As compliance risk continues to be a focal point for regulators, compliance officers in banks and other financial institutions are encouraged to take steps to ensure that compliance risk is adequately managed.
Guidelines and Standards
Best practices for compliance management ensure that compliance risk is adequately managed. On a periodic basis, management should identify and assess the primary compliance risk issues applicable to all business activities including the related control mechanisms utilized to identify, measure, monitor and control the relevant risks. Regulatory and standard setting bodies such as the Board of Governors of the Federal Reserve System and the Basel Committee continue to issue guidelines and standards regarding compliance functions in banks. Specifically, the Board of Governors of the Federal Reserve System has adopted the requirement of the Basel Committee paper entitled “Compliance and the compliance function in banks” with respect to bank compliance standards by issuing a Supervisory Letter, SR 08-8/CA 08-11 in October 20082.
Definition of Compliance Risk
Compliance risk is defined as: The risk of legal or regulatory sanctions, financial loss, or damage to reputation resulting from failure to comply with laws, regulations, rules, other regulatory requirements, or codes of conduct and other standards of self-regulatory organizations (SRO’s) applicable to the banking organization (applicable rules and standards).
Compliance Risk Assessment Framework
The key object of a Compliance Risk Assessment Framework is to effectively assess the legal and reputational risk exposure of an institution’s business activities, not only in terms of adhering to applicable laws and regulations, but also to relevant internal firm policies and standards of conduct. A compliance risk assessment should include the following three key components: Regulatory Matrix – Includes an inventory of federal and/or state laws, regulations, rules, standards and other guidelines to be used in determining the applicability of each to relevant business units and/or activities. Additionally, the matrix will reflect (at a summary level) the results of each risk review, including inherent risk, control factor assessment(s), residual risk and any recommended corrective action. Compliance Risk Analysis – Provides a detailed analysis of the level of compliance risk inherent for each applicable law or regulation, including the effectiveness of the compliance risk control methods used to measure, monitor and control all identified risk(s). The risk analysis will result in a calculated level of residual risk and will contain recommended corrective action(s) to reduce unacceptable residual risk to an acceptable level. Compliance Reviews – Provide for an assessment of overall compliance with respect to applicable laws, regulations, rules, standards, guidelines and/or firm policies and relevant control environment used to identify, measure, monitor and control compliance risk.
Conclusion
The Compliance Risk Assessment Framework provides the methodology for assessment of compliance risk and the assignment of risk ratings that best describe the level of compliance risk with respect to applicable laws, regulations, rules, standards or guidelines. Thus, a financial institution’s compliance risk management program should be documented in the form of compliance policies and procedures and compliance risk management standards. The processes for managing compliance risk should be formalized in a compliance program that establishes a framework for identifying, assessing, controlling, measuring, monitoring, and reporting compliance risks across the organization, and for providing compliance training throughout the organization.
One of the many challenges and a top concern for financial institutions and their customers is dealing with financial fraud involving identity theft. According to the Association of Certified Fraud Examiners (ACFE) fraud against an organization can be committed internally by employees, managers, officers, or owners of the company, or externally by customers, vendors, and other parties.
Fraud experts rank identity theft as the fastest growing type of fraud as financial institutions continue to see increases in loss from account takeover fraud, credit card fraud and Internet fraud. Account takeover fraud continues to be a leading focus for financial institutions and their regulators.
ACCOUNT TAKEOVER FRAUD
Account takeover fraud occurs when an unauthorized party gains access to an existing bank account though identity theft and steals information from the account to conduct illegal transactions. The fraudster obtains and uses the victim’s personal information to take control of existing bank or credit card accounts and carries out unauthorized transactions against them. Account takeover sequences can be initiated through various means. Most often, the consumer or an employee of the targeted business is lured into opening e-mail attachments or responding to social media friend requests, which often redirect the person to compromised websites. Account takeover activity differs from other forms of computer intrusion as the customer, rather than the financial institution maintaining the account, is the primary target.
Cybercriminals may use phishing or spamming in order to gain access to the computer system. There are several methods of obtaining the account information depending on the ultimate goal of the intrusion effort. Trojan keystroke loggers are commonly used. This malicious software (malware) monitors and captures keystrokes including account access credentials and sends them to the cybercriminal to gain access to the account. This malware can be customized to target groups of individuals with the goal of accessing either financial or proprietary information. Once compromised, the criminal has access to the user passwords and credentials allowing him or her to control the system, transfer funds out, or gather and transmit data.
ANOTHER FORM OF IDENTITY THEFT IS APPLICATION FRAUD
This occurs when a perpetrator uses someone else’s personal information to establish new accounts. Fraudsters employ a variety of techniques to obtain the personal and financial information typically needed to take control of existing accounts. According to law enforcement and fraud experts, obtaining such information can be as simple as dumpster diving or cold calling. Alternatively, fraudsters may use more technology-reliant methods, such as phishing, or establishing fake websites to collect payment details. Incidents of application fraud are increasing in both frequency and levels of financial loss.
While account takeovers are most often achieved through the use of malware that exploits just one entry point into a network to start the theft, fraudsters may also use social interaction to prompt individuals into divulging account information. This information allows the fraudsters to access the account and move the money out of the account in a very short time. A 2012 Javelin study estimated losses from account takeover fraud at over $4.9 billion, representing a 69 percent increase over 2011. The same study concluded that much of this increase is likely attributable to security vulnerabilities in online and mobile channels, as well as shifts in consumers’ use of technology. This $4.9 billion in losses includes other consumer accounts such as loans, insurance, telephone, and utilities—in addition to deposit accounts at financial institutions.
