Dr Siân Lewin, the founder of Reg Doctor, spoke at today's conference in London hosted by Altus Consulting about the main problems that financial service firms have when managing regulatory changes.

Dr Lewin specialises in project and programme management and works with a variety of regulatory IT ('regtech') firms that are in the early stages of their lives. Her observations are recorded here in the form of an article.

When I was composing my PhD, in which I looked at the impact of regulatory change on regulated organisations such as banks, I spoke to my interviewees about what they did day by day to deal with regulatory change. These people tended to work in risk, finance and regulatory liaisons.

10 regulatory risk management practices

They came up with ten top activities: regulatory relationship management; internal education and awareness; lobbying; regulatory impact assessments; regulatory change management; the management of regulatory requests; business planning and mitigation; regulatory interpretation; the monitoring of regulatory developments; and the monitoring of regulatory compliance.

Their 'number one' priority was to manage their relationships with regulators. In decreasing order of priority after that, they cited internal education and awareness, the job of making sure that the rest of their organisations knew what was happening in terms of regulatory change. Next came lobbying, though that is not an activity that we overtly discuss a lot in the industry, but some firms certainly devote a lot of time and attention to responding to consultation papers and participating in industry working groups. This type of lobbying is really to do with (a) understanding the content of the regulation, (b) making it workable and correct and maybe (c) starting to think about some of the unintended consequences of some of the proposed changes.

Regulatory impact assessments are next, and require you not only to understanding the changes you need to make to your organisation but also (particularly in the realm of prudential regulation) to understand the financial effect on your company's balance sheet, the better to mitigate it later on, which again is one of the other activities (see business planning and mitigation, below).

Regulatory change management is another one. This encompasses all the programmatic change that you need to make to your organisation's systems, process, policy, data and structure. It penetrates every single layer of the organisation.

Managing regulatory requests is next on the list of priorities. Requests from the regulators have increased significantly since the financial crisis began. Not only has automated regulatory reporting gone up exponentially; so have ad hoc requests for data and information.

Next comes business planning and mitigation (see above) and then regulatory interpretation - this takes up a huge amount of time, sometimes because the rules are written as principles and you therefore have to go through the exercise of making sense of them for yourself, sometimes because the rules are not clear, sometimes because the rules continue to change. This is therefore a big problem.

Then there is the job of understanding the changes that are on the horizon. Again, the monitoring of developments is a full-time job for not just one person but maybe for 20.

At the bottom comes the job of monitoring regulatory compliance. This is last on the list but its importance should not be minimised.

Problems to be overcome

My respondents mentioned several challenges that emerged when they were conducting these activities. Top of their list came the idea of regulatory uncertainty. Certainly after the financial crisis began, nobody knew the direction in which the regulators were going to go. There were different types of uncertainty associated with regulatory change. In what direction was the change going to go? What were the new rules going to be? What effect were those rules going to have on organisations? What structures were they going to have to put in place?

My respondents told me that they were no longer able to speak to the regulator ex ante about the types of 'solution' they wanted to implement, so they had to second-guess the regulators' expecations when deciding on the right ones to put in place.

The volume and scope of regulatory change has been growing enormously and I think that it is worth pointing out that the scope in particular has made this problematic. Regulation now touches more parts of an organisation than it ever has before and it is therefore a pretty impossible task for one person to understand it.

Internally, firms have capacity and resource constraints, not only in terms of the number of people but in terms of the expertise they have in being able to understand regulation. There is also an element of 'change fatigue.' If it's all "change, change, change" at a firm, people burn out and it becomes really challenging even to get the smallest thing done. Then there are the limitations of legacy systems and data. Large financial service firms tend to grow organically and their systems do so as well. Data is fragmented in lots of different places and does not necessarily always 'reconcile' in the same way. Finance and risk data, viewed through two very different lenses, seem very different from each other.

Then there is a challenge that should not be underestimated: the cultural and human factor at work in a large organisation. Different parts of an organisation have different regulatory priorities. The revenue-making part of the business might be keen to be compliant but at the lowest cost. People in risk and compliance are the ones who have to face the regulator more regularly and therefore are more interested in being able to demonstrate their firm's compliance and its serious commitment to regulatory change. Firms have to resolve these internal conflicts when undergoing regulatory change.

* Dr Siân Lewin can be reached at sian@regdoctor.co.uk