When firms first start planning for the implementation of the new SM&CR regime, they seldom prioritise the ongoing challenge and risks associated with how well systems and processes will support things after it goes live and becomes business as usual. The challenges of managing a consistent approach across the various workflows; the difficulty of joining together what are often disjointed or siloed processes; how to ensure a robust and consistent approach to the related procedures across the firm, and crucially; future-proofing of your systems and processes and maintaining an comprehensive and accessible audit trail.
So why isn’t record keeping ‘front of mind’ for SM&CR project teams? Understandably, there are big to answer early on such as ‘who will our SMFs be?’ and ‘who do we allocate the Prescribed Responsibilities?’ Similar difficult questions also need to be answered regarding the Certification Regime.
However, what tends to get lost whilst these discussions are taking place is that a key requirement of the SM&CR regulation is being able to evidence compliance with the rules. And, because the regulator can request evidence on any given date in the past, accurate record keeping is key. To make things worse, the larger the firm and the longer the regulation is in place, the more difficult the record keeping challenges become.
The final, but important, point to mention regarding SM&CR record keeping requirements is that, in functionality terms, it requires a mix of record management, including attaching documents, e.g. regulatory references from other firms for new joiners, and workflow, e.g. managing the Fit & Proper process end to end.
So, if that answers the question, ‘how will you manage your SM&CR records’, what are the options? In broad terms firms have three options;
Using Existing In-House Systems For Managing SM&CR Records
Every firm will already have a range of in-house systems that might be fit for purpose. As responsibility for SM&CR is often spread across HR, Compliance, Risk and Operations there is often a great deal of systems to choose from! Understandably, this is the first place that firms tend to look when considering the record keeping challenges around SM&CR.
However, in-house systems will almost certainly only contain part of the functionality required to deliver against the requirements of the SM&CR regulation. For example, many dedicated HR systems will be able to store records of DBS and Credit checks. Similarly, Governance systems will likely be able to store records of a firm’s committee structures and members.
However, there are two problems with in-house systems;
1. Records related to SM&CR are typically stored in different systems and managed by different teams. This means taking a holistic view of the SM&CR picture at any time is difficult and, as a result, introduces the risk of not meeting regulatory requirements.
2. Between them, existing systems may not have all the functionality required by the SM&CR rules. This leaves firms with the prospect of having to tailor these systems or reply on resource hungry processes and a growing reliance on work-arounds. All introducing cost, delay and, again, risk into the equation.
Using Microsoft Office for Managing SM&CR Records
Because IT departments are usually so busy and lead times for system changes are so long, firms are full of ‘cottage industries’ of people developing Access, Excel etc. in very creative ways to ‘plug the gap’. So for many firms, using Microsoft Office products is an alternative if their in-house IT teams can’t create new functionality or amend existing systems in time.
Find out about the software solution offered by Worksmart for the management of SM&CR.
Whilst appealing, particularly enabling the go-live deadlines to be met, using Office products have their drawbacks.
1. At the risk of stating the obvious, using Office products that were designed for a specific reason and using them for managing SM&CR will require their core functionality to be taken to the limit. Even at this point, it may be SM&CR’s requirements are a ‘step too far’, e.g. managing workflow using Access or Excel.
2. They are unsupported. There are many cases of Office products being adapted to meet specific business needs. However, the ‘technical guru’ who created the adapted software has left and so all the knowledge about how to maintain the software has gone as well. In-house IT departments avoid picking up support responsibility for this type of solution because they don’t know the ‘how and why’ of the solution’s changes.
3. The final problem, and one everyone will relate to, is version control. As an Operations Director once said to a colleague of mine, ‘if you ask me ‘who was responsible for what’ in the bank last year, I can tell you about anytime, apart from last October!’ Losing control of versions as they are updated may be irritating in most circumstances, but with SM&CR, it could risk your regulatory permissions.
Deploying Dedicated Systems For Managing SM&CR Records
There are dedicated systems which have been developed to meet the specific needs of SM&CR. If a dedicated system, i.e. one that covers all the requirements of SM&CR, is the favoured option then there are two further options;
1. In-House Build – Creating a dedicated SM&CR system using your own IT team has genuine attraction. If well specified, the system will enable not only all the SM&CR requirements to be met, it can also cater for any specific additional requirements the firm may have. It also puts the firm in full control of any updates it may wish to make.
The downside to all of this is time and expense. Firms’ IT teams are invariably busy, with long lead times until new projects can start. Additionally, new software takes time to build and ‘snag glitches’ out before going live. Finally, ‘new builds’ are expensive.
2. External System – Dedicated systems are available for servicing the UK’s SM&CR regulation. Some of these systems are extensions of software firms’ existing offering, and so risk having the same limitations as using existing in-house systems. However, some software firms have built completely new platforms. The advantages of a dedicated system are obvious. The downsides? Firms need to do their due diligence very carefully to make sure all the promised functionality actually exists. Also, firms should check the existing functionality is robust, in other words, that the software has a track record in the marketplace.
Find out about the software solution offered by Worksmart for the management of SM&CR.
