The partners and the other staff involved in the post opening duties were enjoying the regular daily banter, which was suddenly brought to a halt when a letter was opened from the regulator announcing a forthcoming visit. The panic that arose from this letter is not uncommon among legal firms but I question whether such reactions should be commonplace. The response of some firms is based on their perceived level of compliance with their regulatory obligations. Whilst for some firms their response is based on their perception of the regulator’s likely approach to identified minor non-compliances. So what should be the appropriate response to such notifications from the regulator? It seems to me that the appropriate response is to prepare to engage constructively with the regulator during the visit to ensure that the objectives of the proposed visit are achieved. Although the specific objectives of the visit may sometimes be unknown, it is possible to prepare for a visit based on the regulator’s stated outcomes for consumers.
A regulatory visit may be triggered for a variety of reasons including high-risk indicators, random selection and thematic reviews in order to develop a deeper understanding of likely issues of consumer detriment at the point of delivery. So how should a firm prepare for a visit particularly when the visit objectives are unclear? In the first instance, the approach that should be avoided is preparing to hide problems/ non-compliances from the regulator or attempting to correct issues on files retrospectively such as backdating client care letters. Although well intentioned, such approaches are counterproductive because the inspectors/investigators from regulators such as SRA and CLC are highly skilled and can easily detect when the pre-visit preparatory activity by the firm attempts to mask the reality of the firm’s compliance position. Adopting a transparent and open approach to the visit is the most appropriate strategy to ensure the right outcomes for consumers.
The first step in preparing properly for a visit is to stop panicking unless you are aware of fraud in your firm in which case self reporting or whistle blowing is critical. Some of the current fear of regulators is misplaced and based on partial stories of exceptional circumstances and not balanced with situations were regulators were proportionate in their approaches. It always amazes me when I hear stories of how an impending visit may lead to a closure of a firm, which is usually largely exaggerated. Whilst maintaining such fear appears beneficial for us as risk and compliance consultants because firms are more likely to seek our services to address their concerns, however it seems to me that a relationship with the regulator based on such crippling fear is not conducive to deliver sustainable better outcomes for consumers. A relationship of mutual respect between the regulator and regulated community is critical for outcomes focused regulation to deliver the right outcomes for consumers.
Once the panic has stopped the firm needs to consider what pre-visit preparation has the regulator requested to be undertaken. This could include collating documentation, ensuring access to relevant records and key personnel. In some instances, the opportunity to have a pre-visit conversation with the relevant staff may be a possibility but it is best to avoid using such an opportunity to debate whether your firm has been unfairly targeted or selected. Such debates are unlikely to change the visit and may affect your ability to prepare constructively for the visit.
The next step is to pool and allocate the necessary resources both internally and externally (as appropriate) to ensure that the firm is properly prepared to engage constructively with the regulator during the visit. In addition, it is important to clarify the respective responsibilities of those likely to participate in the visit emphasising that the visit is not an examination and it is not expected that all staff will have the same level of understanding of the firm’s arrangements. Anticipating likely questions during proposed interviews and preparing staff to respond appropriately is helpful particularly for those staff that may find an interview process intimidating. However, it is important to ensure that the interview preparation is not focused on providing staff with the ‘right’ answers because they may come unstuck if they have to deal with unanticipated probing questions.
Depending on the robustness of the firm’s internal audit process, it may be beneficial to carry out a self-assessment of the firm’s compliance in key areas informed by its risk register as appropriate. However, the purpose of such self-assessment is primarily for the firm to be aware of its current strengths and weaknesses. It is important to re-emphasise that the purpose of any pre-visit audit is not to hide any identified non-compliances. For example if relevant customer information was not sent to customers, such information can be sent prior to the regulatory visit but it should be clear that the correction action took place after the visit notification letter. Being open with the regulator about corrective action implemented since the notification letter was received demonstrates transparency and may reflect positively on the firm subject to other findings from the visit.
Finally, it is important to be aware that although effective regulators as a priority do not seek to be liked by their regulatory communities, they also do not intentionally set out to be disliked. It is evident that regulators are not perfect and from time to time, they may make mistakes largely due to competing priorities, which may give rise to unfavorable perceptions with regard to their likely approach. However, one should not forget that they wish to see their respective regulatory communities serve consumers safely and profitably. So the next time, a visit notification arrives from the regulator, perhaps you may think of them as a critical friend rather than as the scary regulator.