Adopt a compliance management system.
If you are a frequent reader of our blog, you know that we have emphasized that message over and over and over again. Today, we discuss the most important element of a compliance management system—a written compliance program.
The CFPB expects that each entity under its supervision will adopt a written, formal compliance program that guides compliance efforts of the company. At a minimum, the compliance program must include three components: 1) policies and procedures, 2) training, and 3) monitoring and corrective action. As the CFPB puts it, “A sound compliance program is essential to the efficient and successful operation of the supervised entity.”
So, the $64,000 question is, “What should a company’s compliance program look like?” Of course, the answer is that each company’s compliance program will be different. The compliance program needs to be tailored to the particular company, and it needs to be adopted and maintained in such a way that it is actually integrated into the day-to-day business operations of the company.
Over the last two years, a large segment of our law practice has been working with consumer finance companies to design and implement written compliance programs in response to the CFPB directive. To share several observations from our experience:
- It is not easy, but it is worth it. Frankly, for many finance companies, this has been a challenging undertaking because, as we have discussed in a previous post, the industry is still getting used to the idea of substantive Federal regulatory oversight. Preparing a proper written compliance program is time consuming and requires a great deal of attention from company decisionmakers. The process usually takes several months. But for those who have invested the time and effort, it has paid off—both in terms of protecting consumers from harm and being prepared for the CFPB.
- A compliance program locked in someone’s head is not good enough. When I ask finance companies about compliance statements and policies, I sometimes hear that seasoned employees know what to do so there is no need for written policies. Those days are over, if they ever existed. In the eyes of the CFPB, complying with Federal law is not optional, and many Federal laws require written policies. The bottom line is that it is impossible to have a compliance “program” without a written document.
- Even good companies have compliance problems. Almost all companies have compliance deficiencies—even those with strong compliance departments. The scope and severity of problems greatly varies from company to company. It is better to catch compliance issues internally rather than waiting for the CFPB, or a plaintiff’s lawyer, to uncover a problem.
- The benefits of preparing a compliance program are two-fold. The primary benefit is having a complete written statement of the compliance efforts of the company that can be used in training employees and establishing a companywide “culture of compliance.” But just as important, a secondary benefit is that the exercise of preparing a compliance program will act as an internal audit of company policies. When we work with a company on a compliance program, we start with the CFPB Supervision and Examination Manual and the questions that we know the CFPB will ask. The key in preparing the compliance program is to come up with right answers to those questions.
- Preparing the written compliance program is just the tip of the iceberg. Once a company finalizes the written compliance program, the work has only begun. The real objective is to use the compliance program, in the CFPB’s words, “as an essential source document that may serve as a training and reference tool for employees.” Companies must incorporate the compliance program into daily workings of the business. At a minimum, this means distributing the compliance program to employees and updating the program from time to time.
A good written compliance program will be the central piece of a company’s compliance management system.
If you do not have a written compliance program at your fingertips, your company is not prepared for the CFPB.