INCIDENCE OF ACCOUNT TAKEOVERS
The data illustrates the growing incidence of account takeovers. Sources: 2013 Identity Fraud Report: Data Breaches Becoming a Treasure Trove for Fraudsters. Javelin Strategy & Research, February, 2013: Account Takeover Activity, Department of the Treasury Financial Crimes; Enforcement Network Advisory notice (FIN-2011-A016), December 19, 2011
The Javelin study also revealed that as new technology evolves and solutions emerge to successfully mitigate some forms of account takeovers, criminals have shifted their attention to less defended targets such as mobile devices. Mobile devices provide fraudsters with a variety of ways by which to compromise the data stored or transmitted by those devices, thus opening additional doors to account takeovers.
MOBILE CONSUMERS’ PERCEPTION OF BEHAVIOR RISKINESS
MOBILE CONSUMERS’ PERCEPTION OF BEHAVIOR RISKINESS
As depicted, less than 50 percent of consumers see risks from otherwise dangerous behaviors when used in a mobile environment. Source: 2013 Identity Fraud Report: Data Breaches Becoming a Treasure Trove for Fraudsters. Javelin Strategy & Research, February 2013.
From a cybercriminal perspective, it’s just as easy to access a financial institution or business account through a mobile text or e-mail as it is through a computer. While free antivirus applications are available and can help protect against many of these scams, educating the user on the vulnerabilities and risks of not having antivirus protection should be on the forefront as one of the most effective defenses against account takeover fraud.
PROTECT AGAINST IDENTITY FRAUD
Some useful methods to protect against identity fraud:
Always check bank and credit card statements for inaccuracies.
Check your financial information regularly, looking for what should and should not be there.
Order and check your credit report at least once a year.
Before providing personal information, make sure the individual or business requesting it has a valid reason for requiring the information.
Never write your credit card numbers or Social Security number on checks or on the outside of envelopes.
Do not put your Social Security number on any document unless you are legally required to do so.
Do not give account numbers over the telephone or to persons/companies you are not familiar with.
Do not use cordless or cellular telephones or e-mail to transmit financial or private personal information.
Keep all financial documents in a secure place.
Choose passwords that will be difficult to crack and use different passwords for all accounts.
Change passwords and PIN codes often.
Use different PIN numbers for all of your cards.
Do not store your PIN numbers on mobile phones or laptops.
Make sure your computer security (spam filters, virus protection, firewall, passwords, etc.) is robust and up-to-date.
As technology advances and continues to rapidly connect more and more people around the globe, the growth in connectivity, convenience, speed, technology adoption, and online and wireless payment options make it easier and more efficient than ever for individuals and businesses to conduct financial transactions. These same factors have given rise to new forms of fraudulent activities such as account takeover and other transnational crimes which are difficult to detect and prosecute.
Companies are encouraged to continuously assess and examine their information security standards, systems of internal control, policies and procedures in order to better identify, measure, monitor, control and report on weaknesses which could be exploited by management, employees, vendors or outside perpetrators.
Almost every organization must confront the issue of fraud in some shape or form. The precise legal definition of fraud varies by jurisdiction and by the specific fraud offense. In the U.S. legal framework, fraud is a specific offense with certain features. Many criminologists, fraud experts and law enforcement professionals define fraud as: “A knowing misrepresentation of the truth or concealment of a material fact to induce another to act to his or her detriment.” As such, fraud includes any intentional or deliberate act to deprive another of property or money by guile, deception, or other unfair means.
According to the Association of Certified Fraud Examiners (ACFE), fraud against an organization can be committed either internally by employees, managers, officers, or owners of the company, or externally by customers, vendors, and other parties. Other schemes defraud individuals, rather than organizations.
There are different types of fraud and many companies continue to see an increase in fraud losses arising from one or more fraudulent activities such as bankruptcy fraud, credit card fraud, mortgage fraud, securities fraud and internet fraud. The Association of Certified Fraud Examiners classifies fraud types as:
Internal Fraud
Internal fraud, also called occupational fraud, can be defined as: “the use of one’s occupation for personal enrichment through the deliberate misuse or misapplication of the organization’s resources or assets.” Simply stated, this type of fraud occurs when an employee, manager, or executive commits fraud against his or her employer.
External Fraud
External fraud against a company includes a broad range of schemes. Dishonest vendors might engage in bid-rigging schemes, bill the company for goods or services not provided, or demand bribes from employees. Likewise, dishonest customers might submit bad checks or falsified account information for payment, or might attempt to return stolen or knock-off products for a refund. In addition, organizations face threat of security breaches and thefts of intellectual property perpetrated by unknown third parties. Other examples of fraud committed by external third-parties include hacking, theft of proprietary information, tax fraud, bankruptcy fraud, insurance fraud, healthcare fraud, and loan fraud.
Fraud Against Individuals
Numerous fraudsters have also devised schemes to defraud individuals. Identity theft, Ponzi schemes, phishing schemes, and advanced-fee frauds are just a few of the ways criminals have found to steal money from unsuspecting victims.
The fraud triangle is the most widely accepted model for explaining why people commit fraud. This model was developed by Dr. Donald Cressey, a criminologist whose research focused on embezzlers—people he called “trust violators.” The fraud triangle model explains factors that cause someone to commit occupational fraud. Together, its components of perceived unshareable financial need, perceived opportunity and rationalization lead to fraudulent behavior.
How organizations can detect and prevent fraud.
As fraud losses increase, companies can proactively develop and implement robust and effective fraud detection and deterrence programs. A key element of an effective fraud detection and deterrence program is a Fraud Risk Assessment. What is a Fraud Risk Assessment?
