RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK...

26
RISK ASSESSMENTS: WHAT WE’VE LEARNED Steve Levine, Chief Legal & Compliance Officer

Transcript of RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK...

Page 1: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

RISKASSESSMENTS:WHATWE’VELEARNEDSteveLevine,ChiefLegal&ComplianceOfficer

Page 2: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

WHATISARISKASSESSMENT?

↗ AccordingtotheCFPB,theRiskAssessmentprocessisdesignedtoevaluateonaconsistentbasistheextentofrisktoconsumersarisingfromactivitiesofanentityandtoidentifysourcesofthatrisk.

↗  “Risktoconsumers”isthepotentialforconsumerstosuffereconomiclossorotherlegallycognizableinjuryasaresultoffailuretofollowfederalconsumerfinancelaws.

Page 3: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

WHATISARISKASSESSMENT?

AsdefinedbytheCFPB,“inherentrisk”includesfactsthatincreasethepotentialforunfair,deceptiveorabusiveactsorpractices,fordiscrimination,orforviolationsofotherFederalconsumerfinanciallaws.Italsoincludesfactorsthatincreasethecompliancemanagementchallengesofabusinessandtherebyincreasetheriskofsuchviolations.

Page 4: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

WHATISARISKASSESSMENT?

“RiskControls”includesfactorsrelatedtobothmanagingandmitigatingspecificinherentriskaswellasthestrengthofanentity’soverallsystemofcompliancemanagement.

Page 5: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

WHATISARISKASSESSMENT?

TheresultofcombiningthesetwoconceptsisananalysisthatinvestigatesBOTHthepracticesthatrepresentrisktoconsumersANDwhatcontrolsthebusinesshasputinplacetomitigatethatrisk.

Page 6: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

CFPB’SRESIDUALRISKMATRIX

Page 7: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

CFPB’SRESIDUALRISKMATRIX

↗ TheCFPBtemplateprovidesaseriesoffactorsthatbearoninherentriskandrelevantriskcontrols.Examinersconductingtheassessmentshouldrateeachrelevantfactor(low,moderateorhighinherentrisk;strong,adequateorweakcontrolsandmitigation.

↗ Thefactorratings,takenasawhole,resultinaRiskSummary,whichisaconclusionaboutwhethertheoverallrisktoconsumersislow,moderateorhigh.

Page 8: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

WHATARISKASSESSMENTISNOT

Ariskassessmentisnotadeterminationastowhetheraviolationofanyspecificlawexists.Itisaninvestigationintopracticesaswellasbusinesscontrolsinplace.

Conclusionsarebasedonriskpresentedtoconsumersaswellasadequacyofcontrolsinplace.

Page 9: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

RISKASSESSMENTTOPICSINCLUDE↗ Website;

↗ Advertisingand

Marketing; ↗ AcquisitionNetwork;

↗ AdverseAction;↗ UnderwritingandScoring;↗ AncillaryProducts; ↗ FeesChargedtothe

Customer; ↗ CollectionCallFrequency↗ Thirdpartycontact;

↗ MilitaryAccounts;↗ Repossessiondecisions;↗ AdherencetoCallScripts;↗ ComplaintManagement;↗ BankruptcyAccounts;↗ CreditReporting;↗ CreditDisputeHandling;↗ StarterInterrupt/GPS

accounts;↗ CPI↗ ANDMORE

Page 10: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

ADVANTAGESOFARISKASSESSMENT↗ Globalviewofoverallbusiness,notsilos;↗ Identifieswheretoinvestresourcesandbudget;↗ Measuresprogress;↗ Setspriorities;↗ Avoidfiredrills;↗ DemonstrateadequacyoftheCompliance

ManagementSystem;↗ Facilitatesworkingrelationshipbetweenbusiness

andcomplianceteams;

Page 11: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

KEYSTOASUCCESSFULRISKASSESSMENT

↗ Projectshouldbeaprocess,notadocument;↗ Itshouldbedynamic,notstatic;↗ Allowsassessmentofcurrentconditionswithgoalof

improving;↗ Don’tjustconsiderwhereyouarebutwhereyouare

going,i.e.newproducts,markets,profitcenters,yields;

↗ Maketheriskassessmentforwardlookingtoo.

Page 12: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

KEYSTOASUCCESSFULRISKASSESSMENT

ENGAGETHEBUSINESS!

↗ Collaboratewiththeallemployeesontheproject;↗ Earlybusinessbuy-iniskeytoacceptance;↗ Involveeveryoneinthedevelopmentofanalysis;↗ Don’twaitforthefinalreporttodeliverbadnews;↗ Recognizeandhighlightthe“goods”;↗ Fixtheproblem,nottheblame;↗ Supportmustcomefromtop;

Page 13: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

BIGGESTRISKASSESSMENTMISTAKES

↗ Thinkingthatthisismerelyacompliancedepartmentfunction;

↗ HidetheBallMentality;↗ Attemptingtodothisin-house;↗ NotinvolvingalllevelsoftheCompany;↗ ConfusinganAssessmentwithanAudit.

Page 14: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

OURGENERALOBSERVATIONS

↗ Thereisoftenadisconnectbetweenseniorleadershipandtheemployeesdoingthedaytodaywork.Thisistrueforbothareasofriskandcontrols.

