What's the basic structure of a Compliance Management System?
"System" is probably a misleading term - a Compliance Management System is really more of a model of how to manage compliance risk ... a way of doing things safely and efficiently. Here are some thoughts on how to structure your own.
Despite hearing about this all the time, you might be avoiding it because it sounds too familiar to "loan origination system" or "point of sale" system ... too familiar to an expensive piece of technology that you'll have to implement. That's not what a CMS is. A CMS is just a way of doing things ... it's something that you write into policies and how you run this portion of your business. Note: There is software available to help with this - it can be similar to a mind-mapping software - but that is certainly not necessary, especially for smaller shops.
A CMS is expected for both CFPB and FDIC-regulated entities. But in any case, it should make your life a lot easier when dealing with changing regulations (not only during compliance examinations).
What does a CMS do?
It is a framework for making sure you're doing everything you need to from a compliance perspective. It should make it easier to manage compliance risk and reduce the uncertainty/confusion that leads to so much frustration nowadays.
Think of it as a process ... a framework ... a way of doing things. It's something where you set it up and fill in the blanks over time. It's like writing a set of instructions for how to install a sink.
But what does it look like?
Just select one of two choices for a basic structure (FDIC or CFPB) and fill in the blanks.
Note: This is just a framework ... there are other ways of structuring this. For example, the Fed breaks it up into (1) oversight, (2) policies, procedures, and training, (3) monitoring and testing, and (4) reporting.
Just select a basic structure and fill in the blanks. Here is the link for more information from the FDIC on this. And you can find the CFPB's information here (on page 34 of this 900+ page version of their most recent examination manual).
But here are some general thoughts on prong #1: Oversight
In #1: Oversight, you need to answer how compliance is overseen in your organization.
You will need to designate a Chief Compliance Officer (just someone who is ultimately in charge of compliance). That person will need to have certain powers. In smaller institutions, we often recommend dividing this function into Lending and Deposit compliance ... as someone with sufficient expertise in both is hard to find. And for very small institutions, a Compliance Committee instead of one person is often the best way to go.
This will be a group of people with other jobs at the bank - VP lending, underwriters, etc. - who meet regularly to run the compliance program (which means discussing upcoming regulations, scheduling compliance training for employees, checking up on current compliance with the rule, i.e., "monitoring", and revising policies/procedures).
A key in satisfying the requirements of prong #1 is to get the information from the Chief Compliance Officer(s) or committee up the chain of command--it's not going to look great if the President doesn't know who exactly is on the Compliance Committee. There should be reports to senior management and to the Board.
Both the CFPB and FDIC expressly permit institutions to outsource the compliance function ... an "outsourced CCO" might serve on the Compliance Committee, manage the lending or deposit side, and sometimes even manage both sides in its entirety. This person may
help spread ideas around from shop-to-shop (like a honeybee and
flowers) ... and could help during regulatory exams by dealing
directly with examiners.
Those are just some of our thoughts ... some of what we've seen. Anyone have anything to add?
Other news/thoughts/trivia:
Do you want to pay $16,000 annually to tie ARMs to the LIBOR? As of July 1, 2014, that's what the ICBA is planning to charge financial institutions. See here for the fee information and here for more information on licensing. Describing these new fees "as a shock to many," the ICBA issued a July 22, 2014 letter identifying the problems and arguing for exceptions for community banks - worth a quick read!
Age discrimination is real. Today is my birthday, and John's already invited me out after work for my "first alcoholic beverage," with Steve chiming in with, "Now that you're old enough, are you excited to go see R-rated movies?" They tell me that "teasing is a sign of affection" ... guess they really like me here?
Sometimes clients ask us for help with "differentiation" of their employees - it might come up in the context of a staffing assessment or in designing a compensation package. E.g., "How do I tell if my processor is doing a great job - she has 50 loans in the pipe now." Based on the unique circumstances, we can determine what the average turnaround time should be, how many loans the processor should be doing, how many loans the underwriters can handle per day, etc. Clients can then tie financial incentives to hard numbers, e.g., "If we decrease the average turnaround time by 2 days over the next 6 months, the entire department will get a raise."
Basically, clients want to reward strong performers and target weak employees for training or new opportunities. This type of differentiation was advocated by Jack Welch--that's how he ran GE, by separating employees into the top 20, the middle 70, and the bottom 10. The criticism is that it's "not fair - everyone at the same position should get paid the same." Jack Welch disagrees ... he would ask, "Did you receive grades in school?" and "Did you think getting grades was mean?" If we get graded all the way through school, "why should we stop getting grades at age twenty-one? To prevent meanness? Please!" He has an entire chapter on differentiation in his book - Winning (c) 2005.
It's easy to see this concept working with sports teams. All the guys on the Red Sox are working together as a team, even though they're all getting paid differently - some more or less than others.
"If Emmitt Smith puts his head down on his desk and dozes off in a team meeting, we get him a pillow and have someone stand next to him to make sure he doesn't fall out of a chair .... If a 3rd string lineman who missed 4 blocks in last week's game dozes off, he wakes up traded to Buffalo.
- Attributed to Jimmy Johnson, when discussing how he treats his star players, by Dan Kennedy in his book, "No B.S. Ruthless Management of People
and Profits"
Thanks so much for reading our weekly newsletters. We're not always going to be perfect, but because we always do our best and try not to overpromise, we hope that we're always going to be trustworthy. Your calls and e-mails are very helpful - please keep contributing.
**These are our opinions. We're not authorized, or willing, to express those of others.**