The simple answer to the Big SharePoint Question – as played out in a lift

There’s one question everyone asks us: “Why did you build your GRC application on SharePoint?”

It’s a great question and one of my pet subjects. I love answering it.
We’ve even produced a white paper on the topic. But if digesting white papers is not your thing, read on…

Recently I was at a briefing about the new EU General Data Protection Regulation (GDPR) and one of our competitors had people there. After the event was over, there followed the usual rush to the lift. But I had to take a call for a couple of minutes so was a little held up.

By the time I boarded the lift, the crowd had gone. I found myself alone except for a man and a woman – representatives of one of our competitors. Their conversation was enlightening and – inadvertently – shows the value of SharePoint as a platform for a GRC solution such as StratexPoint. They had no idea who I was.

It was, if you like, an elevator non-pitch.

Competitor Sales Person: “Do we have a good answer for Company X’s questions about access control and permissions? And can we say that our application will help them with this new EU GDPR requirement?”

I try to give the impression I’m not listening, staring down at my shoes.

Competitor Technical Person: *“We have not heard anything back from the US development team, but on its own we cannot meet their access control and permissions requirements – and we certainly can’t help with GDPR.”

Competitor Sales Person (looking shocked): “What! We’ve already stated in the RFP response we could do that and I reassured them on those points last week.”*

Competitor Technical Person (looking a little smug): “Yes, yes I know. I talked to some of the guys here and we think we can blag it with SharePoint. SharePoint does all of this out of the box and we figure we integrate with SharePoint, kind of… so will probably be able to get away with it.”

My antennae are twitching. Possibly so am I. I try extra hard to give the impression I’m not listening. Wow, my shoes are really shiny!

Competitor Sales Person (not happy): “Maybe we should tell them not to bother buying our application and use SharePoint instead!”

I can’t be certain I’m not smirking, but do my best to maintain a poker-face.

Competitor Technical Person: “Well that wouldn’t be a bad option for them. They already use it across the business so it’s familiar and would save them a load of money if they leveraged it further. I have always said we should develop more of our stuff in SharePoint – it is a great platform for this sort of application.”

Competitor Sales Person (agitated now and also somewhat pink): “Well we don’t sell SharePoint do we? And I need this deal. They are coming in this afternoon and I hope you techies do a good job.”

Silence. Doors open.

And that is why we built our GRC solution on SharePoint; the strength of the platform and rich development environment ‘out of the box’. To quote an (unnamed) competitor “it is a great platform for this sort of application”.

From a user point of view, it is often already a familiar part of the everyday work environment thus delivering easy and high level of adoption. It also brings a welcome simplification of the IT landscape through leveraging an existing IT investment. Better still, it reduces the overall cost of ownership of applications.

Ironically, one of the data breach scenarios mentioned in the executive briefing related to accidental breaches… like conducting unguarded, commercially sensitive conversations in lifts.

Individual accountability is important to Standard Charter as well as the PRA and FCA

Just days ahead of the introduction of the Senior Managers' Regime (SMR) and Certification Regime (CR), Standard Chartered appear to be as focused on Individual Accountability as the PRA & FCA.

On the back of a poor set of results at the tail end of an aggressive growth strategy by its former CEO, Peter Sands, the FT reports that “accountability reviews” have been established to “to investigate if bonuses can be recouped from any people found to be responsible for compliance and risk-management breaches”.

