Scottish IOR Conference 1st November, 2013

1. Making Conduct Risk [Good] Business as Usualtaking a strategic approach to Conduct Risk Management Scottish IOR Conference 1st November, 2013

2. Introduction • 15 years plus in strategy and risk management • CEO & Founder of Manigent (consultancy) • CEO & Founder of StratexSystems (software) • 2006/07 -12 month / 21 organisation research project into the integration of strategy and risk management • 2008 - Created the Risk-Based Performance Management methodology during various strategy and risk related engagements in the city

3. Agenda • The emerging regulatory landscape • Implementation of a Conduct Risk Management framework • Taking a strategic approach to Conduct Risk

4. The emerging regulatory landscape

5. With the creation of the FCA, Conduct Risk becomes central to the regulatory agenda FCA Objective To make relevant markets work well so consumers get a fair deal. CONDUCT RISK Outcomes • Consumers get financial services and products that meet their needs, from firms they can trust; • Markets and financial systems are sound, stable and resilient, with transparent pricing information; and • Firms compete effectively, with the interests of their customers and the integrity of the market at the heart of how they run their business. 3 Pillars Regulatory Approach Firm Systematic Framework (FSF) Event-driven work Issues and products

6. FCA has a range of new powers • Power to; • ban products or restrict sales • stop misleading financial advertising • tell the public earlier about enforcement action • Better tools to regulate markets “The key difference between the future and now is we (the FCA) are being given the power to shoot first and ask questions later” Martin Wheatley to the Association of British Insurers, September, 2012

7. The FCA has new regulatory tools Business Model and Strategy Analysis Stage 1 Are the interests of customers and market integrity at the heart of how the firm is run? Governance and Culture Sales Processes Stage 2 Product Design Post-sales/services and transactions handling

8. What does the FCA really want from firms? “We accept the FSA has not been as effective a conduct regulator as it could have been” “Led in many cases to a tick-box and overly legalistic compliance culture within firms, encouraged by what has been seen as a tick-box regulatory approach” Clive Adamson, Director of Supervision, FCA, 19/4/2013 • “We will have a greater expectation of a strategic approach to the conduct agenda and senior management and board engagement in it.” • Clive Adamson, Director of Supervision, Conduct Business Unit, FSA, January 2012 “We accept that firms need to be able to generate acceptable returns for shareholders, and have to be financially robust but this is about ‘good profits' rather than profit at any cost - either to firms' own stability or their customers’ best interests.” Martin Wheatley, FCA CEO

9. What does the FCA really want from firms? • Customers at the heart of your firm’s business model and strategy • A strategic approach with strong senior management and board engagement • Good profits • Stability and accountability “We accept the FSA has not been as effective a conduct regulator as it could have been” “Led in many cases to a tick-box and overly legalistic compliance culture within firms, encouraged by what has been seen as a tick-box regulatory approach” Clive Adamson, Director of Supervision, FCA, 19/4/2013 • “We will have a greater expectation of a strategic approach to the conduct agenda and senior management and board engagement in it.” • Clive Adamson, Director of Supervision, Conduct Business Unit, FSA, January 2012 “We accept that firms need to be able to generate acceptable returns for shareholders, and have to be financially robust but this is about ‘good profits' rather than profit at any cost - either to firms' own stability or their customers’ best interests.” Martin Wheatley, FCA CEO

10. How are you responding to the Conduct Risk agenda? Specific Conduct Risk Management Framework • Embedding Conduct Risk Management into the existing Management approach Vs. Which approach has your firm taken?

11. How are you responding to the Conduct Risk agenda? To meet regulatory requirements • To truly put customers at the heart of your business Vs. What is your firms motivation?

12. What we have seen over the last few months • “We have created a Conduct Risk Management framework which adds 175 new indicators to our monthly MI” – Director of Operational Risk • “Conduct Risk is been handled by the compliance team – CEO” • “We don’t see a real need to change, Conduct Risk is just TCF 2.0” - CRO Specific Conduct Risk Management Framework To meet regulatory requirements

13. We believe Conduct Risk represents a big opportunity for your firm and for the Risk Management profession • Drive strategic and operational change to drive improvements is customer satisfaction and profitability • Embed risk management as a core part of your firm’s strategic and operational execution culture • Drive improvement across management processes, information and decision-making • Raise your professional profile and that of your team Embedding Conduct Risk Management into the existing Management approach To truly put customers at the heart of your business

14. Implementation of a Conduct Risk Management framework

15. Developing a Conduct Risk Management framework is an understandable response by firms

16. However, we believe a specific Conduct Risk Management framework is an sub-optimal response Creating a new, specific Conduct Risk Management framework can have a number of potential pitfalls: • Can create significant duplication and confusion • Can significantly increase the amount of data been collected and reporting…but reduce the amount of insight generated • Perpetuates the tick-box approach and culture • Misses the opportunity to: • Drive real business change and improvement • Put risk management (and customers) at the heart of strategic and operational execution

