Reprinted from Issue 13 December Investment Management Review A Quarterly Update for the Investment Management Industry.

Size: px

Start display at page:

Download "Reprinted from Issue 13 December Investment Management Review A Quarterly Update for the Investment Management Industry."

Amos Boone
6 years ago
Views:

1 Reprinted from Issue 13 December 2009 Investment Management Review A Quarterly Update for the Investment Management Industry Assessing Risk

The current market environment presents an ideal opportunity to improve oversight and to simultaneously achieve two critical goals:

2 Oversight Getting It Right with Your Service Provider The right level of oversight means striking a balance. Now is the time to redefine and transform the oversight of outsourced functions. The current market environment presents an ideal opportunity to improve oversight and to simultaneously achieve two critical goals: managing operational risk and reducing costs. Investment managers may be assuming unnecessary risk and/or missing out on cost savings if they have not recently reviewed and streamlined their oversight activities.

3 Girard Healy Managing Director Beacon Consulting Group Mike Kerrigan Principal Beacon Consulting Group

4 Investment managers may be assuming unnecessary risk and/or missing out on cost savings if they have not recently reviewed and streamlined their oversight activities. Many opportunities exist to improve the processing environment for outsourced or offshored fund accounting, fund administration and middle-office functions. The issue for many investment managers is that they may be utilizing an oversight model that has not changed since the outsourcing relationship began. A lot can change over the years and outdated models may not be focused on the range of risks that the current market environment has created. Defining oversight is especially difficult in organizations that have recently outsourced these functions as they may not have successfully planned the transition from doers to reviewers of service provider output. Oversight may also be difficult in organizations that have a long-standing relationship with a service provider, as the natural tendency is to grow the level of tasks performed in the name of oversight, irrespective of relative risks. Human factors also present barriers to effective oversight as cultural resistance to change complicates the transition from performing tasks to reviewing tasks. The recent decline in assets under management and associated drop in revenue have prompted investment managers to respond with a variety of initiatives aimed at reducing costs. Managers are merging funds, eliminating share classes, reducing staff and rationalizing their capital spending. At the same time, operational risk and investor scrutiny has increased. Market volatility, increased trading volumes and added investment complexity have presented technology and operational challenges to many overburdened investment support areas. Now is the time to redefine and transform the level of oversight of outsourced functions. The current market environment presents an ideal opportunity to improve oversight and simultaneously achieve two critical goals: managing operational risk and reducing costs. Oversight It is estimated that 85% of fund managers have outsourced some or all of their fund accounting, fund administration or middle-office activities. Even though these functions are outsourced, investment managers retain a shared responsibility and liability for ensuring that routine tasks are performed accurately and in accordance with regulatory and industry standards. This objective is usually achieved via an oversight role. The ideal oversight model achieves the efficiencies, scalability and cost savings that led to the initial decision to outsource these functions, without increasing operational risk. The right level of oversight means striking a balance between completely shadowing the service provider and inattentive acceptance of anything and everything the service provider delivers. For most investment managers, defining that balance is more art than science. Beacon s experience indicates that effective oversight activities: Are risk-based; Ensure accountability; Embrace comprehensive planning and communication; and Utilize skilled professionals. Risk Oversight activities should be designed and applied based on a comprehensive, process-based risk assessment. As described in more detail below, a process-based approach ensures that risks, beginning with trade support and ending with financial reporting, are identified and mitigated throughout the investment life cycle. The recommended approach includes an analysis of risk by activity and a review of service provider capabilities. A risk-based approach will reduce unnecessary duplication of service provider activities and ensure that analytical reviews of higher-risk transactions are performed by investment manager personnel. Accountability Assumption of responsibility by the investment manager and service provider is an important element of oversight activities. Without accountability, the risk-based approach to oversight described above cannot work. There needs to be commitment on both sides that agreed-upon procedures and controls will be followed. Investment IMR 4

