Risk and compliance

These may be the result of employee misconduct or error, malicious external factors such as cyber-attacks, regulatory intervention in areas such as financial crime, or fast-evolving ESG requirements.  

We help our clients identify, manage, and mitigate these risks. Having effective and well-governed risk and compliance management arrangements in place is essential to operating a business successfully. Those arrangements include: 

• Board and executive oversight of risk and compliance 
• Risk and compliance framework, appetite, and strategy 
• Risk and compliance taxonomy, controls, and assessment process 
• “Three lines of defense” (3LoD) 
• Obligation management arrangements across jurisdictions 
• Operational resilience (cyber risk, data privacy, outsourcing/supplier management) frameworks 
• Front office and first-line supervisory frameworks 
• Horizon scanning for risks, regulatory reform, change, and shifting expectations. 
• Training in operational resilience and control 
• Financial crime compliance and risk management

Representative matters 

Consulting assisted a global asset manager in strengthening its enterprise risk management (ERM) framework for a regulatory review. Our efforts involved updating policies, procedures, reporting, and key performance indicators, focusing on the second line of defense and operational risks. The enhancements to the ERM and three lines of defense model improved the firm's risk management, accountability, governance, and overall resilience.

Consulting by A&O Shearman was tasked with enhancing a major European asset manager's AML and sanctions compliance after regulatory scrutiny revealed deficiencies. Our role involved conducting an assessment and root cause analysis, followed by the creation and application of new compliance frameworks. We developed a strategic multi-year plan tailored to the client's specific risks and responsibilities, updated policies and procedures, provided training, evaluated systems and controls, and communicated with regulators regarding the remediation's progress and results.

Consulting streamlined a global asset manager's approach to regulatory compliance across ten jurisdictions, advising on and implementing a Regtech solution for obligations management, horizon scanning, and compliance monitoring. Our team developed an extensive obligations register, aligning over 20 regulations with the client's internal risk framework and operational policies, identifying areas for enhancement. We continue to offer support in compliance assurance, monitoring, and remediation guidance.

Consulting enhanced a premier financial services firm's cyber resilience by aligning it with regulatory standards and best practices. Our thorough examination covered the firm's cyber risk governance, management, reporting, operational resilience, and testing procedures. We also conducted qualitative scenario analysis to gauge the impact of cyber incidents on essential business services and clientele. Our insights led to a strategic roadmap with prioritized recommendations to enhance the firm's cyber resilience and preparedness.

Consulting assisted a global bank in establishing an extensive first-line risk and control framework for its global markets division, encompassing all asset classes and regions. Our team collaborated with top-level stakeholders, performed a gap analysis, and crafted policies and procedures. We also developed and disseminated training and communication resources, oversaw quality assurance, and managed the project. Our efforts led to a strengthened risk culture, better regulatory compliance, and diminished operational risks for the client. We continue to offer support in monitoring the framework's effectiveness and managing necessary remediations.