A Fraud Risk Assessment examines the internal controls, policies and procedures of an organization to identify weaknesses which could be exploited by management team members, employees, vendors or outside perpetrators. The assessment team determines if management and employees are aware of and practice these policies in their day to day work, and confirm through testing that they are being practiced. Fraud risk assessment methodology is broken down into modules; each module examines a specific business function and the assessment team looks for vulnerabilities in areas where fraud is most likely to occur. The assessment team will identify and document weaknesses and develop recommendations for remediation.
Fraud experts suggest that the most cost-effective way to limit fraud losses is to utilize a Fraud Prevention Checklist. This checklist helps organizations test the effectiveness of their fraud prevention measures. This sample checklist focuses primarily on employee fraud awareness, internal controls, reporting and training. Fraud Prevention Checklist
Is ongoing anti-fraud training provided to all employees of the organization?
Do employees understand what constitutes fraud?
Have the costs of fraud to the company and everyone in it — including lost profits, adverse publicity, job loss, and decreased morale and productivity — been made clear to employees?
Do employees know where to seek advice when faced with uncertain ethical decisions, and do they believe that they can speak freely?
Has a policy of zero-tolerance for fraud been communicated to employees through words and actions?
Is an effective fraud reporting mechanism in place?
Have employees been taught how to communicate concerns about known or potential wrongdoing?
Is there an anonymous reporting channel, such as a third-party hotline, available to employees?
Do employees trust that they can report suspicious activity anonymously and/or confidentially and without fear of reprisal?
Has it been made clear to employees that reports of suspicious activity will be promptly and thoroughly evaluated?
Do reporting policies and mechanisms extend to vendors, customers and other outside parties?
To increase employees’ perception of detection, are the following proactive measures taken and publicized to employees?
Is possible fraudulent conduct aggressively sought out, rather than dealt with passively?
Does the organization send the message that it actively seeks out fraudulent conduct through fraud assessment questioning by auditors?
Are surprise fraud audits performed in addition to regularly scheduled audits?
Is continuous auditing software used to detect fraud and, if so, has the use of such software been made known throughout the organization?
Is the management climate/tone at the top one of honesty and integrity?
Are employees surveyed to determine the extent to which they believe management acts with honesty and integrity?
Are performance goals realistic?
Have fraud prevention goals been incorporated into the performance measures against which managers are evaluated and that are used to determine performance-related compensation?
Has the organization established, implemented and tested a process for oversight of fraud risks by the board of directors or others charged with governance (e.g., the audit committee)?
Are strong anti-fraud controls in place and operating effectively, including the following?
Proper separation of duties
Use of authorizations
Physical safeguards
Job rotations
Mandatory vacations
Does the internal audit department, if one exists, have adequate resources and authority to operate effectively and without undue influence from senior management?
Does the hiring policy include the following (as permitted by law)?
Past employment verification
Criminal and civil background checks
Credit checks
Drug screening
Education verification
Reference checks
Are employee support programs in place to assist employees struggling with addiction, mental/ emotional health, family or financial problems?
Is an open-door policy in place that allows employees to speak freely about pressures, providing management the opportunity to alleviate such pressures before they become acute?
Are anonymous surveys conducted to assess employee morale?
Are fraud risk assessments performed to proactively identify and mitigate the company’s vulnerabilities to internal and external fraud?
Identifying risk is the first step to loss prevention. That’s as true for fraud loss as for any other type of loss. A formal fraud risk assessment program is the first step towards protection for competitive advantage, proprietary assets, shareholder relations, regulatory compliance and disruption prevention. With adequate policies and procedures and an effective internal control framework in place, organizations are able to focus on operating a business instead of fighting breaches, theft and all the other forms fraud can take.
Overview
Many financial institutions continue to be challenged in developing robust policies, procedures and systems of internal control to meet specific requirements as outlined by the competent authorities in support of BSA/AML Compliance. Regulators continue to focus their attention on key areas of the BSA/AML Compliance Program to ensure that such risks are adequately identified, measured, monitored, controlled and reported. One such area of focus is Section 314(a) of the USA PATRIOT Act, Information Sharing between federal law enforcement agencies and financial institutions.
Section 314(a) of the USA PATRIOT Act and 31 C.F.R. Part § 1010.520 grant the Financial Crimes Enforcement Network (“FinCEN”) the authority to require that each financial institution, expeditiously search its records to determine whether it maintains or has maintained any accounts for, or engaged in specified transactions with, each individual entity or organization named in FinCEN’s request. A federal law enforcement agency investigating terrorist activity or money laundering may request that FinCEN solicit, on the investigating agency’s behalf, certain information from financial institutions. Upon receiving the requisite certification from the requesting federal law enforcement agency, FinCEN may require the financial institution to search its records to determine whether it maintains or has maintained an account for, or has engaged in a transaction with, any specified individual, entity or organization. Designation of Contact Person
Each financial institution must have designated points of contact regarding Section 314(a) requests (“FinCEN 314(a) Requests”) and provides FinCEN with the name, title, mailing address, e-mail address, telephone number and facsimile number for registration purposes. The institution should also promptly notify FinCEN of any changes to such designation or contact information. Notification of FinCEN 314(a) Request
The designated points of contact at the institution, as registered users, are notified by FinCEN of all FinCEN 314(a) Requests via the Secure Information Sharing System (“SISS”). Once notified, designated contact person or other registered representative of the institution accesses the SISS website (https://www.fincen.gov/314a/) and downloads the current FinCEN 314(a) Request. Since FinCEN normally transmits FinCEN 314(a) Requests every other Tuesday, the designated contact person or other registered representative of the institution should access the SISS at least once every two weeks regardless of whether FinCEN notifies the financial institution that a FinCEN 314(a) Request is available. Record Search
Upon receipt of a FinCEN 314(a) Request, financial institutions are normally required to conduct a one-time search of its records to identify any current account, or any account maintained in the last twelve (12) months, for a named suspect and to identify any transaction conducted outside of an account by or on behalf of a named suspect during the preceding six (6) months. The records that must be searched are specified in the FinCEN 314(a) Request, and the financial institution should perform the search according to the specified parameters if different from those normally utilized. Review of Potential Matches
In order to determine whether a potential hit is a false positive or a positive match, the institution should consider all relevant information related to the customers, including, but not limited to: name, street address, city, state, country, and any unique identifiers (i.e., social security number, employer identification number, tax identification number, passport number, etc.). The institution may utilize certain rules to determine the appropriate classification of any potential hit related to an entity or organization.