↗ It’shardtogetaccesstotherightinformation.Thisisconcerningbecausethecompanymustdemonstrateitsefforts!;

↗ Thereismisunderstandingaboutrolesandresponsibility;

Page 15: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

OURGENERALOBSERVATIONS

↗ Companiesthinktheirtraininginitiativesarealotmoreeffectivethantheyare;

↗ Companiesstrugglewithanalyzingtheirbusinessthroughthelensof“consumerrisk”andtendtofocusontheirownrisk;

↗ Weoftenhear“it’snotillegaltomakemoney”asadefensetotheofferingofproductsandservices.Thequestioniswhetherthereistransparencyandfairnesstotheconsumer.

Page 16: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

OURGENERALOBSERVATIONS↗  “FOLLOWTHEMONEY”isagoodwaytoidentifyrisk.Someof

themostprofitableinitiativesalsocontainthemostrisk,forinstancefees,aftermarketproducts,CPI,etc.

↗  Businessestendtoembellishthecontrolsthatareinplace;whatappearsonacompanyorganizationchartmaybeverydifferentthanwhatactuallyhappens;

↗  Thereisn’tnecessarilyacorrelationbetweencustomercomplaintsandareasofrisk;however,nothavingstrongcomplaintmanagementisinitselfarisk;

D

Page 17: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

OURGENERALOBSERVATIONS

↗  Therearesomepracticesthatareinherentlyrisky(CPI,Advertising)andinthoseareasevenstrongcontrolsinplacemayresultina“moderate”riskassessment;

↗  Similarly,thereareareasofmoderateorevenlowriskthatcanbeassessedas“moderate”riskbecauseofweakcontrols;

↗  Beinganindependentthirdpartyallowsamorehonestassessmentbecausethereisnopre-existingprejudice;

Page 18: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

POLICIESANDPROCEDURES

↗  PoliciesandProcedures,standingalone,donotconstitutestrongcontrols.

↗ Digdeeperandintovariouslevelsofthecompanytolearnfamiliaritywiththepolicies,howoftentheyareexaminedandupdated,andhowstrongandthoroughisthetrainingreceivedbypersonnel.

Page 19: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

INDIRECTLENDING↗  Indirectlendersthatbuycontractsfrom

hundredsorthousandsofdealersneedtohavestrongcontrols,(underwriting,contractsaccepted,thirdpartyproducts);

↗ Unfortunately,budgetaryandvolumepressuresmakeithardtosticktothesecontrols.

Page 20: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

VENDORMANAGEMENT↗  Generally,companiesaren’tasstrongwith

thisfunctionastheythinktheyare;

↗ Policiesarenotalwaysfollowed,exceptionsaremade,mostprominentlyinrepossession;

↗ TherecentWellsFargofinehadsomegoodinsightintomanagingvendors,askingpenetratingquestionsandbeingproactive.

Page 21: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

COMPLAINTMANAGEMENT

↗ Mosthaveapolicyandprocessbutwidedivergencewithitcomestoremediation;

↗ Companiesdon’tdocumentwelland“losecredit”forcomplaintstheyresolvequickly;

↗ 3mostcommonarea)poorservice;b)employeerude;andc)reporelated.

Page 22: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

THIRDPARTYCONTACTS

↗  Thereisconfusionastowhenathirdpartycanbecontacted,anditoftencontactismadewhenlocationofcustomerisknown;

↗ Companieslackamechanismtotrack“donotcall”instructionsfromthirdparty;

↗ Managersdon’tliketheruleandtrytocircumvent.

Page 23: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

CREDITREPORTING↗ Disputehandlingfunctionisnotadequately

staffedinmanyinstances;confusiononwhat“adequateinvestigation”means;

↗ Furnisherobligationsaren’talwaysunderstoodandauditsdon’tmatchsizeandcomplexityofbusiness;

↗  Inherentlyhighrisktopic,sotrainingvital.Staffisoftennotadequatelytrainedandinheritjob.

Page 24: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

COLLECTIONSANDSERVICING

↗ Scriptsdon’talwaysexistandwhentheydotheyareoftennotfollowed;

↗ Collectionnotesarenotalwayspresentandoftennotclear;

↗ Datanotalwayseasytolocate;

↗ Integrationbetweenvarioussystemsneeded.

Page 25: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

MeetusattheAfterParty!

ContinuedDiscussiononourwebinar!

RiskAssessments:WhatWeLearnedFor2018

WednesdayJune6th

2PMCDT

[email protected]!

Page 26: RISK ASSESSMENTS: WHAT WE’VE LEARNED€¦ · place to mitigate that risk. CFPB’S RESIDUAL RISK MATRIX CFPB’S RESIDUAL RISK MATRIX ↗ The CFPB template provides a series of

IgniteConsultingPartnersconsultsBHPHdealers,financecompanies,andotherlendersoncompliance,cyber-threatassessment,processimprovementandhowtoleveragetechnologyto

driveefficiencyandperformance.

SteveLevineChiefLegalandComplianceOfficer

(817)[email protected]

FollowSteveonTwitter@LawyerLevine