There has been increasing regulatory scrutiny about the trend of outsourcing the chief compliance officer (CCO) function to third parties. Late last year, the SEC published findings of approximately 20 examinations as part of an Outsourced CCO Initiative that focused on SECregistered investment advisers that outsource their CCOs to unaffiliated third parties.1
THE SEC INITIATIVE RE: OUTSOURCED CCOS
The initiative was conducted by the Office of Compliance Inspections and Examinations (OCIE) of the SEC.
In the SEC’s Risk Alert, the staff shared certain observations regarding effective outsourced CCOs and restated their first principles and long-standing guidance on the role and importance of a CCO. The staff reiterated that (i) an adviser’s CCO should be “competent and knowledgeable regarding the Advisers Act and…empowered with the full responsibility and authority within the organization to compel others to adhere to the compliance policies and procedures” (citing the Adopting Release for Rule 206(4)-7 of the Advisers Act), and (ii) the CCO “should have a position of sufficient seniority and authority to compel others to adhere to the compliance policies and procedures”2 (Adopting Release, Sections II.C.1).
During the examinations, the staff focused on registrants that had outsourced the CCO function and assessed the effectiveness of outsourced CCOs by evaluating a number of factors, including whether:
• The CCO was administering a compliance environment that addressed and supported the goals of the Advisers Act (compliance risks were appropriately identified, mitigated, and managed);
• The compliance program was reasonably designed to prevent, detect, and address violations of the Advisers Act, Investment Company Act, and other federal securities laws, as applicable;
• The compliance program supported open communication between service providers and those with compliance oversight responsibilities;
• The compliance program appeared to be proactive rather than reactive;
• The CCO appeared to have sufficient authority to influence adherence to the registrant’s compliance policies and procedures, as adopted; and
• Compliance appeared to be an important part of the registrant’s culture.
In reviewing these factors, the staff noticed instances where certain service providers did not have adequate resources to perform compliance duties for their clients, “especially given the disparate and dispersed nature of the registrants that the CCO serviced.” In addition, there were concerns expressed about the nature of the annual reviews performed by outsourced CCOs, especially given that some of the registrants had the ability to “selectively provide records to the outsourced CCO that … may have affected the accuracy of these registrants’ annual reviews.”3
A. MEANINGFUL RISK ASSESSMENTS
Compliance and risk have been increasingly identified as critical components of an effective enterprise risk management program. In the Adopting Release for 206(4)-7 and 38(a) (1),4 the staff observed that “an effective compliance program generally relies upon, among other things, the 'correct identification of a registrant’s risks in light of its business, operations, conflicts, and other compliance factors.’” Whether because of resource or access constraints, the staff observed that certain CCOs relied upon standardized or generic checklists that did not appear to “fully capture the business models, practices, strategies, and compliance risks that were applicable to the registrant.”5 In certain cases, the risks described by the registrant’s principles were different from the risks described by the outsourced CCO. The result was predictable: such registrants did not have the policies, procedures, and/or disclosures in place to adequately address certain risks.
B. COMPLIANCE POLICIES AND PROCEDURES
During the examinations, the staff identified instances of compliance policies and procedures that were not tailored to the registrant’s businesses or practices. In certain instances, outsourced CCO templates resulted in critical risks not being identified, inconsistent policies in relation to the advisers’ businesses and operations, and the failure to perform critical control procedures. Rule 206(4)-7 requires that the CCO certify that an adviser has adopted and implemented policies and procedures that are designed to detect and prevent violations of law. Clearly, using a service provider’s unmodified, “off-the-shelf” templates will rarely result in a system of policies, procedures, controls, and risk assessments tailored to the business practices of a specific adviser.6
C. ANNUAL REVIEW OF THE COMPLIANCE PROGRAMS
The staff’s harshest criticism concerned the annual review of the Compliance Programs, which is a central element of Rule 206(4)-7. The staff observed that “certain outsourced CCOs infrequently visited registrants’ offices and conducted only limited reviews of documents or training on compliance-related matters while on-site.” In addition, the staff noted, “such CCOs had limited visibility and prominence within the registrant’s organization to, among other things, improve adherence to compliance with policies and procedures.” In sum, the staff concluded that “advisers and funds with outsourced CCOs should review their business practices … to determine whether these practices comport with their responsibilities as set forth in the Compliance Rules.”
