, Israel, Jersey, New Zealand, Switzerland, Uruguay or USA (under Privacy Shield only) If there is no adequacy decision made by the EU commission about UK by March 29th, and until such a decision is made, the UK will be considered a "not safe" country for the European Union. During this period, until the adequacy decision is made, you should consider putting in place one of the appropriate safeguards to cover the restricted transfer under articles 44 and 46 GDPR in order to be able to receive personal data from European Union and remain compliant. Often a relatively simple way to provide an appropriate safeguard for a data transfer outside the EU is to enter into standard contractual clauses between the sender (EU organisation) and receiver of personal data (UK organisation). The UK Information Commissioner's Office published an interactive tool to help you decide: if you need to use standard contractual clauses for transfers from the EU to the UK, available here: https://ico.org.uk/for-organisations/data-protection-and-brexit/standard-contractual-clauses-for-transfers-from-the-eea-to-the-uk-interactive-tool/ And also template contracts: Controller to controller: https://ico.org.uk/media/2553982/ico-guidance-controller-to-controller.docx Controller to processor: https://ico.org.uk/media/2553983/ico-guidance-controller-to-processor.docx Multinational corporate groups can also consider their use of existing EU approved binding corporate rules to make transfers into and out of the UK. Some of the derogations for specific situations under article 49 GDPR for the transfers of personal data to a third country (from EU to UK) are the following: - the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards; - the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject's request; - the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person; - the transfer is necessary for the establishment, exercise or defence of legal claims; 2.4 Brexit and the EU-US Privacy Shield framework Those UK organisations transferring data to the US under EU-US Privacy Shield framework will be required to adhere to the following: Public commitments (external privacy statements, Data Processing Agreements and other data protection related documents) must state specifically that the commitment extends to personal data received from the UK in reliance on Privacy Shield.  If an organisation plans to receive Human Resources (HR) data from the UK in reliance on Privacy Shield, it must also update its HR privacy policy. Model language for these updates is provided below: "[Your organisation name] complies with the [T EU-U.S. Privacy Shield Framework] [and the Swiss-U.S. Privacy Shield Framework] as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the [European Union and the United Kingdom and/or Switzerland, as applicable] to the United States in reliance on Privacy Shield.  [Your organization name] has certified to the Department of Commerce that it adheres to the Privacy Shield Principles with respect to such information.  If there is any conflict between the terms in this privacy policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern.  To learn more about the Privacy Shield program, and to view our certification, please visit https://www.privacyshield.gov/." An organisation that does not modify its privacy commitment documents as listed above will not be able to rely on the Privacy Shield Framework to receive personal data from the United Kingdom after the Applicable Date (either March 29, 2019 if there is no Transition Period or December 31, 2020, at the end of the Transition Period), see Fig.2. Figure 2 Written by Elena Riazanova, CIPP/E Elena is a Data Privacy certified specialist and Certified Information Privacy Professional for Europe (CIPP/E) by IAPP. She has gained practical experience of UK, European and worldwide data protection and cookie regulation and laws of France, Germany, Netherlands, Italy and Poland, including UK Data Protection Act 2018, PECR, GDPR, Asia-Pacific Economic Cooperation (APEC) Cross Border Privacy Rules System, California Consumer Privacy Act, Privacy Shield framework, Lawful Business Practice Regulations, Federal Law 152 of Russian Federation) and Payment Card Industry Data Security Standard (PCI). Elena is the founder of the Quick GDPR tool for SMB, which offers vulnerability scans for websites and creates privacy policies, and has been the external Data Protection Officer for several US and UK based companies since 2017 across different industries. Elena can be contacted via [email protected] if you are looking for additional consultancy or want to appoint an EU rep in France, Spain, Germany or Ireland. Find out more about the Quick GDPR tool here.  

Risk Appetite provides management with a view of the level and type of risk that the entity is willing to take, and the risks that the entity will pursue. Missing from the IIA’s (and others) assessment of risk is the Target Risk level. This represents the level of risk acceptable for any individual risk based on the Risk Appetite of the entity. The delta between Inherent Risk and Residual Risk measures only the current assessed level of control or risk. It does not provide a link to what is the acceptable level of risk (and control) for the entity.  This means that Internal Audit could, in theory, report that the entity is well controlled as the Residual Risk level is accurately stated and the controls to enable that level of Residual Risk are functioning effectively.  Equally, in theory, the Residual Risk level could actually be fully in-line with the Risk Appetite, and in such a case there would be no Internal Audit findings other than “(Auditable area) appears to be well controlled with the current Residual Risk being within the Risk Appetite”. I do say “in theory” because I have only seen one Internal Audit report in the past 35 years that did not contain findings and recommendations, even when reporting that the audited area is effectively controlled. Internal Auditors simply, almost pathologically, count the number of findings, and too few findings are seen (by the Internal Auditors) to indicate a poorly performed or ineffective Internal Auditor. For a candid discussion of the “7 deadly Internal Audit sins” I would only point you to the video from Richard Chambers, IIA President and CEO. The concept limiting risk to Inherent and Residual is sound – IF that remediation reduces risk to within Risk Appetite. The reality is that Inherent and Residual Risk scores do not cater for the situation in which the level of residual risk is inconsistent with the entity’s Risk Appetite. This is left to Internal Auditor to attempt to determine what the control environment should include to bring it within the Risk Appetite, sometimes in the absence of a defined Risk Appetite. In this case, we need to know what the Target Risk score is, in terms of the Risk Appetite. The most important delta then is between the Residual Risk level and the Target Risk level, not between Inherent and Residual. Of course there is the common problem that many (most?) entities do not have a well-defined Risk Appetite, and therefore it is almost impossible to confirm that a Residual Risk position actually is within the Risk Appetite. This make development and communication of the Risk Appetite a critical step for an entity in its journey to becoming “well controlled”. Therefore, as the Risk Appetite frequently is either non-existent or not well communicated and understood, the probability is that the Residual Risk position will not be in line with what would be the Risk Appetite. What is needed then is to determine what management considers the “Target” risk position should be for any risk, thus creating the de-facto Risk Appetite at that particular risk level. Then, with a Target Risk score, it is possible to clearly communicate the difference between the Residual and the Target. That difference is the Internal Audit finding, and can be used to demonstrate the need for improved or additional controls, or can be used to demonstrate that existing control are not operating effectively. In an ideal world the entity will have a defined Risk Appetite statement, or Target risks scores for each identified risk, therefore having a de-facto Risk Appetite at the risk level. And in such an entity, all Internal Audit findings and recommendations should demonstrate how those recommendation will enable achievement of the Target, and therefore Risk Appetite. This will also allow management to petition an adequately senior authority to “accept” the risk or authorise resources to plug the gap.  Such “acceptance” should of course be in line with the Delegations of Risk Acceptance, but that is a topic of a different article. Written by Daniel Roberts This article originally appeared here and has been reproduced with permission. Daniel has over 30 years experience in Risk Management, Internal Audit and Innovation, Information Systems Audit, Information Technology, Consulting in E&E, Corporate Governance and XBRL. Daniel has worked in North America, New Zealand and the UK, and has undertaken assignments in Australia, Ireland, Malaysia, Thailand, UAE and France, and has been an FCA Approved Person. Daniel is the founder of Governance and Risk Management Services international, a boutique consultancy who deliver a range of Governance, Risk and Internal Audit consulting and XBRL services. Find Daniel on LinkedIn, find out more about GRMSi or read more of his articles here.  

In your experience, how effective are financial firms at communicating Risk beyond the Risk function? In relation to metric information, generally good. Heatmaps and dashboards tend to get decent exposure at senior governance forums, such as Risk Committee and Boards, however rarely do you see the same information filter down to the operating level, which nine times out of ten are the people who provided the data in the first place and have it within their gift to improve the control or process that may not be effective Where do you see the responsibility for communicating information relating to Risk sitting within an organisation? The tone must be set from the Board - if the Board put the Risk agenda and Culture at the forefront of operational activity, then it becomes much easier for the 2nd line Risk teams to provide information that can add value to the 1st line. The key then, is to ensure you engage with the 1st line in the right way and build collaborative relationships that help improve the control environment so that communicating Risk becomes a two-way street. If engaged, and given the correct training, the 1st line will always identify risks, control improvements and process enhancements before the 2nd line Risk Team. How do you think Risk functions are viewed within financial firms, and does this affect their ability to communicate effectively? The value 2nd line functions actually add has been a discussion bouncing around since time began. It’s up to risk functions to prove value. If you only see your Risk functions at formal committees, or meetings with perfect RAG rated slide decks pointing out failings or receiving an email five minutes after risk event/incident has occurred asking for war and peace before the dust has even settled, then you are never going to be viewed positively. The biggest part of Risk Management in my eyes is relationship management, building trust with knowledge gained, spending time with SME’s, and having a decent understanding of how the firm operates. If you can do that, you tend to be called a minute after an event/incident occurs to be part of the remediation from an oversight perspective that can guide the business through good quality corrective actions for the immediate issue and the bigger picture objective of reducing Risk over the longer-term. It also means within the formal committees, or meetings, you are more likely to hear “We have been working with the Risk team/1st line and have created a solution" or "have improved such and such". How can firms ensure that all employees receive the Risk training they need in order to be able to sense and respond to threats, are aware of where accountability lies and know where their responsibilities fit within the risk framework? Inherently, every member of staff is a Risk Manager - the key is having a simple, clear and prominent Enterprise Risk Management Framework that can be understood to tap into that person’s logic. Add Risk training to the mandatory training suite, make sure the Risk team presents at new starter inductions, and ensure the core objectives of the department and individual are intertwined with the firms' Risk Appetite. How you can ensure that middle and front-line staff are aware of an organisation’s risk management goals? The Risk Management goals must be linked directly to the firm’s strategy, inclusive of the commercial elements. Risk in its purest form is “the chance of something happening that will have an impact on objectives”. Linking Risk Appetite to the firm's strategic goals will help raise awareness of the risk agenda, and if understood will ensure risk discussions become part of management decisions, rather than an argument about whether the risk is Green, Amber or Red! When new risks are identified, how would you advise an organisation shares this information across the business? Whether new risks are identified from a strategic level, or bottom up approach, the key is having a consistent enterprise framework with consistent taxonomies, and scoring mechanises. This is where the Risk function can really add value with ensuring one department mole hill isn’t another’s mountain and can take a measured view of the risk and escalate to different areas as required. If you could share one tactic for risk leaders to employ in order to better communicate risk issues, what would that be? Relationship Management. Risk function members should spend time learning the SME processes and issues throughout the year, not just when a RCSA cycle of event/incident has occurred. If a relationship is in place during the good times, it much easier to talk during the bad times. What are your thoughts on technology as an enabler for effectively communicating Risk within an organisation? Well implemented Risk systems can add much value and automation to Risk Management objectives, however it only really works if the 1st line own the input and the 2nd line are the custodians of the data and set the parameters within which data can be entered in line with polices and Risk Appetite. If it’s a tool simply used by the 2nd line, you may as well stick to the spreadsheets! Thank you Martyn! Martyn is an experienced, commercially minded risk professional who has worked across a range of financial services organisations including Alternative Finance, P2P, stockbroking, advisory, wealth management and pensions. Martyn currently works for Wellesley, an established alternative property investment platform, that issues Bond investments to the UK retail market. Find Martyn on LinkedIn or find out more about Wellesley.  

For the Information Security professional and Project Manager, Risk is our friend. Calculated by multiplying the Likelihood of and event by the Impact of that event we will have a numerical value that we can use to drive the strategic direction of a Security framework or Project. But before we make the simple calculation we must evaluate the other factors that will ultimately affect our report to the Board or Project Team. In the world of Information Security we must, (as a minimum), consider: Threat, Threat Actors, Vulnerability, Intent and Capability. In the world or Projects we must, (in addition), consider: Cost, Resource and Supply Chain. Threat: What might attack our network or project? Threat Actor: Where is the Threat coming from? An individual, a rival, a criminal? Vulnerability: How vulnerable to attack is our network? How vulnerable is our project from other projects or uncontrolled circumstances? Intent: What do I believe the Intent to attack my network to be? Is my network a target? Capability: Is the threat actor capable of attacking my network? Cost: Do I have sufficient budget to run the Project to full completion given these other factors? Resource: Do I have sufficient resource to manage the Project? Supply Chain: How reliable are my suppliers? If we have an established IT Network then very often our biggest threat is likely to be Internal. It is rare indeed to assess an established network architecture where there are no Firewalls, Anti-Virus, IDS or IPS nor procedures or policies to guide employees in good security. Unless our business is in the financial sector, Public Services, Industrial, Research or Charitable, then statistics show that the threat of a targeted cyber-attack is slim. We are much more likely to fall victim to opportunistic attack along the lines of a Virus or Ransomware attack and these attacks are only successful because of the employees. Our employees are always the weakest link. They are not, (normally), malicious but they may be stressed and don’t think what they are doing. Employees who have been with a company for a long time are far more likely to facilitate an attack because they have become complacent – “We’ve always done it this way!” – and is also known as ‘Normalisation of Deviance’ whereby incorrect actions are taken over a long period but because nothing bad ever happens, those actions become the norm and which is why, very often, risk remediation is simply User Training. So when we start our Risk Assessment we must take time to think about all these elements and evaluate each one separately to ensure that our assessment is both appropriate and accurate. We start, therefore, with each identified asset. For example a new Website and we adopt a methodical approach. We ask questions along the lines of: Is the Website vulnerable to external threat and/or internal threat? If a cyber-attack is launched against the site, will it withstand the common attack vectors, e.g. cross-site scripting or SQL Injection? Once we have, (hopefully), established the threat and vulnerability. Next we look at the Likelihood of attack. Is the business a target? Is the business susceptible to opportunistic attack? Has the business been attacked before? Will the Website be on the open web or the deep web (i.e. listed or not listed on search engines – don’t confuse this with the Dark Net)? Next we look at the Impact of a successful compromise of our Website: If the site were to be compromised, does it allow access to internal databases? If data is stolen, what would be the impact on the business, (reputation, customers, financial penalty, compensation, legal challenge etc.)? If the site were to become unusable (e.g. subjected to a DDOS attack will the business be adversely affected? So now we have evaluated the Likelihood of attack taking into consideration the possible threats and the vulnerabilities to those threats and the impact should the attack and compromise be successful. Thus the calculated Risk Score will be accurate based on available knowledge. If the Risk Score falls within the business or project Risk Appetite, (that is the level of Risk that can be accepted without any further action), then we’re good to go. If, however, the Risk Score is higher than the Risk Appetite then we must mitigate the Identified Risk with remedial action. The Information Security professional has four primary Mitigations at their disposal: Reduce Accept Remove Transfer The simplest way to remove a risk is to stop the project. But this is rarely acceptable unless other actions are just financially unviable. We can accept the risk and often this is an agreed mitigation as the business benefit may still outweigh the risk. Transferring the risk may be expensive but for some areas of technology can be very beneficial as it effectively removes the risk from the parent company and becomes part of the Risk Management for a dedicated company. For example, off-site hosting and management, in the case of a website. This leaves us with the most common mitigation of reducing the risk. To achieve this we can try and make our website less vulnerable to attack thus reducing the likelihood of a successful compromise. Once we have decided on the appropriate mitigation then we then put in place the remedial controls to affect that mitigation, for example: If the Website leads to a database we could improve the security controls behind the site thus further reducing the likelihood of a compromise or even the Impact if for example, the attacker is unable to access any data. When all our assets have been assessed and all remedial action, appropriate to the mitigation, has taken place then we recalculate our Risk score using the revised figures we have applied to the Likelihood and Impact. This final score is the Residual Risk and this is the value that is tracked as part of our overall Risk Management strategy. Written by Andrew Denley With more than thirty years’ experience in technology, Andrew has worked in a variety of industries including Maritime, Research & Development, Central Government, Business and Consultancy. Trained as a Maritime Electronics and Radio engineer he has diversified as Information Technology has advanced and has spent the last ten years specialising in Information Security and Data Protection. He is a qualified Risk Practitioner, GDPR Practitioner and ISO27001 Lead Auditor and has considerable experience in CLAS-related Security, Cyber-Essentials and NIST Information Security. He has co-written a technical guide to GDPR aimed at the non-European market which is due to be published in late 2018. Find Andrew on LinkedIn.

As the UK's leading risk recruiter, FourthLine are in an excellent position to observe hiring activity and movement of professionals across the risk market. Consequently, we've published the first in our new series of Influential Movers Reports. Within the report, we’ve compiled some of the key hires and moves of risk professionals between January and September 2018, alongside unique market insights and commentary across some of our key areas of expertise, including: Information Risk Financial Services Regulatory Risk Retail Regulatory Risk Risk Management CASS and Regulatory Reporting To view the report click here. If you’d like to find out more about any of the points covered within the report or discuss your recruitment requirements, get in touch.  

