One of the less frequently discussed requirements of the CFBP is that companies have in place a Compliance Management System. This has resulted in a lot of concern and confusion about what exactly they are requiring. Typically when discussions involve the term system, most often it is a discussion about technology. Yet it is commonly assumed that this is not a requirement to implement an entire new technology platform focused on meeting all the regulations. In fact, not all the regulations have been finalized. Therefore even though there is great concern about making sure the requirements are met, this requirement can’t be about technology. So what in fact is this requirement all about? Let’s break it down:
What is a system?
When it comes to understanding what the CFPB means when it requires a “management system” lenders must remember that the term system is far broader that just a technology platform. A system is a set of principles according to which something is done. In the business world it is the set of values and possibly a mission statement under which the business operates. Imbedded in this set of principles are the goals and objectives of the company. These typically revolve around the expected results of the company and generally focus on three sets of stakeholders. These include shareholders who are expecting a good return on their investment, customers who expect that the products and/or services promised will be produced and the members of the organization. Turning these principles into the expected results is the “system” under which the company operates.
While some business systems are relatively simplistic, most are very complex, having numerous functions operating together to produce the desired result. This complexity is addressed through operational functions such as marketing, production, financial management, risk management and regulatory compliance. In order to ensure that all functions are working in an effective manner, a coordinated monitoring and feedback system is put in place. Part of this system’s management responsibility is developing the goals and objectives for the organization. Flowing from these goals and objectives are the development of which products and/or services will be produced.
Designing the product/service that the company will produce is typically the responsibility of individuals with significant knowledge about the company’s goals and how such products/services are generated. In most manufacturing companies this is the work of the engineering team. In mortgage banking however, we look to credit policy and secondary marketing experts for this design work. Their work results in the specifications of what is going to be produced and is most frequently seen as policy statements and requirements.
Once the product and/or service policy has been designed, the operational units must produce the corresponding operational functions. For example, if the product policy statement contains requirements which include ensuring the integrity of the data, then the operational staff must incorporate a process to make this happen and document it through a procedure that is given to the operations staff to follow. An integral part of this development process is the identification, selection and implementation of the technology that will be used in conjunction with the production of the products.
In both of the systems involved in mortgage lending (production and servicing), there are numerous overlapping procedures that must also be incorporated into the final product. Operation management must ensure that these overlaps are clarified and consistent among all staff and are grounded in the organization’s policies and procedures. In other words, can management demonstrate how a policy is actually implemented in the procedures across all operational units used by the company? Among these overlapping functions are risk, accounting and regulatory compliance. Because of all these overlapping systems, mortgage lending and servicing is an extremely complex business and requires highly complex systems to make it work. It is also why a management system is an essential part of the business.
Purpose of a management system
All business have some type of management system. They can be as simplistic as having one person deciding the goals of the business and then determining how those goals are to be met. This individual must also determine what risks the organization faces in meeting these objectives and how these risks will be addressed as well as monitor the output of the operational processes and direct any changes that are necessary to meet the goals and objectives. However in a business as complex as mortgage lending, it is impossible for one individual to accomplish this and most frequently there are several key members in the organization with specific responsibilities.
While not always recognized as a “system”, the interaction between these individuals is the leadership that successful companies require. If one of the functions within a leadership system overwhelms all other functions the result is typically an organization that fails to meet its overriding responsibilities for its shareholders, customers, regulators and/or employees.
Elements of a management system
Management systems have three basic responsibilities that, when effectively executed, assure that the founding principles are followed and goals and objectives met. These functions include governance, risk and control.
Governance refers to the system of structures, duties, and support by which corporations are directed and controlled. Governance provides the structure through which corporations set and pursue their objectives and monitor the actions, policies and decisions of the corporation. In other words, governance involves determining what the company will produce and putting in place all the elements that will ensure the production. This includes oversight of all the processes, people and technology and all facets of these operational requirements.
The second is risk management. Risk is commonly defined as the chance of something happening that will have an impact on the objectives of the company. Every organization contains numerous risks and a management system must have a means of identifying, evaluating and determining how these risks will be addressed. This includes ensuring that there are coordinated, delegated resources to minimize, monitor and control these risks. One such risk is, of course, complying with all regulatory requirements. This includes not just those related specifically to consumers, but comprehensive regulatory risks as well.