2009 Methodology

Click here to download a PDF version of this document (will open in new window)

Introduction

1.         The FSC has been successfully applying a risk assessment methodology across all supervisory divisions since 2003. In 2005 the FSC revised the basis of profiling firms.
2.         The FSC has re-engineered the assessment methodology building on the experience of these past years to deliver a more efficient and effective process through which the risks of a firm are assessed and mitigated.
3.         In arriving at the revised methodology the FSC is seeking to concentrate on high level risks rather than regulatory compliance issues. The focus of attention of the revised methodology is to arrive at a conclusion as to the ability and competence of a firm’s senior management to identify and mitigate risks as well as to put into place adequate systems of control to meet regulatory requirements.
4.         The intensity of the FSC’s interfacing with a firm will be completely dependent on the perceived risks that a firm poses to its customer base and the jurisdiction.   The more a firm’s senior management does to address its risks, the less interfacing with the FSC it will have.
5.         Those firms in which senior management has shown little attention to the identification and mitigation of risks or in meeting regulatory compliance requirements will find it a very onerous experience. The FSC is seeking to make greater use of the Reporting Accountants Regime (Skilled Persons under the Insurance legislation) in order verify to regulatory compliance issues where the FSC perceives there to be failings.
6.         The revised methodology will continue to assess firms based on two Risk Types (Business and Control) and six Risk Groups (Financial Soundness & Capital, Environment, Business Plan, Controls, Organisation & Management) as well as using an Impact Score as a multiplier. The Impact Score has been aligned across all divisions under the revised methodology.

Outline of 2009 methodology

7. The revised methodology has changed from the previous version to the following;

Outline

Figure 1 - Outline of methodology

8. The main difference of approach is the earlier profiling of a firm. This is necessary in order for the intensity of the on-site to be proportionate to the FSC perception of the risks it faces and the impact the firm has on the jurisdiction.
9. The following sections describe each of the steps in greater detail;

Off-site

10. This is the main element of the FSC’s work programme as it consists of pulling together information from a variety of different sources into the assessment. Some of the information is already existent within the FSC but other information will be sought directly from the firm.
11. In reviewing the information already held by the FSC the following source documents will be examined:

Correspondence. In order to identify major changes to the firm’s business plans, licensing requirements, compliance arrangements.
Appointments and Resignations. In order to take a view on the adequacy of the composition of the Board and Senior Management as well as corporate governance arrangements.
Returns & Financial Statements. To view adequacy of capital and liquidity both in terms of meeting the minimum regulatory prudential requirements as well as to support current and future business needs.
Complaints. To determine if there are systemic failures in the management of the firm’s affairs.
Outsourced functions. To determine if a firm’s head office and mind and management requirements continue to be met.

12.       Additionally, the FSC will seek to obtain at a very early stage of the risk-assessment process additional answers to risk specific or regulatory compliance matters through the use of questionnaires.
13.       Examples of these generic questionnaires are included in this document but may be varied for a given firm or sector. Additional questionnaires may, from time to time also be issued.
14.       Compliance specific questionnaires may also be issued by a division in order to ascertain regulatory compliance with a set of requirements (e.g. seeking to review the firm’s completion of the AML/CFT Compliance Report).
15.       In most cases the FSC will also seek to obtain up to date financial forecasts for the following three years indicating, where appropriate, compliance with prudential requirements (e.g. capital adequacy, solvency margins, etc).

Profiling

16. The FSC seeks to obtain a risk profile of the firm through the assessment of six separate Risk Groups. The risk profile of the firm will determine the FSC’s approach to that firm.
17. During the preliminary stages, the FSC will use its available information of a firm to arrive at a risk profile. This may change once the FSC has effected its on-site work.

Business risks

18. The analysis of the business risk will be performed using the following risk groups: Financial Soundness & Capital, Environment and Business Plan (“FEB”). This review will comprise an analysis of the financial position of the firm, the firm's overall business and external environment and its future strategy. This will facilitate a historical, current and forward-looking assessment of the firm's key business risks. The objectives behind each of the Business Risk Groups assessment are:

Financial Soundness and Capital - To determine the adequacy of capital, funding and insurance cover in light of the current and future business plans of the firm.
Environment - To determine what operational and other market risks the firm is subject to in carrying out its business plan.
Business Plan - To determine where the current and future risks lie in a firm’s business plan, products and strategy.

