Greater tightening of regulations in the financial services sector is leading to increased demand for compliance and risk management professionals. Jim Woods, risk and regulatory services leader, APAC, at PwC, outlines the opportunities in the field.
How has the landscape for risk and regulatory services changed globally and in Hong Kong?
The greater importance of technology has led to much more serious issues concerning data privacy and cybersecurity. Companies, particularly those in financial services, face increased regulation – this is to a large extent a result of the global financial crisis. The power and speed of media – particularly social media – has also changed things. for businesses. In the past, a lapse of judgment or a performance issue for, say, a car manufacturer could be more easily contained. But now it can spread like wildfire. A dissatisfied customer can write something on Facebook and it can immediately go viral.
It’s also a more litigious world, with more onus on directors personally. This is driving boards to put more emphasis on corporate governance, due diligence and so on. In Hong Kong, regulatory authorities have introduced rules that require more accountability. Even if you don’t get fined, you have to think of reputational damage. Boards are consequently more cognisant of the need for better risk management.
There has been a massive wave of new legislation in the wake of the global financial crisis, particularly around anti-money laundering and know your customer, as well as US regulations that have a global impact, such as FATCA, and Common Reporting Standards (CRS). In Hong Kong, new corporate governance rules require greater focus on the establishment of a proper internal audit function and more diligence around risk management. Soon, all listed companies in Hong Kong will have to prepare an annual environmental, social and governance (ESG) report. The need to maintain strong controls over cybersecurity and data privacy is also requiring greater emphasis and management focus.
Anti-corruption measures, especially for companies with a China focus, are another area. Corruption has both risk and regulatory aspects. From a regulatory perspective we need to think about corporate governance – do you have proper segregation of duties and a policy on gifts and donations, for example? There is often a perception that doing business in Asia carries a higher level of inherent business risk in this regard, and the establishment of a strong anti-fraud framework, and internal control policies and procedures, is critical.
There is a reduced level of confidence generally because of emerging crises, health scares, terrorism and other shocks to the system. It’s a more uncertain world, and companies and people generally are demanding more confidence and trust. That, in turn, is driving increased demand for risk and regulatory services.
How are businesses responding to these changes in terms of recruitment?
There is now a greater need for people with international experience and global awareness, as well as strong business acumen. Because of this, more companies now have global mobility programmes. Basic technology skills are also now a must. Independent Non-Executive Directors (INEDs) are demanding more focus on risk management and compliance so, in terms of recruitment, there is a beefing up of risk and compliance functions, as well as internal audit. This trend is gaining more momentum as the HK listing rules become more aligned with international best practice.
What opportunities are open to professionals working in risk and regulatory services?
There are definitely significant progression opportunities. If you look at the CIOs, CFOs, CTOs and even CEOs of large corporations, many come from a professional services background – perhaps big four, or one of the major technology or consulting firms. Experience working in risk and regulatory services offers a great grounding and foundation for propelling your career, as people working in this field are increasingly in demand.
This need is not just because of compliance concerns or value protection – companies also want to hire people who have an eye for opportunities. A good background in risk will also enable you to look at value enhancement because you have a deep understanding of risk and reward. Your company could be managing its risk inefficiently, for example. A useful analogy is a Formula One racing car mechanic: he doesn’t only ensure that the car doesn’t break down; he also tries to make it the fastest on the track.
What separates a great person in your profession from an average one? What other skills are needed to succeed?
The really great people are innovative, self-motivated and looking to enhance value. Their focus is on self-development and continual improvement. They are always finding new ways to do things – making use of data analytics for example.
Great people have to be team players because risk is pervasive across the whole organisation. You can’t operate in a silo – you need a holistic mindset and good interpersonal skills.
Being tech-literate is an absolute must, as is having vision and a commercial orientation. In risk it is easy to be conservative and say no to everything – the great person assesses risk and makes good commercial decisions. At the end of the day, business is about evaluating and managing risk, not avoiding it altogether.
What do hirers in this area look for?
You should have the basic technical qualifications related to your field, such as internal audit. You don’t necessarily have to be a CPA – you might have a different qualification, such as Certified Information Systems Auditor (CISA).
The new world of risk includes a wide variety of specialisation areas and makes use of lawyers, forensic accountants and a broad range of other professionals. Auditing is a very good foundation, but practical experience is even more important.
Is it easy to make a switch into this industry?
Absolutely. I started as an auditor, then did M&A work and now I lead risk assurance. To be an auditor is a fantastic grounding – you get to understand the whole client organisation, which could help you to move into business advisory work later on.
If you work in financial services audit, you learn about a highly regulated industry sector, so that provides you with the tools to move into areas like regulatory advisory services. It’s never too late to try something new. In fact, at PwC we actively encourage our people to move around and try working in different departments. This enriches their own work experience, and provides a broader perspective and deeper insights to our clients.
Accounting has a reputation for long working hours. Is this still the case and if so, What can workers to achieve better work-life balance?
It’s all about life balance: some people will work long hours and then relax over the weekend; others will manage their time differently. Depending on the area you work in, there will be different peaks and troughs. For example, in China all companies have a December year-end, so if you’re working in the audit business you’re going to be particularly busy from January to March.
How you prioritise is a very personal matter. It depends on how ambitious you are, how important family is for you, and other considerations. Working style is also a factor, for example delegation, working in teams and the effective use technology, which can all have an impact.
Organisations have also changed – there is more and more emphasis on well-being. There is a balance – we are in business and we have clients whose needs we have to meet. Working hard is fine, but you need to make sure that your people are taking breaks and not burning out. Technology is automating a lot of low-value tasks, and the need to work long hours on manually-intensive tasks is diminishing. People are moving towards higher value, more intellectually challenging work that requires greater judgment.
How does work vary between the big four and smaller firms?
There are a lot more institutionalised structures, processes and management disciplines in a big four firm. In a smaller organisation you might know everyone, so there will be more informal processes.
In terms of scope, a global firm working with global clients can focus on solving big, important problems, whereas with a smaller company you are typically working with smaller clients on more local issues. Our large clients already have a lot of in-house resources and expertise, so the issues that we work on tend to be a lot more substantial. There is more depth, breadth and scale. We also have a middle market client base, where you work more as a trusted business adviser.
This article appeared in the Classified Post print edition as Reaping risk’s rewards.
