The best way to prepare for a regulatory audit is to conduct a compliance review of your own.
This will help firms identify, and correct, compliance deficiencies before regulators do, said Carol Sands, chief compliance officer, Brandes Investment Partners, speaking at the Strategy Institute’s Registrant Regulation Compliance Strategies Summit, in Toronto.
“I will trigger an immediate review when [we] hear there is a sweep being done within the industry,” she said. “[Even] if we weren’t selected for that review I would still call the business people together and go through: what is it that they’re looking at; do we have an issue; and is there anything that we need to address or look at. You may be just down on the list by the time they get to you, so you’re ahead in the game.”
If a firm is subject to a full review at some point, a pre-emptive, in-house review ensures it has met the criteria and addressed any issues that may be outlined.
“Your compliance role also is to mange the business risks,” said Sands. “So make sure that you’ve got the information and know where to find information on privacy breaches; you may have to report a privacy breach to the privacy commissioner.”
A key part of preparation is making sure that senior management is involved, said Pam Thadani, assistant vice-president, chief compliance officer, Capital International Asset Management (Canada) Inc.
“One of the things that you need to do is instruct the key individuals within your organization that the OSC may contact,” said Thadani. “I’ve told everybody in my firm that if there’s any regulatory contact, they need to escalate that to me immediately or the ultimate designated person (UDP).”
Firms should name one point of contact for the OSC when they come for an audit. “And that point of contact is constantly checking in with the OSC throughout the review; there should be no surprises at the exit meeting and that also helps to have a more collaborative approach,” she added.
Start with an initial meeting with the OSC that introduces the organization, the key players of the firm, and its business model.
“It’s very helpful for the OSC to better understand that structure throughout the audit; it sets the tone of the audit,” said Thadani. “The OSC can also use that as a good reference tool as they’re going through your books and records, because things will make sense to them as opposed to them having to ask you questions all the time.”
Thadani said the importance of being honest and proactive couldn’t be overstated. “During the course of the review, there will be ad hoc requests that come up; make sure you document those as well as documenting your responses,” she said. “It’s very important to keep everything intact.”
Do not hesitate to ask for additional guidance if it is not immediately clear what the auditors are looking for, said Sands.
“[It is important to] understand what the actual question is, because sometimes business people and regulators have different ways of talking about the same thing,” she said. “So sometimes it’s making sure that the compliance person is involved to be able to interpret what the actual question is [and] make sure that you have people responding only to the question that they’re asked.”
Not only is it important to be specific when responding to questions, it is also not advisable to speculate when asked questions that seem besides the point.
“[Don’t] answer hypothetical questions, agree or disagree with opinions, or provide irrelevant information,” said Thadani. “Only answer the question that’s being asked and it’s very important to not get offended by the ‘why’ questions. The OSC will ask the ‘why’ questions because they want more information, or they want help.”
Sands asserted that it may be a very isolated registration category review. It is, therefore, imperative to stick to the topic at hand.
“There’s no need to fall into portfolio management issues when you’re doing a fund manager review,” she said. “It’s not to sound like we’re withholding information, or not cooperating in any way, shape or form. At the end of the day, any audit, whether it’s an internal audit, a regulatory audit or an external audit, you really want it to go as smoothly as possible.”
Finally, if you promise you’ll fix issues identified by regulators, make good on it.
“If you’re telling the OSC that you’re going to have a short- and long-term solution, make sure that you follow up on the long-term solution and that it actually gets implemented, because three years down the road when you’re up for a review again, they’re going to take your last report and start from there.”