5 managers and service providers frequently speak about creating true partnerships, but few things create a true partnership and define accountability more effectively than a comprehensive service level agreement (SLA). An outsourcing relationship is a long-term proposition and approaching it as a partnership yields far more benefits for firms that view it as such over firms that view it as purely a scorekeeping exercise. One-sided SLAs typically result in a scorekeeping exercise an SLA that obligates both sides creates a true partnership. Planning and Communication Planning and communication are critical to the performance of successful oversight. The investment manager should ensure that the service provider is aware of operational changes, new technology, new products, portfolio strategy changes and major transactions well before they occur. A best practice is to convene weekly update calls with the service provider to track issues and monitor resolutions. Report cards that detail key performance indicators should also be part of the communication process. Significant transactions should be treated like special projects and include a comprehensive project plan with milestones and assigned responsibilities. Postmortems are also an important element of ensuring successful oversight. Utilization of Skilled Professionals The investment manager should perform its oversight activities with knowledgeable industry personnel who are experienced in performing the analytical reviews required to maintain a successful oversight model. These individuals must understand and resolve complex fund accounting and administration issues brought to their attention by the service providers. The oversight professional staff should consist of a mixture of individuals with deep technical knowledge as well as experienced generalists who understand the downstream ramifications of issues across all functions. For instance, professionals who understand and can communicate the impact to the tax function of an issue identified during the financial reporting processes would be beneficial. In a challenging economic climate, retaining experienced professionals for oversight can improve the oversight process and accelerate decision-making when complex issues need to be resolved. Getting Oversight Right Defining the investment manager s oversight model requires more analysis than simply saying, If we performed the task using ten people, then it should only take three to review it. Defining oversight is a continuous cycle of risk and activity analysis, implementation, planning and monitoring. (See accompanying illustration.) The objective is that the expertise and time devoted to an oversight activity is commensurate with the risk. The risk and activity analysis entails identifying operational risk points and understanding exactly how the investment manager s oversight personnel are spending their time. To facilitate the analysis, the investment manager should identify all functional areas as for which oversight activities are performed and utilize a matrix to assist in the evaluation. Beacon recommends that investment managers evaluate the risks at the detailed activity level and assign a risk rating of high, medium or low. Using the matrix, the investment manager can also specify the roles of the service provider or the investment manager. Typical roles are perform, review, provide or joint responsibility. The matrix can be designed to evaluate the entire enterprise or be customized on a fund-by-fund basis. The assessment process should identify material risks as well as evaluate instances where nonmaterial risks can become material when aggregated. The risks and activity analysis should be preceded by an evaluation of unique fund characteristics and internal capabilities, as well as external factors. The assessment should take into account the complexity of each fund s strategy and product mix, trade volumes and historical issues. The level of assigned risk is also dependent on the strengths and weaknesses of the service provider. The investment manager must have a thorough understanding of the service IMR 5

6 provider s strengths and weaknesses in both technology and personnel. The investment manager can leverage reports such as a SAS 70 and, if available, internal audit reports to expedite the review. Lack of knowledge of the service provider s capabilities could unintentionally direct oversight activities to low-risk areas. To become familiar with a service provider s processes, controls, cutoff times and technology capabilities, a site visit to the service provider is recommended. Detailed knowledge of the service provider will direct where the manager s oversight activities should be focused. For example, transactions or activities that are manually uploaded from the service provider s ancillary systems to its core systems should receive a higher degree of oversight than those that are processed straight through. A complete inventory of available reporting from the service provider should be created. The reports should be analyzed for adequacy in helping the manager meet its oversight role. Reporting gaps and related enhancements should be coordinated with the service provider. Next, it is critical that investment managers understand exactly where their personnel are spending their time. The same matrix that is used to assess risk should also be utilized to measure time spent on activities by the manager s personnel. Upon completion of the risk assessment steps, the manager can overlay the risk profile against time spent. This analysis is the best way to make adjustments and redirect oversight activities to high-risk areas. An additional benefit from this approach is that it may be helpful in allocating technology spending, especially where low-risk, manual processes are consuming a significant amount of time. Once the oversight roles are determined, implementation activities can begin with the development of an oversight model. An operating model defines the scope of functions performed by the firm and outlines how the oversight processes would be logically organized into work groups to deliver effective oversight. The ideal oversight model has the following characteristics: Achieves flexibility and scalability while maintaining a risk-based approach Speeds operational oversight of new and complex products Supports growth strategies The investment manager s oversight policies and procedures should be documented to ensure adherence to oversight activities. The procedures should specify the party responsible for the tasks as well as the frequency with which they should be performed. The procedures should identify the specific review procedures, include reasonableness tests and specify levels of materiality that may require additional research or coordination with the service provider (e.g., pricing, income and expenses). Functional job descriptions for oversight personnel should be developed to ensure that key functions are performed and evaluate their oversight capabilities. The investment manager should take the lead in communication and planning with the service provider. The investment manager is driving the business and the service provider needs to be privy to upcoming strategic decisions and operational changes that may impact its ability to deliver quality services. An SLA should be revised or initiated with the service provider. Industry-standard SLAs typically include a list of service requirements and identify the responsible party and time frames by which the requirement must be met. The SLA should include obligations by both parties especially where the service provider s compliance with the SLA is dependent on action by the investment manager. For example, the SLA might stipulate that the service provider will book all trades on trade date, provided trades are sent by the manager at the agreed-upon frequency and prior to the cutoff time. The process described above is a continuous process. New risks are identified on almost a daily basis. The investment manager s oversight regimen should be structured so that it can quickly anticipate risks and provide effective oversight of new products. IMR 6

