Managing Compliance Risk and Breaches
Domain 5 tests how firms identify and manage compliance risk, and how they detect, escalate, report and remediate breaches.
Risk-based compliance
Compliance risk is the risk of regulatory sanction, financial loss or reputational damage from failure to comply. A risk assessment maps inherent risk against control effectiveness to give residual risk, scored on likelihood and impact. Risk appetite statements set tolerances; key risk indicators give early warning; the risk register records owners and actions. Monitoring plans are prioritised by risk, with defined scope, frequency and testing method. Controls may be preventive, detective or directive.
Breach management
The lifecycle is: identify and log, assess materiality, contain, find the root cause, remediate, notify and learn. Materiality considers the number of clients, financial loss, duration, root cause, whether the breach is systemic and whether it indicates a control failure. Regulatory notification is time-sensitive: in the UK, SUP 15.3 requires notification of significant breaches as soon as reasonably practicable, and Principle 11 requires disclosure of anything the regulator would expect to be told. Do not wait for full quantification or a completed remediation plan where the breach is plainly significant. Breach registers and trend analysis support governance and should be reported to the board.
Accountability and remediation
Under the Senior Managers and Certification Regime, individual conduct rules apply and breaches can affect fitness and propriety, references and certification. Remediation may include client redress, control redesign, training, disciplinary action and independent review; the regulator can require a skilled person report. Whistleblowing channels must be effective and protected.
Worked example
A firm finds it has overcharged management fees to 3,000 clients for two years after a pricing file change was not tested. It should stop the overcharge immediately, quantify and begin client redress, notify the regulator promptly rather than waiting for full root-cause analysis, investigate why the change bypassed testing and monitoring, strengthen change control, and report to the board and risk committee. Records of decisions and rationale matter if the regulator later asks.
Traps that cost marks
Waiting for certainty before notifying; treating the breach as a one-off without root cause; poor record keeping of decisions; confusing remediation with discipline; forgetting client notification and redress.