The first question I’m often asked is ‘what is a SIPP?’ Created in the late 80s the first SIPPs were introduced by life companies and I worked with Sun Life on SSASs when they introduced one of the first SIPPs. A simple extension from a single provider’s insured funds to one that included unit trusts from a wider range of fund houses. In answer to the question SIPPs were an extension from a single provider to one that enabled investment in a wider asset universe. In the 1980s this was aimed at the new shareholding generation and the property boom. It was not until 1990 that James Hay introduced what was known as a so-called ‘true SIPP’ which included commercial property. Still operated through a life company it was followed by many small independent providers some of whom fell into difficulties and fraud leading eventually to the regulation of personal pension schemes in 2007 by the FSA.  As we fast forward almost 30 years the nature of a SIPP fits very well on a platform which is designed to provide investments of multiple product providers in one place. However, like many of the smaller providers some of these platforms made the mistake of not keeping an eye on the asset universe and allowed non-standard assets that turned sour and have led to SIPP companies closing down or being taken over and merged together.  It is worth reading the RPPD which is based on a TCF paper from 2007 when SIPPs were first regulated and requires product providers and distributors to ensure the fair treatment of customers in every part of the distribution chain. SIPP providers would have been wise to have heeded this advice as should platform operators when providing a wider asset universe to retail clients. Having worked on launching a number of new life company sponsored platforms it has been my advice to utilise the life company to operate the SIPP. If the life company is to remain open to new business, then it makes sense to use it as the life company usually has all the relevant permissions to operate a personal pension plan. Not only that but insurance business is exempt from VAT and therefore none of the administration of the SIPP will be subject to VAT and in-house models can also be provided without charging VAT. In addition, the capital requirements for producing new business are generally better and past losses can be offset against the costs of setting up the product; in the case of a new platform that can mean most of the platform set-up costs are offset against tax. Of course, most platforms and SIPP providers do not have the benefit of piggy backing onto a useful life company, so an investment SIPP must be set up using investment permissions through an IFPRU firm. Stand-alone SIPPs have their own lower capital requirements, which are now subject to additions for non-standard assets. The key ingredient is to have experienced pension staff even if the business is outsourced to an experienced administration firm. Another challenge that often comes up is the question of compensation if something goes wrong.  With a SIPP the compensation limits generally rest on the scheme relevant to the underlying assets. Even for life companies the FSCS website suggests that claims can be made based on the underlying assets e.g. the depositor’s protection scheme for bank accounts. However, a life insurer is not an eligible claimant and assets are linked to a policy of insurance but the FSCS seem to be comfortable that provided you can see through to the underlying member of the scheme then the trustee of the personal pension scheme can make a claim on member’s behalf despite the apparent contradiction in the rules. Last but not least legal advice is generally inevitable as the scheme is likely to need a trust deed and scheme rules that need to be water tight along with suitable terms and conditions. All of which the FCA is likely to require before granting permission to operate. Written by Anthony Smith Anthony Smith is a Fellow of the Chartered Insurance Institute (FCII), Associate of the Personal Finance Society (APFS), and Chartered Insurance Practitioner Anthony has extensive experience working with many leading financial services firms from investment firms to life and pensions, mortgages and general insurance, and he is the Director of AJS Consultancy Services.  He has worked with a number of firms setting up new investment companies and with leading platform providers to ensure compliant CASS processes including changing a bank into a pure investment firm with client money.  Anthony has led a number of Part IV applications for platform providers and developed platform strategies for RDR and direct to customer propositions, as well as acting as interim head of risk and compliance.  He has also worked with the offshore industry in Dublin and on many strategic compliance projects. Anthony has also developed a number of Risk and Compliance Solutions with Mettis based in Cape Town, south Africa. To find out more about AJS Consultancy Services click here, or find Anthony on LinkedIn.

Could you tell us about yourself and your journey to becoming Risk & Compliance Director at the Money Shop? I started in financial services immediately after university, when I joined the graduate scheme of a big bank. A feature of my time with RBS was the wide exposure to a lot of different roles, from operations, project management through to internal communications and front line retail branch management. Experiences from this time live with me right through to the present day. I started to specialise in risk and compliance during the course of my time with Welcome Financial Services. We had a particular challenge at Welcome that required a significant restructuring of the business, and I was responsible for leading the PPI work between Welcome and the Financial Services Compensation Scheme (FSCS). I joined the Money Shop in 2014 at the height of the regulatory scrutiny of the high-cost, short term credit industry. I remember being asked by Welcome’s CEO why I was “jumping out of the frying pan into the fire” and it was been the most rewarding and stretching part of my career so far. For the last 10 years, I have worked in what could be called “regulatory distressed” firms in a regulatory role. The principal challenge has been the lack of a playbook – each regulatory or conduct issue is new, and presents its own set of questions to a team. But often a challenge can become an opportunity; the absence of a defined playbook means that you have a licence to try new approaches. Lots of regulatory scrutiny means that you get lots of feedback, which means you can learn very quickly if you are open minded. I tend not to think about success or failure; instead, I create a hypothesis and test the assumptions that underpin that theory – either way, progress is made because you learn whether your assumptions are true or false. What do you think are the top qualities that make for a successful leader within the risk and compliance space? In most business-specialist roles (from Finance, IT and Risk & Compliance), you start off needing strong technical skills. To an extent, these remain valuable – it means that you can add value to your team’s life by helping them achieve their goals, and it’s the first step on the road to respect and trust. I regard myself as a business leader, who happens to specialise in risk and compliance. A business exists to turn a profit. Any risk and compliance lead must see their role in this light. Position the disciple in this way; good business people are always managing their risks – the technical tools we bring to the table help people do their jobs more effectively. Really understanding how the role helps the business achieve its goals creates the gravitas and credibility you need to achieve your goals. How do you overcome the challenges of managing large teams across different disciplines and regions? What we regard as “work” would be (to someone like Aristotle) indistinguishable from “play” insofar as most of our output is words whether in written or oral transmission (I find it difficult to explain to my children what I do for a job!). A great deal of words are used before any action is taken, such as writing IT code, or launching a new product in the market. So the challenge in leading a large, multi-geographic, multi-disciplinary team can be described as influencing all the conversations taking place through the thousands of different emails, meetings and conversations. There are some themes that I consistently use – Give people a forum for these conversations to take place and thereby give them a purpose. I see project governance fulfilling this role. I have invented a number of spurious workstreams for no other reason than giving a group of people that forum for these conversations to take place. It brings a focus to the conversations that would happen anyway. Consistency of message. I strongly believe in narrative. Each project is a story, with a start, middle and an ending. The easy parts of the narrative are the start and finish. The middle is the longest and often where the game is won or lost. A narrative that divides the middle into chapters is vital, and the message remains constant during that chapter. When you then change your key messages, you are signalling that you have turned the page to a new chapter, and a sense of progress and momentum is maintained. Read the tempo – in an ideal world, the project board or steering group should act as the heart beat for the endeavour. The project board will suck in update and information, and then pump back out direction, and new actions and tasks. Sometimes, it’s necessary to maintain a steady, relaxed rhythm. Other times, there’s a need to up the tempo and create urgency and intensity. If you can get the timing right, great results can be achieved. In summary, I visualise a large team as a river busily running its course, tumultuous and rapid. How best to manage the river? It’s mostly with subtle adjustments that influence its course – the placing of a boulder here creating a diversion that relieves some pressure, or shoring up the banks over there that prevent some flooding. Every now and again, drastic measures are required like building a dam, but such drastic measures are costly, in time, money and emotion. Be aware of the price of such moves. A river takes a different form depending upon location. It can be deep and slow moving in one region and then shallow and fast flowing in another. Over the course of time, I find that team can change a great deal. In one significant project, in the early days when we were thinking through our plans, and defining the solution statements, the art was to harness the creativity, which we did by organising a governance structure that was heavy on meetings – allowing the ideas to be documented, shared and developed. Eight months later in that same project, when we were in the delivery phase, we actually cancelled all meetings and said “just go and get stuff done”. Naturally, some meetings still took place (meetings being like cockroaches) but the key message was that the time for conversation was over and activity was prioritised. How do you ensure through your leadership that your team performs to the highest standard? You need to be crystal clear on what your expectations are. You cannot expect people to achieve a standard that is unknown, or indeed unmeasurable. I also think that it’s helpful to have a defined method to achieving those expectations. For example, I am very evidence-based; if and when decision is needed, we look at the evidence. If we do not have any evidence, we find some. If evidence cannot be found, we extrapolate from some basic first principles. We then test and learn from the evidence we have created from the test. I think that version 5 will always be better than version 1. Getting to version 5 means that you have to get though versions 1 to 4 as quickly as possible. I believe that the enemy of good is better, and the enemy of better is best. Get version 1 out there, learn about it, and then get version 2 out there as fast as possible. The reason that you should understand your method is that you can then understand if your team can work with that method. My current teams thrive in this working method, but this wasn’t always the case. If someone shares the same professional values, then the working method gets the best out of them. Conversely, if someone doesn’t share the same professional values, then that working method could be bewildering in the rate of change, and ‘cold’ with such a focus on evidence and data. So it’s vital that the working method that you put in place is right for your team. There’s no point playing a back 4 if you don’t have any full backs! What do you think the future holds for risk leadership? The speed of change in technology that we currently see is unprecedented. New communication media, new distribution channels, and the sheer number of people and firms actively seeking to disrupt the industry means that the risk profile of firms is constantly changing. Firms need to identify controls to these new risks as quickly as these risks are emerging and being identified. As a result, I think the old stereotypes about risk and compliance folk are being turned on their head. The days of the stuffy, conservative nay-sayer are long past us, and risk & compliance professionals need to be as dynamic and as innovative as those setting up new businesses and products to protect both firms and consumers from the harms of unintended consequences. Thank you Sheraz Sheraz Afzal is a risk and compliance leader with a career spent in retail banking and consumer lending. Since February 2018 he has been Risk and Compliance Director at The Money Shop UK. Find Sheraz on LinkedIn.  

During the past year of madness that has been the data protection revolution, I’ve discovered a very lucrative spin off for software companies. Now software developing is in our family blood, with both my husband and son working in this industry, so I’m well placed to know a little more about it than most. But before I put these software companies on the naughty step, let me take you back to 1361 and the introduction of the very first privacy law in the UK, The Justices of Peace Act. This allowed for the arrest of peeping toms and eavesdroppers. Today these would be you or I on a train reading the persons email on their laptop in the seat in front of us. Oh how things have changed! As you can see from the evolution of the spoken word, moving forward to the written word and now the e-word, allowing someone to see the information we hold has been a concern to us for many hundreds of years and laws have been put in place to protect this. The introduction of the 1989 Data Protection Act was just a natural progression of these. However, it did give us many additional rights, one being, to have our data deleted if we so requested. After all these years of protecting our data and the introduction the 1988 DPA, how were software companies able to sell non-compliant systems that did not allow for this feature? Whilst I also take the point that companies that bought these systems did not undertake the due diligence required, the cost of putting this fatal error right can be extortionate!    Now anyone who knows me will tell you that I am made of strong stuff, but even I had to sit down when one company, very well known too I might add, gave a quote of £20,000 to write the code to correct this and allow the company to delete its data. Around this time I was think of phoning my husband and son to inform them we were most obviously missing a gap in the marketplace and to get the Sunseeker 95 on order!   The point to make is:- •    Never underestimate the importance of Privacy by Design and DPIA’s. •    Did these companies have a contractual obligation to be compliant with the DPA 1989? •    If so, should the customer have to pay to put this right? •    If you are unable to delete data in line with your retention policy, you are in breach of the GDPR. And now the interesting question is:- Do you pay to bring these legacy systems into compliance or accept the risk? What will you do? Written by Lisa Wilson Lisa is an experienced and passionate Privacy Consultant with a wealth of GDPR and compliance experience, gained from working with large corporates, local authorities and smaller enterprises. Lisa has recently undertaken a new role as Interim Data Protection Officer at Good Energy. Find Lisa on LinkedIn.  

There are a number of risks in any organisation.  All organisations employ people, one of many business assets, and people in themselves can present risk to an organisation.  If you read any employment market update you will read about a shortage in skilled employees and the ‘war on talent’.  Many organisations have talent management or employee development programmes in place, but how many get it right? If you really want your employees to be their best selves, you need to treat them as your most important assets.  That means investing in them and their development.  Most employers will allocate resources to maintain facilities, plant, equipment and software, but the percentage of spend allocated to talent is usually, in my experience, much less.  When times get tough and budgets are under pressure, that type of discretionary spend is often the first to go. To make it more challenging for employers, top talent that feel their needs aren’t being met are more likely to look elsewhere, leaving a bigger talent gap behind. I am seeing more and more advertised vacancies talk about, and in some cases focus on, the organisations approach to talent and development, often included explicitly along with the list of benefits.  This can be a key differentiator in recruiting and retaining talent. I was once told by an employer that the responsibility for developing an individual rests with the individual.  While I agree an individual needs to take responsibility for their development, if their organisation is not investing in their people, and the leadership are not visible in their support of development, that individual responsibility may be the driver for them to look elsewhere for an organisation that will support their growth. If employees feel that their employer is investing in their development, they tend to be much more engaged.  More engaged employees do their best work and are more likely to be working at full capacity.  Disengaged employees have lower productivity and higher rates of absenteeism. But it isn’t just a lack of leadership belief in development or a lack of investment in the right programmes. The pace of change means that more investment in training is required just to remain functional and competitive, let alone investment in development to create a differentiator through your people. The workforce is changing too.  The days of staying with one employer for 40 years and receiving your golden clock are long gone.  The new generation expect a greater balance of freedom and a better work-life balance, as well as the opportunity to progress.  How do you manage development with a remote workforce or one who works from home? Sometimes technical roles are viewed as purely that.  There are many disciplines within the broad area of risk and risk management.  Some of those disciplines are highly technical and require quite prescriptive education and training.  I think it is fair to say that since the financial crisis a decade ago, risk management has received more exposure at the Board level, with Shareholders, and with Regulators.  In order for risk professionals to be fully effective, they not only need to have the appropriate technical skills, they also need to have the right soft skills.  No matter how strong an employee is on their area of subject matter expertise, if they can’t engage the Board or their fellow employees they are unlikely to be able to be their best or realise their full value to their employer. Some relevant soft skills will develop with experience, but they can also be taught and enhanced through practice and coaching.  Some risk practitioners, and indeed some governance frameworks, can make the assessment if not management of risk a rather dry, spreadsheet driven exercise.  To engage a workforce, particularly senior leadership, you really have to bring it to life.  I think one of the soft skills that every risk practitioner should have in their toolbox is facilitation.  I have worked with countless organisations where any number of employees may facilitate a workshop or a meeting, but relatively few have actually had any facilitation training.  As with many skills, if it has been learned by observation and example, or just through being thrown straight in at the deep end, it is unlikely to be anywhere near as effective as if it has been taught, practiced and honed through feedback.  If you empower your risk practitioners to be better facilitators then they will be able to get more out of the workshops they hold, leading to a better understanding of your risks and the identification of stronger, practical controls. If your people make you successful then you have to invest in the success of your people.  Like all risk, there is an upside and a downside.  The threat to business objectives from not nurturing your people and losing your talent, versus the opportunity of attracting, developing and retaining talent and helping your people, and through them your organisation, be the best they can be. Written by Hugh Gilmore Hugh is an experienced risk and compliance practitioner with strong strategy and transformation capacities, gained in multiple industries where he has introduced change, improved financial performance, built strong stakeholder relations and substantially increased customer satisfaction.  A formidable team leader and strategist, he combines good abilities in the areas of active listening, empathy and persuasive influencing, with a pronounced commercial focus. Find Hugh on LinkedIn.

