Using KPIs to tackle individual accountability
How KPIs can allow you to link Individual Accountability Regime (IAR) requirements to company performance – By Charles Cattell.
As the broader financial services industry prepares for the extension of the Individual Accountability Regime (IAR) to all financial services firms in 2018, this whitepaper explores how firms can use Key Performance Indicators (KPIs) to track staff performance and simultaneously adhere to the compliance requirements of the regime.
Of all the lessons learnt from the banking crisis and subsequent scandals, one of the most significant has been how challenging it has proved for regulators to hold individual senior managers to account for the poor decisions and subsequent failures which have occurred on their respective watches. As is so often the case following major catastrophes, it was generally agreed that the previous position was unsustainable and that “something needed to be done”.
So, something has been done. Indeed, quite a lot of somethings have been done. As far as the matter of holding individuals to account, the most significant development has been the implementation of the Senior Managers and Certification Regime (SM&CR) as a replacement for the Approved Persons requirements. The SM&CR came into effect for the first tranche of firms (namely banks, building societies and certain others) in March 2016. At the same time, most insurers became subject to the somewhat simplified requirements of the Senior Insurance Managers Regime (SIMR). This means that there are now two parallel senior management regulatory regimes in operation – the new arrangements for banks and insurers whilst the existing arrangements continue for all other firms. However, this situation is only temporary. The Bank of England and Financial Services Act 2016 will extend the Senior Managers and Certification Regime to all financial services firms by 2018, and will introduce a ‘duty of responsibility’ for senior managers in all authorized firms.
At the heart of the SM&CR (and SIMR) lie arrangements to identify the core management responsibilities within each regulated firm and to ensure that these are allocated to specified individuals. Meanwhile the new Conduct Rules set out the standards of behaviour which are demanded of staff at all levels with the firm, from senior management downwards. The combination of allocated responsibilities and the Conduct Rules make the expectations placed on senior management much more transparent and will make the regulators’ task much easier, should it become necessary to take action against individuals for future failures.
Clarifying the responsibilities
The regulators have specified a number of prescribed responsibilities which have to be allocated between those senior staff subject to the senior management regime. These responsibilities are set out in the Statement of Responsibilities (or Scope of Responsibilities in the case of SIMR) which forms part of the documentation submitted to the regulator to obtain the approval needed to appoint an individual to a senior position in the first instance. Also included in the Statement of Responsibilities are the main business activities and functions of the firm for which the individual is ultimately responsible.
To ensure all the relevant responsibilities are covered, firms are required to create and maintain a Management Responsibilities Map (or Governance Map in the case of SIMR) which brings together all the responsibilities set out in the Statements of Responsibilities. This single document sets out the firm’s management and governance arrangements, including details of reporting lines, the lines of responsibility and reasonable details about everyone who is part of these arrangements. The Management Responsibilities Map is intended to ensure that the firm has a clear organisational structure and to help the regulators identify who is accountable for particular issues.
Senior managers are obliged to comply with the Senior Managers Conduct Rules. These include
requirements for individual managers to:
- Take reasonable steps to ensure that the business of the firm for which they are responsible is controlled
- Take reasonable steps to ensure that the business of the firm for which they are responsible complies with the relevant requirements and standards of the regulatory
- Take reasonable steps to ensure that any delegation of their responsibilities is to an appropriate person and that they oversee the discharge of the delegated responsibility effectively.
Practitioners of Senior Management
As can be seen, the SM&CR places some hefty obligations on individuals. But by definition, no-one expects individual senior managers to discharge their responsibilities in isolation or without aid. The aim of the requirements is to encourage senior managers to take their accountabilities seriously and to be actively involved in managing the areas for which they are responsible. To enable them to sleep at night, they need to be able to assure themselves that appropriate actions are being taken and that areas of potential concern are escalated to them so that actions can be instigated before problems manifest themselves.
To enable them to meet these expectations and to use the resources at their disposal wisely, they need relevant key performance indicators (KPIs) which will enable them to monitor activity and determine if progress is being made, alongside key risk indicators (KRIs) to give them early warning of potential problems. Although there are attractions in relying on a dashboard of quantitative metrics, the complexity of most senior management roles combined with the nature of the prescribed responsibilities demand some element of qualitative analysis to make KPIs and KRIs meaningful.