Reporting Positive Matches to FinCEN
Positive matches must be sent to FinCEN using the SISS on or before the designated response date, which is normally fourteen (14) calendar days after the request is transmitted.
As a prudent internal control measure, the institution should confirm that all searches have been completed prior to reporting positive matches to FinCEN because the SISS does not permit edit responses once they are submitted. The institution should retain a confirmation and a FinCEN 314(a) Search Self-Verification from the SISS that it has responded to the FinCEN 314(a) Request and that the response was made in a timely manner. Once the confirmation and self-verification from the SISS has been obtained, the institution should also notify management, (i.e. Chief Compliance Officer) that the institution has responded to the FinCEN 314(a) Request. Escalation of Potential Matches for Investigation
If the institution reports a positive match to a FinCEN 314(a) Request, it should also escalate the positive match information and all relevant information to management, typically the Chief Compliance Officer. Confidentiality of FinCEN 314(a) Requests
Financial Institutions are prohibited from using information provided by FinCEN for any purpose other than:
Reporting to FinCEN as provided in this section;
Determining whether to establish or maintain an account,
or to engage in a transaction; or
Assisting the institution in complying with any requirement
of 31 C.F.R. Part 103.
Therefore, the persons responsible for reviewing the lists and following up on potential matches should use discretion to maintain the confidentiality of FinCEN 314(a) Requests. In order to protect the confidentiality of the FinCEN 314(a) Requests, all search results, the FinCEN 314(a) Log and any supporting documentation should be stored either in a protected folder, if stored electronically, or in a secured file location, if retained in physical files. Documentation and Record Retention
The financial institution should document the results of all searches utilizing the FinCEN 314(a) Log, which contains the tracking number, the date of the search, any potential hits identified during the search, the resolution of any potential hits, the number of positive matches identified and the date reported to FinCEN.
While there are no specific recordkeeping requirements concerning 314(a) Requests, appropriate documentation of the request and record search should be maintained for a reasonable time period to provide for an effective and thorough audit trail. In accordance with Bank Secrecy Act record retention requirements and the recommended retention period indicated in FinCEN 314(a) FAQs, institutions should maintain all FinCEN 314(a) Request files for five (5) years.
EXECUTIVE SUMMARY
As regulators continue to focus on risk management, boards of directors and senior management face many challenges in establishing an ERM infrastructure that facilitates the advancement of risk management to provide better knowledge and information about the enterprise’s key risks and its capabilities for managing those risks. Adequate risk management programs can vary considerably in sophistication, depending on the size and complexity of the organization and the level of risk that it accepts. Irrespective of the firm’s size and complexity it is the expectation that a formal risk management system be in place to address their activities and to provide senior management and directors with the information they need to monitor and direct day-to-day activities. What is ERM?
The Committee of Sponsoring Organization (COSO) defines ERM as a “process, effected by an entity’s board of director’s management and other personnel, applied in strategy-setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its appetite, to predict reasonable assurance regarding the achievement of entity objectives.” ERM focuses on the establishment of oversight, control and discipline to drive continuous improvement of an entity’s risk management capabilities. Enterprise risk management framework is geared to achieving an entity’s objectives, set forth in four categories:
Strategic – high-level goals, aligned with and supporting its mission
Operations – effective and efficient use of its resources
Reporting – reliability of reporting
Compliance – compliance with applicable laws and regulations.
Components of Enterprise Risk Management
Enterprise risk management consists of eight interrelated components. These are derived from the way management runs an enterprise and are integrated with the management process. These components are:
Internal environment – The internal environment encompasses the tone of an organization, and sets the basis for how risk is viewed and addressed by an entity’s people, including risk management philosophy and risk appetite, integrity and ethical values, and the environment in which they operate.
Objective setting – Objectives must exist before management can identify potential events affecting their achievement. Enterprise risk management ensures that management has in place a process to set objectives and that the chosen objectives support and align with the entity’s mission and are consistent with its risk appetite.
Event identification – Internal and external events affecting achievement of an entity’s objectives must be identified, distinguishing between risks and opportunities. Opportunities are channeled back to management’s strategy or objective-setting processes.
Risk assessment – Risks are analyzed, considering likelihood and impact, as a basis for determining how they should be managed. Risks are assessed on an inherent and a residual basis.
Risk response – Management selects risk responses – avoiding, accepting, reducing, or sharing risk – developing a set of actions to align risks with the entity’s risk tolerances and risk appetite.
Control activities – Policies and procedures are established and implemented to help ensure the risk responses are effectively carried out.