A Three Lines of Defence (3LOD) model has become the norm in recent years, but how effective these models are varies enormously. For example, there is often blurring of the “lines”, or over-reliance on the third line (Internal Audit), or a general confusion over what each line should be doing. Certain measures can be taken to enhance the effectiveness of the 3LOD model, such as having clear roles & responsibilities in place and regular communication. However, it is important to go back to the basics and the raison d’etre for any 3LOD model, which is to ensure issues are captured and dealt with at the earliest possible stage. The following graph shows where one would expect issues to be identified across a business. In an ideal world, the first line should be identifying and addressing most issues. To meet this goal, there should be a strong focus on ensuring the first line is adequately skilled and resourced. The million-dollar question is whether the business could operate without a 2nd and 3rd line of defence! Indeed, there are many organisations which operate without a 3LOD model and this emphasises the importance of having an effective first line of business. Of course, the 2nd and 3rd lines of defence provide additional assurance through monitoring and audit activities. What is extremely important in a 3LOD is the need for effective working relationships between each line. Remember, they are all internal and need to work well together. We often hear comments like “we can’t do that as it is a first line activity” or “this will cause blurring of our 3LOD model”. Whilst that is true, there are times where one of the lines of defence can, quite rightly, bend the rules, especially if this will have a long-lasting effect. For example, the 2nd line of defence can help the 1st line establish certain processes and controls, thereafter the 2nd line would move to an oversight role. Likewise, Internal Audit can act in an advisory capacity to help the business with specific programmes of work, rather than a more common approach, where Internal Audit work at arm’s length with the business. The clue is in the name – “internal”. External Auditors and Regulators, of course need to maintain a greater distance and independence from the business. Oversight functions (2nd and 3rd line) can often be perceived as clinical and distant. Some may event say unhelpful! But ensuring effective partnerships exist across a business requires different, softer skills. Yes, there needs to be clearly documented and codified processes and controls. Yes, there needs to be clear roles & responsibilities across the 3LOD model. And yes, there needs to be appropriate segregation and lines of demarcation. But there also needs to be an acknowledgement that everyone is working towards a common goal. There needs to be effective communication and healthy working relationships. This requires everyone to understand and be aware of other teams, their remit, the challenges they face and so on. It requires strong emotional intelligence from the leaders in each line of defence and they should build robust working relationships. Regular 1:1s and stakeholder meetings are important to cement the relationship and to discuss topical issues. This will also minimise any duplication of effort and maximise efficiencies. This one reason why Internal Audit should engage with any Compliance Oversight function to discuss monitoring and audit plans so they complement each other as opposed to duplicating effort.    Organisational design or, in other words, how the business is structured including any 3LOD model, is clearly important. However, the culture and behaviours are vital to ensure a harmonised working environment. The FCA also expects the right culture to be in place! The kind of behaviours all parties should be working towards include: Acting as one Team. Taking Ownership. Form and maintain strong working relationships. Be a good Listener – we have two ears for a reason. Focus on solutions, not blame. Be proactive, not reactive. So, in summary, maintaining effective working relationships requires not only a clear operational structure and clear roles & responsibilities, but it also the right attitude and behaviours. When all these are harmonised, the rest takes care of itself. Written by James Wilson With over 30 years retail Financial Services experience James’ career has covered a variety of financial services sectors including banking, insurance, investment and wealth management. James also has a strong legal and regulatory background having spent time at the Law Society of Scotland and Financial Services Authority. He has held senior Executive/Board positions in RBS, Standard Life, TD Banking Group and Speirs & Jeffrey. He has held a variety of Regulatory Approved Persons positions including Director, NED, Compliance Oversight, Risk Management and Money Laundering Reporting Officer. He possesses a strong pedigree in the implementation of risk and governance frameworks across a variety of businesses. As well as being an ex-Regulator James has managed Regulatory relationships and successfully navigated many regulatory inspections in the UK and overseas. He is a member of the Personal Finance Society (DipPFS), a Fellow of the Chartered Institute for Securities and Investments (FCSI) and possesses an MBA and the Financial Times NED Diploma. Find James on LinkedIn.

AI-based solutions can shape how financial services businesses make money, whether the business model is the same or not. For an existing financial services business, the motivations may vary and range from efficiency to expanding the business. There would be project risk as with any development, but leaving that important consideration aside, it is worth bearing in mind that AI-based solutions would also impact the risk profile of the business. This may or may not be the original intention, but it becomes more likely. The key implication is that implementing an AI-based solution would require a radically different risk oversight approach by the business. Standard computer algorithms which are not AI-based can—and do—solve complex problems. The main feature of such algorithms is that the problem is somehow defined and an algorithm developed to solve it which will produce the same answer as long as the same inputs are provided. So a credit-scoring mechanism calibrated to capture a certain type of client gives you just that. The answers offered by an AI-based system may change over time. New data is used to reassess the underlying relationships and recalibrate the relationship between the target variable and the potential explanatory variables. This “learning” can also happen in a standard programme when there is a process of recalibration. The difference is that in the case of AI, learning would happen on a real-time basis—that’s the essence of AI. Alternatively, with AI a target variable may not have been defined. That’s not as unusual as it might sound. For example, algorithms assessing a loan or credit card underwriting may fall in this category because there is no single rule to predict a borrower’s likelihood of repayment. New data can lead to a certain recalibration or can be used to identify new relationships between certain data. For example, over time an AI-based system might identify that outstanding debt is a better predictor of the likelihood of borrower repayment than repayment history and penalise someone with a relatively good track record of timely repayments. The first type of AI-based solution is called “supervised machine learning” and the second one “un-supervised machine learning”. The key difference is the extent of autonomy that goes with the learning. Consider the potential impact on conduct risk of AI-based tools. One of the expectations from Treating Customers Fairly (TCF) with respect to product governance is that they are designed to meet the needs of identified consumer groups and are targeted accordingly. This requires a clear business strategy, including identification of the target market through a combination of qualitative and quantitative research and oversight of the business to ensure that it is aligned with initial expectations of customers and business generated. Take the example of automated investment services covered in a recent FCA review. These providers would rely on some type of AI-based solution, whether supervised or unsupervised machine learning. The possibility of capturing different customers or the advice generated being different from what was envisaged cannot be ruled out. The challenge is how to put in place a monitoring approach which ensures that outcomes and risks which arise are consistent with the expectations in the business plan. Something similar can apply from the perspective of credit risk, impacting the quality of the portfolio and performance. Suppose you have been targeting retail customers with a specific risk rating for a credit card business. If you roll out an AI-based solution to enhance the efficiency of product underwriting, you would need to have in place mechanisms to ensure that the credit quality of the portfolio is consistent with your expectations—or else change those expectations. Both options are fine. You may want to keep your target credit rating constant and seek more volume, or perhaps you see AI-based solutions as a more robust tool to support decision making and, in a controlled manner, can relax your target rating. Regardless of your choice, you would need to put in place a credit risk monitoring approach that is suited to the new AI-based solutions, as well as ensure that the business understands the portfolio implications of “learning” that is at the core of an AI-based solution system. The salient point to take away is that the roll-out plan of AI-based tools may focus the launch. However, the greatest challenge may well be the need to provide for the ongoing and timely monitoring of the AI-based tools and their integration in business governance and risk management. Written by Isaac Alfon This article originally appeared here and has been reproduced with permission. Text © Crescendo Advisors, 2013 - 2018 Isaac is an independent consultant with extensive experience of risk management in financial services. His expertise includes enterprise risk management, governance, risk transformation, stress testing, assurance, capital, risk appetite and risk policies.He has worked in industry, including start-ups, consulting, financial regulation and HM Treasury covering the development and implementation of risk and capital insurance regulation. For further details please go to www.crescendo-erm.com.

The greatest risk for any organisation is the “human factor”. In 2017 the ICO issued 52 monetary fines, of which only 5% could really be said to have been caused by factors outside of the organisation’s control. The other 95% were a direct result of the actions of an organisation’s employees. And, with the breach reporting requirements of the GDPR, staff both being willing to report incidents to their DPO and acting in line with organisational policy has become even more crucial. Considering all this, embedding a culture of compliance and best practise within an organisation should be a priority for any DPO. Embedding a compliance culture is primarily an exercise in change management - winning hearts and minds. Unfortunately, the subject of data protection is viewed by most people as “boring” at best, and “red tape” that “gets in the way” of doing their jobs at worst. So how do you promote a culture of compliance when you’re up against those kinds of attitudes? Every DPO has their own tips and tricks. Here are some things I’ve found useful: Senior Management Buy In The attitude of senior management to compliance will ultimately filter down through the organisation. If staff can see that data protection compliance is valued by their boss, they will be more willing to accept any changes and take policies seriously. Of course, if an organisation has hired a DPO, they probably already appreciate the importance of compliance. But, if not, you will have to persuade them of the value of compliance. Once you have their support, they will probably be happy to do things like adding their name to an email chain to give a particular project more “clout”, and attending training sessions, alongside staff, to lead by example. Training In my opinion, the single most valuable tool in your compliance arsenal is training. Good training does more than make staff aware of what data protection is, and what’s expected of them. It’s an awareness raising and engagement tool. I personally favour face-to-face training sessions where possible. And the more interesting, fun and practical you can make them, the better. Training is an opportunity to sell the value of GDPR, to make it personally relevant to staff, and, yes, to explain the consequences when something goes wrong. If you can make your staff understand data protection law, and, more than that, to see compliance as something other than “boring”, “red tape” and an obstruction in the path of doing their job, they will want to comply. You will find people come to you with questions more often, willingly report incidents, and follow policy with far less grumbling, if you can get them on side. And training, when you have their uninterrupted attention for an hour, is the perfect opportunity to do that. Audits In order to ensure compliance, you need to check that your policies and processes work in practise. But an audit has a secondary purpose. The results of your audit not only show good practise but demonstrate areas of weakness. People will act in a compliant manner for two reasons: because they have bought into what you’re trying to achieve and see the value in it; or because they don’t want to get caught out. An audit is your opportunity to show that there are immediate consequences for getting it wrong. In summary, the importance of a compliance culture cannot be overstated. It is the backbone of any data protection regime in any organisation. It is also arguably the most difficult of all compliance tasks to achieve. However, with buy in from senior management, an audit cycle which is communicated to all staff,  and a really good training and awareness raising programme, it is achievable.   Written by Ceridwen Lee Ceridwen Lee is an Information Governance Professional and Privacy Specialist with over 10-years experience in the public and third sector. Find Ceridwen on LinkedIn.

In a world where financial institutions are having to transform and embrace digital methods, how do you see the risk profession needing to evolve? The extent and impact of the digital revolution in the financial services world is striking, especially for companies such as insurance companies and pension funds that are trying to play catch up with banks, prompted by but also helped by Fintechs. At the centre of this very fast paced evolution are the customers and their ever-growing expectations that everything should and will be at their finger tips. Cost reduction and operational effectiveness are another big driver of change. Non surprisingly, with all attention initially focused on the end of the customer facing processes and operations supporting those, Risk is very often lagging behind.           How can organisations ensure that their risk teams are able to understand more complex risks than ever before? There are two ways in my view companies can invest in their risk functions to ensure they are fit for purpose now and for the future. The most obvious one is obviously training e.g. on data analytics, data security or cyber risk. I would argue though that what needs to be encouraged is also a less silo mentality when it comes to expertise: having one data scientist or a cyber risk expert in a team is great, but what would be more effective in my view is to form a core of risk or compliance people to understand the whole spectrum of risk their company is exposed to, from op risk to financial risks to conduct or cyber risk. These will be the future risk leaders who can make informed decisions quickly or reach out to the right experts to make them. Creating multi-disciplinary risk and compliance teams, even virtually, who are embedded in specific parts of the business is the best way in my view to learn this fast on the job. The second way is to actually invest in Risk & Compliance’s own technological revolution. I read in the 2017 McKinsey digital risk survey that whereas 70% of the banks surveyed had digital risk on their radar, but only a portion of the risk budget in the digitalisation of risk management processes. With data legacy systems often cumbersome and processes extremely manual partly for that reason, working in Risk or Compliance is often a long exhausting hurdle race with not much value add. Investing in new technology not only in client facing areas to boost growth or in operations to reduce costs but also in digitising risk processes would open a world of possibilities for the profession but also ensure that time is spent on strategic adding value decisions rather than manual and routine low value work. How can a risk professional ensure they keep up to speed on the latest risk technology developments? Well I am not an expert on training risk professionals, having been one only for the last 4 years but I would say that training is often in our own hands rather than in the hand of an organisation. Especially given the beauty of this digital world we live in is this incredible and free access to information. Unfortunately, I have witnessed many times risk and compliance teams being the most reluctant to access that information and use it. I remember inheriting a financial risk team where no one ever read market news. Similarly, if risk professionals are not ready to embrace and make use of new technologies, they will be doomed and will soon be replaced by data scientists or modelling gurus. I am not myself a Cyber risk expert for example, but I would be hard pressed to find a risk conference that does not cover the topic those days. There are so many free events, seminars, blogs available those days that it would be criminal for people who are serious about enhancing their expertise and developing their career not to tap into those resources, especially in an environment where training budgets are the first ones to be cut. What changes are you seeing in the ways in which risk teams work with each other and across the business? How is the agile way of working evolving and contributing to these changes? As mentioned above, I think connectivity and embeddedness are key. People can’t work anymore in silos, not only within Risk & Compliance but within the entire business. Within Risk & Compliance, senior managers need to be able to both connect the dots and access quickly the expertise available across the functions. Creating an organisational design (and work environment) allowing this is extremely important. This may need to be supported in some cases by radical changes in culture – hard reporting lines may need to be replaced by matrix organisations or multi-disciplinary “virtual” teams embedded into the business that can input live into the design of new processes or products for example. The latter in my experience does help improve the cadence of advice and challenge given to the business by the Risk & Compliance function, its speed of response and hence its credibility. People may say this is agile working – I would just say, it is being adaptable to the demand of businesses who are working faster and need nimbler brains. Working in silos of expertise and “overseeing” the business from miles away is what could get the Risk profession stuck in time. How has the need for new processes heightened as risk functions digitise? I might turn the question slightly differently: “do you need to create new risk management processes so they can be digitise”. In a lot of cases the answer is yes – and not only in Risk but in Finance or Actuarial. Big financial services companies with 100s of years of history often carry a heavy load of outdated systems and practices. Faced with corrupted data or fragmented processes, those professionals have come up with amazing way to cope and do their jobs – one manual control here, one check there, one spreadsheet later etc…interestingly, in a lot of departments, it often results in those individuals understanding that incredibly complex process becoming essential. And when digitisation knocks at the door, the answer almost invariably comes back : “oh no, this is too complex a process to be digitised, you do not understand”. The point I am trying to make here is that more often than not, the process indeed can’t be digitised as it is. The process needs to be looked at with fresh eyes and re-engineered end to end before it can be digitised. That in itself means new ways of thinking and strong collaboration with the business, developers, Finance etc. But it can be done, and it has to be done. What do you consider to be the main challenges that institutions face as they look to evolve their risk teams and staff whilst going through transformation? I would say the challenges are often access to talent, culture and rigid organisational structures. As mentioned above, the latter are often focused on separating areas of expertise and are difficult to break – this is what people are comfortable with, not only in Risk but in Finance or HR etc. When we created a Transformation Risk team, it would be fair to say that most of my colleagues wondered whether we were going to overlap with their teams…We did and we still do but with a bit of pragmatism and a very strong sense of collaboration, we are now working seamlessly with our operational, financial and technological risks colleagues. Finding the right talents for the future is another hurdle. It is also honestly quite difficult to find Risk professionals who are also data scientists or understand new technologies and to find data analytics experts who want to work in Risk. As Director of Transformation Risk it was actually quite a challenge for me to gauge what capabilities the team needed – did I need an op risk person alongside a financial risk one? Did I need programme risk specialists? I ended up deciding that what needed was good brains, able to ask the right questions at the right time, able to collaborate and interact with a wide and diverse set of stakeholders, from other risk colleagues to developers in feature teams to business leads in sales. It was however not that easy to translate that into job specs recruiters would be able to take to the market.   Finally, culture is often the slowest thing to change. For Risk and Compliance professionals who may tend to be, rightly so, prudent and conservative, embracing a new fast paced world where a Cyber attack could easily wipe down your bottom line or any mishandling of customer data could expose the company to regulatory sanction, is challenging. They are being asked to think fast on situations that would have traditionally required careful consideration and deliberation, they are asked to trust tech guys with risk management processes they have lovingly built. They ask themselves – what if this goes wrong?  Am I not accountable for ensuring nothing goes wrong? What does “fail fast” means in Risk? Those changes are not easy to make, for anyone. Can you make any predictions for how the risk profession will continue to evolve over the next 5 years? Well, first of all, the importance of Risk will continue to increase, not because most predict regulatory scrutiny will, but because managing risks (whether reducing those or taking the right ones in the right quantum) is now recognised as core to any business. In that sense it is not only the responsibility of the Risk & Compliance functions to manage risks and the frontiers between first and second line may become more blurred as we move to more agile ways of working. Secondly I would personally suspect that most Risk professionals won’t be Risk professionals by background anymore – I was myself an ALM expert and had always worked in first line before I joined Risk. This certainly helped me when I became Financial Risk Director at Prudential. Bringing in into Risk & Compliance teams people who have worked in the business, in tech, in operations, in sales is extremely valuable for the effectiveness of those teams but also for the future of the profession, as it will help in my view unlock pool of talents that are currently not necessarily thinking of a career in Risk. Conversely, bringing Risk professionals into the core of the business processes and functions will go a long way to making those fast paced digital transformations secure. Any other perspectives to add? I would only add that I had the most exciting times of my career since I have worked at exec level in Risk – we see the big picture and the detail of so many things, we are part of so many key strategic decisions the business needs to make. It is truly, especially nowdays, a fascinating place to be and I would encourage anyone to jump in! Thank you Aurore! Aurore Lecanon is since January 2018 Transformation Risk Director at M&G Prudential, responsible for oversight and assurance across all strategic change initiatives at M&G Prudential. Aurore joined Prudential UK in 2015 as Financial Risk Director at Prudential UK and prior to that, held Head of ALM positions at both Old Mutual and Aviva Group. Aurore also spent years in investment banking, at Credit Suisse where she covered large UK insurance companies within the Insurance & Pensions Solutions team and at Société Générale in London where she focused on structuring insurance-linked financing and risk transfers. Her career however had started in the insurance industry, at Aviva, where she worked in a number of roles across the Treasury, Capital and Risk Management areas. Aurore is a graduate of the Ecole Polytechnique in France and holds Masters in Stochastic Mathematics and Financial Engineering from Princeton University and the University of Paris VI. Find Aurore on LinkedIn.  