This shows that the risk associated with a senior management role has changed significantly. In Oct. 2015, I posted an article which included my ‘starter for 10’ requirements for software solutions to support and enable firms to meet the regulatory and cultural challenges with the Senior Managers' Regime. My ‘starter for 10’ were;

1. Must be able to generate a Governance Map and Statements of Responsibilities.
2. Must enable a Senior Manager to evidence that they have discharged their ‘duty of responsibilities’ when making decisions within the bank.
3. Must be able to present a historical snapshot.
4. Must enable a ‘Line of Sight’ alignment of objectives and risk appetite from the corporate level to individual Senior Manager. 
5. Must be able to capture, map and report on operational losses by Senior Managers.
6. Must be able to capture and map Conduct Rule breaches to Senior Managers.
7. Must be able to monitor and report on the performance and risk of key ‘SMR related’ processes.
8. Must be able to store documents such as Regulatory References and map those to individual Senior Managers, or integrate with such a system.
9. Must be able to support an attestation process to enable individual Senior Managers to attest that they understand their Responsibilities and regulatory obligations under the SMR.
10. Must be able to support a Regulatory Risk Assessment and Controls Effectiveness Assessment capture and reporting in relation to SMR.

Maybe we should add to this list the ability to capture and report on not only the decisions that senior managers took but also the context within which they took those decisions. Hindsight is a wonderful thing and perfectly sensible decisions take today could look anything but sensible in a year, 3 years, 5 years into the future.

Therefore, when conducting ‘accountability reviews’ firms and regulators should consider the context within which decisions were taken and ask themselves;

• What level of risk was the firm experience within their business model?
• Was the firm executing its strategy successfully? Were strategic objectives and milestones been consistently achieved?
• What level of execution risk were they running?
• What were the firms strategic and operational KPIs and KRIs indicating, were they flashing Green or Red?
• Was the firm operating within their risk appetite boundaries?
• How effective was the control environment?
• What was the level of loss events, breaches and complaints been seen within the firm?
• How clearly defined were accountabilities and were these accountabilities notional or real?

Equally, when individual senior managers are taken decisions and engaging in risk-taking activities, they should be considering these questions and be sure that they can evidence the answers in the future should they get a knock on their door from a regulator or an incoming management team.

Want to know how software can support embedding Senior Manager's Regime compliance into your organisational culture? Contact Us Now

For more about culture in Financial Services and the Senior Manager's Regime check out www.cultureofaccountabilities.com

Ahead of the Senior Manager’s Regime, it is time to re-assess your human capital risk

Within a few short weeks the UK Financial Services industry will see a new era of individual accountability and responsibility unfold with the Senior Managers Regime coming into effect on March 7, 2016.

Developed in the wake of the 2008 credit crisis on the recommendation of the independent Parliamentary Commission on Banking Standards (PCBS), the Senior Managers' Regime (SMR) and Certification Regime (CR) is a key part of the Government’s push to reform the culture and conduct within UK Financial Services. It will see Directors and chairs of board committees, CEO’s and other senior managers become personally accountable for the risk-taking activities of their firms.

While the Senior Managers' Regime (SMR) and Certification Regime (CR) will have a range of impacts on across the city, one area that is not getting a lot of coverage at the moment but is highly likely to have significant unintended consequences for individual banks and the industry as a whole is the effect this regime will have on the ability of Banks to attract and retain senior management and leadership talent. 

Over the coming months and years how many times will we see a repeat of the story that has emerged from Barclays over the last few days, with the announcement that Tom King, the head of their Investment Bank is to leave the bank. In their reporting of this departure, the FT suggested that the accountabilities rules contained within the Senior Manager’s Regime played a significant part is Mr King’s retirement.

So with the introduction of the Senior Managers’ Regime only a few short weeks away and the month-end risk reporting cycle about to go into full swing for many banks, I suggest that it is time for Human Capital related risk(s) on the Corporate Risk Register to be re-assessed ahead of the introduction of the Senior Managers’ Regime and appropriate long-term risk migration initiatives developed. The reassessment of Human Capital risk, and development of risk migration initiatives should also happen within each UK Business Unit/Legal Entity initially, but given the international interest in the Senior Managers’ Regime and recent Department of Justice guidance on Individual Accountabilities, it might be prudent for firms to go beyond their Business Unit/Legal Entities.

Want to know how software can support embedding Senior Manager's Regime compliance into your organisational culture? Contact Us Now

For more about culture in Financial Services and the Senior Manager's Regime check out http://www.cultureofaccountabilities.com