Information and communication – Relevant information is identified, captured, and communicated in a form and time frame that enable people to carry out their responsibilities. Effective communication also occurs in a broader sense, flowing down, across, and up the entity.
Monitoring – The entirety of enterprise risk management is monitored and modifications made as necessary. Monitoring is accomplished through ongoing management activities, separate evaluations, or both.
Enterprise risk management is not strictly a serial process, where one component affects only the next. It is a multi-directional, iterative process in which almost any component can and does influence another. ERM and Internal Control
Internal control forms an integral part of enterprise risk management. Enterprise risk management framework encompasses internal control, forming a more robust conceptualization and tool for management. Authoritative guidance (Internal Control – Integrated Framework, Committee of Sponsoring Organizations (COSO) of the Treadway Commission) defines Internal Control as a process designed to provide reasonable assurance regarding the achievement of business objectives.
Internal control has three main objectives:
To promote effectiveness and efficiency of operations
To ensure reliability of financial reporting
To maintain compliance with applicable laws and regulations
Adequate internal controls
An institution’s internal control structure is critical to the safe and sound functioning of the organization generally and to its risk management system, in particular. Establishing and maintaining an effective system of controls, including the enforcement of official lines of authority and the appropriate separation of duties is one of management’s more important responsibilities. Appropriately segregating duties is a fundamental and essential element of a sound risk management and internal control system. Failure to implement and maintain an adequate separation of duties can constitute an unsafe and unsound practice and possibly lead to serious losses or otherwise compromise the financial integrity of the institution. Serious lapses or deficiencies in internal controls, including inadequate segregation of duties, may warrant supervisory action, including formal enforcement action.
When properly structured, a system of internal controls promotes effective operations and reliable financial and regulatory reporting, safeguards assets, and helps to ensure compliance with relevant laws, regulations, and institutional policies. Ideally, internal controls are tested by an independent internal auditor who reports directly either to the institution’s board of directors or its designated committee, typically the audit committee. Personnel performing these reviews should generally be independent of the function they are assigned to review. Given the importance of appropriate internal controls to organizations of all sizes and risk profiles, the results of audits or reviews, whether conducted by an internal auditor or by other personnel, should be adequately documented, as should management’s responses to them. In addition, communication channels should exist that allow negative or sensitive findings to be reported directly to the board of directors or to the relevant board committee.
In accordance with regulatory expectation, when evaluating the adequacy of a firms’ internal controls and audit procedures, management should consider whether these conditions are met:
The system of internal controls is appropriate to the type and level of risks posed by the nature and scope of the organization’s activities.
The institution’s organizational structure establishes clear lines of authority and responsibility for monitoring adherence to policies, procedures, and limits.
Reporting lines provide sufficient independence of the control areas from the business lines and adequate separation of duties throughout the organization
Official organizational structures reflect actual operating practices.
Financial, operational, and regulatory reports are reliable, accurate, and timely; wherever applicable, exceptions are noted and promptly investigated.
Adequate procedures exist for ensuring compliance with applicable laws and regulations.
Internal audit or other control review practices provide for independence and objectivity.
Internal controls and information systems are adequately tested and reviewed; the coverage, procedures, findings, and responses to audits and review tests are adequately documented; identified material weaknesses are given appropriate and timely high level attention; and management’s actions to address material weaknesses are objectively verified and reviewed.
The institution’s audit committee or board of directors reviews the effectiveness of internal audits and other control review activities on a regular basis.
Lessons learned
The lessons learned from several institutions that failed can be divided into five main areas:
Lack of segregation duties
Lack of senior management involvement
Poor control procedures
In many institutions, not only is there a separation of operational duties between the front and back-office, but there is also a unit independent of both to provide an additional layer of checks and balances;
Lack of supervision
There may be many supervisors; in reality none exercised any real control over processes; and
Inadequate capital
There are two aspects to this issue – an institution must have sufficient capital to withstand the impact of adverse market moves on its outstanding positions as well as enough money to keep these positions going.
Today, many financial institutions are facing tremendous regulatory challenges due to lack of a comprehensive Anti-Money Laundering (AML) risk assessment process. As a key component of an effective AML Compliance Program, regulatory guidance recommends that financial institutions develop and implement a comprehensive AML risk assessment process that includes products and services, customers, geographies and business units. The purpose of the AML risk assessment is to identify the products and services, business units, customers and geographies that pose heightened risk for money laundering or terrorist financing.
A Business Unit Risk Assessment (BURA) forms a key component of an AML Risk Assessment. A BURA is an attempt to identify each business unit’s level of vulnerability to money laundering and terrorist financing risks. This involves an evaluation of, among other factors, products and services, customer base of each business unit and the risks and controls at the business unit level. In order to identify and understand an institution’s overall AML risk exposure, a Business Unit Risk Assessment (Assessment) must be established and conducted. The primary purpose of the Assessment is to measure the inherent AML risk within each business unit, by providing a mechanism for identifying each business unit’s respective AML risks and assessing the mitigating controls used to manage these risks.
The results of a BURA should be used to identify gaps in an organization’s AML Compliance program and to establish priorities. Additionally, the BURA results allow senior management and the board of directors to make informed decisions about money laundering and terrorist financing risks and to oversee how these risks are being managed.
