Investment Adviser Compliance Programs in Uncommon Times Reprinted with permission from The Investment Adviser Association Elaine A. Lindenmayer Of Counsel San Francisco 415.249.1042 elaine.lindenmayer@klgates.com
Extraordinary events in the marketplace involving investment advisers have created unprecedented compliance challenges. Indeed, with the market turbulence, horrific frauds and a series of investor losses attributable to investment advisers, the profession can anticipate heightened scrutiny by both regulators and investors. This, in turn, makes up-to-date, focused compliance monitoring and testing and competent annual compliance reviews an essential element of advisers businesses. This article will provide food for thought on aspects of compliance and review some general principles for effective monitoring, testing and annual reviews. Compliance Programs in View of Recent Developments Recent events in the securities industry suggest that CCOs may want to take a fresh look at aspects of their compliance programs, beginning with the role of compliance in overall risk management for the firm. As the industry reassesses risk management and ways to effectively anticipate and address risk on a firm-wide basis, CCOs might have suggestions for greater or different compliance involvement in the firm s risk management efforts. When performing risk assessments, CCOs might also consider whether some of the risks identified in the assessment process provide opportunities for enhanced coordination with other areas of the firm, such as audit or technology, to improve firm-wide risk management. CCOs might explore ways to leverage technology and/or the work performed by personnel in other departments to gain efficiencies in monitoring and ultimately saving money by detecting and correcting and even avoiding compliance problems. CCOs also may want to evaluate the effectiveness of their risk assessment processes not only in identifying known risks, but also in anticipating those that reasonably might occur. New types of investment vehicles and use of sub-advisers or other agents suggest that evaluating due diligence with new perspectives might be worthwhile. The adequacy of compliance escalation procedures and, likewise, of management support for the CCO s tough decisions that impact the business is critical. In this environment a strong compliance culture set by the tone at the top has never been more important and deserves ongoing consideration by CCOs. Regulators will expect firms to have evergreen compliance programs, i.e., programs that continuously account for changes in the firm s business, significant compliance events and regulatory developments. Accordingly, CCOs would be wise to give attention to compliance issues that regulators have highlighted as concerns. In her speech at the IA Week and the Investment Adviser Association Best Practices Summit in March 2009, Lori Richards, Director of the SEC s Office of Compliance Inspections and Examinations, flagged disclosure, custody, performance and adequacy of resources as current issues. CCOs might address these issues by asking critical questions. 1. Disclosure. Do the firm s disclosures provide investors with timely, accurate and meaningful information that clearly describe the firm s activities and conflicts of interest consistent with its obligations as a fiduciary? Does the firm have accurate disclosures of conflicts created by business arrangements and affiliations, compensation arrangements with solicitors and other service providers, fees and the services to which they apply, and the use of client commissions to pay for products and services? 2. Custody. Do the firm s overall controls for custody enable the firm to provide clients with reports that fully and accurately reflect transactions and portfolio positions? In addition to any independent audit that may be required, should the firm consider obtaining and comparing copies of the custodian s client statements of transactions and portfolio positions with the firm s records and statements sent to clients, or reviewing the firm s reconciliation process and documentation of the reconciliations? If the adviser or its affiliate has custody, would it be appropriate to perform additional verifications, such as reconciling the adviser s records with confirmations from entities independent of the adviser? 3. Performance claims. Are the firm s controls for making performance claims adequate? Should the firm consider retaining an outside firm to verify performance claims and/or implement other steps when using composites for marketing materials? Does the firm have the requisite documentation to substantiate performance claims? 4. Resources. The very best policies, procedures and controls won t be effective if the firm s resources to implement them are inadequate. Does the firm have adequate quantity and quality of staff reasonably necessary to detect, prevent and correct violations? If resources are an issue, the CCO should escalate the concern and flag it in the annual review. Additional issues. Recent SEC examinations also have focused on personal trading by advisory staff, proxy voting and funds use of proxy voting services, valuation and liquidity issues and advisers soft dollar practices. CCOs might want to heighten review of their controls and/or reassess their risk ratings and/or testing schedules for these areas. Guiding Principles for Compliance Monitoring and Testing A strong compliance environment implements controls that are reasonably designed to prevent violations of the Advisers Act and its rules, as well as to detect and deter problems. An undetected rogue employee can wreak havoc, derail business plans and could bring down the entire firm. Effective compliance simply makes good business sense. The following principles provide a framework for effective ongoing compliance monitoring and testing of these controls and lay a foundation for the annual review. 