Now that the SFC’s Manager-in-Charge (MIC) regime has gone live, we are frequently being asked, “What are my responsibilities as an MIC?” as MICs are understandably nervous about their potential personal liability for acts or omissions of colleagues. We thought it might be useful therefore to spell out the ABCs as to how an MIC needs to educate themselves and put systems in place so that they can be comfortable they are complying with their obligations as an MIC; and as such hopefully avoid any personal legal or regulatory liability. We have also added the key action item for Overall Management Oversight (OMO) MICs at the end.
In addition, as part of this exercise, it would be prudent for each MIC to read carefully through the SFC Internal Control Guidelines to identify any other more general obligations which are not set out in the firm’s policies. The MIC regime has heralded a re-emergence of focus on the Internal Control Guidelines – it is very clear that when drafting the MIC circular, the SFC referred to the Internal Control Guidelines. We have noted over the years that firms tend not to focus on the obligations in the Internal Control Guidelines as much as the two Codes of Conduct. This is probably because of the unusual style in which the guidelines have been drafted and because the Internal Control Guidelines do not contain any prescriptive obligations. Instead, the obligations tend to be high level statements of principle – e.g. “Management ensures that adequate training suitable for the specific duties which staff member(s) perform is provided both initially and on an ongoing basis.”
The firm’s compliance team should be able to play a big role in this regard if it is adequately resourced.
Thirdly, the MIC needs to ensure that the relevant controls identified above are actually being complied with by staff. This requires two things (i) training and (ii) testing, i.e. compliance monitoring. In terms of training, the MIC needs to understand (i) how new staff are trained in terms of the internal controls around each relevant obligation and (ii) the frequency with which the training is repeated to remind existing staff of the need to comply with the relevant internal controls. The MIC needs to be satisfied with the content and the frequency of the training, although the compliance or other relevant teams can be responsible for conducting the training.
Our clients sometimes wonder about the role of the internal audit department, and also separately, the firm’s external auditors in this regard. In an ideal world, the function of internal audit should be to check that the compliance department is conducting appropriate monitoring and not to do the monitoring but these lines are sometimes blurred depending on how a firm is structured and its size, and of course in many cases there may be no internal audit department. The appointment of an external audit firm, which issues a “compliance” report to the SFC, cannot be relied on as an alternative to internal compliance monitoring because the scope of their appointment does not extend to this general compliance monitoring.
It is important to understand that if a firm is investing resources in conducting reviews or compliance monitoring, the time and money is wasted unless the results are effectively communicated internally to the appropriate persons, i.e. the MIC and other members of senior management, who should consider the results and then follow up as appropriate. If compliance monitoring is being conducted properly, issues should be identified from time to time. This is normal. What is not normal is for the responsible MIC not to be informed of the issue, or not to be interested and engaged in ensuring that the firm takes appropriate steps to minimize the chances of such an issue arising again (e.g. additional staff training, tweaking a process or internal control and in appropriate cases taking appropriate disciplinary action against relevant staff members). Similarly, as discussed above, the MIC needs to be engaged in the ongoing review of the compliance plan generally to ensure it remains adequate as the situation changes.
MICs who can (i) explain to the SFC with confidence how they have followed the K.A.T.T.E.D. process and (ii) back their explanations up with an audit trail of documentary evidence, such as meeting notes and emails, should be in a strong position to be able to demonstrate to SFC inspection staff that they have understood and complied with their obligations as an MIC and avoid liability.
The OMO MIC simply needs to go one step further. They need to be sure that each of the MICs is K.A.T.T.E.D.!