CONTEXT
A financial institution had its AML Compliance program criticized by internal auditors and regulators for lack of a robust and comprehensive risk assessment process. While the institution developed, adopted, and implemented a risk assessment methodology, the risk assessment rationale and methodology did not take into consideration all of the five (5) business unit risk assessments and how these risk assessments impacted the overall AML Compliance program. Audit fatigue, lack of resources, data integrity, and technology issues within the AML Compliance department led to process breakdown. Based on the issues noted, Alacer created a task plan that included:
creating a Business Unit Risk Assessment Questionnaire
appointing a central point of contact to lead facilitated sessions with business units
engaging subject matter expertise and assistance
identifying areas and departments to determine the population of business units that are required to complete the Questionnaire
training business units and compliance personnel
completing Questionnaire with business units, assigning risk ratings and finalizing assessment documentation with compliance.
APPROACH
Alacer Group professionals with deep expertise in AML Compliance, Risk Management and Technology had previously worked within the institution. Based on our experience and institutional knowledge, we knew this process could work for the institution.
The Assessment process includes:
developing and maintaining a consistent, structured and integrated methodology for identifying, monitoring, managing and reporting AML risk;
reviewing background materials (e.g., Audit Reports, Regulatory Examination Reports, Benchmarks or other Matrices, MIS) related to each business unit prior to leading the facilitated sessions associated with the Assessment in order to better understand the products and/or services and processes utilized by each business unit;
serving as a facilitator for each business unit by providing guidance in completing the Assessment module;
conducting a quality review of each business unit’s Assessment results prior to submission to the business unit’s head for approval;
conducting comparative analysis of the current year’s AML risk assessment results versus the prior year’s results and documenting any significant changes; and
tracking the status of each business unit’s Action Plan(s) and requesting status updates to assess whether the deadline for completion is met or any issues that might impact the deliverable are escalated to the head of the business unit.
RESULTS
Alacer Consultants worked with bank management to greatly enhance the business unit risk assessments process, and the overall AML risk assessment process in order to meet regulatory expectation. In addition to identifying where money laundering and terrorist financing risks are the greatest, the results of the BURA process was used to identify gaps in the organization’s AML Compliance Program. The BURA process dictates documentation and verification requirements for new and existing customers, support and validate the customer risk assessment process, determine the nature and frequency of transaction monitoring, influence the nature, scope and frequency of AML audits and assist in establishing other AML Compliance program priorities such as policies and procedures, training, staffing, compliance monitoring and testing.
CONCLUSIONS
A best practice approach in conducting BURA is to engage the business owners – the people who has the best knowledge and understanding of the business in identifying the inherent risks in the products and services, any money laundering & terrorist financing risks posed by the customers they serve and current money laundering/terrorist financing controls and any noted gaps in the AML Compliance program. Compliance plays a critical role in the process by reviewing and approving business owner-assigned ratings. Additionally, Compliance should implement, oversee, coordinate and maintain an effective AML Compliance program for the institution. More specifically, Compliance should support the business units in establishing and implementing procedures for compliance with applicable AML laws and regulations as well as meeting regulatory expectations.
In addition to Compliance, Internal Audit plays a pivotal role in the process. Internal Audit assesses the activities and processes conducted within each business unit to determine if they are consistent with the organization’s documented policies and procedures. More specifically, with respect to the Assessment, the primary responsibility of Internal Audit is to evaluate the Assessment process and methodology as part of its risk-based independent testing and as deemed necessary, conduct testing activities.
The Currency and Foreign Transactions Reporting Act of 1970, commonly referred to as the Bank Secrecy Act, or BSA, requires financial institutions to help the U.S. government detect and prevent money laundering. To do this, financial organizations must expeditiously file suspicious activity reports (SARs) so that law enforcement agencies gain maximum benefit from the information. SARs play a critical role in the country’s ability to utilize suspicious transactions to combat terrorism, terrorist financing, money laundering and other financial crimes.
In general, banks monitor and report suspicious activities using programs that include four key, interdependent components:
the identification of unusual activity (which may include employee identification, law enforcement inquiries, referrals and transaction and surveillance monitoring system output)
management of alerts
SAR decision making
SAR completion and filing
Since one purpose for filing SARs is to bring violations or potential ongoing violations of the law to the attention of appropriate authorities, FinCEN’s guidelines suggest that banks should review suspicious activity at least every 90 days and, if necessary, file a SAR. Since preparation errors and filing weaknesses, including late submissions, can reduce SAR effectiveness, good bank risk managers recognize that the quality of SAR content is critical to the adequacy and effectiveness of the suspicious activity reporting system.
