When looking at reportable events to the FCA, it is clear that some of the most common root causes of problems are software or application issues, cyber-attacks and third-party failures. All of these play into the operational resilience theme and our understanding of the impact tolerance of internal and external business continuity plans. This is why we need a holistic approach to risk that views operational efficiency from an operational resilience standpoint.

The governance of tax and cost efficiency

Developing this holistic theme, Aaron reflected on the growing requirement for more substance around governance (driven by industry initiatives, such as the Bank of Ireland’s CP86 consultation on fund management effectiveness). With the increasing use of sub-funds, and different domiciles using evermore-complex fund structures to compete with each other, there is an urgent need to understand and manage the relationships between different service providers to reduce friction in the investment management process and understand the operational governance of this.

This is particularly important when looking for efficiencies in operational  and fund management costs. For instance, it is all too easy to assume that low cost trackers are good value; but what are the hidden costs in terms of additional risk? For example, lower cost might mean  reduced oversight, the selection of alternative, cheaper, benchmarks and the use of securities lending to eke out additional returns. We also need to look at whether managers are able to represent the interests of all their investors when voting on corporate actions and how many allow split voting, for example.

Aaron gave the example of how good governance can improve efficiency by looking at withholding tax. There is a lot of talk of cost transparency – but less attention paid to tax transparency. As a result, tax-exempt investors in opaque fund structures, that use tax treaty rates, often end up paying unnecessary withholding tax that they can’t reclaim. This tax drag can add around 40 bps of costs to a standard global equity fund, which has a long-term effect on performance. Yet tax transparent fund structures, such as the Common Contractual Fund in Ireland, which has been available for over 10 years, make this an avoidable cost. Rather than leaving this money ‘on the table’, fund managers have a fiduciary duty to ensure they are using tax efficient fund structures that provide ‘see through’ to the underlying investor for tax purposes.

Improving consistency and best practice
 

Returning to the governance issue, Alain Mandy said that he had seen a big shift in recent years, particularly in Ireland and Luxembourg, on the topic of best practice in operational governance. There are now greater levels of consistency between domiciles and a heightened emphasis on improving risk management, fund compliance and oversight, as well as tackling the issue of cyber security. He made the point that regulators no longer expect you to have just a contract and service level agreement with third party providers. They also want you to demonstrate that you are using ongoing monitoring and key performance indicators to judge vendor performance. They expect to see a risk-based approach to such monitoring. This risk-based approach can prove a challenge because everyone has a different risk template. However, Alain mentioned that ICI Global was working with distributors and vendors to develop a standardised set of best practice due diligence questions for the industry. Their aim is to create a comprehensive questionnaire, which distributors and platforms could complete once a year and then make available to any fund management company that asks for the information."

Technology as both an enabler and a risk

The speakers then reflected on how tech is making monitoring easier in certain circumstances and improving transparency. Tech has the advantage of providing greater insights – particularly through intelligent dashboards – without companies having to add more people to the task. This is making it easier to comply with regulators requirements for management companies and fund promoters to perform due diligence on and maintain oversight of service providers.

However, tech is also increasing vulnerability to cyber attacks. This means the risks you and your investors face come not just from failures of internal operations or third parties but also from malicious actors outside your control. As Mario pointed out, testing business resilience requires companies to engage in real world scenario planning to test all functions against threats, particularly cyber related.

These tests can’t be a simple check box routine and need to be conducted by independent experts.  Good practice would be to  involve second tier management, not just senior executives, to ensure the whole organisation can cope when faced with a catastrophic event. The process should include measuring management responses and subsequent communications to ensure you can provide regulators with clear evidence not just of your ability to respond to threats but your proactive work to prevent them. 

Please contact us if you have any questions about any of these topics or would like to know how AMX can help you improve governance and efficiency.