12 September

Why legal and compliance professionals make the best regulatory project managers.

Selecting the right project manager is always an important component in any successful project. For regulatory projects, however, being a competent project manager is only part of the required skill set.  While project managers do not always need to be technical subject matter experts, regulatory projects represent one of those situations where expertise in managing the legal and compliance risk is essential if the organisation is to achieve compliance with the new regulatory requirements.

Most large financial institutions are conglomerates of a number of different businesses separated by culture, risk levels, product complexity, client types, technology and geography.  Operating across international borders, which most banks do, exacerbates the regulatory and organisational complexity issues enormously.

A regulatory compliance project manager for a bank or other financial institution must therefore deal with a multitude of stakeholders that range from client facing staff to back office teams, and include numerous process owners and risk functions.  Each of these stakeholders will have their own resource constraints and solution preferences. Additionally, the impact of the regulatory change is likely to be felt differently across the various parts of the organisation. It is within this chorus of a notionally aligned, but frequently competing community, that a regulatory project manager will need to oversee the design and implementation of solutions for what can be remarkably complex legal and compliance requirements.

At every stage of the project, the legal and regulatory impact of decisions must be considered.

Clarify the changes required

Rarely are regulations black and white in their interpretation or application.Being an active participant in any industry consultation helps clarify the intended scope and application of new regulations. This preliminary work may also involve some back and forth with the relevant regulator and discussions with industry bodies and external counsel.Only a project manager who is familiar with the environment in which these discussions take place,together with the intended outcomes to be delivered by the regulatory change, will be able to develop the first-hand understanding of the intended application of the new regulations.  This in turn helps ensure that the new regulation is implemented only to the degree required to avoid costly over implementation and deliver the best outcomes for the project and the institution in question.

Impact assessment

How the new regulation will impact the organisation needs to be considered carefully before framing the scope of the project. There are frequently knock-on changes that need to be made in a range of systems and processes to accommodate the regulatory requirements. In some cases, especially where the industry has experienced several waves of regulatory reform, there may well be remediation work that needs to be done before work is started on accommodating the new regulations.

While the owners of the affected businesses and systems will generally be responsible for this work, they will rely heavily on their legal and compliance colleagues to advise them on the scope and requirements of the new regulations. This will be next to impossible unless the legal and compliance staff have already developed a first-hand understanding of the regulations in question.  Having a project manager with a similar professional background greatly facilitates this education process.

Develop a consensus on required changes

People generally don’t like change, especially where the change may impact the client experience, introduce new costs or reduce the scope of existing business practices.  Accordingly, there is often considerable push-back from the leaders of affected business units on the necessity of proposed changes to accommodate the new regulations, especially where there is some ambiguity as to the scope and application of the new regulation. Positions around these discussions can become quite entrenched as colleagues seek to exploit any lack of clarity to protect their revenue streams or market positions.  This push-back and the work involved to resolve it can endanger the project timeline unless the project manager has the technical credibility to carry the argument. Only a project manager that is literate in the regulatory detail and the underlying risks is able to do this.

Manage the project work to effect the changes

Any decent project manager is able to steer a project’s book of work to completion. However, the inter-dependant nature of many of the systems and processes within large financial institutions, and their tendency towards poor integration,present a challenge to project managers that is highly technical in both the interpretation and implementation of the regulatory change.  It is important for the project manager to understand how the various adjustments and changes to the project will impact compliance with the new regulation as well as continued compliance with existing regulations.

As with any project, time and cost constraints are crucial performance metrics.Time constraints are particularly important given that regulatory change will entail a date by which industry participants must be compliant.  It is these regulatory deadlines that create a moral hazard for project managers who have on one hand an immovable end-date by which the organisation must be compliant and on the other, a complex community of stakeholders with varying degrees of interest and involvement in the project. Project managers who are imbued with an appreciation of the importance for compliance with both the letter, as well as the spirit, of the regulation are able to resist the temptation of solutions that offer the appearance of compliance but do little to address the underlying goals and actual requirements of the regulation.

Post implementation

The go-live date for new regulations is naturally the focal point of any regulatory project, however achieving compliance on day-one is only half the battle.  Post implementation monitoring, along with the development and implementation of the associated staff training and reporting arrangements are just as important as the project itself.  All too often, a follow-up remediation project is required to address gaps in the initial project’s book of work that were missed or glossed over in the rush to be compliant by the go-live date. The book of work for these remediation projects also frequently includes work to complete the development and implementation of the compliance assurance framework. 

Only project managers who understand the scope and application of the new regulation, and the risks it is intended to address, are able to correctly separate innocuous process deficiencies from deficiencies that jeopardise compliance with the primary regulatory risk and the regulator’s expectations.

Project managers who do not understand the risk drivers of the regulation will invariably focus exclusively on delivering a project according to the common project performance metrics of time and budget. With any reasonably competent project manager this will deliver a project that performs well against those parameters but will not provide any certainty that the organisation is compliant with the spirit and the letter of the new regulation.  Project managers that have first-hand experience in managing legal and compliance risks and who view their primary role as achieving the management of those risks are best placed to ensure that regulatory projects remain focused on addressing those risks over the life of the project.