In this paper, we:
briefly outline how one global financial services company used Lean Six Sigma methodologies to meet the challenges of its SAR 90 day follow up process
review the results the new solution achieved
A global financial institution’s US-based operations were subject to FinCEN’s 90-day continuing activity monitoring guidelines. The existing process (similar to the bank’s regular review of suspicious activity triggered alerts) had two steps: an initial review of the SAR, called a scrub, followed by further investigation. Plagued with inefficiencies and encumbered by duplicated time, the rolled throughput yield for the existing process was 14%, the scrub yielded another 30% and further investigation yielded 48%. The following challenges were identified:
volume surges coming into the 90-day continuing review queue from an increasing number of SARs via the investigation queues
an increased risk of missed FinCEN regulatory deadline
decreasing productivity per investigator
inadequately trained resources for handling duplicate review processes
lack of transparency and performance management tools
Based on this list, Alacer created a task plan that included:
identifying specific actions to help optimize the scrub and investigative processes
determining if a “one-touch” process should replace the current two-step review process using productivity differentials as dispositive
creating performance management transparency to ensure regulatory guidelines are met
training compliance personnel in Lean Six Sigma to drive the culture for continuous improvement
APPROACH
The Alacer Group had previously applied Lean Six Sigma tools in different process areas within the same financial institution’s risk management and compliance functions. Based on our experience, we knew that these tools could work on the organization’s SARs backlog and processes if skillfully applied. Initially, we focused on establishing a fact-and-data derived baseline that could provide an accurate view of the institution’s current performance across the following dimensions: incoming SAR volumes, aging SARs, costs, productivity, mean and dispersion of review cycle times, and levels of adherence to performance management practices. Once these processes were mapped, we took the following actions:
“walked the process,” modifying and validating the existing 90-day follow up process map
created a fishbone analysis that identified 32 root causes limiting desired productivity levels
identified 38 potential solutions to the root causes
prioritized the options by weighing each solution’s potential impact against ease of implementation, then winnowing the list to 22 potential fixes (three with high impact)
identified quick hit, near term and longer term opportunities
developed final recommendations and an action plan
RESULTS
The remarkable results stretch across several dimensions of value to the institution:
80% of the review team now uses a one-touch process, eliminating duplicative efforts, resulting in a 65% improvement in process yield
a new aging, or vintage, report is now generated daily to deliver insight into productivity levels as well as to forecast risk of non-compliance with regulatory time lines
productivity improved by 66% and, with the adoption of the one-touch process, cycle time decreased by 50%
100% of SARs are now reviewed within the required regulatory time line; none have fallen outside the 90-day review period
after Lean training sessions were held with line managers and investigators, the organization experienced increased adoption of Lean tools and methodologies in the review process, especially with waste identification.
CONCLUSIONS
Like other business processes, risk management and compliance functions can be streamlined through the skillful deployment of Lean Six Sigma principles. The 90-day follow up requirement for SARS is an area of higher risk for financial institutions, and non-compliance comes with hefty fines. Filing a SAR, while not dispositive, at least suggests that the financial institution needs to conduct a timely review of that account or customer as required by law. Missing the deadline for conducting the review is unacceptable. As experienced by this banking institution, meeting the challenge of designing a new review process using Lean Six Sigma practices can not only help law enforcement agencies, it can also result in lower costs and higher productivity.
Most financial services organizations agree that the current risk and compliance environment has become increasingly complex and a navigational challenge. New mandates pose cost challenges, task employee skill levels, challenge system and process integration and require ongoing enhancement of overall performance management practices. The costs of non-compliance are high; fines, adverse impact to reputational capital, citations and restrictions on non-organic growth opportunities are some obvious ones.
Six Sigma is a methodology that helps any business reduce costs and inefficiencies by identifying and eliminating whatever wasteful steps exist within a process. Although it was originally developed for use within manufacturing, Six Sigma tools can be effective within financial services organizations to help solve compliance problems, even though the problems typically have many intricate and legacy processes.
Given the cost of non-compliance fines, there is real motivation within financial services to adhere to regulations and to more effectively manage the compliance processes and cost. In this paper, we:
briefly indicate the challenges faced in this regulatory and risk management landscape
highlight the approaches that can be adopted to help the company manage these challenges
review how one financial institution used Lean Six Sigma tools to meet compliance challenges
CONTEXT
The Royal Bank of Scotland recently estimated that the cost of its risk and compliance has risen 30 percent in the last two years. A survey by Veris Consulting, conducted in early 2013, showed that banks must plan to devote more resources to Anti-Money Laundering (AML) and Office of Foreign Assets Control (OFAC) complaints, but a third of the respondents had insufficient budget to meet those demands.
For many financial institutions, the answer is simply to hire more staff. But the Federal Reserve Bank of Minneapolis estimated in 2013 that hiring just one additional employee would reduce the return on assets by 23 basis points for banks with total assets of $50 million or less. This decline could cause about 13 percent of them to go from profitable to unprofitable.
But there is an alternative that requires an inward focus rather than an outside view of bringing in additional staff. Lean Six Sigma tools could be deployed that would streamline processes, eliminate waste and cancel the need for more personnel.
The Alacer Group recently worked with a U.S.-based financial institution that had rapidly grown through acquisitions. It had not adequately anticipated the resources, process and system challenges inherent in integrating the compliance functions across multiple entities with differing regulatory needs. The parent organization’s risk monitoring systems were being applied indiscriminately to acquired entities, leading to volume spikes in suspicious activities. The organization’s resulting failure to deal with the triggered alerts within the allowable regulatory time allotments resulted in OCC citations and adverse findings.
In addition to volume spikes and unprocessed alert backlogs, the compliance officers and investigative teams faced the following challenges:
each alert’s increasing processing cost
declining productivity per investigator
95% of alerts were not processed within the allowable timeframe
non-existent performance management processes
limited transparency
The immediate management directive was clear: find a way to deal with the backlog of alerts to achieve regulatory compliance. Other desired initiatives:
The Alacer team believed that, by using basic Lean Six Sigma techniques, the financial organization could optimize its review processes and improve its ability to comply with regulatory mandates and guidelines, yet reduce time and resource costs.
Initially, we focused on establishing a fact and data-derived baseline that could provide an accurate view of the institution’s current performance across several dimensions: incoming alert volumes, processing costs, productivity, mean and dispersion of review cycle times and levels of adherence to performance management practices. Once established, the baseline could then be analyzed using a combination of Lean Six Sigma tools. This identified root causes of problems and suggested the best improvement options.
RESULTS
For this organization, using Lean Six Sigma tools to streamline its risk and compliance processes has resulted in:
57% decrease in alert volume
63% increase in productivity
21% decrease in processing costs
100% of alerts now fully compliant within
regulatory review periods In comparison, there were 23,160 alerts out of compliance on January 1, 2011; by March 2011, there were zero alerts out of compliance.