Have you ever wondered how to decide how much and at what price businesses are charged for borrowing money? It's not a topic that tends to come up at a party or around the dinner table, but it’s a question lots of business owners, sales-people and risk specialists would benefit from knowing as it sends a signal to them about the perceived risk, whatever the product. Prior to starting SME Finance consultancy, Ravens Wood Capital, I was responsible for risk management at alternative finance lender, Growth Street (2016-18). As the first risk employee after the Co-Founder, I had the unenviable position of growing lending volumes through underwriting and protecting the provision fund from unnecessary defaults. The price of debt was a key mechanism for protecting the fund, as part of the interest rate was paid into the fund each month. The fund would grow in line with the risk of the portfolio. Implementing risk management tools and techniques in any company can be difficult, let alone in an early stage company with huge growth aspirations. We knew we had to use well-established data and traditional models to supplement our internal processes to engender confidence from our investors and give a reference point for the portfolio compared with more established assets, but we also needed an edge. Our data providers were well-known names in the credit market giving us a great foundation, backed up by many years of data. They gave us the reference points; our people and processes gave us the edge. By speaking to all potential borrowers, we were able to apply qualitative scoring overlaid with our data. This served us well and provided a unique selling point to our borrowers who would once have had a relationship manager at their bank. Underwriting now had an effective risk management process that would scale and provide ongoing data points for in-life monitoring. In-life monitoring is a very different risk management discipline to initial underwriting and is something which doesn't happen in all lending institutions. This is short-sighted and dangerous in my opinion, particularly on medium and long-term dated products. How can you possibly know how a company will perform over the three years of a loan? You simply can't and even with the best data in the world, proactive monitoring will win every time. Technology is the great enabler here, and for the machine-learning and AI followers, there is a mountain of data waiting to be put to use in the credit risk space! We had access to real-time data from the majority of our clients giving insight into trading now, and not in a month or 3 months’ time when they were obliged to provide updated performance metrics. These insights alongside the traditional data sources help to take proactive action on deteriorating risks and informed our front-end underwriting of weakening sectors and borrower characteristics. We didn't need to spend endless funds on an AI model to predict defaults, however, I am excited by the benefits this will bring when the company is ready. Using market-leading external data and borrower real-time data we were able to build a strong foundation to credit risk management without hiring an army of analysts that helped inform the company on credit matters and potential marketing opportunities. How many credit risk departments can claim that?   Written by Russell Green Russell is the Co-Founder of Ravens Wood Capital, a financial advisory set up to give business owners confidence in their cash flow. After spending 13 years in various risk management roles across the UK, including Head of SME Credit at Worldpay plc (now Vantiv), where he helped set up the Manchester office, through to Head of Risk for Alternative finance lender, Growth Street, Russell, and his co-founders Jayesh and Philip have embarked on sharing his knowledge first hand with businesses. When Russell isn't sharing insights with clients, he is enjoying time with his family, learning about English history (his son's into knights), coding, or learning about NLP. Find Russell on LinkedIn.

Following the auditors focusing on the strength of firms TPA oversight related to CASS, FourthLine decided to host our second CASS event of 2018 around this hot topic at the highly impressive Sky Garden on Fenchurch Street. The breakfast event lasted for 2 hours and included a 30 minute presentation and Q&A by one of the CASS experts in our network, Zak Karim of Karim Consultancy. This was followed by a peer2peer discussion over breakfast. Zak advised how to ensure strong TPA oversight and the skills that make a strong oversight professional. .embed-container { position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%; } .embed-container iframe, .embed-container object, .embed-container embed { position: absolute; top: 0; left: 0; width: 100%; height: 100%; } Some of the key points discussed included: TPA Oversight is at the top of the FCA’s CASS agenda. Activities can be delegated but regulatory obligation cannot be. Processes should be understood as if performed in-house. Establish strong governance & oversight. Establish a transparent breach reporting process. Implement ongoing due diligence, monitoring and reviews. Importance of soft skills to foster a positive relationship. Following the event, we caught up with Zak to find out more about the areas of debate covered during the session. .embed-container { position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%; } .embed-container iframe, .embed-container object, .embed-container embed { position: absolute; top: 0; left: 0; width: 100%; height: 100%; } If you’d like to find out more about what was discussed during the morning including some key takeaways, please email [email protected]

In the build-up to the introduction of the General Data Protection Regulation (GDPR), we saw an unprecedented level of data privacy related hires as organisations prepared for the new regulation and rolled out their GDPR programmes. For many organisations this meant new roles were created in the form of Data Protection Officers. Whilst we continue to see some organisations bringing in a dedicated DPO for the first time, many are now able to build out their privacy functions. DPOs have been in the role for 6 months plus and the change team’s contracts have finished, so there is a requirement for extra permanent team members to help run business-as-usual operations. A standard team set-up we’re seeing is that of a three-tier function; with one member (typically the DPO) focused on strategy, another (data privacy/protection manager) implementing the strategy across the business and a third (business analyst) dealing with risk assessments, subject access requests and other BAU procedures. As such, we’ve seen an increased demand for these manager and business analyst level roles. Beyond that the market has settled, with many happy to stay in their current positions unless an outstanding opportunity presents itself. This was very much to be expected, with many DPOs only a short time in the role and just starting to receive extra budget to work with. Plus, many will want to see out the successful implementation of projects they have started.  Some organisations have struggled to bring in a full time DPO, in which case many have created a dual-titled role such as Privacy and Compliance Manager. One area we’ve seen an increase in demand for is privacy lawyers, with organisations requiring someone with experience of reviewing contracts alongside other privacy-based duties. This has come about due to the actual commercial requirements that companies face whilst implementing and abiding by the regulation. We’ve also been engaged to resource on behalf of several US-based companies who are looking for a UK or EU based presence so that they can more closely align their data protection strategies. Although scheduled to leave the EU in 2019, the UK has been chosen as the location for these roles over mainland Europe as it will be in a good position to sit between the US and the EU. Across all sectors in which we recruit, we’re seeing a distinction between whether organisations want somebody with B2B or B2C experience depending on the type of business they conduct. This is due to the different ways in which consumer data is understood and the requirements of personal data vs that of a business. Multi-jurisdictional experience is also highly desirable for organisations, particularly exposure to privacy laws in places such as Japan and Singapore. With so many new data privacy roles created, we’re increasingly seeing experts moving from other sectors to take up positions. Those who hold records management compliance roles within the public sector are commonly moving into data privacy roles, where they are trained on the job by the DPO or Data Privacy Manager. Likewise, we’re seeing people move from the legal sector into in-house privacy roles, with paralegals or newly qualified lawyers being pulled across. Next year we expect see more business-as-usual activity with the hiring of managers and analysts. Organisations will continue to build out their privacy functions, and firmly establish them as part of the overriding Information Risk structure with privacy teams sitting alongside and working effectively with compliance, information governance and information security teams. If you’d like to find out more about any of the above points or discuss your privacy recruitment requirements, get in touch with our Information Risk team today. Did you know we are hosting a workshop in November on the topic of Improving your Data Privacy Risk Management led by a leading industry expert. Spaces are limited - please get in touch to secure your place.

Here is the million dollar question: “Are you ready for the SFTR challenge?” This question is one that needs an urgent and precise answer to resolve a make-or-break situation in a very complex regulatory environment impacting every player in the industry value chain. The Securities Financing Transactions Regulation (SFTR) is an EU regulation and part of a drive by the EU to increase transparency of activities that are broadly categorised as Shadow Banking. The regulation is designed to report (similar to EMIR for OTC derivatives) transactions that could pose a significant level of systemic risk and therefore sets out requirements to improve market transparency of Securities Financing Transactions (SFTs). Any participants in the European securities financing markets will be required to provide daily reporting to a trade repository (TR) of not only every new trade, amendment, correction, error and cancelation but also any trade lifecycle events, collateral valuations and legal entity wide collateral re-use statistics. ESMA published the final RTS report on 31st March 2017. The reporting start date is still pending the adoption of the delegated act and publication in the EU Official Journal, but latest predictions are that this will be in Q1 2019. Consequently, the reporting Go Live date will be at the start of 2020 for banks and investment firms (Phase 1) at the earliest (i.e. a year after publication in the Official Journal). With this important indicative milestone in mind, it is essential that firms start work as soon as possible to ensure readiness for SFTR in a timely, efficient and professional manner. “Not seeing the forest for the trees” The colossal amount of data to report means its naturally tempting for firms to consider doing the strict minimum to meet compliance deadlines without analysing thoroughly the long-term impact of SFTR and understanding the unstoppable direction of travel the whole Securities Finance Industry is heading in. From my standpoint, the danger is “not seeing the forest for the trees” and neglecting compelling opportunities to break down silos within the firm, redesign suboptimal operating models, reduce operational costs by automating business processes, improving data management systems and connectivity which will create a long-term virtuous business cycle for anyone willing to go the extra mile. The upside is there for the bold and brave: operational excellence, inventory and collateral management optimization, lower reputational risk, reduced balance sheet usage, funding costs and collateral footprint, improved trading strategies, profitability (ROE), risk/liquidity management and client relationships through advanced data analytics and robust business intelligence. SFTR Workshop If you would be interested in learning more about this topic, I will be leading the SFTR | Top to Tail morning workshop on 23rd November, which will provide you with a thorough overview of the regulation, who should report, what products are in scope, which reports ought to be submitted and when, the 153 data attribute requirements and what will be matched and reconciled. We will also look at implementation challenges, solutions options and identify what works needs to be done in 2018 and beyond to fully comply with the regulation.   Post Credit Crisis in 2008, there has been a persistent regulatory drive towards collateralization in trading. For the interested parties, we will even go further in the afternoon session (Part 2) by looking into the “Bigger Picture”. While SFTR is just one part of the collateral flow within a bank, some of the reporting attributes can be applied upstream to a much wider collateral pool to enable an overall trading cost optimization program. Full details of the workshop can be found here. Spaces are limited – please get in touch to secure your place. Written by Johan Joly Johan Joly is the Founder of MHA Consulting a boutique consultancy firm specializing in Advisory Services and Regulatory Risk. He is a front office, regulatory risk and business change subject matter expert with over 20 years' experience in the Financial Industry.  Johan held several senior front office (Trading/Modelling/Structuring/Sales) and compliance advisory roles at Barclays, Lehman Brothers, HSBC, Accenture, Legal and General Investment Management (LGIM) and Mitsubishi UFJ Securities International (MUSI). He provides advisory services to every participant in the industry value chain (buy-side and sell-side) to navigate risk and regulatory complexities efficiently and deliver optimal operational and technological solutions.  Johan speaks at numerous industry conferences and runs professional workshops across Europe. Johan holds a Master Degree in Finance & Trading from ESLSCA Business School, Paris (France). To find out more about MHA Consulting click here, or find Johan on LinkedIn.

A no-deal Brexit is now a real possibility. I still do not believe that it is the most likely outcome but, given the apocalyptic predictions about what could happen, it’s a possibility that has at least to be considered seriously. There has been an awful lot written about a no-deal Brexit, but most of it is about the politics and the negotiations. This article is about what you can and should be doing now to protect your business. A few basics: - There really are things you can do, but;  - Preparations are unlikely to be cost-free; and,  - Senior time needs to be spent on planning. This is obvious, but in order to do anything you have to consciously acknowledge its reality. This is particularly true because the temptation to ‘wait and see’ is large, particularly given the government’s almost superhuman ability to keep kicking the can down the street. Even if the likelihood is not as great as the 50:50* the EU is predicting, it is still is still a prospect real enough to require consideration. It is also worth reminding ourselves that the Bank of England’s stress tests (real estate prices down by a third, interest rates up to 4 per cent, unemployment at 9 per cent and the economy in a 4 per cent recession) are just that, tests of banking resilience in the most extreme circumstances, and not necessarily the most likely effects of a hard Brexit. How will your business be affected? In talking to businesses about Brexit, I have used various ‘buckets’ to provide a frame for how you can examine how you might be affected - there are many ways you can examine the impacts but, broadly, the people, trade, regulation and government policy split has always seemed sensible. There is probably a slightly different mix for the hard Brexit scenario. The list will, of course, vary according to your business but the following should definitely be considered:  Supply chain  Other trading effects  Currency and capital effects  Travel and people Supply chain Honda has taken the unusual step of publicising with some specificity the potential impact of Brexit on its UK operations and came to the conclusion that if the UK came out of the customs union this would increase the time of its general EU/UK ‘product journey’ from less than a day to up to nine days. This includes additional time for customs declarations, actual customs clearance, border checks and the potential impact of congestion on channel ports. How does your supply chain look when these are added? Are substantial delays a real prospect in a hard Brexit? I think the answer is undoubtedly ‘yes’, and the period around the hard Brexit date may have additional delays as interim measures are put in place, and theories of what should work are tested to destruction. Should you start stockpiling, either to guarantee that you can still meet UK demand or to create a stock buffer for your UK production? I think the answer to that depends on the nature of what you need and the cost to store it e.g. Sanofi and AstraZeneca have started to build up stock reserves in the UK but if you have low-value, bulky, perishable stock, there may not be an economical way to factor for delays this way, but at least think about it and make the decision consciously, rather than waiting for it to hit. Other trading effects Delays at the ports are likely to work in both directions so the desirability of your products may decline, at least for EU members. How good are your contracts? Time to refresh them? If the most extreme predictions are realised, UK demand for non-basic items may fall as consumers deal with a recession. Consumers will be hit by higher prices and feedback loop could develop, further depressing demand. How are you configured to deal with this? Currency and capital effects Another extreme prediction relating to a hard Brexit is a fall in Sterling by as much as 15%. Good news if you have mostly UK inputs and are exporting to non-EU countries, but worth understanding the implications if not. It is also worth thinking about your financing needs. The banks themselves will be hit and lending may become harder. Better to do some refinancing now? How good is your buffer? Travel and people Additional border controls could have an impact on business travel and, in the helter-skelter post a hard Brexit, undertakings, like that of the UK government in relation to rights of movement in the transition period, could still go back in the pot. The effects on the ‘People’ category I have used in broader discussions of Brexit could theoretically be quite extreme in a hard Brexit, with up to three million EU citizens in the UK potentially losing their right to stay and work, with consequent effects on business. It would, of course, quite insane for a UK government to take this approach and it is more likely that there would be some kind of transition leading to enhanced third country national rights. However, the very fact of a hard Brexit would have a chilling effect on both confidence of EU nationals working in the UK and also on the ability to recruit from the EU. Hard-Brexit as a Business Continuity Event It may be helpful to consider a hard Brexit on the basis we use for other high impact events. As the deadline approaches, it would be sensible to up the tempo of planning meetings. Unlike many other business continuity events, there is likely to be some warning, so plans can be refined as you approach the day. Take advantage of this and continue to adapt your plans as the likely effects become clearer. More positively... Because corporate Britain was mostly ‘Remain’ in its instincts, there may be a tendency to omit risk upside in the consideration of potential outcomes. In whatever form Brexit eventually takes, there will be some opportunities; make sure that your risk analysis includes these (and not just the currency effects). There is some thought that the government would have money to spend if it does not settle the £40bn Brexit divorce bill. It’s hard to say what effect this might have and it seems reasonable to think that they mightn’t be too profligate, on the basis that there might be bills to pay as a longer term settlement is agreed (or the EU sues for the money) but there are still likely to be opportunities ...and bear in mind that it isn’t just Brexit With all the noise, one can be forgiven that Brexit is the strategic risk that is going to have the biggest impact on your company over the next few years. For many businesses, the impact of Brexit, even a hard Brexit, may not be as significant as disruptive cherry-picking of your profitable activities (e.g. the impact of fintech start-ups on ‘old banking’ and other financial service businesses), a large trade and tariff war (any UK firm manufacturing in China for global export) and technological change (most companies). Make sure that your examination of risk addresses these things and keeps pace. These are, of course, just broad guidelines with general applicability. Merlance has worked with clients in a number of sectors provided some sector specific advice. Please feel free to contact us to discuss. * The EU is, naturally, likely to be biased in this assessment but it is interesting to note that the UK’s betting market actually rates a no-deal Brexit as more likely than this. Written by Patrick Healy. This article originally appeared here and has been reproduced with permission. Image and text © Patrick Healy. Patrick, Principal at Merlance Consulting, is a senior executive with a unique combination of risk expertise and leadership insight developed over many years working both in industry and in management consultancy, most recently as Executive Director at EY, heading the Strategic Risk Outcomes group. He led EY’s internal risk management for UK & Ireland and was UKI Risk lead for Brexit and the FRC’s Corporate Governance Code. His career has included senior risk management roles including Group Head of Risk Reporting for Man Group plc, where he set up the Group Risk function.  He has also been Head of Risk & Compliance for Cordea Savills and has worked in other risk, audit and control roles for Morgan Stanley, Aviva and a JP Morgan JV. He is a chartered accountant, having trained at Deloitte, and has a Law degree from University College, Dublin. To find out more about Merlance Consulting click here, or find Patrick on LinkedIn. Upcoming Workshop If you are currently wondering how to get out from under the Brexit rock or how to leverage your Brexit preparations to address other uncertainties, Patrick Healy will be facilitating an interactive workshop (Strategic Risk | Brexit | Coping with Uncertainty) on the 21st November 2018 to delve deeper into this topic. Whether you are a CEO, CFO, CRO, NED, Risk Manager, Head of Internal Audit, or a Brexit-responsible Manager, becoming a delegate at this event will enable you to walk away with the practical tools and frameworks required to prepare as well as find opportunity in the Brexit challenge. Spaces are limited – please get in touch to secure your place.  

