SMCR technology: why software is the only viable solution

For firms of a certain size, the complexity and scale needed for complying with the Senior Manager's Certification Regime means that SMCR technology is the only viable option for managing these requirements. The risk to the firm, and individually to senior managers, of personal fines and sanctions, is too significant to rely on manual solutions.

Compounding this complexity is the fact that many firms consist of multiple legal entities and the SMCR applies at legal entity level. This requires multiple Responsibility Maps and Statement of Responsibilities for senior managers with roles in several firms within the group. This imposes more emphasis on consistency, change management, version control and interactions between entities.

The cost and pace of regulatory change are cited by many chief risk officers and chief compliance officers as one of the biggest and highest priority risks in the industry and there are no signs of it reducing. The degree of regulatory change, if anything, is set to increase.

The problem with manual solutions

Within a typical, medium-sized firm, it is easy to identify over 100 existing or new policies and processes impacted by SMCR. As well as this, over 40 new ‘Regulatory Artefacts’ must be maintained, kept in sync and retained as evidence such as Responsibility Maps, SoRs, Reasonable Steps Policy and Handover Policy.

A particular bank updated their Management Responsibilities Maps (which have to be submitted to the regulator) 12 times in the first 24 months, including more than 200 updates to their Statements of Responsibilities (across approximately 20 senior managers).

In another case, a bank performed manual updates to six SoRs which required approximately 80 man hours of effort. Using our SMCR software, the same task would take 90 minutes with a guaranteed and consistent result. Furthermore, the Certification element of the regime imposes critical dependence on existing Performance Management (HR and Training & Competency). These functions are typically inadequately equipped or resourced to provide the significantly increased rigour that the regime demands.

How a software solution can help

Our clients have selected our SMCR software solution, Pentana Compliance, to help them manage risk and compliance in a better, faster, cheaper and far safer way than manual solutions. The technology offers an opportunity for firms to apply more stringent controls that mitigate the risk of human oversight or inefficiency by automating compliance and implementing a system that places transparency at the heart of business operations. It minimises the risks of malpractice across front, middle and back offices.

One of our clients originally implemented SMCR based on a combination of existing HR systems, spreadsheets and manual processes. Whilst it was sufficient to meet the regime’s requirements, it resulted in the following issues:

• Inefficiency – data needed to be collated and checked manually, often being re-keyed from multiple sources
   
• Risk of inaccuracies – mitigating inaccuracies meant that HR, compliance and senior managers needed to manually check data and records
• Poor audit trail – there was no central data store or efficient reporting function or rigorous evidence record
• Poor user experience – resulting in HR and compliance teams having to help end-users
• Senior manager confidence – given their personal responsibility, the firm needed to give their senior managers greater protection and confidence in the accuracy of records and audit trail
  
  To address these issues, our client chose our SMCR software solution. The contrasting outcomes were as follows:
   
• Process automation – the Certification process being automatically scheduled, communicated and actioned, requiring no manual intervention whatsoever
• Greater protection and reduced risk – mitigating any non-compliance and breaches
• Accurate data – reports, data and Certificates stored centrally, providing a full audit trail
• Improved user experience – the interface is intuitive therefore removed the need for any end-user training
• Senior managers confidence – senior managers now have complete confidence in the consistent application of controls