CONCLUSIONS
Lean Six Sigma tools can be successfully applied to the financial services industry, particularly in the areas of risk management and compliance; after all, these are simply business processes. The monitoring, reviewing and reporting functions can all be streamlined through the skillful use of lean principles. Given the current regulatory environment, Lean Six Sigma presents a real opportunity to financial institutions to combat financial and reputational damage without incurring sustained additional cost. Through Lean Six Sigma, tangible, successful outcomes can include a reduction in processing costs, enhanced productivity and, ultimately, full compliance with regulatory guidelines.
In today’s high-tech world of banking, complex processes – some of which are legacy processes and no longer operating at peak efficiency – are the norm. Design for Six Sigma (DFSS) is one way to bridge the gap between profitability and these cumbersome processes, increasing regulatory requirements and higher overhead costs.
DFSS is a separate and emerging business process management methodology (process generation rather than process improvement) that helps organizations determine its customers’ needs and to use that information to create a solution. These techniques also include tools and processes to predict, model and simulate the product delivery system (the processes/tools, personnel and organization, training, facilities, and logistics to produce the product/service) as well as the analysis of the developing system life cycle itself with proper investigation results and gains to ensure absolute customer satisfaction with the proposed system design solution.
USING DFSS TO CREATE BIG RETURNS
Lean Six Sigma has been used within the financial community for more than a decade, particularly in the area of continuous process improvement. It is still a popular and effective tool to improve financial services operational efficiency; however, many organizations are finding that identifying and reducing incremental defect variability does not fully maximize the full spectrum of improvement opportunities. To achieve a larger return on investment, many organizations are discovering how DFSS can help them reexamine, radically recreate and often build entirely new processes.
In a 2010 article for iSixSigma, author Randy Woods asked Richard Paxton, co-founder and CEO of the Alacer Group, about the growing interest in DFSS as a preferred approach to process design and reengineering. Specifically, he was interested in Paxton’s take on DFSS versus the DMAIC improvement cycle (Define, Measure, Analyze, Improve and Control).
“In financial services, a typical DMAIC project can deliver somewhere between $500,000 and $600,000, whereas DFSS projects can be upward of $20 million,” Paxton said. “The key is knowing where and how to apply the technique.”
He added that, 10 years ago, many financial institutions were wary of using DFSS tools and thought of them primarily for application in manufacturing industries. Additional apprehension centered on a misperception that massive technology deployments had to be part of DFSS solutions. Today, DFSS is being embraced for its ability to provide robust designs for reengineering existing processes and products and developing new ones.
“Financial services today are very similar to large technology organizations; relying upon a complex network of interrelated processes and systems to deliver quality products and services for their customers,” Paxton said. “By taking an end-to-end view, and designing across functional boundaries, new levels of performance and quality can be realized. This is where DFSS is a perfect fit, and can help bridge the gap between business and technology.”
Similar to Lean and DMAIC, DFSS does take time to implement. Depending on the scope and level of complexity, a large-scale design and build can take 12-18 months to complete. Alacer recently finished a project where the core business processes for a large financial institution were completely redesigned. It took 18 months to flawlessly execute a new workflow environment, support processes, user interfaces and system integrations.
As another example, Alacer recently worked with a national bank with thousands of branches across the U.S. to solve its increasing Suspicious Activity Report (SAR) workload. While SARs play a significant role in reducing the country’s vulnerability to terrorist threats by identifying potentially fraudulent activities, the process was causing an increased financial burden on the financial organization. Specifically, the bank was experiencing an unanticipated related cost of $40 million in vendor and contracting expenses.
Alacer partnered with existing bank vendors to develop a multiphase approach that focused on expense controls, end-to-end process reviews and the identification of high variability areas. Using DFSS principles, Alacer developed new processing and staffing models to address work backlog and to mitigate operational impact. As a result, the bank realized $36 million in savings over three years, and $16 million in savings through vendor contract reductions. The result outperformed regulatory expectations and was designated “Best in Class” by government agencies.
DFSS AND FUTURE PROOFING
“Over the years, the functions of banking have remained the same – sales, fulfillment, and service,” Paxton commented. “What has changed is the way those functions are delivered. In the future, what will differentiate a financial institution will be its ability to deliver products and services customers want, in the way they want it and at a level of efficiency that makes sense for the business. When used in conventional and unconventional ways, DFSS can help organizations deliver this value to customers and, simultaneously, increase the bottom line.”
This tactic proved effective for a Fortune 10 financial organization looking to revamp its mortgage process. It was highly inefficient, cumbersome and lacked standardization, resulting in costly rework, increased risk exposure and loss of business. The Alacer project team applied DMAIC and Lean principles to identify defects and waste in the end-to-end process, where it was discovered that the steps to income verification and credit guidelines would be the areas where radical improvement was most possible. The DMADV (Define, Measure, Analyze, Design, Verify) roadmap of DFSS was then selected to design a new automated income verification process.
The results were impressive. The financial organization’s end-to-end mortgage processing time was reduced by 30 percent and overall risk exposure was lowered, freeing up $500 million in capital for funding new loans. Thousands of man-hours were restored to bank branches, enabling them to significantly increase customer service and sell additional products.
CONCLUSION
DFSS and its DMADV methodology can be powerful tools for creating new business processes within financial services organizations. It isn’t necessarily about identifying solutions, but rather it’s a system for honing in and refining existing processes to better meet business needs. From the reconfiguration of drive-up banking to improvements in setting up new customers, DFSS can help an institution create new products and systems that best respond to the needs of its user base…all while adding revenue to the bottom line.
