As the second post in our series of seven blogs on the FCA’s increasing focus on corporate conduct we look at what steps a business can take to identify conduct risks.

Many years ago, Donald Rumsfeld attracted widespread derision for his speech about ‘known unknown’ and ‘unknown unknowns’. It was clumsy, perhaps, but he was onto something. In the business world there are many things we don’t know. Some we’re aware of, but others would take us completely by surprise. The same is true in the regulatory environment.

In her speech to the FT Investment Summit, the FCA’s Megan Butler put this question to her audience:

“What proactive steps do you take to identify conduct risks in your business?

Know the risks

As with any risk, you cannot hope to mitigate something you don’t know exists.”

It’s an important issue to address, because in business and in life it’s not the risks you’re aware of that cause trouble, it’s the ones that completely pass you by. As the regulatory environment moves forward quickly there will be plenty of risks businesses aren’t yet aware of.

For example, look at the challenges involved with the chip vulnerabilities dubbed Meltdown and Spectre. Identified by Google earlier last year, Meltdown is a flaw in the chip design which could leave computers vulnerable to attack. There’s nothing new in this vulnerability – it’s been there for years without detection. Now, though, the industry is aware of it, but so too are cyber-criminals.

When taking steps to assess risk in their business, companies must be thorough and try to identify as many of those unknown, or difficult to see risks as possible. Only then can they mitigate against them.

The first thing to remember is that almost every operation involves a risk of some kind – not only in our professional lives but every day. We all take risks from getting up in the morning to getting in the car. We are all subconsciously risk managers. We decide if a task is worth the risk and work hard to minimise this.

The first task is to look at your company’s mission and decide why it is taking the risks it does. This can help you decide is the outcome worth the risk – big or small.

Next, organisations must draw up a comprehensive assessment of all the risks the organisation faces in its routine trading activity. To do this, managers will need to delegate and harness expertise from around the organisation. This must draw up a list of ultimate worst-case scenarios and ensure steps to mitigate them are in place at every stage.

Listen to the experts

To do so managers will have to draw on a wide range of expertise, especially in the realm of technology, who can identify risk vectors they might not have thought about. At the end of the day, though, it is the managers themselves who will have to take complete ownership of the projects.

As regulators have shown over the past couple of years they are working hard to demand greater levels of personal accountability for managers which ups the stakes for everyone.

Managers will also have to stay abreast of the evolving expectations placed on them by regulators. The last couple of years have seen a move to place greater levels of personal responsibility on the shoulders of managers for their own personal conduct and that of their organisations.

Using technology

The rise of regtech promises to give managers more tools to mitigate risk. Our Global Regulatory Intelligence platform, for example, brings in reports, case studies and insights to help employees stay on top of their requirements and ensure they are as informed as they possibly can be.

Other technological solutions will seek to harness the power of AI to help businesses become more proactive in their risk management. It would provide greater insight into operations and issue alerts when it encounters a problem. Although advanced technologies such as these are still in development they do signal a world in which businesses find it easier to be proactive and take preventative measures.

As Butler outlined in her speech, the FCA is mindful of the challenges people face, and their role in supporting the sector, but they are still driving hard towards an environment of greater accountability and competition. Managers will have to assume a central role in all of this.