For the Information Security professional, ‘Risk’ is at the hub of everything she or he does. Every Information Security framework, every Data Protection Impact Assessment will start with a Risk Assessment. However, the word ‘Risk’ is often mis-used. We listen to the weather forecast and we hear that there is a “Risk of rain” and so we may take an umbrella to work. But what we’re really hearing is that there is a ‘likelihood’ or ‘possibility’ of rain. We know that ‘Risk’ is a calculation of ‘Likelihood’ multiplied by ‘Impact’ so what our forecaster is actually saying is “It is quite likely to rain today and if you get caught outside when it does you’ll get wet”. Rain is ‘Likely’ and getting wet is the ‘Impact’. Multiply the two together and our ‘Risk’ is really how wet we might actually get. Our Risk mitigation is to take an umbrella. In the world of Information Security and Data Protection we have to be far more specific if our Risk Assessments are going to be of any use. So we must qualify our Likelihood and Impact statements and quantify the resultant Risk. We do this by clearly defining what the Likelihood of an event is and what the Impact will be if the event actually happens. We then add weight to those statements by saying how ‘likely’ the Likelihood is and the ‘level’ of Impact. This can be used by simply stating whether the Likelihood and Impact is ‘Low, Medium or High’. Thus a Low Likelihood multiplied by a Medium Impact will be given a score of Medium Risk. This is a quick and dirty assessment as we have not stated what a Low, Medium or High Risk actually means, (is a High Risk catastrophic or merely an annoyance?). We could instead grade our ‘Likelihoods’ and ‘Impacts’ by describing them as say ‘Very Low’, ‘Low’, ‘Medium’, ‘High’ and ‘Very High’. But this becomes very messy when we start trying to multiply ‘Very Low’ by ‘Medium’ – will it be ‘Low’ or ‘Medium’ or somewhere in between? So what we do is give our definitions a number. ‘Very Low’ becomes 1, ‘Low’ becomes 2 and so on until we reach ‘Very High’ which is 5. Now, when we multiply ‘Very Low’ by ‘Medium’ we are actually showing 1 x 3 = 3. Our resultant Risk is ‘3’ or ‘Medium’ and we can further add weight by defining a Medium Risk as something that needs attention of the Board, may have a financial penalty or may simply need monitoring. Not only does this make our Risk calculations much simpler, (it can be easily automated too), we can easily demonstrate this in a graphical representation which Boards just love!  It also gives us much more ammunition to drive changes in Information Security practices. A Risk Score of 20 (graded High and coloured Red) should make the Board sit up and take notice. We can then demonstrate that by a few simple changes to reduce the Likelihood or Impact of an event happening we can quickly reduce the Risk to say 15 (Medium and coloured Amber). For example: If we let every employee have uncontrolled access to the Internet then it is highly likely that there will be a successful cyber-attack, albeit an un-targeted opportunistic virus. The impact may only be annoying as, hopefully, patching and Anti-Virus patterns are up to date. But it could be an opportunistic Ransomware attack which is far more damaging.  Now if we get backing from our Board to introduce Internet controls so that only approved categories of web sites are made available and perhaps to disable downloads without the relevant permissions, then straight away we have reduced our Likelihood of cyber-attack.  Any change that affect the workforce must be followed-up with education through policies, procedures and maybe a lunchtime presentation. It is always important to explain to employees why changes are absolutely necessary. Employees and the Board will always speak of and refer to Risk when they mean Likelihood or Threat which is fine but the Information Security professional must be absolutely clear of Likelihood, Impact, if they are going to manage a successful Information Security Framework and Data Protection environment. In my next article we will look at the anatomy of a Risk Assessment and will be considering Threat, Capability and Intent.   Written by Andrew Denley With more than thirty years’ experience in technology, Andrew has worked in a variety of industries including Maritime, Research & Development, Central Government, Business and Consultancy. Trained as a Maritime Electronics and Radio engineer he has diversified as Information Technology has advanced and has spent the last ten years specialising in Information Security and Data Protection. He is a qualified Risk Practitioner, GDPR Practitioner and ISO27001 Lead Auditor and has considerable experience in CLAS-related Security, Cyber-Essentials and NIST Information Security. He has co-written a technical guide to GDPR aimed at the non-European market which is due to be published in late 2018. Find Andrew on LinkedIn.

The Senior Managers and Certification Regime (SMCR) emerged from the 2013 Parlimentary Commission on Banking Standards. Jointly driven by the FCA and PRA, the three main objectives of SMCR are: To focus individual accountability on a narrower number of senior managers To encourage senior managers to take greater responsibility for their actions To make it easier for regulators to hold individuals to account SMCR was implemented for banks, building societies and major investment firms from March 2016, and then extended to insurers from 10 December 2018 followed by full roll out to almost all regulated Financial Services firms from 9 December 2019. In anticipation of this roll out, FourthLine hosted a Breakfast Briefing titled ‘SMCR: Individual Accountability within Investment Management firms’ at the Sky Garden on 14th September 2018. We were joined on the morning by John Chrimes, a Programme Manager with experience of delivering complex and high profile change programmes within the Financial Services, Asset Management and Retail sectors. .embed-container { position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%; } .embed-container iframe, .embed-container object, .embed-container embed { position: absolute; top: 0; left: 0; width: 100%; height: 100%; }   John shared his experience of implementing the regime end-to-end within a Bank, and drew on his experience running the programme at an Insurer. Topics discussed included: The regulation itself and what it means for Investment Management firms.  Potential challenges and how to overcome them  How to engage with senior stakeholders  Following the event, we caught up with John to find out more about the areas of debate covered during the session. .embed-container { position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%; } .embed-container iframe, .embed-container object, .embed-container embed { position: absolute; top: 0; left: 0; width: 100%; height: 100%; } If you’d like to find out more about what was discussed during the morning, including some key takeaways, please email [email protected]

To find answers to these questions, FourthLine hosted a Breakfast Briefing on 11th September 2018 to discuss steps to embed privacy culture in a post GDPR world. Joined by guest speaker Helen Woolett, Group Compliance Counsel & Data Protection Officer at The Body Shop, the morning identified different standpoints on how we are moving forward into a new digital age. .embed-container { position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%; } .embed-container iframe, .embed-container object, .embed-container embed { position: absolute; top: 0; left: 0; width: 100%; height: 100%; } Topics discussed on the day included: Are we ready as organisations to support rights and breaches? What do we see the regulators doing? What is being seen in the public domain? What is the future for data protection and GDPR training? Have we identified the right talent for a long-term privacy strategy? Are we exploring all the options for building out our privacy function including graduates, interns, analysts and managers? How can we influence the board in to signing off on additional privacy resources? In our interview below, Helen discusses where organisations are up to with the implementation of their GDPR programs and what the next few years may hold. .embed-container { position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%; } .embed-container iframe, .embed-container object, .embed-container embed { position: absolute; top: 0; left: 0; width: 100%; height: 100%; } With the UK’s largest specialist information risk recruitment team, FourthLine are in a unique position to comment on data protection resourcing market activity, and presented some of our findings at the event. Below is some of the types of moves we’ve seen in the market during 2017-2018: 1. Internal promotion and side stepping from legal, risk & compliance 2. Contract roles leading to permanent positions: 3. Plenty of movement and career progression into new firms If you need support in bringing privacy specialists into your business or would like to discuss any of the above topics in more detail, contact our Information Risk team on 0203 800 1099 or email [email protected]

FourthLine’s first Retail Conduct event of 2018 was held at the highly impressive Sky Garden on Fenchurch Street, and focused on good conduct and culture and the link to leadership. We were joined by guest speaker Gary Storer from Enterprise Learning, who presented and led the group discussion. Jodie Sable, Managing Consultant of FourthLine's Retail Conduct team, summarises the main talking points of the event: .embed-container { position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%; } .embed-container iframe, .embed-container object, .embed-container embed { position: absolute; top: 0; left: 0; width: 100%; height: 100%; } Some of the key points raised and debated were: The FCA’s belief that culture, conduct and leadership are intrinsically linked The five key points the define good conduct culture: customer focus, capability, reliability, effectiveness and motivation Examples of the drivers of poor conduct The link to leadership: distinguishing drivers and capabilities How to develop the provider and consumer relationship Following the event, Gary gave us his thoughts on the importance of getting culture and leadership right. .embed-container { position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%; } .embed-container iframe, .embed-container object, .embed-container embed { position: absolute; top: 0; left: 0; width: 100%; height: 100%; } Gary’s 6 tips to develop a stronger conduct culture were: Educate and develop your regulated leaders Benchmark your ‘conduct culture’ regularly, separately to staff engagement surveys HR should understand conduct and risk Risk specialists need to understand culture, leadership and organisations Make conduct, culture and leadership the purpose of SMCR Don’t ever assume your culture is fixed! It always needs to be worked on. What is conduct culture? Customer focus: the focus, encouragement and priority given by management throughout the organisation to deliver great customer outcomes Example: reward and recognition for outstanding customer service Capability: the value placed on continually developing staff and management ability to deal with customer requirements or complaints/issues directly or strategically Example: prioritising high quality training, coaching and feedback provided to customer service staff and managers at all levels Reliability: the importance given to ensuring customers can rely on the organisation to deliver its promises to them Example: the extent to which errors or complaints are prioritised and corrected for customers. Effectiveness: valuing effective processes and technology to support effective customer delivery Example: the extent to which leadership is perceived as investing in high quality technology and dealing with issues which compromise customer service. Motivation: how much staff and managers feel motivated to deliver fair customer outcomes and outstanding customer service Example: empowering and encouraging staff to support customers and ‘go the extra mile’ for them. If you would like to find out more abut any of the above points or discuss your resourcing requirements, contact FourthLine on 0203 800 1099 to discuss the ways in which we can help.    

2018 is proving to be a challenging time for sell side firms, as they face up to the uncertain challenge of Brexit whilst simultaneously navigating a myriad of potentially overlapping regulations. What is driving change within the Sell Side? There are a number of regulations affecting sell side firms that have either recently come into force or are approaching on the horizon, from MiFID II and GDPR to BRRD, SMCR and SFTR. Alongside this, Brexit is an ever-looming presence over financial services, with its timeline overlapping that of the regulatory reforms. This overlapping of deliverables in increasing critical dependencies across differing complex programs of work, ultimately increasing the risk of failure. Sell side firms are attempting to assess the operational impact of Brexit and prepare their new business models in response to its challenges, whilst operating in a state of uncertainty. In these politically uncertain times, firms need to prepare for the worst-case scenario of a hard Brexit and look at their licences, booking models, technology and resources. Firms would be wise to take on board some of the lessons learned from MiFID II, and not leave it too late to prepare. Although there is much uncertainty surrounding Brexit, talented specialists are going to be in extremely high demand. As Brexit will cover all sector and not just Financial Services, the supply of experts will be even more stretched. What skills and types of experts are in demand this year? With a wide selection of major regulations requiring attention from sell side firms to achieve ongoing compliance, we expect experts whose experience overlaps across these regulations to be in high demand. Expert talent who can take a holistic view and understand the impacts of these various regulations, and the way they work alongside each other, will be particularly desirable for employers. As firms continue to set up their Brexit programs, we are seeing demand for the following experts and related skill sets: Project/Program Managers - Regulatory Change Delivery specialists - Stakeholder management and end to end program/project design and delivery Business Analysts - Ability to conduct gap analysis on existing business models and overlay regulatory requirements, review existing legal entity structure, and the extent to which it will meet future requirements of the business and where change may be required - Design TOMS and identify options for updating entity structure Legal and Compliance Specialists - Contract negotiations, jurisdictional framework review - Legal documentation review specialists Operational Change Specialists - Agreeing process changes, booking models etc - Client re-papering - Running complex client outreaches HR Professionals - Resource management and restructuring Technology Professionals - Technology System Changes, software development Experts who have touchpoints with European regulators, specifically Irish or German, will also be wanted as firms build their operations in the EU. On a somewhat related note, there will also be demand for those who have experience of setting up new premises or offices. We are seeing demand for experts within our network who have proven experience in running multi-jurisdictional projects, with the ability to manage offshore teams, complex workstreams and navigate regulatory differences. Finally, we are also being contacted by clients looking for change communication specialists, who can effectively communicate change strategies across all areas of their business. What are FourthLine’s predictions for the rest of 2018? Whilst there is undoubtedly a huge amount of uncertainty surrounding Brexit, one thing we as a specialist recruiter can confidently predict is that there will be a huge demand for Brexit specialists, and that they will come at a premium cost. If your firm hasn’t already started preparing your Brexit program, we would advise you get in touch with FourthLine as soon as possible so we can connect you with the expert talent you need from within our extensive network. There is going to be a real stretch of resources, and not acting now could run the ultimate risk of firms not being able to do business following Brexit. The nature of Brexit’s requirements mean that we could see different organisations trying to do similar activities at the same time, potentially leading to regulatory congestion and processing delay. We anticipate some Financial Services firms will need to recruit from outside of Financial Services to find the talent they need, whilst conversely the cross-industry nature of Brexit could see non-Financial Services industries leveraging experienced talent from Financial Services. This could further reduce the size of the available resource pool. Under pressure to meet the challenges of overlapping regulations and Brexit, smaller firms may struggle to mobilise in time. We expect that as a result, we may see the merger of smaller brokerages so that they can stay competitive whilst also compliant.   If you’d like to find out more about any of the above points or discuss your recruitment requirements, get in touch with our Sell Side Regulatory Change team today.  