7 Conclusion The appropriate levels and depth of oversight activities should be designed and applied based on a comprehensive, process-based risk assessment. A continuous assessment process ensures that oversight activities can be directed to significant risk areas. Understanding the details of the service provider s processes and controls is an integral part of the assessment process. Developing good relationships with service providers is important, as well as agreeing on a mutual service level agreement. Applying a risk-based approach is critical. Any other approach to oversight is likely to result in a significant amount of ineffective, but well-intended, activities performed in the name of oversight and ultimately will conjure the story of the policeman who one night spotted a man in the road on his hands and knees looking for something. What are you doing? asked the officer. I dropped a nickel a mile down the road, said the man. Then why are you looking for it here? asked the officer. Because the lighting is better here, said the man. How Many? No examination of service provider oversight would be complete without answering the question: How many professionals does it take to perform adequate oversight? There is not a formulaic answer. The keys to the right level of oversight lie in the investment manager s capacity to move from performing core tasks to a culture of performing analytical reviews, the capabilities of the service provider, the experience of the investment manager s staff and the volume and complexity of the funds. Interestingly, Beacon Consulting Group recently completed a benchmarking study that compares the relative performance of the financial reporting process using in-house staff versus outsourcing the process. The firms that outsourced the financial reporting process utilized two-thirds fewer staff than those preparing the financial reports in-house. Getting Oversight Right Is a Continuous Process Service Level Agreements Key Performance Indicators Deadlines Reporting Sanctions Monitoring Risk & Activity Analysis Activity-Oriented View Time Allocation Understand Service Provider Capabilities and Technology Changes in Product, Strategy Project Orientation Communicate Planning Implementation Operating Model Policies and Procedures Job Descriptions IMR 7

8 Global Transaction Services Citibank, N.A. All rights reserved. Citi and Arc Design and Citibank are trademarks and service marks of Citigroup Inc. or its affiliates, used and registered throughout the world. All other trademarks are the property of their respective owners. Citigroup Fund Services Canada, Inc. is a non-bank member of Citigroup. The material in this magazine is for informational purposes only. Information herein is believed to be reliable but Citigroup does not warrant its accuracy or completeness. Information provided herein may be a summary or translation. Citigroup is not obligated to update the material in light of future events. This magazine does not constitute a recommendation to take any action, and Citigroup is not providing investment, tax accounting or legal advice. Citigroup and its affiliates accept no liability whatsoever for any use of this magazine or any action taken based on or arising from the material contained herein. The views expressed by contributing authors may not represent views or opinions of Citigroup or any affiliate. No part of this publication may be reproduced, in whole or in part, without written permission from the publisher GTS /10

Internal controls over financial reporting

Internal controls over financial reporting Outlining a program that meets stakeholder expectations kpmg.com After showing why a company s internal controls over financial reporting (ICOFR) program may