Has there ever been a more challenging climate for the second and third lines of defense? The COVID-19 pandemic has quite clearly changed the entire 2020 landscape for financial services. A flurry of economic challenges and hurdles has put tremendous pressure on the business models of both traditional organizations and upstart, digitally native firms. Risk functions, in addition to dealing with financial challenges, are grappling with assessments of their risk universes, searching for previously overlooked single points of failure in operations, IT and supply chains. Compliance functions are racing to ensure that they meet unwavering regulator expectations with respect to financial crime, market and consumer conduct. Internal audit departments, as their counterparts in the second line, are adapting to the work-from-home (WFH) environment, adjusting audit priorities and leveraging digital capabilities wherever possible to compensate for their inability to perform onsite audits.
For the second line, sudden economic shifts often result in the perfect storm: a disrupted market that provides new opportunities for those inclined to engage in dishonest practices such as fraud, bribery, investment schemes and market manipulation, and increased vulnerability. The websites of governmental agencies and regulators globally offer myriad warnings and advisories about these risk scenarios.
Financial institutions need to take reasonable steps to ensure that their compliance monitoring programs are designed to identify fraudulent activity and market abuses, intentional or inadvertent. In the current environment, compliance assurance programs should include enhanced scrutiny of the following areas:
- Transaction monitoring—Pre-COVID-19 transaction monitoring models may no longer be fit for purpose, given significant changes in consumer behavior. In response, monitoring rules should be recalibrated to avoid:
- Overwhelming numbers of false positive alerts, which distract analysts from reviewing truly malicious activity
- Missing new patterns of behavior indicative of criminal activity
- Fraud management—New fraud schemes have been devised to take advantage of government support measures and public demand for certain goods. Shortages of goods also heighten the potential for public and private sector bribery. Financial crime prevention teams should evaluate how wrongdoers can take advantage of the current situation and incorporate new rules and keyword typologies into fraud management to identify and flag potential criminal activities.
- Market abuse surveillance—Insider trading, market manipulation and investment schemes have been on the rise in parallel to the unprecedented market shifts that have occurred over the past few months. Traders working from home have introduced new challenges related to information leakage and potential insider trading. Vulnerable parties, such as unsophisticated investors, may be more susceptible to manipulation activities such as “pumping and dumping.”
- Analyze control environments—Organizations should be evaluating their control environments to ensure that their prevention and detection capabilities are fit for purpose.
- Conduct risk and treatment of vulnerable customers—Regulators expect firms to have in place sufficient forward-looking conduct risk metrics and indicators and to be performing analysis of their activities and transactions, so that they are assured that conduct risk is being properly managed. Given the dramatic changes in many customers’ circumstances, increased numbers of customers are vulnerable and the impact of the organization’s decisions on those consumers during the pandemic is likely to be subject to significant regulatory scrutiny. Enhanced compliance assurance and testing in this area is a top priority.
As with other second-line functions and with the third line, WFH compliance departments have had to adapt and modify their methodologies for monitoring and testing. While for most compliance departments, the focus has been on managing the immediate short-term shock of the crisis, much remains to be seen about the mid-to-long term effects. History has taught financial institutions that crises often lead to a wave of regulatory mandates in the future—along with the remediation efforts and costs required to manage these—and that practices developed to deal with crises can lead to operating model improvements.
Three common themes have emerged as organizations have responded to the compliance monitoring challenge. While the first appears to be an interim, tactical change, the last two point to an acceleration of many executives’ strategic plans for a more dynamic assurance model.
The following are 3 themes observed during ongoing compliance monitoring:
- Repositioning staff—Following government actions to protect consumers and markets, many organizations have had to respond quickly to huge demand from their consumer and business customer bases seeking to take advantage of the benefits put into place. This has also led to a large volume increase in customer contact and service requests. In response, some first-line personnel have been temporarily seconded to customer service roles and even second- and third-line personnel have been redirected to assist. This short-term solution has both risk and a potential benefit. Risk arises from asking people with limited training and experience to step into roles with which they are unfamiliar, heightening the chances of error, and from withdrawing second- and third-line personnel from their assurance activities, at a time when they are already challenged to deliver these activities effectively.
- Enhancing active assurance techniques to provide an immediate feedback loop—To support their organizations with rapidly evolving demands, assurance functions have changed their ways of working to operate in more responsive ways. This has included greater involvement in emerging topics and issues, including the areas of increased risk noted above, flexibility to ensure that reviews do no inhibit first-line performance and increased use of data and analytics. Some clients are delaying deep dive reviews until later in the year to prioritize emerging risk. Active assurance has been applied most toward data-focused reviews of key risk indicators in the financial crime space; operational resilience; and in response to government actions such as new government loans and guarantee schemes, furloughs and payment holidays.
- Increasing the use of technologies to support active assurance—Becoming a more digital organization across the first, second and third lines was already a top priority for most executives prior to the COVID crisis. The consequences of the pandemic have accelerated this trend.
In all likelihood, many of the changes to the ways of working that have been introduced to respond to the current environment are here to stay, and the assurance functions that respond most innovatively to ways of working during the pandemic are likely best poised for future success.
Read more about compliance assurance during the COVID-19 pandemic in the full article from KnowledgeLeader.
This article was excerpted with permission from Protiviti’s KnowledgeLeader, a subscription-based website that provides audit programs, checklists, tools, resources and best practices to help internal auditors and risk management professionals save time, manage risk and add value. ISACA® members receive a discount on an annual subscription to the service.