A recently published FSA Newsletter contained an article on recent observations from ARROW risk assessments. Although the Newsletter is targeted at ‘smaller wholesale insurance intermediaries’ the observations can be equally applicable to other sectors and to firms that fall outside the remit of ARROW.
The comment is made that the FSA expects senior management to have regard to relevancy as part of their ‘business as usual’ activity.
Items covered include data security and the need to consider what is on the hard drives of photocopiers and scanner devices; lack of proper controls in business transformation scenarios; business continuity (and we are warned that “this remains an area of focus for supervisors”); and the need to have persons of good repute. The issue here is not that firms are not carrying out background checks – they are – but rather that they are not routinely including this requirement within the scope of their HR policies and procedures.
