We’ve talked a lot about the regulatory requirements underpinning fit and proper testing and the considerations that those performing fit and proper assessments need to bear in mind. This is a critical element. No approach to fit and proper testing can hope to meet its objectives without a proper understanding of what the law actually requires. At the same time, however, effective and consistent fit and proper testing can only be achieved when an accurate theoretical understanding is implemented within a well-designed and implemented practical framework.
There are three basic elements which are required in order to deliver such a framework:
- A standardised approach,
- An open culture, and
- A commitment to continuous improvement.
We’ll say a bit more about each.
A standardised approach
The first element demands a standardised approach founded on a commitment to training. Only then do assessors understand what is required of them and can consistent and justifiable results be delivered.
The types of questions firms should ask themselves when designing a standardised approach to fit and proper testing include:
- Who will oversee the entire process?
- How do we identify who is in-scope?
- Do specific roles create greater risks (for example, sales roles)?
- Who will perform fit and proper testing?
- What is the process for reporting Certification Risks and Certification Issues?
- What are the threshold for determining that fit and proper testing is required in any given circumstance?
- What are the pass (or fail) criteria for the fit and proper assessment?
- What evidence is to be gathered with respect to each type of fit and proper assessment?
- What kind of screening checks will be conducted in any given scenario?
- What kind of attestations or declarations are staff required to make (and at what intervals)?
- What happens if evidence is not available (or forthcoming) or can’t be verified?
- How will (or to what extent can) the firm verify each source of information?
- How is information to be assessed (particularly with respect to its relevance and ‘seriousness’)?
- How will the firm respond if an issue is identified with a member of staff?
- How will the firm ‘learn lessons’ from the issues that arise? Some firms maintain a ‘fit and proper’ issues log.
- How will ‘fit and proper’ decisions be appealed and reviewed?
- How will fit and proper testing dovetail with existing HR and performance management processes?
- Where will everything be stored and recorded?
- This is particularly important as we move towards the new normal of hybrid working. It won’t be enough simply to have staff saving fitness and propriety information down on their c: drives.
In terms of useful, practical, advice, the FCA has published, on a webpage[1], a table setting out positive and negative indicators to illustrate how firms should demonstrate that they are making regular, thorough and consistent assessments of the fitness and propriety of senior managers and certification staff. It is helpful to bear these factors in mind when designing any firm-wide approach to fit and proper testing. In summary these factors are:
[1] https://www.fca.org.uk/firms/senior-managers-certification-regime/solo-regulated-firms#revisions
| Positive Indicators | Negative Indicators |
|---|---|
| Fitness and propriety checks identify new issues with staff – some fail. | Fitness and propriety checks identify nothing new; a ‘rubber stamp’ exercise. |
| Relevant Senior Managers actively oversee the fitness and propriety process and ensure appropriate reporting. | Relevant Senior Managers have delegated the fitness and propriety process and cannot demonstrate adequate oversight and reporting. |
| Competence assessment demonstrates that thought has been given to each specific role (including managers). | Competence assessment is perfunctory and/or cannot be evidenced as being objective. |
| Development plans are put in place as a result of fitness and propriety assessments. | No development needs are identified. |
| Managers are adequately trained in the firm’s approach to fitness and propriety and understand what is expected of them. | Managers are poorly trained and/or have inadequate guidance as to what is expected of them in terms of fitness and propriety. |
| A detailed fitness and propriety process has been introduced and integrated into existing HR/performance management processes (it covers what happens if someone fails fitness and propriety). | Fitness and propriety is considered (without review) to already be covered by pre-existing HR/performance management processes and/or there is no process for dealing with someone who fails fitness and propriety. |
| Fitness and propriety – which include senior managers - are convened to consider marginal cases. | Process for considering marginal fitness and propriety cases either does not exist or is rarely convened. |
| Firm has appropriate criteria and a robust process for identifying certification staff on an ongoing basis. | Identification of certification population is ad hoc and/or a burdensome manual process. |
| Regulatory references disclose misconduct/relevant concerns and are produced in a timely manner. | Regulatory references fail to provide the necessary information and/or are not available promptly. |
A standardised approach requires all staff involved in the process to be provided with appropriate training. Broadly, this should:
- Firstly, ensure that individuals who are actually performing fit and proper testing have the necessary training and ongoing support. This should extend beyond simply ‘how to conduct a fit and proper assessment’ to include ‘how to discuss the outcome of a fit and proper assessment’ with the person who has been assessed.
- Secondly, help all staff (and particularly line managers) understand how to identify Certification Risks and Certification Issues and what to do once either have been identified.
- Finally, ensure that all staff understand what is required of them when they are being assessed – particularly with respect to the different types of information they will be required to provide and the declarations they will have to make. It almost goes without saying, but it is nonetheless true to say that it is actually in a candidate’s best interest to help facilitate fit and proper due diligence by his/her employer.
An open culture
An open culture which accepts that failure can happen is another critical element in building a framework within which fit and proper testing can be successfully implemented. Only when firms accept that failure can happen is there any real prospect that staff will feel comfortable reporting the failures the inevitably do occur. Given that staff are, in reality, likely to be the primary source of information with respect to Certification Risks and Certification Issues impacting the firm – this is a critical line of communication to maintain. To paraphrase Donald Rumsfeld, when it comes to understanding the Certification Risks and Certification Issues, it must surely better to have a “known known”, rather than an “known unknown”.
A commitment to continuous improvement
A commitment to continuous improvement based on ‘lessons learned’ is a third critical element in building a framework within which fit and proper testing can be successfully implemented. Continuous improvement is often based around a four-step ‘closed loop’ methodology, involving:
- IDENTIFYING – opportunities for improvement.
- PLANNING – how current processes can be improved.
- EXECUTING – the planned changes.
- REVIEWING – the impact that planned changes have brought.
