WMA JOURNAL Issue 4 Autumn 2015
In this issue
Defence against Cybercrime The changing face of research 25 facts celebrating 25 years of the WMA Industry Statistics The importance of implementing a robust policy management programme
Issue 4 Autumn 2015
1
The Importance Of Implementing A Robust Policy Management Programme By Tim Wilson, Sales Manager - Wealth and Investment Management, Hitec
W
E
P
A
ealth Management Association organisations continue to face a tsunami of regularity pressure and scrutiny, placing an everincreasing burden of responsibility on compliance teams.
enalties for non-compliance include eye-watering fines, reputational damage and in extreme cases, the closure of business.
A
sea change in director accountability now makes Board Members responsible for the actions of employees and while the majority of organisations have taken steps to meet this requirement, many are failing to adopt adequate methods to demonstrate Best Practice and distance themselves from the actions of rogue individuals.
nsuring all employees, supply chain partners and agents across a global workforce have read, understood and signed-up to key policies can be a logistical nightmare and major challenge for any regulated company.
s relentless regulatory and security demand continues to drive the cost of compliance upwards, those using traditional and time-consuming methods to communicate policies and procedures are increasingly buckling under the financial strain.
I
t is no longer possible to simply ignore a Policy or Procedure and hope it goes away or worse still, claim that it was not received in the first place.
The key function of policy compliance is to: • • • • •
Ensure the correct policies reach the right people at the right time; Ensure employees read, understand and sign-up to key policies; Identify employees who have not adhered to a policy; Regularly review, assess and update policies; Provide senior management with detailed reports and a clear audit.
Issue 4 Autumn 2015
19
Why should companies divert precious resources away from key business areas and allocate them on creating and communicating policies? Reputation
A robust policy management system reduces the chance of litigation and the negative impact on reputation by keeping an accurate audit trail.
what has already been produced in house). While this can be the costliest option, it does free up senior management time and shifts the onus of keeping policies up-dated to a third party.
Goals
Deploying and auditing policy
Setting positive goals and communicating them to your workforce can help imbue a positive, “can-do” culture within an organisation.
Organisations are adopting a wide-range of expensive, timeconsuming and ineffective strategies to deploy policies, such as:
Culture
Pinning policies on notice boards and/or publishing them on the intranet, a method that leads to them often being ignored by staff.
Communicating a clear policy that outlines what is expected from employees and how they conduct themselves, helps to shape appropriate behaviour. Many of the world’s most successful organisations are characterised by a clear, well established, ethical culture.
Accountability
Well drafted and effectively deployed policies help to embed Best Practice, strengthening accountability by ensuring people sign up to relevant policies and procedures and leaving a clear audit trail.
Agility
Issuing new employees with a staff handbook and including a clause in their contract obliging them to read the information. In reality, few employees actually take time to read a policy handbook, which is rarely updated to reflect new policies. Circulating paper copies of a policy with the requirement that they are signed and returned to the issuing manager, a method that means an organisation has no way of knowing if it has been fully understood.
A good Policy Management system enables organisations to react swiftly to changing market conditions and regulatory mandates.
Distributing policy via email may have the advantage of leaving an audit trail, but it is too easy for employees to delete or ignore incoming messages.
Time-Management
Conclusion
Effectively communicating policies achieves internal efficiencies, saving money by driving down administration time and cutting costs by automating a previously labour intensive process. How should organisations implement a robust policy management system?
Creation of Policies
Experienced professionals within a company can play a key role in drafting and creating policy, although it is worth bearing in mind this can be a time-consuming process. Pro-forma policies are available on the internet but these tend to be expensive, difficult to tailor and the onus is on organisations to keep them up-to-date. Another option is to engage a third party professional, such as a lawyer or consultant, to assist with policy drafting (or review
20 @WMA_UK
Wealth Management organisations are increasingly looking to technology to manage the demands of adhering to compliance requirements. One of the industry’s biggest challenges is managing the significant and growing number of Policies and Procedures that they are required to communicate to staff. One way to demonstrate Best Practice is to implement a bespoke technology based Policy Management solution that supports the key principles of the UKBA/FCPA and BSI 10500, ensuring a clear compliance audit trail for the benefit of the Board, Senior Management, Auditors and Regulators. Jeremy Crame, CEO of Hitec says: “The only way companies can demonstrate Best Practice and distance themselves from the actions of a rogue individual is to implement a bespoke technology based Policy Management solution that ensures a clear compliance audit trail for the benefit of the Board, Senior Management, Auditors and Regulators and reduce risk.”
WMA Journal
Five Critical Stages Of Policy Management Below, Hitec sets out five basic stages that should form the backbone of any successful policy management programmes: Stage One – Establishing policy requirements • •
Audit employee understanding of the regulatory environment. Retain data to feed into subsequent stages of the policy life cycle.
Stage Two – Drafting policies • • •
Cut and paste or import policies from existing documents. Collaboratively draft and edit. Use Version Control to ensure the latest version of policy and procedure is always being worked on.
Stage Three – Policy deployment • • • • •
Deliver a clear and consistent presentation of the right policies to the right people across the organisation. Set automatic reminders to those employees who haven’t signed up to policy documents. Specify different policies for different user groups. Provide individual policy libraries with access to up-to-date policies in each. Automatically present policies in local languages to staff whatever their location.
Stage Four – Testing understanding and affirming acceptance • • • •
Ensure secure confirmation by staff that they agree to terms of the policy. Test employee understanding through random, multiple-choice questions for most important policies, such as anti-bribery and anti-money laundering. Set automatic reaffirmation – periodically re-present policies to refresh / reinforce understanding. Respond to low scores or non-agreement e.g. re-presents policies and questionnaires, alert policy owner.
Stage Five – Auditing and reporting • • • •
Capture and display detailed data on effectiveness of policy deployment. Demonstrate acceptance and understanding of policies (by policy, groups, individuals, over configurable timescales etc). Provide audit trails e.g. who received/agreed to which version of which policy on what date. Highlight ambiguous or poorly worded questions.
To learn more about Hitec and how it can help implement a policy management programme, visit www.hiteclabs.com/policyhub Issue 4 Autumn 2015
21
Report designed by Cicero No responsibility for loss to any person acting or refraining from acting as a result of any material contained in this publication can be accepted by the WMA, the author, publisher or printer. The views expressed by individual contributors are not necessarily those of the Association. Company limited by guarantee. Registered in England and Wales. No 2991400. VAT registration 675 1363 26. Published for the WMA by WordWide London. Copyright WMA 2014.
22 City Road Finsbury Square London EC1Y 2AJ Tel: +44 (0)20 7448 7100 Fax: +44 (0)20 7638 4636 www.thewma.co.uk Twitter: @wma_uk Members: enquiries@thewma.co.uk Non-members: info@thewma.co.uk
Issue 4 Autumn 2015
23