JFSC Bitesize feedback on Compliance Monitoring plans and programmes[CMP]

In 2023, the JFSC undertook thematic assessment visits to assess how supervised persons periodically assessed their adherence to legislative and regulatory requirements and the effectiveness of corresponding controls.

Below is a breakdown of their observations of good practice, areas of improvement and key considerations. Although these were directed at investment businesses, they apply across the spectrum.

1. Each test within the compliance monitoring plan (CMP) is mapped to a risk or control recorded on the firm’s business risk assessment (BRA) or an element of the legal or regulatory framework, enabling the board to evaluate whether its systems and controls are appropriate.
2. Regular detailed reporting is provided to the board setting out the CMP activities and risk-based quantification of the results. Discussions, decisions made and agreed actions are clearly articulated in board minutes.
3. Where sample testing identifies issues, consideration is given to whether the results may be indicative of wider systemic weaknesses and issues, and further testing is undertaken to confirm.

1. Whilst a record of the CMP being approved by the Board was generally on record, in several cases,  there needed to be more evidence to show the plan had been discussed or challenged by the Board.
2. There needed to be more testing of the effectiveness of proliferation financing controls at many firms.
3. The BRA did not consider exposure to proliferation financing risks.
4. In some instances, the BRA did not record and consider all the financial crime risks to which a firm was exposed. Consequently, the CMP did not include effectiveness testing certain key aspects of the firm’s control framework.

1. Do you have ongoing arrangements to review legislative and regulatory requirements to identify relevant changes? Are these changes reflected in your risk assessments and CMP?
2. Is your CMP reviewed regularly and subject to formal approval by the board or senior management to ensure it remains fit for purpose? Can it be amended quickly in case of an identified risk increase?
3. Does the compliance function’s report to the board include a standing agenda item focused on CMP results, relevant findings, recommended remedial actions and progress with remedial actions since the previous report?

Source

https://www.jerseyfsc.org/media/7600/bitesize-feedback-investment-business-compliance-monitoring.pdf