ARROW is the framework used by the FSA to carry out risk-based regulation (it stands for ‘advanced, risk-responsive operating framework’). It was first introduced in January 2000 and has been used more recently by the FSA to help introduce the FSA’s principles-based approach and allow it to focus its resources where necessary.

The FSA uses ARROW to identify and measure the risks that firms potentially pose to the FSA’s statutory objectives and to mitigate and monitor those risks on an ongoing basis. The ARROW framework has two main components: ARROW firms, under which individual firms are assessed (sometimes referred to as vertical supervision); and ARROW themes, under which the FSA reviews a particular theme eg payment protection insurance (PPI) (sometimes referred to as horizontal supervision). This newsletter focuses on the former.

What is an ARROW visit?

The FSA conducts a preliminary assessment of every firm that it regulates and assigns each a risk rating. A firm that is considered low-risk will rarely be assessed under ARROW. All other firms will usually be assessed every one to four years. The FSA may also conduct a smaller review between assessments to monitor progress within the risk mitigation programme (RMP) that is developed from a firm’s risk assessment and is designed to address issues the FSA has identified during a visit.

ARROW visits serve a number of goals for the FSA, including fostering better communication with firms, managing risk with greater efficiency and effectiveness, 2007and encouraging a consistent FSA response to risk. The ARROW process also helps the FSA to compare areas, allowing it to devote its resources to those areas of greater risk.

Procedure for visits

Before the FSA’s on-site visit, a firm will receive an information request from the FSA. This may include requests for the firm’s current business plans and/or strategy documents; compliance and internal audit plans and reports; group structure and organisation charts; financial statements; board minutes; and risk management information. The documents requested will usually provide firms with an indication of the FSA’s likely focus during the ARROW visit.

An interview schedule will also be arranged in advance of the visit. The FSA will usually specify who it wishes to meet and the topics to be discussed, again providing a strong indication of the areas in which it is interested. Interviews will generally be with senior management and those operating in the firm’s control-led functions. It is important to ensure that relevant people are able to attend these interviews and discussions should take place with the FSA if necessary to ensure that their interview schedule takes into account everyone’s availability.

Areas that the FSA is likely to focus on

It is possible to gain some insight into the FSA’s priorities and areas of concern by keeping an eye on its website, reading the speeches of key personnel and analysing the ‘Dear CEO’ letters (in the library/communication documents section). Topics that the FSA will almost certainly want to cover include: roles and responsibilities; corporate governance structure; risk management; capital and liquidity; outsourcing arrangements; business continuity planning; compliance functions; audit functions; training and competence; focus on customers (tying in with the FSA’s ‘Treating customers fairly’ initiative), products and markets; financial controls; and client money.

Firm-specific areas of focus

Predicting these areas may be a little more difficult but some indications can be obtained by looking at the outcome of any previous ARROW visit and any matters that may in the meantime have been discussed with the FSA supervision team. If any issues were raised on the RMP, they will almost certainly be examined on the ARROW visit. Similarly, if the firm has previously been subject to enforcement action, the FSA will be keen to ensure that all issues have been addressed appropriately.

Before the visit: what can firms do?

Advance preparation is key to a successful ARROW visit. The FSA expects firms to prepare and consideration should be given to setting up a team to deal with the ARROW process to ensure that it runs smoothly.

The team should meet in advance to share ideas and discuss themes. The firm should also consider communicating with the FSA before the visit to gain a better understanding of its anticipated areas of focus. It is important to remember that the ARROW process is meant to be co-operative and not adversarial.

The firm will need to respond to the FSA’s information request. It may also consider creating short summaries that can be given to the FSA during the visit, synthesising and explaining the information provided. Individuals who are to be interviewed by the FSA should ensure that they are fully prepared for all anticipated questions and should think about the documents they may want to have with them, such as their role profile and an organisation chart, to help discuss their roles within the firm.

During the visit: what can firms do?

Consider whether note-takers should attend the interviews; it may be useful to have a record of what was said from the point of view of the firm in case there are any issues at a later date. Notes may also help inform those still to be interviewed of the FSA’s areas of focus. A team meeting at the end of each day may also be useful. Finally, before the visit ends, try to get some informal feedback from the FSA on how it went.

After the visit: what can firms do?

A formal close-out session will take place immediately following the visit or, for larger firms, as soon as practicable afterwards. This enables the FSA to share significant findings from the risk assessment with the firm before the RMP is finalised. Use this opportunity to address any issues you wish to raise and to put forward the firm’s perspective if it differs from the FSA’s findings.

After the visit, the FSA team will present its notes to the ARROW review committee. The FSA will then send the firm’s board of directors a letter containing key findings and the FSA’s view of the main risks and controls within the firm as well as the RMP. The RMP will set out issues identified, actions to be taken and the intended outcome, along with a timetable for action. The firm will generally have two weeks to respond confirming that it intends to follow the RMP. If the firm has any issues with the RMP, they should be discussed with the firm’s supervisor. If the firm is not satisfied with the response of the supervisor it can contact the supervisor’s manager or head of department. The FSA will continue to monitor progress under the RMP and will close the issue if, in its view, the firm has undertaken an action and the outcome has been achieved. If the firm takes no or inadequate action, the FSA may consider using other regulatory tools such as a skilled person report under section 166 of the Financial Services and Markets Act 2000 (FSMA) or a formal request under section 165 of FSMA. It is important that the firm addresses the issues in the RMP appropriately and maintains an ongoing dialogue with the FSA to ensure that it maintains, or achieves, a healthy regulatory relationship with the FSA.