1. Understand your firm s business. Compliance is not one-size-fits-all. An advisory firm s policies and procedures should be tailored to the nature of the firm s operations and the compliance risks that are relevant to the adviser s particular business. 2. Perform ongoing risk assessments. Compliance programs should be constantly evolving and nimble enough to ascertain and quickly address new and emerging compliance risks associated with business and regulatory developments. This has never been more important and it makes ongoing risk assessments essential. In performing risk assessments, start by inventorying aspects of the firm s business that pose risk, including current regulatory issues. Consider financial, operational, reputational, and strategic risks in addition to compliance risks. Investment Adviser Compliance Programs in Uncommon Times 2
Then, map the policy and procedural controls that the firm has designed to address the risks. This will help identify any gaps for which controls should be developed and implemented and/or strengthened. Once you have identified specific controls or developed new ones, rank the risk associated with each control as high, medium or low. Issues that the regulators have identified as concerns in the firm s past examinations should be given special consideration and probably categorized as high risk until the firm has been reexamined or the relevant control has been satisfactorily tested. New businesses and products should be assessed for risk and added to the testing schedule at the time they are added to the firm s business model. There is no single standard for assessing these risks; indeed, a risk that is high at one firm because the activity occurs frequently may be low at another firm if that activity rarely, if ever, occurs. For example, an adviser that invests client assets in stocks would have higher trading risks than a firm that invests client assets in mutual funds. Firms that use an affiliated brokerdealer would have higher risks of trading conflicts of interest than a firm that uses an unaffiliated broker-dealer. Effective risk assessment must be done with an understanding of your firm s overall business. 3. Prioritize and conduct monitoring and testing that is suitable to the risk being tested. After ranking the controls as high, medium or low risk, prioritize your monitoring and testing schedule based on your assessments. Generally, this means controls that address higher risks should be tested more frequently. Be sure to schedule testing for all of the risks you have identified, even if you test them infrequently. A low risk area that is never tested could become a high risk. The firm should be able to demonstrate that over time it has assessed the effectiveness of its controls for all risks associated with the business. Thorough testing of your firm s compliance program entails different types of testing for different aspects of the business. Transactional testing. Transactional testing is performed at or near the time an activity occurs. Periodic Testing. Periodic testing is performed at scheduled intervals. Forensic Testing. Forensic testing identifies trends. It is used to evaluate whether particular outcomes are consistent with expectations. This testing is a critical element of any compliance program; it aids in the detection of illegal acts or activities that can subvert the compliance program. The following example of testing conformance of client investments with the client s investment restrictions illustrates the differences between the three different tests. A transactional test would compare a purchase at the time of the trade with the client s investment restrictions. A periodic test would involve a comparison of the client s restrictions with the client s statement that reflects holdings. A forensic test would compare performance of the account with the performance of a relevant benchmark and other client accounts with similar guidelines, the expectation being that material differences in performance would suggest that client guidelines are not being followed. 4. Document, document, document! Document the results of your risk assessments, testing and follow up. This will facilitate monitoring and testing, provide a record of your compliance efforts and help identify trends. Moreover, the SEC will expect you to have these records. The SEC s Core Initial Information for routine examinations (available on the SEC s website) expects advisers to be able to produce information that, among other things, demonstrates the firm s compliance policies and procedures, testing, inventory of compliance risks and changes to it, and written guidance to employees regarding compliance with risk assessment processes and procedures to mitigate and manage compliance risks. A risk assessment matrix is an efficient and convenient way to achieve some of this documentation. A matrix might look something like this: Strategic Business Area Elements of Risk Risk Assessment (High, Med., Low) Policy/ Procedure Control Process Compliance Manual Section Monitoring Frequency Date/Results Last Review Portfolio Managment Process Consistency of portfolio with client investment guidelines Supervision of portolio PMs Automated/ manual monitoring of client portfolio vs. client guidelines Section 1.a: Portfolio Management Processes Section 1.b: Compliance with Investment Guidelines Investment Adviser Compliance Programs in Uncommon Times 3
