Chartered Institute of Internal Audit

Transcription

1 Chris Spedding Chartered Institute of Internal Auditors 13 Abbeville Mews 88 Clapham Park Road London SW4 7BX 8 April 2013 Chartered Institute of Internal Audit Effective Internal Audit in the Financial Services Sector - Draft recommendations to the Chartered Institute of Internal Auditors Dear Mr Spedding, The Investment Management Association (IMA) is the trade body for the UK asset management industry, representing around 4.2 trillion of funds under management. Its member firms include managers of a wide range of asset classes for a wide range of clients, including institutional funds, authorised unit trusts and open ended investment companies. We welcome the opportunity to comment on the Institute s draft recommendations. Key messages The IMA supports the issue of recommendations to improve oversight at financial institutions, especially those considered to be of systemic importance, and the pitching of the recommendations at a high level, so that they can be tailored to firms. Many of our members are small firms and do not have a range of dedicated control functions. Some guidance as to how they should implement the recommendations and what would be acceptable to the authorities would be helpful. We welcome the Institute working with the Financial Services Authority (FSA) and look forward to practical inclusion of the recommendations into the UK rulebook. Furthermore, we believe that the FSA, and its successors, should lobby regulators overseas in adopting similar recommendations. We agree that the rationales for audit opinions, particularly satisfactory ones should be more substantive. 1

2 Internal Audit should have a seat at any committee which looks at risk and have the authority to invite itself to any such gathering. For example, some firms have a transaction and/or client approval committee. There should be Internal Audit representation on them. Conclusion The IMA looks forward to working with stakeholders to create effective governance frameworks. Annex 1 to our letter contains our formal response to the consultation, and further specific observations and questions arising from the proposals. Annex 2 summarises the differences between banks and investment fund managers. We believe that the roll-out of these recommendations, especially if incorporated in FSA, or successor, rules, should be with regard to the nature, scale and complexity of financial institutions. We hope that you will find our comments useful. Please contact me by way of (ihenry@investmentuk.org) or telephone on should you require further information. Yours sincerely, Irving Henry Prudential Specialist Investment Management Association 2

3 Annex 1 Role and mandate of Internal Audit We support this recommendation. We would add that Internal Audit have an input the policing of the firm s (evolving) risk appetite (although this is addressed in B 3 c). We like the idea of an Internal Audit Charter and argue that other control functions, risk and compliance, should have the same. Scope and priorities of Internal Audit As per the above, we welcome Internal Audit s input on risk appetite. This should involve review of, for example, asset and liability committee papers and discussions. This is particularly important when a firm undertakes a new business, for example in advance of or soon after a merger or an acquisition (although this is addressed in B 3 g). In the case of a merger or an acquisition, corrective action plans may have to be set up to bring the new business in line with the firm s risk appetite. Internal Audit has an active part to play in this process. We support the focus on outcomes and the impact on reputational and regulatory risks (B 3 e and f). This should be with regard to individuals, corporates (both big and small) and financial institutions. The link between reputational damage and risk to capital and liquidity is not sufficiently understood. The loss of customer confidence can have an impact on liquidity. The damage can be serious well before capital depletion. Prioritisation of Internal Audit work We agree with the recommendations, but add that Internal Audit s rationale for the assessment should be fully documented (which 6 c addresses in part), subject to FSA document retention rules and available for regulatory inspection. Reporting results We agree with the recommendations and think that other control functions, risk and compliance, should have the same rights and obligations. Interaction with Risk Management, Compliance and Finance We support these recommendations. Good practice would involve Risk and Compliance making reference to Internal Audit reviews, and liaising with Internal Audit, as they begin and finish monitoring a line of business, and vice versa. Overlap is preferable to underlap. 3

4 Independence and authority of Internal Audit Internal Audit should have a seat at any committee which looks at risk and have the authority to invite itself to any such gathering. For example, some firms have a transaction and/or client approval committee. There should be Internal Audit representation there. Further to E 14, the budget and resources for Internal Audit and other control functions should be controlled independently, i.e. by the Audit and Risk Committees, or where appropriate in smaller and less complex firms (although this is addressed in F). With regard to the objectives and performance of Internal Audit, E 17 and 18, the European Union s Capital Requirements Directives III and IV, and other financial services frameworks, require the remuneration of control functions to be determined independently of lines of business. With regard to reporting lines, E 19, standard setters should be aware that many crossborder firms operate a management matrix, so there will be reporting within jurisdictions, for legal and management reasons, and across border for lines of business, control functions and shared services (e.g. finance, human resources, information technology etc.), for business reasons. Resources Quality assessment With regard to G 27, we believe that the Institute in tandem with regulators should set up a (regular) forum where issues can be aired, good practice shared etc. Relationships with Regulators Wider considerations With regard to interaction with the Financial Reporting Council (FRC), we welcome the suggestion of additional guidance if necessary, but suggest that other bodies, for example professional associations, be brought into the discussion. 4

5 Annex 2 Fundamental differences of investment managers from banks (a) All assets held and managed by an investment firm are segregated and placed with an independent depositary/trustee (e.g. as required by EU law) or custodian. In the event of the failure of an investment firm, these assets would remain segregated and held by the custodian. Consequently, the impact upon markets would be negligible as the volume of money circulating in the system would not change and the impact upon consumers would simply equate to the administrative task of transferring the investment management mandate; (b) Costs are largely fixed (relating to staff and running costs) and as no deposits are accepted, there is immaterial maturity mismatch between balance sheet assets and liabilities. Liquidity management is thus a simple exercise with known requirements. There is consequently limited potential for a run on the firm, and even if one were to occur, the impact on markets and consumers would be insignificant as the assets managed would remain segregated; (c) Many investment firms are privately owned and not therefore publicly traded; those which are publicly owned are primarily funded by equity and retained earnings and have no reliance upon either retail or wholesale depositors. In the event of any concerns arising in relation to the firm, an investor could sell his/her equity stake, but this would not generate a run on the firm in the same way as a withdrawal of deposits would for a bank. Similarly, if concerns promulgated into the funds managed by the firm, any redemptions of shares or units in a fund would equate only to a sale of transferable securities and would not therefore have an adverse impact upon markets or consumers; and (d) Operational risk is the principal risk to which an investment firm is exposed. With no dealing on own account permitted, market risk relating to trading book activities is minimal, and as credit cannot be provided, credit risk relates primarily to the counterparty risk associated with cash positions. The crystallisation of operational risk in an investment firm is unlikely to migrate to the broader financial system and should not therefore have an adverse impact upon financial stability or markets. 5