19. This analysis will be undertaken, for example, using prudential data, annual accounts, and information requested from the firm together with information already held on the FSC's files.

Control risks

20. In analysing the controls over the business, the FSC will undertake an assessment using another three risk groups: Controls, Organisation and Management (COM). As mentioned above, most of the information for this analysis will come from information already held on the FSC's files, including reporting accountants’ reports. The objectives of the Control Risk Group assessment are:

Controls - To determine the control environment of a firm and management’s ability to put into place proper oversight procedures.
Organisation - To determine if the legal ownership structure and/or Passporting of services of the firm provides any impediments to the supervision of the firm.
Management - To determine if the firm’s corporate governance arrangements and management are adequate for the nature, size and complexity of the firm.

21. During the pre-assessment stage, the FSC will identify where there are information gaps, how to fill them and with whom the regulator needs to meet when carrying out on-site work.

Combining scores

22. The FSC will be looking beyond the titles of each of the Risk Groups to a further level of details known as Risk Elements to make a determination of perceived or actual risks materialising in any of these.
23. Each risk element is scored according to its weighted score, taking into consideration underlying constituents, which are scored as either:

Negligible	1.0
Possible	1.75
Probable	3.0
Perceptible	5.0

24. Each Risk group is also weighted to reflect its relative importance to the Risk Type as follows;

Business Risks
	Financial Soundness & Capital	40%
	Environment	30%
	Business Plan	30%
Control Risks
	Controls	45%
	Organisation	10%
	Management	45%

25.       Both scores (Business and Control Risks) are then multiplied by the Impact Score of the firm in question to provide a Business Risk Profile Score and a Control Risk Profile Score.
26.       The impact scores of firms is determined through the use of an impact matrix which takes into account a number of environmental and jurisdictional issues and their relative weightings. All firms, across the supervisory divisions of the FSC are subjected to the same impact assessment.
27.       The basis upon which a firm will be impact scored is shown in Appendix 2.

Risk types, groups and elements

Figure 2 - Risk Types, Groups and Elements

28.       The scoring by FSC staff of each of the elements is a vital constituent of the revised methodology as previously the FSC only scored at the higher level of Risk Group. The previous method showed some distortions in the scoring and this new approach seeks to provide greater consistency of approach.
29.       The weighting of each of the risk elements and risk groups has been carefully considered by the Executive of the Commission based on the experience of the Heads of Division and previous risk assessments.
30.       A pro-forma spreadsheet on the scoring of a firms risk elements and effect of the impact score can be found in Appendix 1.
31.       The FSC will, for each Risk Element, document why it assigned such a value to it. This will also translate into what items the FSC will consider important enough to raise with the firm going forward. Therefore an element which is scored as “Negligible” or “Possible” will not generally feature in discussions with the firm nor as part of the on-site verification process.
32.       The scoring of each of the Risk Elements when multiplied by the Impact score   produces two values that can be plotted on a simple chart to produce the risk profile of a firm;

Risk Profile Chart

Figure 3 - Risk profile chart

33. By having obtained a preliminary risk profile the FSC is able, at this stage, to decide upon the scope and intensity of its remaining work, including the on-site verification programme.

34. Firms will fall into one of the following risk profiles;

Low Monitoring & Remediation : Firms who have a strong control environment supported by good governance as well as stable business plans and who generally are lower impact firms. These firms will have little by way of regular contact with the FSC in between risk assessments other than the occasional prudential meeting.
Low/Medium Monitoring and Medium Remediation : Firms who are making improvements to their control environment and regulatory compliance arrangements. It is likely that these firms will be the subject of focused visits or reporting accountants reports to validate the work being conducted by senior management.
Medium Monitoring & Low/Medium Remediation : This would apply to firms who’s business plan is changing quickly, either because they are in a start-up scenario or changing their business plan. Although some changes to their control environment may be required the FSC will want to maintain regular contact through prudential visits to keep abreast of developments.
High Monitoring & High Remediation : These firms are the ones that the FSC will be most concerned about. The cause for the additional monitoring and/or remediation will be greater magnified by the impact score of the firms. The FSC will be seeking to maintain very regular contact on a formal as well as informal basis with senior management of the firms as well as subjecting these firms to focused compliance visits and/or reporting accountants reporting.

35. In the description for each of the profiles, a number of terms have been used. It is useful to outline what each one of these means.

