Risk management: a requirement of FAIS

In this first part of a two part series, Megan Young, Head of Compliance at Celestis, takes a general look at what risk management is and what the legislation requires from financial services providers.

Part IX of the FAIS General Code of Conduct requires that every FSP should have a risk management framework in place. In terms of the Code, every FSP must:

* at all times have and effectively employ the resources, procedures and appropriate technological systems that can reasonably be expected to eliminate, as far as reasonably possible, the risk that clients, product suppliers and other FSP or representatives will suffer financial loss through theft, fraud, other dishonest acts, poor administration, negligence, professional misconduct or culpable omissions;

* structure the internal control procedures concerned so as to
provide reasonable assurance that (a) the relevant business can be carried on in an orderly and efficient manner; (b) financial and other information used or provided by the FSP will be reliable; and (c) all applicable laws are complied with; and

* if, and to the extent required by the registrar, maintain in force suitable guarantees or professional indemnity or fidelity insurance cover.

Annual report
The compliance officer, or the key individual of the FSP where no compliance officer has been appointed, is required to report back to the FSB in the annual compliance report whether the FSP has a risk management framework in place.

Risks
Every business enterprise faces risks determined by the nature of the business activities. Risk management is simply a matter of identifying the risks and taking steps to manage them. Business risk issues cannot be separated from management responsibilities.

The human element in a business often poses the biggest risk including the employment of staff, the possibility of losing staff, and the activities undertaken by management and staff.

It may appear to be a rather a daunting task to put together a risk management plan. But financial advisers can implement a simple risk management plan by following these few basic steps:

1.  Identify the risks
Make a list of all the risks that may affect your business. These may relate to business premises, financial and operational infrastructure, management, staff, legislative environment, clients, product providers or competitors.

2. Assess the risks
Take each risk identified and ask these two questions:

* What is the probability or likelihood of the risk occurring? 
* What will be the impact on the business, either as financial loss or reputational damage, if the risk materialises?

3. Classify the risks
Prioritise the assessed risks by placing them into categories of high, medium or low risk.

4. Implement control measures
Think practically around what steps you should take to prevent these risks from occurring, or if the risk is unpreventable, what you can do to minimise the impact.

5. Monitor effectiveness
Test your plan regularly to assess whether the control measures are adequate and whether they are consistently applied.

The financial advisers risk management plan can further be strengthened by the following support services:
 
* Compliance services to ensure all legislation requirements are met;
* Practice management to assist in implementing sound business practices; and
* Technology systems support to drive efficient and accurate processes.