By Mark P. Dangelo
This article also published at the National Mortgage Bankers Association at: http://www.mortgagebankers.org/tools/FullStory.aspx?ArticleId=21965#full
Regulations and oversight have become synonymous with death and taxes across FSI. For many organizations and individuals, compliance with the new Frank-Dodd Act (FDA) — SEC, Federal Reserve, CFTC, Treasury, and FDIC — is a burden and an intrusion against their existing business models and practices.
As evidenced by the positions that, “Dodd-Frank fails to meet test of our times[1],” and “Greenspan is wrong: we can reform finance[2],” it appears that the changes to financial code of conduct and actions are far from concluded.
Yet, as is often the case with sweeping regulatory compliance actions (e.g., SOX), rule adherence can promote silver linings of unintended consequences if properly assessed and implemented (i.e., xBRL, system rationalization, process efficiencies, data standardization, and even risk assignment).
Moreover, with 2011 estimates ranging from no increases for IT to widespread cancelations of discretionary projects to meet compliance requirements, the cost of adhering to FDA will not be zero-sum when addressing the interconnected components (see Figure 1).
Compliance can provide a non-traditional innovation spur to alter organizational behaviors especially within the once rigid back-office practices and processes. A few preliminary, optimistic estimates put the savings after subtracting compliance costs from zero to a net gain of 10% to 15%.
As FSI organizations begin reviewing specific rules from the aforementioned governing agencies across all the interconnected Titles of FDA, there are discrete roadmaps being created to assist organizations seeking to use one-off compliance initiatives (e.g., reporting, governance, and data management) as leverage for broader corporate innovations and greater returns.
Enterprise vs. Department Approaches
As with most regulatory proposals or actions, there is a rush to understand “what it means to me?” What does it do to the IT and business budgets? When do I have to have it? How can conformity be assured and insured? Can it be avoided or mitigated? The last thing many decision makers believe is that compliance mandates can hold any redeeming value for efficiency and innovation.
In a rush to “get it done” the costs of regulatory implementation rise across siloed initiatives – a range of 15% to 45% over centrally controlled compliance program offices. This range is in line with prior norms, but below the massive burdens and audit fees actually incurred under the SOX initiatives (e.g., permanent yearly audit increases from 60% to 390% of pre-SOX spend levels were commonly experienced). When examined from a polar perspective, differences between the two approaches can be understood (see Figure 2).
Within the real estate, housing and mortgage segments, the cost of compliance is viewed as a cost with little or no redeeming benefit to the greater efficiency of the organization or its changing consumer behaviors. If we leave the “good” or “bad” debate to those lobbying for change and focus attention on how to change efficiently (regardless of whether we agree with the regulations or not), differences in approaches can yield essential ROI and CAPEX leverage. Additionally, when considering FASB accounting changes and proposals, the need for tightly integrated compliance changes becomes increasingly important.
Figure 2
Department Approach: For large, intertwined regulatory actions (like FSA), enterprises disperse the Title language and rules into silos of existing operations. Whereas compartmentalization is good for segmentation reuse (like OO), without context and proactive designs, departments; a) recreate substantial portions of data repositories needed for increased reporting, b) fail to capitalize on standards, and c) consume computing resources (internal or cloud) that could be leveraged – avoiding costs, improving transparency, and increasing auditability of the result. One-off departmental approaches are common in organizational cultures with autonomous, decentralized decision making and full P&L accountability.
Enterprise Approach: With the acceptance that risks have not been fully assigned or understood, senior leadership teams have increasingly implemented top-down programs of work aligned to common compliance architectures. Using a cohesive and comprehensive approach, synergies of programs can be designed, while creating a framework for regulatory auditability and reuse. Lessons and best-practices from this approach are found across prior SOX initiatives. Characteristics are integrated programs, common architectures, and leadership goals tied to individual and organizational performance.
As mentioned, there are growing and varied number of summarizations and checklists surrounding Frank-Dodd – Morrison and Foerster, Information Week, PwC, and even the MBA – the challenge is finding which ones have efficacy across the established success parameters aligned to risk tolerances (as indicated in Figure 1).
Best-Practices and Lessons Learned
Increasingly acknowledged, regulations are about yesterday – not tomorrow’s business models, consumers, or marketplace realities. The pendulum of regulatory changes tends to swing to extremes before finding a model that works – or is proven deplorably weak as the world recognized too late shaving off trillions in global wealth in the process. FDA is an example of trying to plan for the “unplanable.”
It is precisely this regulatory engineering necessity (i.e., more regulations, stress testing, safe and soundness) which dictates a tightly-coupled series of sensible innovation approaches reactive to external requirements and pressures. As presented earlier in Figure 1, we can establish a model for compliance innovation best practices encapsulated by program management disciplines. Let’s consider just a few of them:
· Architecture: A series of interconnected blueprints (e.g., retention, reuse, reporting) must be proactively designed to accommodate not only today’s requirements, but anticipation of tomorrow’s practices. It acts as a “filter” for technology innovations and approvals.
· Data: As a baseline for compliance, it represents the most stable and reusable portion of any enterprise compliance program, and one of the best sources of leverage (e.g., warehouses, repositories, and taxonomies).
· Governance: A critical aspect needed for on-going validity and cost management across data, technology, and operational methods necessary for market facing reporting and transparency.
· Infrastructure (technology): Is a by-product of integrated data and architectural building blocks tied to process and governance requirements. It is the least stable of the compliance building blocks.
· Outsourcing: With multiple back-office functions outsourced, changes needed to contractual relationships can increase costs and tensions. However, those relationships set up under gain-sharing arrangements, may yield improved returns over mature captives. Leverage of outsourcing best-practices (honed across multiple clients with similar needs) can shorten lead times, while delivering commonality of architectures and data reusability.
· Reporting and Analytics: This is where many organizations start – and work back into new compliance requirements. However, failure to incorporate feedback as part of a closed-loop approach (i.e., adaptability) can yield false-positive conformance when assessed against risks – resulting in stop-start efforts, rework, and poor returns.
· Risk Management: The goals set for by the spirit and letter of the laws, provide the success criteria for any compliance mandates. The “work-breakdown” of the requirement into practice, demands auditability of the rules and flows to ensure not just initial conformance, but for repeatability, disclosures, and replication.
Additionally, with the incorporation of best-practices and lessons learned from within and across industry segments, compliance innovation can be used to address on-going regulatory inconsistencies and emerging political agendas.
* * * * * * * *
In conclusion, with the final disposition of the GSE’s still under debate, any approach taken to deal with sweeping regulatory compliance such as FDA should be constructed for even more pending changes to the compliance structures.
History has proven time-and-again, the only certainty about regulations for FSI operations is that there will always be more – not less. Today, there are an estimated 20,000 state, federal, and local regulations – up nearly 30% since 2004.
The success of our compliance efforts are more than checking-the-boxes, submitting the data, or passing an audit – due in no small part to changing global wealth and shifting finance “guidance” from Asia. For domestic business to be sustainable, compliance innovation must become a goal of the corporate agenda and a guiding principle for IT budgetary efforts.