Focused Visit : These are performed by FSC staff and will focus on a specific area of regulatory compliance (e.g. AML/CFT processes, Mifid Compliance, Returns Preparation, Corporate Governance, Outsourcing arrangements, etc). The firm will be reviewed for its compliance arrangements against specific regulatory requirements be these regulations, administrative notices or guidance notes which the firm should already have put in place.
These focused visits will be requested if the FSC knows or suspects that the firm is not addressing specific regulatory compliance matters. The number of FSC staff present to conduct such visits and the amount of time that the team will spend on these visits is dependant on the risk profile of the firm.
Prudential Visit : Also performed by FSC staff. The meetings, which may take between a couple of hours to a complete day will generally be held with senior management of a firm but may also wish to interview other members of the firm’s staff. The prudential meeting seeks to update the FSC with developments in a firm’s business plan, operating environment or financial situation.
Reporting Accountants Report : This is, for the firm, the most onerous type of reporting that the FSC will impose as part of the risk assessment process. The FSC will use the powers under the Supervisory Acts to require a firm to appoint a set of Reporting Accountants so that they can review the firm’s regulatory compliance arrangements with any aspect of the legislation including regulations, administrative notices or guidance notes. It is onerous on the firm for two reasons [1] the breath, depth and scope is far deeper than the equivalent report produced by the FSC and [2] the costs of this report are borne by the firm.
The reporting accountants report will be used more frequently by the FSC in the case of larger, more complex firms or where the FSC considers that it does not have the resources or expertise to look at a particular area.

36. It is clear from the descriptions given above that a firm’s senior management can, through pro-active risk management, reduce the regulatory burdens of an FSC risk assessment by taking appropriate action throughout its daily operations. By doing so a firm may actively reduce its risk profile and therefore the intensity of any FSC interfacing.

Initial risk profile

37. By having arrived at an initial risk-profile of a firm the FSC will set its general tone for the rest of the risk-assessment process. Therefore firms with an initial profile of Low Monitoring and Low Remediation will not require an intensive on-site verification programme. Conversely those with an initial High Monitoring & High Remediation profile will require greater allocation of resources to the next stages of the assessment.

Risk Assessment On-Site

38.       Through the on-site the FSC seeks to validate its initial profiling, to identify the mitigation programmes already in place at a firm as well as being able to gain first hand experience of a firm’s senior management and compliance culture.
39.       Through the initial profiling, the FSC will have identified those risk elements which it considers are most likely to contribute to the materialisation of an actual risk. Through the initial profiling stages, the FSC will have documented its reasons why it considers this to be the case.
40.       As mentioned above the FSC will only seek to validate its findings for those risk elements which it has scored as Probable or Perceptible.
41.       The on-site visit effected by FSC staff will seek to discuss these matters with senior management as well as those members of staff directly involved with the risk element in question. It is likely that the FSC staff will undertake some verification of processes put in place by the firms to mitigate these risks.
42.       The on-site presents the firm with an opportunity to describe processes or mitigations that may not have been clear from the documentation supplied through practical engagement of the FSC team. Again, the more co-operative a firm’s senior management is with the FSC the shorter the duration of the on-site element is expected to be.
43.       Throughout the on-site, the FSC team will be seeking to make a judgement on the senior management’s approach towards regulatory compliance matters generally and although the on-site will not seek to carry out specific testing of regulatory compliance matters the on-site will determine if focused visits or reporting accountants reports should form part of the risk mitigation stage.
44.       Prior to carrying out an on-site the FSC will:

Determine the time it expects to spend with the firm.
Arrange with the firm mutually convenient dates for the on-site to take effect.
Provide the firm with a formal agenda which will:
- List all the issues/risk elements that it wishes to discuss with the firm’s senior management.
- Identify any individuals that the FSC wishes to speak with on any of the matters.
- Allow the firm’s senior management to invite to the meeting any other person it feels would contribute to the on-site.
- Provide a list of any additional document or information that it may wish to review on the firm’s premises together with a list of any documents that it may wish to take copies of.

45. The on-site will end with a close-out meeting. This close-out meeting will seek to:

Summarise the areas reviewed by the FSC team.
Summarise any areas which the FSC considers it requires additional information.
Summarise the findings as they relate to the risk elements.
Invite the senior management of the firm to provide input to the team on areas which they wish to add to the risk assessment.