FourthLine work with clients across the insurance, banking and wider lending sectors, connecting them with the expert talent within our extensive network of expert talent. What types of skills are in demand? Across Retail Financial Services we see a consistent need for policy, advisory, monitoring and generalist compliance experience, which is usually the result of growth or the natural turnover of staff. As a rule, our smaller clients tend to favour candidates with more generalist experience so that they’re able to cover more areas. More recently we are seeing a lot of firms strengthening their back office infrastructure based on ever increasing regulatory scrutiny and consequently they’re in a position to invest in more specialist skills such as policy experts. As always, compliance needs to work with businesses and not against them so our clients are always asking us for candidates with good examples of working with stakeholders at all levels. This includes good influencing skills, an understanding of technical areas, and ensuring products have informed conversations at the right level. In terms of new skills, we’re seeing a very close link between Brexit and the need for candidates with policy or documentation review skills. Any changes that come in because of Brexit will mean a need to review an entire suite of policies. We are also seeing an increased demand for European language skills as a result of Brexit, as well as a desire for experience or knowledge of European regulation. Finally, in cases where smaller companies don’t have the budget or need for a Data Protection Officer, we are seeing a need for compliance professionals to upskill or develop broader expertise around data protection. What types of experts are in hire demand? We are seeing demand for the following types of experts: Separation/authorisation experts – the UK appears to be an appealing place to domicile a financial services business, but it does come with risks. Businesses who need to alter their permissions or apply for a full PRA license will be in need of authorisation specialists. Culture and Conduct experts – this year will see the FCA drive culture and conduct more than ever, so there will be a greater need for leaders to embed a strong conduct culture. We predict that firms will invest more heavily in training and competence at a senior level to help define and embed culture throughout their businesses. Technology – firms are embracing new technology across all of their operations, so candidates with experience of different technology platforms will be in high demand, as will those who are open to embracing new ways of working. What is driving change within Retail Finance and Insurance? There are several elements driving change across Retail Financial Services, from Brexit (which is driving change across the whole of the Financial Services environment) to regulations such as SMCR encouraging increased accountability and the 5th Money Laundering Directive. As mentioned above, new technologies are also a driving force of change. Another cause of change is the FCA increasing their efforts in relation to enforcement. The regulator also plans to look more closely at other culture and governance challenges, including remuneration, culture, and conflict of interest issues. Will firms need to reassess how they incentivise their 1st line of defence? What are FourthLine’s predictions for the rest of 2018? We expect to see salary increases across Retail Financial Services, as firms are working harder to ensure they retain their staff. Firms don’t want to lose the top talent or need to go through the difficult process of recruitment, and we’re seeing more counter offers than ever before. Saying that however, some firms are totally out of sync with the market when hiring new staff, especially when it comes to positions that they haven’t hired for before. If this doesn’t change, they are going to miss out on the best talent. The industry wide roll out of SMCR and increased accountability from a personal perspective will also drive salary increases. More generally, the market stays busy throughout the summer and into the final quarter of the year. We anticipate permanent regulatory compliance hires to remain stable, whilst we expect to see an increase in the need for interim regulatory specialists to provide support with regulatory change agendas, especially SMCR. If you’d like to find out more about any of the above points or discuss how FourthLine can assist with your resourcing requirements, get in touch with our Retail Conduct team on 0203 800 1566.

On the 16th May 2018 FourthLine hosted a breakfast briefing event focused on "How to select and interview high performance Data Protection Officers" at London's Sky Garden. We were joined on the day by guest speaker Rachel Mulligan, a qualified solicitor in the UK and Ireland and an Attorney-at-Law in New York. .embed-container { position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%; } .embed-container iframe, .embed-container object, .embed-container embed { position: absolute; top: 0; left: 0; width: 100%; height: 100%; }   Topics discussed on the day included: The DPO role – what is it, do you need one, where should the role sit within your organisation? Making the hire – creating the role and writing the job description, what qualities should a successful DPO possess? How to interview a DPO – what should you be asking them and how should you assess their answers? How to ensure the DPO succeeds in the role – what infrastructure and support do you need to provide? Watch our interview with Rachel to find out more about the role of the DPO and which skills are transferable to a DPO position. .embed-container { position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%; } .embed-container iframe, .embed-container object, .embed-container embed { position: absolute; top: 0; left: 0; width: 100%; height: 100%; } If you need any advice or support on bringing a data protection specialist into your business, contact FourthLine on 0203 800 1099 to discuss the ways in which we can help.

It’s fair to say that 2018 has been a huge year for data privacy, and it’s been a hot topic for discussion from boardrooms to newspaper front pages. As organisations have been taking the steps needed to meet the requirements of the General Data Protection Regulation (GDPR), FourthLine’s Privacy team has grown into the largest specialist data privacy recruitment team in the UK. With 10 consultants solely focused on helping businesses make permanent and interim data privacy and information security hires across the Financial Services, Technology, Retail, Media and Publishing sectors, we consider what is driving hiring demand this year and what the rest of the year will have in store. What skills are in demand this year? With so much attention and resources being geared towards GDPR compliance, it’s unsurprising to find that demonstrable GDPR project experience is high up on the list of attributes that employers are looking for. There is a desire to see candidates who have led or contributed to the delivery of successful GDPR projects, from initiation through to closure with quality work delivered within the agreed timescale. Specific operational skills are going to be in high demand, with employers requiring expert talent who can look at policies and procedures, ensure they are up to date and then put them into practice across their business. The ability to produce quality risk assessments and Privacy Impact Assessments, or answer Subject Access Requests effectively and efficiently, are all going to be sought after skills. Experts with strong stakeholder management and relationship skills are also going to be in high demand this year. Where previously roles may have been focused around getting programs up and running with some stakeholder investment, there is now going to be a shift towards embedding data privacy practices within the culture of a company and educating staff cross the wider company. As we discussed in How to select and interview a DPO, DPOs who can relate and engage constructively across a business will be highly desirable for employers. Of course, not all data experts will necessarily have the strongest interpersonal skills, so there may be opportunities to provide content and guidance to professional trainers who can then come into an organisation and deliver the required training. What types of experts will be in hire demand? GDPR has led to an increased demand for Project/Program Managers and Business Analysts, usually brought in on contracts to deliver GDPR compliance within an organisation. We expect to see these types of experts still in demand as organisations continue to get themselves compliant, but with GDPR now here we should see organisations looking for permanent GDPR SMEs as companies think long-term about continued GDPR compliance and the embedding of data privacy practices at the heart of their outlook. Specifically, we expect SMEs with demonstrable data privacy experience, such as DPOs, Data Protection Consultants and Managers, and lawyers, to be in particularly high demand. As the supply of DPOs will be unable to meet such high demand, it’s possible that experts who were previously in interim roles could look to become DPOs in order to fill any gaps. We also anticipate a demand for data privacy trainers, who can either work in-house or come into a business and train staff on all matters of data protection. This could be an excellent career move for those currently working in interim roles who are coming towards the end of their contracts. What is driving change within the privacy sector? It goes without saying that GDPR is the biggest driver of change within the privacy sector, and this is expected to continue for at least the next 6 months as organisations continue to get themselves into a position of on-going compliance. The Data Protection Bill and the new ePrivacy Regulation can also be viewed as drivers of change, with the latter now expected to arrive next year and worthy of attention. The Senior Managers and Certification Regime (SMCR) also needs to be considered, as it will hold senior managers to account for their organisation’s use of data. How is data privacy recruitment changing this year? The biggest shift we expect to see in the privacy sector this year is an increase in the demand for permanent rather than interim professionals, especially towards the later stages of the year. Contract employment was in high demand due to the pressure to deliver GDPR projects, but with contracts coming to an end as work is completed companies will now be looking more long-term in their privacy goals. We expect to see companies looking for full time DPO roles, as they consider ways to embed privacy into the heart of their business and develop an ethical culture of data processing. Indeed, any new product or project will be approached with data protection a consideration from the very start. Processes and procedures that were set up as part of GDPR programs will need to be continually reviewed and updated as businesses evolve. What are FourthLine’s predictions for the rest of 2018? At FourthLine we expect to continue assisting companies with the recruitment requirements of their GDPR projects across the remainder of 2018, but as mentioned above there should be a shift towards an increase in permanent roles later in the year. It’s probably fair to say that a lot will depend on what sort of penalties are handed out by the ICO to non-complying organisations. With companies trying to save money and a lack of experienced data professionals in the market, we should see organisations consider training up compliance juniors into DPO roles within their current company, potentially asking contractors to deliver training before their contracts finish. Alternatively, there me some lenience in skill set requirements, as there simply isn’t the supply of experienced DPOs to meet the current demand. We also expect to see data privacy experts moving from the public sector to roles within either the financial or wider private sector, and also foresee an increase in new data protection auditor roles. Finally, with the expected switch of contractors into permanent positions there could be a clash between candidate’s salary expectations and the reality of what companies are prepared to pay. Accustomed to high day rates, contractors may need to realign their expectations as they move to full time employment, but we may see salaries increase across the board as a result. If you’d like to find out more about any of the above points or discuss your data privacy recruitment requirements, get in touch with our Privacy team on 0203 800 1558.

2018 is proving to be a challenging year for Buy Side firms, with regulatory pressures increasing whilst the uncertainty of Brexit’s impact looms large. At FourthLine we are well positioned to help firms navigate these challenges and build their change programs, drawing upon our extensive network of expert talent. What is driving change within the Buy Side? The Buy Side is currently facing up to seismic shifts, as its landscape is transformed by new regulations and geopolitical uncertainty. MiFID II was implemented at the start of this year and with it came sweeping changes. Implementation was fairly smooth, but there is still a lot of work to be done particularly in the areas of Transaction Reporting, Costs & Charges and Research Payments. Brexit remains a complicated and uncertain issue for Buy Side firms, with its output unknown and clarity difficult to come by. It seems certain that it will lead many firms to relocate to Europe, and this will in turn drive demand for certain change professionals. Firms also need to look ahead to SMCR, due in 2019. Whilst final requirements are still to be confirmed, firms will need to ensure they are in a position to understand how the changes will affect their business and plan implementation strategies. What skills and types of experts are in demand this year? Whilst most firms have deployed compliant MiFID II solutions, as we move into Day 2 a significant number of contracts have not been repapered or are still being negotiated. This will lead to demand for legal professionals who specialise in the area. With many firms outsourcing their Transaction Reporting requirements to ARMs, there will also be a need for oversight specialists who have experience of designing and building oversight functions, as well as experts with strong vendor relationship management skills. Professionals with experience and knowledge of Research Payments and Costs & Charges are also likely to be in high demand. In relation to Brexit, we expect to see a huge increase in demand for contracted change experts across the whole project spectrum. Whilst we don’t know exactly what Brexit will look like at this point, professionals with knowledge of Passporting agreements for UCITs and AIFMD funds are likely to be in high demand, and there will undoubtedly be a requirement for regulatory lawyers and legal experts. Professionals with experience of corporate restructuring will be wanted, whilst the changes to derivative clearing should present opportunities for change professionals with knowledge of the current regulatory landscape and intricacies of the European Financial Services infrastructure. Firms looking ahead to SMCR will require change specialists who have successfully implemented SMCR within banking firms and those with HR experience with regulatory project work. How is the Buy Side changing this year? We expect the Buy Side to continue to see unprecedented levels of change, with much depending on how Brexit plays out in the UK. The impact of MiFID II will continue to be felt, with more responsibility on Buy Side firms to ensure that systems are working as they should be on a daily basis and a shift in the wider culture, with a greater need for transparency. The upcoming SMCR should also lead to a change in where accountability sits, and ultimately the way in which firms behave. What are FourthLine’s predictions for the rest of the year? By all accounts, the unpredictable nature of Brexit makes it extremely hard to predict what will happen over the next year to the Buy Side, though firms would be wise to plan for worst case scenarios. A lot will inevitably ride on what decisions are made with regards to access to the Single Market and the Passporting of funds. With regards to MiFID II, we anticipate that some firms may fall foul of the regulation as the FCA start handing out fines. In some cases, firms ran light MiFID II programs and mistakes will have been made, so we expect to see the recruitment of MiFID II experts throughout the year to assist with remediations. We also expect SMCR to drive demand for change professionals with a strong understanding of the senior management regime requirements, conduct responsibilities and regulatory reporting. If you’d like to find out more about any of the above points or discuss your recruitment requirements, get in touch with our Buy Side team on 0203 800 1568.  

Due to the recently implemented MiFID II Transaction Reporting requirements and extensive use of Approved Reporting Mechanism vendors like TRAX and UnaVista, asset management firms are likely to need to design, implement and build an oversight function to ensure that they are fully compliant in the future. On 1st May 2018, FourthLine hosted our MiFID II Transaction Reporting - Building ARM Oversight Functions breakfast briefing at London's impressive Sky Garden. We were joined by guest speaker and MiFID II consultant Kristian Martin-Dominguez who led an informative discussion on the opportunities and potential pitfalls of building this kind of function within an asset management firm. .embed-container { position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%; } .embed-container iframe, .embed-container object, .embed-container embed { position: absolute; top: 0; left: 0; width: 100%; height: 100%; }   Following the event, we caught up with Kristian to find out why oversight is important and how you should hold ARMs accountable. .embed-container { position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%; } .embed-container iframe, .embed-container object, .embed-container embed { position: absolute; top: 0; left: 0; width: 100%; height: 100%; }   If you are looking to build an oversight function within your business, contact FourthLine on 0203 800 1099 to discuss the ways in which we can help.

2017 was the first year that firms were audited under the FRC’s new standards, and it’s likely that the FCA were more lenient in their approach as a result. Following this year’s audit however, posted to the FCA on 30th April, it’s unlikely that the regulator will be quite so tolerant with fines again. The FCA will make the decision to scrutinise or investigate any audits that arouse suspicions, giving firms 48 hours’ notice for a spot check of their CASS RP. Whilst inside a firm, the FCA can also investigate compliance with other regulations such as GDPR or MiFID II, and issue a s166 notice if necessary. What types of experts will be in hire demand? At FourthLine we see a pretty consistent level of demand for CASS experts, but are there are two main types of experts that we expect to be in particularly high demand following this year’s audits. Firstly, we anticipate firms will be looking to bring in experienced TPA Oversight Specialists. As the FCA considers that the outsourcing firm holds responsibility to ensure that it has effective oversight in place, there will be a big demand for experts who can strengthen firms in this area. Reporting directly into the CF10a, TPA Oversight Specialists will need to go over all CASS dealings in fine detail, overseeing and monitoring collateral transactions. They will need to be able to analyse different outputs specific to their TPAs, identify areas of concern and address them. In addition, we also expect CASS Assurance Specialists to be in high demand. These experts control the mapping and testing of CASS within a firm, and whilst this job tended to be done thoroughly when the new rules were introduced, inevitably it’s likely that standards have now slipped. We wouldn’t be surprised if this hasn’t been tested or updated in some firms since last year, so bringing expertise into the assurance space should resolve any issues raised in this year’s audit and reduce the risk of an adverse audit in the future. What skills are in demand this year? There are typical skill sets that will always be in demand within the CASS market, and any expert with a thorough knowledge of CASS and the ability to demonstrate their experience will be sought after. In line with the roles discussed above, experts who have strong social and stakeholder management skills will be of particular use to potential employers. These roles require someone who can show assertiveness and push back when necessary, present to stakeholders and build strong relationships across the firm and with third parties. What is driving change within the CASS market? We expect remediations from the latest CASS audit will be the main driver of change within the CASS market this year. In particular, we anticipate a need for line-by-line rule mapping in response to the FRC’s new Assurance Standards. Additionally, oversight of TPAs will be another area driving change, with the FCA increasing their focus on TPAs due to a perceived underperformance. What are FourthLine’s predictions for the rest of 2018? We expect that the next 6-8 weeks will be very important within the CASS market, and we’ve been preparing thoroughly for this period. As firms start posting the results of their audits we should see an increased demand for CASS expertise, and FourthLine are ready to help firms with their resourcing requirements with up to 150 CASS specialists qualified within our network. We anticipate that the firms who have something to be worried about following the audit will be hearing from the FCA sooner rather than later, giving them more time to prepare for remediations. It’s likely that all firms will have some feedback to respond to, and whatever level of assistance you require, FourthLine can connect you to the expert talent you need to resolve any issues. Beyond this upcoming period of increased activity, we expect the rest of 2018 to be busy for our CASS team, partly driven by the knock-on effect of specialists changing roles and creating new openings in the previous companies, and partly due to the business as usual nature of CASS recruitment. Finally, we anticipate some demand for senior CASS experts in response to the Senior Managers & Certification Regime (SMCR) later in the year. Firms that currently have multi-control function holders are likely to be targeted by the FCA, who aren’t keen on individuals wearing too many hats within a firm. In these instances, we expect small firms to be looking for experienced CASS specialists to come into new dedicated CF10, CF10a or CF11 roles. If you’d like to find out more about any of the above points, or discuss your CASS recruitment requirements, get in touch with our CASS team on 0203 800 1553.