17. Taking a strategic approach to Conduct Risk

18. An integrated model for Strategy and Risk Management Strategic Strategy Map Strategic Risk Map Business Drivers Alignment Process Alignment Matrix Initiative Alignment Matrix Appetite Alignment Matrix Operational Initiative Portfolio Operational Risk Map Process Architecture

19. An integrated model for Strategy and Risk Management Strategic What are our key value drivers? What our Business Objectives? What our Strategic Risks? Strategy Map Strategic Risk Map Business Drivers Alignment Are our BAU processes aligned? Are our initiatives aligned? Are we operating within Appetite? Process Alignment Matrix Initiative Alignment Matrix Appetite Alignment Matrix Operational What are our key BAU processes? What are our key change initiatives? What our Operational Risks? Initiative Portfolio Operational Risk Map Process Architecture

20. Central to this integrated model for Strategy and Risk Management is the Strategy Map

21. The Strategy Map is a leading tool to enhance the communications, execution and monitoring of strategy Improve Shareholder Value To succeed financially, how should we appear to our shareholders? Shareholder Value ROCE Productivity Strategy Revenue Growth Strategy Improve Cost Structure Increase Asset Utilization Enhance Customer Value Create Value from New Products & Services • Customer Profitability • Cost per Unit • Asset Turnover • New Revenue Sources • Market and Account Share • Customer Acquisition • Customer Retention • Customer Satisfaction To achieve our vision, how should we appear to our customers? Product Leader Customer Solutions Customer Value Proposition Low Total Cost Product/Service Attributes Relationship Image Price Quality Time Function Service Relations Brand Operations Theme Customer Management Theme Innovation Theme Regulatory and Society Theme To satisfy our shareholders and customers, what business processes must we excel at? To achieve our vision, how will we sustain our ability to change and improve? Human, Information, and organisational Capital Strategic Competencies Strategic Technologies Climate for Action

22. The Strategy Map articulates how an organisation creates value Financial Drive sales execution “We align our incentives to our appetite & desired behaviours” “Their fees are clear and fair” Deliver Revenue Growth Customer Objective Statement of what strategy must achieve and what’s critical to its success KPIs How success in achieving the strategy will be measured and tracked Targets The level of performance or rate of improvement needed Initiatives Key action programs required to achieve Priorities Internal Process Sustainable Growth Objective KPIs Targets Initiatives Drive sales execution YTD % Increase in income 25% • Implement new sales process Learning & Growth

23. However, to create value, risk-taking must be aligned to strategy… Financial “We align our incentives to our appetite & desired behaviours” Drive sales execution “Their fees are clear and fair” Deliver Revenue Growth Customer Objective Statement of what strategy must achieve and what’s critical to its success Appetite How much risk are we willing to run to achieve the objective? Exposure How much risk are we currently running? Alignment Is our current risk-taking aligned to appetite? Internal Process Sustainable Growth Objective Appetite Exposure Alignment Drive sales execution Moderate High Over-exposed Learning & Growth

24. Effective risk management supports value creation and value protection... Financial “We align our incentives to our appetite & desired behaviours” Drive sales execution “Their fees are clear and fair” Deliver Revenue Growth Customer Objective Statement of what strategy must achieve and what’s critical to its success Risks The threats and opportunities (risks) exist which may impact achievement of objectives Thresholds The appetite and tolerance thresholds used to monitor risk Mitigation The activities undertaken to manage risk Internal Process Sustainable Growth Objective Risks Thresholds Mitigation Drive sales execution • Mis-selling resulting in reputation loss • Appetite • Tolerances • Controls • Initiatives • Policy & procedures • Processes Learning & Growth

25. The Strategy Map can be used to demonstrate the role customer outcomes play in the firm’s strategy Financial Drive Shareholder value Deliver Revenue Growth Control Costs Customer “Their fees are clear and fair” “Their solutions continue to meet our changing needs” “We have quick, convenient access to our financial info” “We received good value” Internal Processes Deliver outstanding customer service @ POS Ensure effective Complaints handling Drive sales execution Continuously seek to understand client needs Learning & Growth “We leverage our data to deliver positive customer outcomes “We sell the right products, to the right people, the right time” “We align our incentives to our appetite & desired behaviours” Information Capital Cultural Capital Human Capital