Final Profiling

46.       All of the information gained from the process to date are compiled and reviewed prior to making a final assessment.
47.       The FSC will look through its initial profile and document where, if any, amendments to the profiling or impact score are required based on the information gleaned from the on-site work and subsequent review.
48.       Once a final profile has been obtained the FSC will, based on the risk profile of firm, design a risk mitigation programme:

Addressing the outstanding risks identified in the assessment. This will include specific mitigation that the firm is to carry out to address these issues and this may take the form of action required to be taken or a recommendation that it be carried out. Where a firm is required to take action, specific outcomes milestones and target dates will be set by the FSC. In most cases the FSC will seek to address no more than five issues which it considers are the highest priority, but may extend this, in exceptional cases, to more should circumstances require this. The FSC will make it clear which risk elements are affected by the mitigation required to be conducted.
Setting out the interfacing between the FSC and the firm including expected numbers and scope of Prudential and Focused Visits planned to be carried out and likely timescales for these.
Identifying any areas to be covered by a reporting accountant’s report and the timescales by which these should be carried out.
Providing the firm with its Risk Profile score. The firm will be prohibited from sharing this score with any party outside of its senior management team and may not use this score to promote or market itself or its products.
Establishing the date when the next formal risk assessment of the firm will be conducted.

49.       The FSC will communicate its findings, most of which should have been raised at the close-out meeting, via a draft feedback letter which will be sent to the firm within four weeks of the conclusion of the on-site.
50.       The firm will be given two weeks to respond to the draft feedback letter in respect of factual inaccuracies that may be contained in the letter but not to discuss the risk mitigation programme elements described in the letter.
51.       The FSC will formally finalise the feedback letter in writing within two weeks of receiving the firm’s views.

Interfacing and Risk Mitigation

52.       Once the risk mitigation programme is agreed with the firm the risk mitigation programme is set into action.
53.       For the most part the FSC will rely on a firm’s senior management to carry out the risk mitigation programme established in the feedback letter. The FSC will seek to verify that the action plan is being complied with through ad-hoc communications with the senior management or more formal Prudential Visits that have already been planned.
54.       Failure by a firm to give effect to any aspect of the risk mitigation programme will have serious consequences for a firm ranging from conducting focused visits and the imposition of formal conditions or directions, the commissioning of reporting accountant’s reports up to the imposition of penalty fees. In certain circumstances, the withdrawal of authorisation may also be considered by the FSC.

Feedback

55. The FSC has, through the adoption of the ISO9001:2000 Quality Management Standard, sought feedback from firms on the risk assessment process. The FSC will continue to seek this feedback from all firms that have been assessed. This feedback will continue to be submitted anonymously.

Appendix 1 – Risk Profiling of a Firm

Business Risks
Importance	Risk Element
5	Types of products & Services
4	Sources of business and distribution
7	Types of customer
7	Strategy
	Business Plan	30%
2	Legal Risk
10	Operational Risk
10	Market Risk
6	Group Risk
10	Underwriting risk
7	Credit Risk
	Environmental	30%
3	Insurance
5	Earnings
10	Liquidity
10	Adequacy of Capital
	Financial Soundness & Capital	40%

Control Risks
5	Corporate Governance
10	Quality of Management
	Management	45%
5	Ownership
8	External Branches & Subsidiaries
10	Multiple Activity Groups
	Organisation	10%
10	Risk Management
6	AML Controls
4	Compliance
6	Reporting to customers
10	Security of customer assets
8	Advising, Dealing and Managing
5	Acceptance of and disclosure to customers
10	Outsourcing
4	Internal Audit
10	External Auditors
7	Actuaries
8	Management Information Systems
5	Business Continuity
6	IT
8	Human Resources
	Controls	45%

Appendix 2 – Impact Scores

Impact Scoring	High	Medium	Low	Importance
Customer Base
Number of Customers	Large	Medium	Small	7
Experience	General Public	Mixed	Professional/ Capitve/ Experienced	10
Financial Base
Client Assets at risk	Significant	Insignificant	None	10
Product Base
Deposit/Investment/Claims Protection Arrangements	No	Yes (some exclusions)	Yes (mostly covered)	5
Product Types	Investment/ Banking	Protection/ Retail	Protection/ Corporate/ Other	4
Jurisdiction Impact
Home/Host Regulator	Home	Host		4
Risk of Contagion	High	Medium	Low	9
Reputational Impact	High	Medium	Low	5
Number of employees	>30	>5 <30	<=5	2

Appendix 3 – Risk Elements & their constituents