FourthLine’s Retail Conduct team supports clients across retail banking, wider lending, payments and insurance to hire risk management and assurance, regulatory compliance and change professionals on a permanent and interim basis.  Although our clients offer a diverse portfolio of products and services, we have identified considerable similarities in the candidate skills and experiences they value most when looking to hire business-critical regulatory talent. Balancing Commerciality with Compliance Companies want confidence that their board, senior management and wider leadership teams are making critical decisions with both growth and innovation in mind, as well as ensuring regulatory compliance and reducing the risk of reputational damage. How do we go about identifying regulatory professionals with this type of mindset? It does heavily depend on the businesses they have worked for, at what level and what type of exposure they have had to the launch of new products, new initiatives, acquisitions and more. It might be that they have been specifically involved in designing bespoke policies in relation to new products or sat on the board or a committee. The implementation and soon to be extension of SMCR should in theory mean that firms will have to make more balanced decisions and therefore the next generation of regulatory professionals will all have this mindset. Theory Vs Implementation When making critical hires, it’s essential to identify candidates with not only detailed theoretical understanding of existing and upcoming regulations, but also practical experience of implementing the associated changes. Knowledge of regulatory rules or handbooks alone without experience reviewing, amending and rolling out new policies and processes is often a concern for hiring managers with smaller teams where a more diverse skill set is needed. The ideal candidate will have experience of understanding the regulation and then creating fit for purpose solutions, across a variety of businesses with different needs or goals that allow for growth or innovation.  Experience working on change projects, whether driven by regulation or individual business change, is highly valued by hiring managers. When qualifying this experience, we look for evidence of ‘I’ vs ‘we’, the detailed impact of their involvement as well as seeking assurance of their contribution via testimonials. Effective stakeholder management I don’t think I have ever taken a job specification from a client where relationship building skills or effective stakeholder management has not been one of the most important things to get right in the hiring process. But what does that mean, and which stakeholders are we specifically referring to? We want to find candidates who are business facing and regularly meet with, advise and challenge other key decision makers within their firms. Most businesses say that want to build a compliant culture, or for compliance to work with the business and not against it, so it’s essential that compliance professionals find common ground with the first line of defence and wider business. An effective compliance professional will adapt their style based on the stakeholder they are working with and take time to understand their goals and deliverables to empathise. We would seek to understand the different stakeholders our candidate has worked with and what sort of challenges they have faced and overcome. Specialists vs Generalists Depending on the business, the structure of the team and the role itself, we are often asked to acquire candidates with either specialist or more generalist skills and experience. There are multiple ways in which we might differentiate or assess the two. Firstly, are we looking for specific skills, in a particular sector, or are we looking for an industry expert? Similarly, are we looking for a compliance generalist, who can turn their hand to writing policy, working on change projects, interpreting upcoming regulations and creating solutions or are we looking for more of an industry generalist such as compliance professional with varied experience across general insurance, retail banking or payments. There are of course advantages of hiring both, as mentioned above, dependant on the needs of the team and wider business. As Fourthline have a detailed knowledge of all compliance disciplines, we are skilled at recognising a true specialist vs key words on a CV! Qualifications As FourthLine’s Retail Conduct team works with firms across banking, wider lending, payments and insurance, we often find that certain qualifications are more desirable than others as a result. From a technical compliance perspective, ICA qualifications are strongly preferred and again dependant on the level of the role being recruited for. Sometimes more of an industry focused qualification is more desirable. Several mortgage provider clients insist on a CeMAp qualification to better understand the process that their mortgage advisors go through and to provide more empathetic advice. Our insurance clients prefer their compliance team to hold CII or ACII, sometimes instead of or in addition to ICA qualifications. Are they needed? I would always be inclined to argue that experience is more highly valued than qualifications. However, in a competitive market, qualifications might represent something further than just knowledge. Commitment and dedication to building a career in compliance is something hiring managers have recently asked to me ascertain. Personal investment in acquiring relevant qualifications is something I would review when assessing this. Culture Finally, I’d like to discuss the ever-topical issue of Culture. Arguably, ‘cultural fit’ is not a skill or experience, but it is definitely one of the most important things that my clients ask me to prioritise, no matter what size of the firm or whether the role is a permanent or interim hire. The skill of accurately assessing cultural fit and subsequently matching suitable candidates and clients is highly demanded of good recruiters in the sector. Following recent market research we have conducted, feedback from our clients suggests that this, in conjunction with our ability to understand and assess technical competence, is why they would choose to work with us over our competition. By taking the time to understand how our clients define their culture, we are able to shortlist candidates we’re confident share the same values, beliefs and have similar approaches and attitudes. The positive impact of valuing cultural fit as equally important as technical skills means both the candidate and client are given confidence that the career move or hire is going to be the right one. This has just been a snapshot of the in-demand skills and experience we’re looking to identify every day on behalf of our clients. Different firms will value and prioritise different profiles according to their company vision, culture, market position and existing talent. However, it’s also our responsibility to share these insights and support our valued network in making the right choices to invest in the skills, experience and qualifications that allow them to progress their careers and ultimately secure their dream roles. To discuss your recruitment needs with one of our team, please contact us.  

On 24th April 2018, Fourthline hosted an event at London’s Sky Garden on the topic of ‘Creating and delivering your Brexit programme’. Our guest speaker Remi Adebonojo, FCMI, guided the discussion to help our attendees understand the skill sets needed to create the best contingency plans and mobilise a programme delivery team. Following the event, we caught up with Remi to find out more about the challenges of preparing for Brexit from a financial services perspective. Why is creating your Brexit programme important at this time? What happened in the past with regulatory change programmes was that firms have waited until the deadline is looming to actually start work, but with Brexit, as it’s a political initiative, you’re not going to get the level of clarity required to deliver when you need to so the idea is to focus on your worst-case scenario now. There is a lot of change required, so you are going to have to consider whether you look at things such as authorisation. You’re going to have to look at it from an operational perspective as well, so what is your legal entity model going to be? How will you go about delivering on that? All of these things are going to take time, so you’ll need to start working on them now. To what extent do you think firms are engaged on their Brexit plans? There is a wide gap between firms at the moment. The bigger firms have done a lot of work and are fully engaged on it, whilst a lot of the smaller firms still haven’t decided what approach to take on Brexit, whilst some haven’t even started to look at it. That gap is what we’re looking at now and trying to resolve so that we can move things forward. I would say that firms are not 100% committed or focused on it yet, but over the next few months there will be a lot work started on it. To mobilise an effective Brexit program, what skills sets do you think will be most important? Like regulatory change programmes that have gone in the past, you will need someone who can bring all of this together. There will be several deliverables that you’ll need to co-ordinate, so you'll need a very strong project manager or programme manager, who can look at things end-to-end. You’ll also need people to support them, such as PMOs. Business Analysts who can understand the work that needs to be done, perform gap analyses on that work, and understand the operating models and design new ones will also be required. You need people from a legal background who can look at jurisdictions and negotiate contracts, and you’ll also need to bring HR to the table to look at resourcing and where resources will be based. And of course, you’ll need people from a technology background to look at this and understand what technology you require to move this forward.   If you’d like to receive the event follow up pack or discuss the ways in which FourthLine can help your firm prepare for Brexit, please contact our Sell Side Regulatory team through Gareth Foulkes. FourthLine are planning more events discussing Brexit and its implications for Financial Services firms, and you can find out about our future events at www.thefourthline.co.uk/events.

Held at the highly impressive Sky Garden on Fenchurch Street, the breakfast briefing lasted for 2 hours and included a 30-minute presentation and Q&A by one of the CASS experts in our network, Kenneth Green of Equilibrium Green. This was followed by a peer2peer discussion over breakfast. Kenneth advised what would happen if the FCA decided to undertake a 48-hour RP review and how best to prepare. Some of the key points discussed included: The FCA are likely to notify you of the 48-hour review via a call and will expect the CF10a to be on-site regardless of availability. Double check the RP and ensure complete accuracy, including getting a peer to fully check the links etc. Ensure that everyone who is involved with the RP and CASS in general is on-site and available to meet with the FCA associate. Appreciate that the visit hasn’t concluded until the FCA provide written confirmation. Ask for all feedback to be provided in writing, as verbal feedback may not be considered once the visit has concluded. Conduct a regular mock review of the RP by a 3rd party. Ask for a minute taker to ensure that everything discussed is well documented. After the event, we caught up with Kenneth to get his feedback on the event and find out more about how firms can prepare for a review. .embed-container { position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%; } .embed-container iframe, .embed-container object, .embed-container embed { position: absolute; top: 0; left: 0; width: 100%; height: 100%; } Our next event will be an online webinar focusing around the importance of strong TPA oversight following the increase in demand for CASS Oversight professionals. We are expecting between 60-80 senior CASS professionals to be present on the call, so if you are interested in attending please contact James Carter on 0203 800 1553. FourthLine are offering a new service in the form of a mock CASS RP review conducted by Kenneth Green who has been involved with 19 different CASS RP’s. For more information, or to discuss any other recruitment needs in the CASS space, please feel free to contact us on the number above.

Many of our SME customers are reporting a lack of experience when it comes to hiring Data Protection practitioners combined with little knowledge on how to recognise, interview and select the best person for the job. That’s why we organised the webinar ‘How to select and interview Data Protection Professionals’ on 22nd March 2018. Featuring our speakers Dan Waltham, Head of Privacy Practice and Boris Wojtan, Privacy Director of GSMA, member of IAPP's European Advisory Board and a recognised authority on Data Protection, the webinar covers: Assessing a Data Protection CV – what should a Data Protection expert look for when assessing a candidate CV? How to interview for a Data Protection Practitioner – what should you be asking and how should you interpret the answers? Making the hire – ideas to gain flexibility in a talent short market Where to place the DPO - practical advice on where the DPO should sit within your organisation This webinar is for any hiring manager or internal recruiter facing that challenge and will offer practical tips to help overcome that current knowledge gap. Watch the webinar recording. Please note, we experienced some technical issues affecting the sound quality during the recording of this webinar, but this should only affect the beginning of the recording Keep an eye on our Events page for the latest specialist industry events and webinars we'll be hosting, giving you the opportunity to come together with our other clients and candidates to discuss best practice around a range of topics.

In June 2017 FourthLine held an event to help provide insight for non-banking retail financial services firms about how to manage their SMCR programme ready for implementation in 2019. .embed-container { position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%; } .embed-container iframe, .embed-container object, .embed-container embed { position: absolute; top: 0; left: 0; width: 100%; height: 100%; } Keep an eye on our Events page for the latest specialist industry events we'll be hosting, giving you the opportunity to come together with our other clients and candidates to discuss best practice around a range of topics.  

The demand for CASS Professionals continues to increase year after year due to a continued focus by the regulator. This has resulted in a large skill shortage in the CASS space, especially at the senior end. CASS Compliance (2nd Line) CASS large firms are beginning to add a further layer to ensure CASS Compliance by introducing a CASS SME role within the 2nd line. This reduces the risk of any breaches going unnoticed by having a CASS Expert sitting within the Compliance team. Relationship Management Skills Following multiple fines due to failures in the oversight of firms TPA and other external partners, firms have looked to shore up the relationship management skills within the CASS team. This improves the accuracy of the firms' TPA and gives the firm an opportunity to push back when necessary. CASS Assurance Following the new FRC Assurance standards in 2017, firms have increased resources from a 3rd line/Assurance perspective. Last year, the regulator had likely been more lenient as it was the first year of the new audit standards, though the same can’t be said for 2018. Increasing expertise in the assurance space reduces the risk of an adverse audit. CF10a With the pending impacts of the Senior Managers & Certification Regime, smaller firms with multi control function holders in post will likely have to bring in someone to solely concentrate on each regulation. For example, each firm will either have to document the percentage of time dedicated to CASS, Compliance and AML, or they will have to appoint an individual for each regulation (e.g. a separate person for CF10, CF10a & CF11). To discuss your recruitment needs with one of our team please contact us.

As the General Data Protection Regulation (GDPR) requires certain organisations to appoint a Data Protection Officer (DPO), we have unsurprisingly seen many businesses taking the steps needed to ensure they will be compliant come 25th May 2018. To tackle GDPR effectively, you need to ensure that you have the right person in the position of DPO to deal with all matters of data protection, ensure you are and continue to be compliant, and develop an ethical culture of data processing within your business. We outline some of the key things you should be looking for from a candidate, and how to go about interviewing them. Creating the role It goes without saying that you’ll be looking for someone with an expert knowledge of data protection laws and practices. A successful candidate needs to have a thorough understanding of GDPR, and ideally previous data protection laws as well. The guidelines for GDPR don’t specify any formal qualifications needed to become a DPO, and in our opinion actual hands on experience is as important as qualifications if you are to get the right candidate. In an ideal world you’d be able to recruit somebody with 5-7 years of experience, who can demonstrate that they have created data privacy policies and programs and embedded these within a business, as well as carrying out data privacy impact assessments. In the current climate this could be difficult though, as the demand for DPOs far outweighs the amount of available DPOs out there, so you may need to carefully consider the level of experience needed for the role you are hiring. Of course, for larger firms you are going to need somebody with a good level of experience, but depending on the level of risk facing your business you may be able to start with somebody less experienced and invest in that person within the role. Be prepared to resource some external support though to ensure you are still getting the advice you need to ensure compliance. When it comes to setting out the duties for the role, it’s going to very much depend on the size of your business. If you have decided that you require a dedicated DPO, then the duties need to be comprehensively focused around data protection. The person needs to be able to set strategy, create policies and make them relevant to your business, understand how to evaluate risk within your business from a data point of view, and educate your employees (and potentially customers) on matters of data protection. They should be able to respond quickly to subject access requests, data breaches and complaints, and continually monitor policies and the effectiveness of your data privacy programs. In addition, there are going to be a variety of characteristics you’ll be looking for from a DPO, including strong communication skills, the ability to organise well, a keen attention to detail and the capacity to work independently and impartially to name but a few. Interviewing a candidate To find the right person to fill a hugely important role within your organisation, you will need to make sure that you get the interview process right and that you’re asking the right questions to assess a candidate’s suitability. Essentially what you’re trying to find out is how much hands-on data privacy experience they’ve had in terms of establishing policies, implementing programs, and rolling out training within a business. It would be wise to keep an open mind and be prepared not to find somebody who can tick every single box you’re looking for, as it’s unlikely you’ll be able to find a candidate who has experience of everything on your wish list. Consider what the absolute deal breakers are, but give yourself some flexibility. Look at the person in front of you and consider how much they could bring to your team and business on a whole. Some things you may want to try and find out about the candidate during the interview process include: What is their understanding of current security and technology issues and how they relate to Data Protection? What are their interpersonal skills like? Are they a business enabler? (To test this, you could ask for examples of times that they have added value to a project, brought innovative ideas, or made a process more efficient.) The one area that is crucial to almost every aspect of the DPO role is that they can relate well to people right across your business. You need to find somebody who can engage constructively and let people know that they are on their side, so find ways to test this in a candidate. You could find someone who knows the law inside and out, but if they can’t communicate it to the wider business then this could create a poor relationship with the DPO role and data privacy in general. Need any help? If you would like some advice around hiring a DPO or with your data privacy resourcing requirements, please contact Fourthline on 0203 800 1099 or email [email protected]  

2018 is set to be another year of turbulent change within Investment Management firms, driving the market's demand for Regulatory, Risk, and Compliance professionals. These are some of the key areas that I believe will be behind this demand: Brexit Whilst Brexit is highly likely to mean that Financial Services firms relocate a number of staff to European cities, as with all large-scale change it is also likely to drive demand for certain types of staff, such as change professionals and lawyers. We anticipate a spike in demand for contract change professionals across the whole project cycle, with a particular emphasis on the following: Passporting Arguably one of the most prevalent of impact areas, professionals with knowledge of Passporting agreements for UCITs and AIFMD funds will be in demand. Despite there now being less than a year left until the transition deal begins, there a still no concrete arrangements beyond the 2 year easing-in period. Phillip Hammond has signalled that the EU’s ambiguous proposal for ‘improved equivalency’ is “wholly inadequate”, meaning that there is some tough negotiating ahead before we know what access will be on the basis of. Regardless of the outcome, this type of professional will be in demand as there will be inevitable change requiring SME knowledge.   Clearing Another area likely to experience change is derivative clearing. Currently, Euro-denominated derivatives-clearing is largely conducted out of London but this has already become a point of contention, with other European cities vying to be the post-Brexit clearing centre. Change professionals with experience of MiFIR Best Execution are likely to be useful to Brexit programmes, as they have a knowledge of the current-state regulatory landscape and the intricacies of the European Financial Services infrastructure. Legal As with any kind of change, there will be huge amount of legal negotiations and agreements necessary regardless of the outcome. There has already been a large spike in demand for regulatory lawyers post-MiFID II implementation and this trend is likely to continue throughout the next few years as a result of Brexit. MiFIR Whilst MiFID II implementation on 3rd January seems to have been relatively smooth, there is still plenty of work to do for firms. There are 2 particular areas that I see driving hiring demand over the course of the year: Transaction Reporting With many firms outsourcing their Transaction Reporting requirements to ARMs like UnaVista or TRAX, there is a need to put in place robust oversight functions internally to ensure that the flow of data and reporting is accurate and timely. This will drive hiring demand for professionals with experience of designing and building oversight functions, as well as people with strong vendor relationship management skills. Payment for Research A continued point of contention, professionals with experience and knowledge of the Research Payments area of MiFID are still likely to be in demand across the Buy-Side. There are on-going challenges for firms in identifying material and services which fit the definition of investment research that falls under the regime. Firms will need to ensure that they are not underpaying and being induced. Research Payment Account (RPA) users will also need to closely manage their evaluation procedures, client disclosures and operating research payment budgets. In addition, I expect the following areas to also drive recruitment decisions this year: Post-Trade Transparency Although most reporting will continue to be carried out by trading venues and  Systematic Internalisers (SI), trades executed off-venue need to be reported by the seller if neither or both of the counterparties is an SI . This regime officially comes into force on 1st September 2018 and so far many counterparties have not ‘opted-in’ despite steps being taken to try and understand whether they will be acting as SI’s. As a result, it is likely that buy-side firms will have reporting obligations, which will drive demand for contractors who worked on the Post-Trade Transparency of MiFIR prior to implementation.   Best Execution The next challenge for firms from a Best Execution perspective is the RTS 28 reporting requirements with reports due on 30th April 2018. Whilst many of the processes will already be in place, there is still likely to be a need for professionals accustomed to this part of the regulation. There will be demand within Compliance Monitoring and Regulatory Reporting functions due to the need for robust and enhanced monitoring procedures to keep track of the vast amounts of execution quality data which SI’s and venues will need to report quarterly.   SMCR Despite the FCA’s Senior Managers and Certification Regime being scheduled for implementation in mid-late 2019, it has been noted that the day-to-day workload of the programme will be quite high. This is likely to drive hiring demand for change professionals who have successfully implemented SMCR within banking firms.   GDPR and Data Protection With implementation of GDPR set for May this year, the race is already very much on to deliver on time. The demand for GDPR professionals has already been nothing short of enormous this year and last. Data Protection will remain a major topic of focus post-GDPR implementation that will further fuel the demand for practitioners. To discuss your recruitment needs with one of our team please contact us.

