Like many of you reading this, I have been doing the rounds at several SMCR events focused on the extension of the Senior Managers and Certification Regimes of late and have picked up (as well as delivered) some useful insights into the good and the bad experiences across the banking sector and the similarities or otherwise of the effect it will have on the wider market.
I thought it would be useful to pull some of these lessons learned into a practical summary of some of the most common areas of concern. After all, we’re all busy people, right?!
Know why you’re doing it
I’ve heard a number of analogies on governance and accountability, not least of which likening it to the armed forces or the mafia. In both cases, a failure to comply can lead to grim and untimely death. Fortunately, nobody is going to die as a result of SMCR (Senior Managers & Certification Regime), but it shouldn’t be taken lightly. Regardless of your firm’s shape or size, if you have senior managers and certified personnel the way you manage the regime can influence not just the organisation’s performance of its obligations and the market’s reputation and stability but the careers of those subject to the regime. Culture and individuals’ attitudes towards their roles and responsibilities to both the firm and its customers is at the heart of the regime and should form an integral part of your implementation and BAU approach.
Think of SMCR as an opportunity to review your governance arrangements and how you manage the competence and culture within your organisation
Expect the unexpected
When identifying your population for SMCR, be prepared to review and realign your supervisory models and really think hard about who is going to be “captured” under the regime. In the early days of planning in the banking sector, we engaged in discussions with a large retail bank. In our first meeting they had identified that they had 2000 certified colleagues but by the second meeting that had doubled to 4000! An extreme example I know, but it demonstrates just how important it is to understand and interpret the rules correctly and accept that it’s a living thing. The more you learn the more you’ll adapt.
Consider carefully the Certification Functions that apply to your organization and who is captured as a result; we hear of a lot of firms who are thinking hard about the influence of colleagues based abroad and elsewhere within group organisations for instance. Also think about your management and supervisory structures; if you currently have a situation where colleagues are managed by one person and supervised by another, don’t forget that both manager and supervisor will need to be subject to the rules of Certification
Be realistic – Don’t throw the baby out with the bath water
Think of SMCR (Senior Managers & Certification Regime) as an opportunity to review your governance arrangements and how you manage the competence and culture within your organisation, but don’t be tempted to start from scratch! Let’s face it, the majority of regulated firms already have numerous processes and systems in place for ensuring their people are the right ones and are doing the right thing. Look at the various activities you already manage across disparate IT systems, Excel spreadsheets or outsourced services and think. Think about where your gaps are. I’m a strong believer in “if it ain’t broke don’t fix it” so focus on fulfilling the missing elements and working out how you are going to evidence that you’ve done it in a clear and consistent manner.
Make your life easier when audit comes calling
Look at your Day 1 implementation with BAU in mind and through the eyes of both your internal audit team and the regulator. If they appeared on your doorstep tomorrow, how quickly would you be able to get your hands on accurate MI that demonstrates that you’ve carried out your obligations and that you can hand on heart say you’ve done everything you can to ensure an individual is fit, proper and competent for the role they carry out. This is where dedicated SMCR systems can really add value, driving robust processes and workflow and pulling together information from multiple sources to create a single point of truth and MI that you can rely on. The ability to centrally store and produce a dossier of supporting evidence (in whatever form that takes – documentation, video, minutes, background checks, testing outputs etc) alongside the headline MI is an absolute gift and its value shouldn’t be underestimated!
Use technology to help you before, during and after implementation
Not only can technology be a godsend in the ongoing management of SMCR, but it can add real value in helping you with mapping your governance arrangements. The bulk of effort on an initial SMCR implementation typically happens ahead of technology being a consideration. We are however now seeing a shift, with our clients adopting the software early to utilise its drag and drop modelling capabilities to design a governance structure with built in capability to identify gaps in allocation of responsibilities, committee memberships and more. Don’t underestimate how potentially dynamic and changeable your structure might be – consider the impact of joiners, leavers, role changes etc. We heard from a medium sized bank recently who had submitted over 30 revisions of the Governance map to the regulator in the two or so years they have been subject to the regime – along with hundreds of related bits of evidence, attestations, applications and validations. Don’t underestimate all the modelling and maintenance required when the new regime settles into BAU.
Be sure that your supplier can evidence a strong SMCR (Senior Manager & Certification Regime) client base and is willing to let you get hands on with the software before signing on the dotted line – if they push back, there’s usually a reason!
I was heartened to hear the FCA’s Head of RegTech speak at a conference recently on the progress the regulator is making in its pilot for automated reporting. We await the outcomes, but the potential to streamline the firm’s MI with your submissions to the regulator is exciting and is something to keep abreast of in the coming months, especially considering possible changes to
the FCA register and the potential that firms could find themselves responsible for updating it.
The number one lesson from the banking sector has been not to underestimate the amount of time and effort is involved in preparing for SMCR. I have heard anecdotes, further evidenced by our own experiences, that on average an SMCR project takes somewhere in the region of 12 months – but, it’s a project that shouldn’t ever end. Despite the December implementation dates, Individual Accountability is for life, not just for Christmas!