26. The Strategy Map can be used to demonstrate the role customer outcomes play in the firm’s strategy Financial Having clear and achievable financial objectives is critical to ensure the firm is sustainable and will be around to provide on-going service Drive Shareholder value Deliver Revenue Growth Control Costs Customer By convention, customer outcomes are expressed is phases you would like to hear your customers use to describe your firm and products/services “Their fees are clear and fair” “Their solutions continue to meet our changing needs” “We have quick, convenient access to our financial info” “We received good value” To deliver financial and customer outcomes, we must be clear about the key processes which will enable us to deliver those outcomes. Internal Processes Deliver outstanding customer service @ POS Ensure effective Complaints handling Drive sales execution Continuously seek to understand client needs Learning & Growth Underpinning the delivery of the key processes, financial and customer outcomes is the organisational culture. “We leverage our data to deliver positive customer outcomes “We sell the right products, to the right people, the right time” “We align our incentives to our appetite & desired behaviours” Information Capital Cultural Capital Human Capital

27. ‘Slice’ the Business Strategy by Customer Perspective to get a ‘Conduct Risk’ view

28. Customer related processes and initiatives are aligned to customer objectives via alignment matrix’s

29. The Strategy Map can be used as a starting point in the definition of risks & controls related to customer outcomes Financial Deliver Revenue Growth Customer “Their fees are clear and fair” Internal Processes Drive sales execution Learning & Growth “We leverage our data to deliver positive customer outcomes Information Capital

30. Use the same approach at an operational level to wrap a risk & controls framework around customer related processes (and initiatives) From a Conduct Risk perspective, define, manage and monitor key customer processes, such as New Product Development, Sales Execution, Customer service, Complaints handling etc. Processes Risk Appetite KPIs Actions Key Risks KRIs Actions Assessment Events Key Controls KCIs Actions Assessment Certification

31. Apply the RACI model at a Strategy and Operational level to clarify and embed accountabilities for Customer outcomes “The doers” Those people working on delivering the objective, managing the risk or applying the control. “The buck stops here” Those with Yes/No authority related to the objective, risk or control. P Responsible Accountable Inform Consult “Keep in the picture” Position(s) that need to know about decision or action related to the objective, risk or control. “Keep in the loop” Those involved prior to decisions or action related to the objective, risk or control.

32. Line of Sight Dashboards which require Accountable sign-off reinforce a culture of accountability

33. Using existing management ‘tools’, Conduct Risk can be embedded within your existing management approach Strategic What drives customer value? What our Customer Objectives? What our Conduct Risks? Strategy Map Strategic Risk Map Business Drivers Alignment Are our processes aligned to customer outcomes? Are our initiatives aligned to customer outcomes? Is our Conduct Risk Appetite aligned to our Strategy? Process Alignment Matrix Initiative Alignment Matrix Appetite Alignment Matrix Operational What are our key BAU processes? What are our key change initiatives? What our Conduct Risks? Initiative Portfolio Operational Risk Map Process Architecture

34. Why take a strategic approach to Conduct Risk? Our experience (with Financial Services and non-Financial Services firms) shows the benefits of taking a strategic approach: • Significant improvements in Board and Senior Management engagement • Significant improvements in Management Information and Insights – shaping the focus on the ‘vital few’ • Improved regulatory engagement • Activities to deliver your Conduct Risk requirements have the additional pay-off of driving real business value • Enables the CRO/Risk Team to demonstrate real business value via enhanced risk management practices

35. Integrating Strategy & Risk Management an Introduction to Risk-Based Performance Management

36. Risk-Based Performance Management (RBPM) is a holistic and integrated approach to strategy execution and risk management Strategy Management What are we trying to achieve? What is our Risk Appetite? Performance Management Risk Management Are we on track? Are we operating within appetite? Appetite Governance & Communications Culture

37. The Risk-Based Performance Management (RBPM)methodology is based on seven management disciplines Business Drivers Capital Income Reputation ? 2. Manage Performance 5.Governance Appetite 1. Set Strategy 4. Appetite Alignment Appetite 7.Culture 3. Manage Risk 6.Communications Shareholder Value Share Price Economic value add Profit ?

38. The Risk-Based Performance Management (RBPM) roadmap can be used to guide the implementation of an effective response to the Conduct Risk agenda Execution Formulation Define Strategic Objectives Define Strengths & Weaknesses Define Risk Appetite Define Strategic Risks Define Strategic Controls Define Strategic Goals Define Business Drivers Define the Strategy Define Indicators Assess Risks & Controls Monitor Appetite Alignment Define the Business Model Align Risk Appetite & Strategy Define Processes Define Initiatives Define Operational Risks Define Operational Controls Executive Board

39. Contact details Andrew Smart CEO Manigent & StratexSystems Email: andrew.smart@manigent.com Blog: www.riskbasedperformance.com Web: www.manigent.com | www.stratexsystems.com LinkedIn: http://uk.linkedin.com/in/ajsmart Twitter:@AndrewJSmart