Annual Review The annual compliance review enables advisers to assess the effectiveness of the firm s policies and procedures and of the overall compliance program. It is essentially a giant forensic test of the firm s compliance program. This review, coupled with the testing of the policies and procedures reviewed annually, forms the basis of the firm s annual compliance review. The annual review should focus on certain critical areas that are a regular part of the firm s business, areas that SEC staff has specified as focus areas and activities that have been the source investor loss or other regulatory concern. Many of these areas overlap. Critical areas that advisers should typically review as part of their annual review include (1) accuracy of the Form ADV and other disclosures, including account statements and advertisements, performance information in particular; (2) accuracy of the firm s books and records generally; (3) trading practices, including best execution and the use of client commissions to obtain execution, research and other services; (4) portfolio management, including allocation of investment opportunities among clients and consistency of investments with clients objectives and restrictions; (5) proprietary trading by the firm and personal trading by employees; (6) marketing of advisory services, including use of solicitors; (7) valuing client holdings and assessing fees; (8) safeguarding client assets from theft, conversion or misuse; (9) protecting the privacy of client records and information; (10) business continuity capabilities; (11) whether there is preferential treatment of hedge funds; and (12) sales practices and suitability of recommendations, particularly if the firm is a dually registered broker-dealer. A reinvigorated SEC is already bringing reform to the securities industry. Effective compliance programs are distinguished by proactive compliance professionals who lay a solid foundation for their ongoing assessments and reviews, are ever-vigilant of the business and regulatory environment in which they operate and who continuously refresh their compliance programs in response to change. Ms. Lindenmayer is Of Counsel at K&L Gates LLP. Ms. Lindenmayer s practice focuses on investment adviser, broker-dealer and financial services matters. This article is for informational purposes only and does not contain or convey legal advice. The information herein should not be used or relied upon in regard to any particular facts or circumstances without first consulting with a lawyer. The annual review is also a time to step back and assess the effectiveness of the compliance program as a whole, its adaptability to changes in the marketplace and how it might be enhanced to anticipate risk and provide even greater benefit to the firm. Investment Adviser Compliance Programs in Uncommon Times 4
Anchorage Austin Beijing Berlin Boston Charlotte Chicago Dallas Dubai Fort Worth Frankfurt Harrisburg Hong Kong London Los Angeles Miami Newark New York Orange County Palo Alto Paris Pittsburgh Portland Raleigh Research Triangle Park San Diego San Francisco Seattle Shanghai Singapore Spokane/Coeur d Alene Taipei Washington, D.C. K&L Gates is a global law firm with lawyers in 33 offices located in North America, Europe, Asia and the Middle East, and represents numerous GLOBAL 500, FORTUNE 100, and FTSE 100 corporations, in addition to growth and middle market companies, entrepreneurs, capital market participants and public sector entities. For more information, visit www.klgates.com. K&L Gates comprises multiple affiliated partnerships: a limited liability partnership with the full name K&L Gates LLP qualified in Delaware and maintaining offices throughout the United States, in Berlin and Frankfurt, Germany, in Beijing (K&L Gates LLP Beijing Representative Office), in Dubai, U.A.E., in Shanghai (K&L Gates LLP Shanghai Representative Office), and in Singapore; a limited liability partnership (also named K&L Gates LLP) incorporated in England and maintaining offices in London and Paris; a Taiwan general partnership (K&L Gates) maintaining an office in Taipei; and a Hong Kong general partnership (K&L Gates, Solicitors) maintaining an office in Hong Kong. K&L Gates maintains appropriate registrations in the jurisdictions in which its offices are located. A list of the partners in each entity is available for inspection at any K&L Gates office. This publication is for informational purposes and does not contain or convey legal advice. The information herein should not be used or relied upon in regard to any particular facts or circumstances without first consulting a lawyer. 2009 K&L Gates LLP. All Rights Reserved. 90720_3027