FourthLine have had many conversations with our clients about GDPR, and this article aims to answer some of the most common questions that are put to us as organisations look to take on a DPO. What is the DPO? Although the specific role of the DPO is not clearly defined within the GDPR, they are going to have responsibility for all issues relating to the protection of personal data within your organisation, ensuring that you are compliant with GDPR requirements. They will act as figurehead for data protection and will be afforded some protected and independent status under GDPR. It’s important that you think of the DPO as a business enabler. It will be their role to go around your business teams helping them to establish new processes or develop new products or services, and they should do it in a way that puts data protection at the heart of what your doing from the outset. This will ultimately lead to better services and products in the long term. Try not to think of it as a trade-off between data protection compliance versus what you need to do as a business. If anything, you should think beyond compliance and consider what you should be doing from an ethical point of view. Of course, the DPO needs to think about compliance, but they also need to help your business make ethical judgements and decisions around how you want to behave with regards to personal data. Do you need a DPO? The GDPR outlines the different types of organisation that need to appoint a DPO, but again some of the terms and considerations are a bit vague. Ultimately it’s a judgement call on your behalf. It’s worth taking a step back from the regulation and consider the relevance of data processing to your organisation. What data do you have? What do you do with it? Are there any inherent risks to your data processing activities? If you are carrying out large scale processing of data or you’re using data analytics in a significant way to drive your business strategy, then you are a data driven business and probably require a DPO. However, if you find that you are only processing employee data then perhaps you don’t need to hire a DPO (though it may be worth hiring a data protection professional voluntarily to mirror the role of a DPO to ensure you do remain compliant). Where should the DPO sit? This is a question that comes up time and time again, and unfortunately there isn’t one single right answer. Ultimately, as long as there is no obvious conflict of interest, then where you place the DPO doesn’t matter. The most important thing is that they are empowered to work across multiple functions to get the job done. Ask yourself what the driving decision is behind hiring a DPO. If you are primarily looking to make your organisation GDPR compliant, then you may want to sit them within your legal team. On the other hand, if you’re looking for the DPO to drive behavioural change and adopt a holistic approach, then you may want to put them into a more operational role. What qualities should a DPO possess? There are many qualities you should be looking for from a DPO. Beyond the more obvious attributes, such as expertise in the area of data protection law or understanding how IT or security systems work, it’s important that you hire somebody who is able to build networks in all areas of your business, and across geographical borders if necessary. The DPO you appoint should be able to balance both the operational and regulatory angle of the role. Essentially, they need to be able to design policies and processes, but also roll up their sleeves and get things done when required. They should be a business enabler with an ethical mindset and the ability to strategically think about the data in your business and the direction you are taking with your data.     Should you outsource or share a DPO? If you didn’t want to employ a full time DPO then there is the option to outsource the position, and it’s something that several clients have discussed with us. Outsourcing would work best if your data activity is straightforward, but there is the potential that it could lead to a cautious, safety-first approach whereby the outsourced DPO identifies some of the risks without helping you to find a solution. Another idea that has been suggested by clients is the option of sharing a DPO with other firms or organisations. Again, this is a possibility if your data processing is fairly simple, and if you are completely certain that there is no conflict of interest or competition conflict with the organisation you are sharing a DPO with. It’s worth remembering though that the GDPR states that your DPO should be ‘easily accessible’ by any organisation this person works with, so this could become more difficult if they are working for several organisations at once. What are your next steps? If you would like to discuss whether your organisation requires a DPO or need some help resourcing a DPO or any other data privacy role, please contact FourthLine on 0203 800 1099 or email [email protected]

In May 2017, FourthLine held a CASS Forum to provide senior CASS professionals with a place to discuss and debate current themes connected to the changes in CASS under the FRC Assurance Audit Standard. Take a look at our video below for some insight into some of the topics that were discussed on the day. .embed-container { position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%; } .embed-container iframe, .embed-container object, .embed-container embed { position: absolute; top: 0; left: 0; width: 100%; height: 100%; } Keep an eye on our Events page for the latest specialist industry events we'll be hosting, giving you the opportunity to come together with our other clients and candidates to discuss best practice around a range of topics.    

One of my key responsibilities as Managing Director at FourthLine is to ensure that we are meeting the demands and needs of our customers month in, month out.  I feel immense pride when I oversee a successful recruitment process, where a client finally secures the specialist talent that will help them prevent risk in their respective organisation after many months of struggles via generic channels.  Choosing a strategic position of “risk recruiter specialisation” is born out of an ethos that in order to best serve the customer you must focus the whole of the organisation on the risk management audience in which you serve daily, as opposed to giving into the temptations of other recruiters who have driven into “other head office” disciplines such as HR or Finance.  This is our tried and tested approach: Focus, Focus, Focus Here at FourthLine we help clients recruit risk management experts that help organisations prevent risk. Clients request risk experts from FourthLine across a broad range of needs, such as building permanent risk function capability, supporting with risk advice, helping drive change across the risk management function or helping to make critical decisions. Our daily focus across the whole of our organisation on building our risk management recruitment capability means we are uniquely placed to provide the right risk expert to help you prevent risk in your organisation. Get the upstream bit right With over 35 risk recruiters networking in the market daily, we generate powerful insights through focusing our networking discussions around the things that matter. We possess insights about what makes a high performing risk expert from a skills, behavioural and performance perspective and also understand the risk management professional better than generic recruiters, which can often help our customers shape candidate attraction strategies.  Our customers expect us to respond to skill shortages in the market, so that is what we do through constantly monitoring changes in the market via our upstream framework. Build & know your network Any organisation can build networks of people, but true value is created by knowing which skills and expertise are in demand and invest resources in developing networks of these capabilities prior to the upward curve of demand.  For example, the global data protection regulation will create a skill shortage of over 80,000 data privacy professionals so we have been investing significantly in building our data privacy capability.  We are monitoring developments around automation to see how this technological shift might impact the need for quality management experts to provide assurance to automated tools. Then it is about spending time with the network in order to develop the knowledge of who the true leading experts are, who is in demand, and who can truly help our customers prevent risk. Service To deliver great service to customers, you need to recruit talent who possess the ability to deliver service.  For us, the service to our customers begins with recruiting exceptional talent who are relationship centric and have a real interest in serving the needs of our customers in the risk management field.  We focus their early stage learning around how to identify high performing experts in their discipline, so they possess the knowledge to advise clients on which candidates to interview and select. The service begins with our consultants being able to demonstrate quickly that they can ascertain an accurate understanding of the expert you are looking to recruit, and then responsively presenting a high-quality shortlist so you can make your selection. Be Reliable We take the value of reliability very seriously, so we don’t recruit outside of our field of specialisation. Why would we? We would be pretty hopeless at knowing the best people. Reliability is also about process reliability; our service is designed to create high quality expert options so that you can make an informed selection decision. We would not be delivering on our process reliability ethos if we only send you one expert. Furthermore, we’ll also monitor our service delivery post engagement to ensure we are delivering on the goal of risk prevention for your organisation.   So, without giving away too much of the magic formula the above is a small insight into how our service is designed at the FourthLine of defence. A mix of decisions, intelligence, network building and service gets the job done for us.

We believe that finding the right recruitment partner for your business is an essential part of the process to the right hire. 1. Industry knowledge In many businesses the HR team may have agreed terms with recruiters who are broad and can cover most aspects of the business's recruitment needs. Whilst this is beneficial at times those roles that require specific technical expertise, especially those in niche industries will find this does not work for them. Choosing a recruitment partner who has a niche specialism in your sector is imperative to recruiting your role right first time. That specialism should be easy to demonstrate when you do your initial research into making that decision on who to partner with and further demonstrated in your preliminary conversations with the consultancy. 2. Reputation It’s easy to have a view on recruitment, this comes with your own experience and that you will hear through colleagues. Take some time to look at what brands the recruitment consultancy can demonstrate they work with (not just a list) and ask them to explain their relationship. Another important facet is their tenure; how long have they been doing what they do and can they evidence success? 3. Quality of the database and outreach What level of proactive candidate search should you expect from your chosen recruitment partner and can you be sure that they are working hard enough on your behalf? Many recruitment consultants will work from their databases of those candidates actively looking for roles, but what if the ideal person you need for your role isn’t currently active in their search? At FourthLine, not only do we have an unrivalled network in risk and compliance candidates we also proactively profile ideal individuals and create an inventory of those ready for your digest. 4. Quality of the recruiter The relationship between you and the recruitment consultant is very important and the understanding they have of your business will often make the difference in them finding the right candidates. Add to that the role that the consultant plays in easing your administrative workload should not be underestimated, especially when the number of initially suitable candidates looks high. A good recruitment consultant will do enough preliminary work to create the best shortlist for your role, allowing you to not waste time on candidates who are unsuitable. 5. Level of service and fees Be sure you know what you are paying for, if there is no placement then presumably no fee. However, consider what time that will have cost you to conclude that there was no one suitable in the shortlist. Similarly, what percentage recruitment fee are you paying if all you are getting is a quick database search and shortlist? Is that worthy of the fee? Ask the consultancy to explain their approach, what they do proactively and what additional costs there may be for your business. 6. Are they a good employer? Recruitment can be a hard industry to work in yet there are many notable examples of consultancies getting the approach right. Check out your recruitment partner – do their values fit with yours, do they value their employees and what is the culture like? Working with a consultancy that fits with your business ethos will cement the collaboration further. 7. Rapport and trust Ultimately any business partnership needs to be built on trust; trust that the consultant working on your behalf can represent your business with authority and trust that they will do their very best to find the right candidate for the role. If your homework on reputation, quality of recruiter and values of the business have been done correctly then you should be able to build a high performing partnership. FourthLine are a specialist risk and compliance boutique recruitment consultancy offering contingent, retained and interim and contractor solutions. FourthLine work flexibly to find the best solution to your resourcing needs. In the last six years over 500 finance regulated businesses have engaged with us to recruit risk and compliance experts.

Here at FourthLine we work flexibly to find the best solution for your resourcing needs, working closely to ensure these six key considerations are satisfied. Strategy What is the client’s recruitment strategy and how does the role fit into the overall business plan and structure? How can we ensure that the role is aligned to business objectives and how easy is that to demonstrate to the best candidates? The most in demand candidates will want to understand not only the scope of the role but also the direction of the business. We spend time with you to understand the complexities of your business. This partnership allows us to be agile and effectively manage the pipeline of recruitment needs without the risk of losing out on the best talent. Cultural Many clients focus solely on the technical skills, yet in some cases this can lead to the perfect role capability but an inability to seamlessly fit into the existing teams and influence the most senior of stakeholders. We work closely with our clients to understand not only the desired technical expertise but to also get a deeper sense of the culture of the business and the team the role will reside in. Technical With many of the key technical skills in great demand, how can you ensure that a candidate can reliably demonstrate those skills in an interview setting? How do you get the balance right between hands-on technical expertise plus the ability to see the bigger picture and think strategically? Working in partnership with your recruiter you can be assured that their sector knowledge will help you make the right choices in a timely fashion. Process How fast can the business move to secure the very best talent within such a competitive market if the recruitment process is over engineered? This may result in the loss of a key hire. It’s vitally important to have all the paperwork agreed before the hiring process starts and any contentious issues around recruitment costs settled. Retained search is best suited to this challenge and is by far the best methodology to recruitment process challenges. Society We are at the cusp of a meaningful change in traditional working patterns. The part that millennials play now in the workforce is significant and with the demand for flexible work schedules and a growing remote workforce how does your business ensure it is tapping into and satisfying that talent too? We advise you on examples of best practice and how to make this all work for your business. Influences The role that social media and review sites play in how candidates navigate the recruitment landscape is notable. How well is your business portrayed on social media and how can you use that to your advantage in the recruitment process? Do you know what your digital presence is and how to maximise that to your advantage? At FourthLine we build high performing risk and compliance teams that protect business integrity and brand reputation. We work closely with your business to navigate this ever-changing recruitment landscape, proactively working with you to secure your next hire.   To discuss your recruitment needs with one our team please contact us.

Tell me about your FourthLine journey? I come from a property background, originally with a Masters obtained from The University of Manchester in Planning. Following graduation, I spent a year working with a Commercial Surveyors in a sales and account management role before moving into a similar role within consumer credit with American Express. After three years of working with Amex I decided that I wanted to move into financial services recruitment. After numerous interviews and a few offers from various firms, I came across FourthLine. It was very quickly clear that FourthLine was the small but rapidly growing recruitment business I was looking for and I accepted the offer that day. Since then, I’ve been promoted four times in three years from Trainee Consultant to my current role as Head of Capital Markets Practice. What is your area of specialism? Buy-side compliance, regulation and risk I manage a team of eight specialist Consultants covering compliance, regulation and risk within asset managers, hedge funds, wealth managers, private banks, wrap platform, IFAs and all other buy-side related firms and intermediaries. What is your view on the market right now? Looking into 2018, we are anticipating a huge amount of MiFID II remediation work as the majority of buy-side firms are already acknowledging that there will be gaps in their delivery. Aside from MiFID II, the main market drivers within the buy-side over the course of 2018 are likely to be based on SMCR, PRIIPs and Brexit, whichever form it eventually takes. Other geopolitical risk such as the outcome of the US election and the turmoil that this has created are also likely to have an impact on hiring How is FourthLine different? We are genuine specialists in our respective fields with a very specific focus on niche areas. This allows our consultants to develop a deep understanding of their markets and proactively build inventories of the top 20% of industry talent in line with upstream market drivers. Top tip to candidates Work only with specialists who have a genuine understanding of the market. Avoid generic recruiters who work across multiple disciplines, as they will never fully understand your background and role preferences.

Tell me about your FourthLine journey? After 15 years’ experience in sales and recruitment, including working as a founding member of a small technology recruitment business, I was approached by Kieran the FourthLine founder to be part of the business and his vision. I have been with FourthLine for over five years, starting as a senior consultant and the first permanent recruiter in the business. I progressed to principal consultant looking after London market compliance recruitment then moved up to manage the permanent practice before starting the data protection practice just over one year ago. What is your area of specialism? I manage FourthLine’s Data Protection team. We have a team of nine recruiters all focused on identifying data protection practitioners, lawyers and change professionals. Due to significant regulatory pressure brought about by the GDPR implementation deadline, it is an extremely competitive and high growth area. In line with our brand we have recruited in this space as part of our regulatory offering and pride ourselves on the depth and reach of our candidate network built as a result of significant investment over the past five years. What is your view on the market right now? This is a highly competitive market due to regulatory pressures and many firms are racing to hire a DPO before the market for quality hires becomes too difficult to navigate. Many of these companies have never hired for a DPO or any kind of data protection professional before and are finding it tricky to understand what 'good looks like'. This means that many firms are making rushed or unsuccessful hires. FourthLine are trying to help the data protection community by designing a DPO interview template and a DPO competency framework to help firms make better hiring decisions. How is FourthLine different? FourthLine truly take pride and care about the careers of the people who work here, our investment in training means we offer an unrivalled understanding of the recruitment landscape in GRC disciplines. We know what we stand for and every decision is underpinned by our ambition and vision to become the leading UK recruiter in risk and compliance. Top tip to candidates Just do your very best and try not to rush your answers without thinking through the questions.