Transparency – driving sustainable GRC success

For many industries, Compliance, Operational Controls and Risk Management have never been more important, and whilst the case studies in this article come from the FS sector, they apply also to many other industry sectors, such as Oil and Gas, Pharmaceutical and Nutrition. Basically – all industries which are subject to stringent regulations and compliance requirements. Nimbus serves clients across all these sectors.

Changes to regulatory requirements have caused Compliance Officers' workload to grow dramatically; to the extent that simply throwing more people at the problem is neither practical or cost effective.  There's a need to share responsibility for compliance across the business,  so that compliance is ingrained as part of day-to-day operations - if you like; "Compliance needs to be in the DNA of the organisation".

Equally, Controls and Risk Management are Increasingly seen as a responsibility for all in operations rather than the domain of a tight knit risk and controls team.  But there are several challenges to successfully engage your workforce in managing risk:

• How to translate a theoretical risk & control model into transparent operating practices which can be adopted by the entire workforce?
• How to keep the risk & control model and associated reporting in line with operational practices?
• How to communicate process, risk and control information in a manner which engages the whole workforce?
• How to inform relevant stakeholders when relevant process, risk or control information is updated?

Nimbus provides solutions to these issues, with use a business process orientated approach, powered by "Nimbus Control" software, which is delivering success for a wide range of customers; as the following two short case studies illustrate.

Case Study 1:

ING SW Europe - Compliance Maturity Program

When ING SW Europe started a Compliance Maturity Program it turned to Nimbus for guidance on business process optimization. Having evaluated compliance operation changes imposed by MiFID regulations, it became apparent that an eightfold increase in capacity was needed.

ING and Nimbus ran a process definition workshop with several compliance officers. As a result ING obtained a complete end-to-end view of the processes in question and were able to identify many opportunities for process optimization and elimination of manual procedures. The next step was to build the required automation. Capacity issues within IT forced ING to outsource development and hosting. Nimbus' hosted software-as-a-service capability was selected so that no software needed to be installed on ING's infrastructure. A technical specification was built from the process content, which after a couple of reviews with ING was handed to the development team who started work straight away.  Within three months the capacity increase was achieved.

"Nimbus Control provided a process view which greatly facilitated the definition of requirements between compliance specialists and developers. Our cost per transaction reduced from €16 to less than €3, and we have exceeded our target for automatic processing." Erik Werson. Program Director - ING SWE Compliance Maturity Programme

The application has been rolled-out across the whole SWE region in 2009 and in 2010 Is rolling-out internationally. Further compliance automation projects have been similarly developed and delivered by Nimbus for ING, including financial instrument trade approvals, insider registration, gift & entertainment registration and outside positions registration.  Further modules are being added including Contract Insider, Services Insider and Document Registration. As a consequence of the success enjoyed by ING, Nimbus has packaged the applications as the "Nimbus Compliance Suite" to make them available to other clients.

Case Study 2:

International Investment Bank - Operational Risk Controls Management

Nimbus has been working with this International Investment Bank* on a risk and controls project for eighteen months. Following a FSA audit the bank decided to establish a global, consistent GRC framework, which transcended traditionally siloed, product aligned departments. The historic approach to managing risk and controls through spreadsheets had not provided the required oversight.

The bank adopted Nimbus Control to create a transparent business process model, together with a consistent risks and controls framework.  This is being deployed to all required employees via a Microsoft SharePoint portal, which integrates processes, risk, controls and KPI's.  Interaction is driven through Nimbus Control's "Action Management" module which helps push personalized workflow tasks to users, such as attestations, risk control self certifications, reminders and escalations. In addition to software, Nimbus provided a global professional services team, working across 3 global hubs to help capture over 4000 processes in four months, and established a Center of Excellence to ensure the content is consistent and kept up-to-date.  The results:

One source of the truth for business processes, risks, controls, KPI's and associated tasks. Transparency from global overview down to operating departments and individual Control instances. Consistent data capture, reporting and behavior by all Risk & Control officers, irrespective of department or region. Clear understanding of how risks, controls and compliance obligations interlink and how they impact the banks operations. Easier audit, with evidence of consistent data, consistent management control and stakeholder engagement.

* Due to a non disclosure agreement Nimbus is unable to name the bank.

About the author

Antony Bream is Global Head of Nimbus' Financial Services Practice and has spearheaded it's growth since 2004.  Nimbus's recent customer engagements include Barclays, RBS, RBC, Northern Trust, HSBC, Allianz, ZFS and ING. A keen sailor, Antony lives in the UK but serves clients in North America, mainland Europe and worldwide.