Suppose you go to your doctor with a nasty cough or nearly bent over with stomach pain. You wouldn’t be too happy if your provider barely looked at you, jotted off a quick prescription and sent you away. Instead, you’d want your doctor to do a full exam, check your lungs for that cough – maybe run a blood test or order some sort of imaging on your abdomen.
In other words, you would want an official diagnosis of what was wrong and a treatment plan to fix it. You wouldn’t want something to simply ease or mask your symptoms, even if it made you feel a bit better.
In the banking world, financial institutions must look at something that’s gone wrong in their operations the same way. You don’t want to simply address what’s amiss on the surface. You want to take the proverbial lid off the box and look inside to find out what’s causing trouble. Somewhere in there is a breakdown with your people, process and/or technology. Audit and regulatory findings are generally issued as a result of systemic or patterns of breakdowns, such as not having a sound anti-money laundering program in place or failing to define and monitor the organization’s risk appetite.
And if you’re forced into issue remediation after federal regulators give you a lesser finding (a confidential Matter Requiring Attention) or something far worse (like a very public consent order, as witnessed with Citigroup this week, the stakes are even higher. You have one shot to get it right from the start. Take a misstep now, and you’ll find yourself even further behind – and losing even more credibility with the regulators who oversee your business.
In the later years of my career on the front line, I have increasingly seen financial institutions work ambitiously on remediating issues, only to have regulators come back at the end and give that effort a failing grade. While no bank wants to be under the shadow of a regulatory finding, working smart and rejecting shortcuts is the only way to deliver the right solution and minimize future risk.
With compliance costs expected to more than double and reach 10% of their revenue spend by 2022, banks can’t afford to get it wrong. Doing it right the first time actually saves time when you consider the losses in investing significant energy and resources in solving the wrong problem, not passing regulatory review and having to go back to the drawing board. An effective remediation strategy should follow several key steps:
This might seem counterintuitive, but don’t just jump into fixing things when you’ve been told there’s a problem. After all, do you know exactly what you’re fixing? Too often, companies fix what they think is the problem, only to learn that they’ve missed the mark – not to mention broken other things along the way. Not understanding the crux of the issue wastes time, energy and resources, as a business acts too quickly because it’s anxious to get out from under the regulatory thumb.
You also should engage your risk partners, including your legal and compliance teams, to review any regulatory finding language to make sure you understand and solve for exactly what the problem is – especially for an issue with broader scope and breadth. Oftentimes, it’s helpful to get expert insight from an outside partner, like Spinnaker, which can keep you from being myopic in your approach when you think you have the answers because you’re the expert in your own business.
Those leading your remediation plan should dig deeper into the root problem by asking “Why?” up to five times, peeling off another layer with each question as you strive toward the core issue. Consider yourself sitting on the side of the road and your car isn’t running. Why is my car broken down? Because the engine stopped. Why did the engine stop? Because it’s overheated. Why is it overheated? Because I didn’t change the oil. Bring those questions to your business problem and keep asking why until you’re grounded on the precise thing that needs to be fixed to make everything work as designed and expected.
Your action plan will serve as a roadmap to get you effectively and efficiently from identifying the root issue to implementing the solution, which is a common gap for many companies. At this stage, keep in mind that, due to everything from stakeholder engagement to technology resources, any solution won’t help overnight.
From the onset, expect that any regulatory-focused remediation could take a minimum of 12 to 18 months to resolve, particularly if you aim to deploy technology. In general, you’ll have a relatively short period of time – as little as 30 days – to identify the root cause and present your action plan to regulators or auditors.
Nothing can derail a remediation more than not having consensus on its direction and end goal. That doesn’t mean you’re inflexible if obstacles pop up, but you need to remain solidly focused on the actions that will fix your root issue and ease the concerns of your regulators or auditors – not to mention reduce customer complaints and reputation risk.
Engagement is another potential pitfall, as you need to be deliberate who you involve in this conversation. The executive ultimately accountable for successfully remediating the issue cannot do so in a bubble. A successful effort will focus on getting the right number of people in the right roles to offer support and perspective. Too many people water down intent and add risk on top of risk, while too few might mean you miss all relevant insights and commitments. This should be a joint effort between your first and second lines of defense.
Remediation often isn’t sexy work. But it is absolutely essential in ensuring your business is doing right by your customers and living up to every product and service commitment. Invest the time to do things right the first time and document everything.
As mentioned earlier, a comprehensive action plan can easily take a year to execute – usually much more time than that. In the meantime, you’ll likely have people in key roles within your organization and regulatory agency leave, which will create a knowledge gap. Comprehensive documentation keeps you moving forward with clarity, as you eliminate the “guessing game” and interpretation gaps. If it’s worth talking about, it’s worth writing down.
Be sure to also build in solid testing to validate that your solution fulfills on your intent, with no side effects that disrupt other processes. Give your remedy time to work (i.e., a sustainability period), say, for a quarter, and make sure all the kinks are gone before you provide it to your third-line line partner for validation.
Remember, whether you have a third-line audit or a regulatory finding, whoever issues it is going to return to see that you solved the right problem. In nearly every single case of a validation failure, the reason is because the work didn’t solve the root cause or align on intent early.
During these many, many months that you’ve been in the trenches, so much turnover could have occurred that maybe no one is around who even issued the finding or developed your action plan. Maybe your business objective, systems and/or regulations have changed along the way. Of course, you should be checking in with your third-line partners every quarter or when hitting major milestones to discuss progress so there shouldn’t be surprises, but this underscores the value of solid documentation, so that every step you take ties directly back to what your plan said you’d do to fix the problem.
Success comes with both a regulator’s endorsement as well as sustained results from your action plan, as evidenced by the reporting and monitoring you’ve put in place during remediation.
A robust monitoring system should help identify an issue before somebody else does – whether that’s a customer or a regulator. If you discovered that your monitoring process is missing issues, now is the time to analyze its performance, identify gaps and resolve issues. You should also use your recently created action plan to develop a repeatable framework for getting things done so you can move quickly once you either self-identify a problem or are advised by outsiders that you’ve got an issue.
Our Spinnaker team has been on the front lines in successfully remediating tough business challenges. Whether you need outside expert analysis to identify root causes or recommendations for internal monitoring, we have the proven experience to get every piece of your business back into regulatory compliance. We can also develop action plans for addressing a regulatory ruling and even guide you in building an end-to-end framework that minimizes future risks.
Contact us to learn more, because we know that doing issue remediation the right way the first time is your only choice.
Let's Talk
Like how we think? Subscribe to have our articles delivered direct to your inbox each month.
Headquarters: 8000 Franklin Farms Drive, Suite 100, Richmond, VA 23229
©2024 Spinnaker Consulting Group. All rights reserved.