This is not to say that entirely new sources of data are necessarily required to generate relevant senior management KPIs and KRIs. Far from it – much of the management information currently produced is likely to be relevant. This is particularly the case in regard to the main business activities and functions of the firm. The challenge is in finding appropriate ways to interpret the data to provide useful information and to identify the critical items which can act as indicators of potential risk and measures of direction of travel.
KPI
In some areas, most of the work is done already. As an example of a main business activity and function, firms which offer financial or investment advice have to have a senior manager responsible for this area of activity. There is likely to be a considerable amount of management information available about the quality of the advisory process and its commercial standing which can be readily used to provide the necessary information to the senior manager responsible. However, for many of the prescribed responsibilities the position is likely to be less well developed.
Some of the requirements may lend themselves to using indicators which are already in place for other staff. For instance, a senior manager has:
Responsibility for monitoring the effective implementation of policies and procedures for the induction, training and professional development of all persons performing designated senior management functions on behalf of the firm other than members of the governing body.
Firms may well be able to help their relevant senior managers meet this obligation by adopting a similar approach to that which the firm applies to more formal training and competence arrangements for advisory staff. This particular responsibility is likely to lead to much closer scrutiny and monitoring of the initial training, performance appraisal and continuing professional development (CPD) of the senior staff in question. Although quantitative data will inform about the amount of CPD undertaken, qualitative information will be required in addition to ensure that the CPD is relevant to the individual’s role and that there are no gaps in knowledge and understanding which remain unaddressed.
A challenge of a different order faces the senior manager who has:
Responsibility for the firm’s performance of its obligations under the employee certification regime.
This senior manager needs a comprehensive set of indicators to be assured that the firm’s fit and proper criteria are fit for purpose, are being properly applied, that certificates are issued accurately and on time, that adequate security exists around the certification process, that full records are kept and that certification role vacancies are filled within the required timeframes. Further, information and indicators are needed in relation to individuals who change role, leave the firm or who are subject to disciplinary action or non-renewal, including the setting of precedents and relevant reporting to the regulators.
Of all the senior management prescribed responsibilities, perhaps the most challenging are those relating to:
Responsibility for overseeing the adoption of the firm’s culture in the day-to-day management of the firm
and
Responsibility for leading the development of the firm’s culture by the governing body as a whole
To address these responsibilities effectively, firms have to consider how they can articulate their culture, determine what is and is not acceptable and identify what they are aiming to achieve. They then need to find ways of measuring progress. Some of these measures may be counter-intuitive. For instance, an increase in whistle-blowing may bring more problems to the attention of senior management, but may also indicate an improvement in culture because individual members of staff feel increasingly able to speak out about their concerns.
Final Thoughts
The SM&CR demands senior managers have access to reliable data about the status of the activities for which they are personally accountable. They need this information to assure themselves that everything is under proper control and there are no problems looming. They also need this information so that they can speak from a position of authority when being challenged on their areas of responsibility, either around the board table or if they find themselves being interviewed by the regulators.
To enable them to do this they need to identify the KPIs and KRIs which are relevant for their firm’s business model and culture. They then need to put in place appropriate systems which can maintain relevant quantitative and qualitative records and which can produce reports which match the individual responsibility sets of each of their senior managers. What is more, these arrangements need to be sufficiently flexible so that they can be readily modified to meet changes in responsibilities and amendments to the Management Responsibilities Map when these occur.
Gathering and analysing all this information will not be an easy task, especially for small or medium sized companies, which often don’t have the capacity or systems to efficiently handle new regulatory requirements. Those firms that do not have the resources to tackle all aspects of the regime may benefit from seeking external help from industry experts in order to streamline IAR compliance management and the setting of appropriate KPIs and KRIs. That is where the know-how offered by industry experts can help firms answer some of the fundamental questions that will be asked by your firm, your customers and by the FCA and PRA about the conduct of your senior managers and employees.