CCO OUTSOURCING AND SUPPORT
There are approximately 11,000 investment advisers registered with the Securities and Exchange Commission, and clearly these advisers differ greatly in terms of their investment strategies, types and number of clients, the amounts of assets under management, and internal resources. Accordingly, the staff continues to acknowledge that a “one-size-fits-all” approach would not be effective.7 Still, the staff’s recent Risk Alert has drawn attention to the fact that there may be qualitative distinctions between internally managed compliance programs utilizing third-party service providers to assist an internal compliance team and outsourcing the compliance function entirely.
The Adopting Release containing Rule 206(4)-7 clearly highlights the SEC’s expectation that a CCO (i) interact frequently with the adviser’s personnel, (ii) be intimately involved in or familiar with the operations of the adviser, and (iii) has the authority and expertise to effectively perform his or her compliance responsibilities. This Risk Alert expresses the SEC’s concerns associated with outsourcing the CCO function and the ability of such outsourced resources to meet the requirements of the Advisers Act. The staff’s concerns generally appear to be addressed when outsourced CCOs (i) frequently and personally interacted with fund and advisory employees, (ii) had sufficient resources to perform their duties, and (iii) were empowered to independently obtain records required for a meaningful and accurate annual review.8
OUTSOURCING AND SUPPORT: A WAY FORWARD
In light of the foregoing concerns and observations, one approach would be to couple an internal CCO or compliance team with an expert third-party law firm or consultant that can provide the CCO much-needed support. Internal CCOs with the authority and expertise to perform their responsibilities would typically possess the intimate knowledge of the firm’s business and operations required to effectively identify risks and manage compliance programs. However, without experienced support, CCOs typically find it difficult to effectively and consistently perform all of their compliance responsibilities.
Below is a summary of services that can be provided to support an internal compliance team, including the CCO:
• Providing independent, targeted reviews of critical areas of concern, such as new business initiatives or areas identified as requiring remediation;
• Assisting the CCO/CRO in developing risk assessments in light of regulatory guidance and industry standards;
• Working with operational heads, compliance, and legal in developing policies and supervisory guidelines that are tailored to the actual business practices of the firm;
• Using a provider as an “on-call” team member to provide regulatory guidance on “hot-button” issues, or complex regulatory matters;
• Providing independent training on key regulatory matters for employees, senior management, and board members;
• Providing pre-exam and on-site examination support in connection with regulatory examinations;
• Providing critical legal and compliance advice in connection with the launch of a new mutual or private fund;
• Providing critical interpretative guidance and/or assistance with implementing AML programs; and
• Conducting independent “mock” SEC exams or similar reviews.
These services can be an indispensable part of an effective compliance program. In utilizing the foregoing approach in conjunction with one or more of these services, CCOs can help foster a strong culture of compliance within their firms and avoid the deficiencies identified by the staff in the Risk Alert.
-----------------------------------------------
1 National Exam Program Risk Alert, Vol. V, Issue 1, November 9, 2015 (Risk Alert), p. 1.
2 See SEC, Compliance Programs of Investment Companies and Investment Advisers, Release Nos. IA-2204 and IC-26299 (December 17, 2003) ("Adopting Release").
3 Risk Alert, p. 4.
4 See Adopting Release.
5 Risk Alert, p. 4.
6 The staff noted, “Some standardized risk checklists utilized by outsourced CCOs were generic and did not appear to fully capture the business models, practices, strategies, and compliance risks that were applicable to the registrant.” Risk Alert, p. 4
7 The staff, in its concluding remarks, stated that “each registrant is ultimately responsible for adopting and implementing an effective compliance program and is accountable for its own deficiencies.” Accordingly, they should “evaluate whether their business and compliance risks have been appropriately identified, their policies appropriately tailored in light of their business and associated risks.” Risk Alert, p. 7.
8 Risk Alert, p. 3.
