Although risk management and compliance do play a role in most industries today, regulatory compliance and risk management are not at the same high level in every sector. Companies that are active in the financial sector, for example, must comply with strict(er) rules from regulators and other stakeholders.
This ensures that risk management and the level of control of compliance issues in the financial world often have a higher maturity level than in most other sectors. For example, this industry applies enterprise risk management (ERM) much more consistently. They use this method at a maturity level that other industries can learn a lot from.
From necessity to virtue
After the financial crisis in 2008, the financial sector came under a social magnifying glass. Politicians, customers and society demanded change. As a result, the industry had to deal with stricter laws and regulations. Organizations in the financial sector have made a virtue of necessity and are therefore strongly committed to building and maintaining specialist knowledge in the field of risk management, internal control and compliance with legislation and regulations.
The example of the financial sector
But in which areas exactly is the financial sector ahead of the curve when it comes to risk management, internal control and compliance with legislation and regulations? We give a few examples.
Compliance through roles and responsibilities
Most financial organizations have a good framework of roles and responsibilities for risk management and compliance. This is often based on the 3-lines-of-defence model. That model uses three lines of defense to mitigate business risks. The business is the first line, followed by systems that steer the risk management and control process in the right direction. Internal audit is the third line and offers additional tools for control and assurance.
Internal Control Framework (ERM)
Financial organizations generally have a good framework for enterprise risk management (ERM). This provides a detailed overview of the main risks and appropriate control measures. Which risks are the most significant and therefore deserve the highest priority? And how are these controlled?
Incident management
Even with extensive precautions and an excellent risk management framework, an incident can never be completely ruled out. Incident management is therefore at least as important as risk management. Financial organizations generally have a clear and efficient policy for incident management. They manage to properly register, analyse and resolve issues that go wrong within the organization.
Periodic reports
To maintain the level of compliance and risk management, continuous evaluation is a must. Periodic reports on risks and the operation of the internal control framework are common in the financial world.
Follow the example
In sectors other than the financial sector, stakeholders are increasingly requesting management to take action on risk management, internal control and compliance with legislation and regulations. The financial sector provides a good blueprint for getting these essential issues in order.
Would you like to know more about internal risk management and how to fine-tune your compliance policy? Please contact INTERMEDIATE. We can help you map out where the challenges lie.
