Deloitte believes that the cost of regulation is yet to peak, and predicts that the governance and control bill for the world’s largest 100 financial institutions could hit GBP50bn (USD100bn) by 2010. This is even before the cost of any new regulation introduced in response to the current credit crisis.

However, a new report by Deloitte entitled ‘In Control?’, suggested that this investment in regulation and compliance can only be fully effective if institutions connect their risk management and controls, and the governance of the two into a ‘holy trinity’.

Chris Gentle, associate partner and head of research at Deloitte, commented: “It appears that a prime feature of the recent losses incurred by major banks in the credit crunch was the inability, in many instances, to link risk and control factors together."

"Financial institutions are always seeking to find and sustain the correct balance between risk and reward, but this lack of triangulation between control, risk and governance is, in most cases, a missing link which needs joining up."

Gentle continued:

“Current market dynamics dictate that there are few more vital issues for financial institutions to address than risk appetite, governance and control. Such systems set few hearts racing until it is often too late, yet they are increasingly determining the winners and the losers across the global financial services industry."

“Governance and control systems need to be right at the top of the corporate agenda, as they are likely to play a central role in the individual success or failure of senior executives.”

Deloitte’s report also recommended that institutions stop viewing regulation as an unavoidable burden, and start to consider compliance and competitive advantage in the same sentence.

The challenge for financial services institutions is to develop the agility and flexibility to absorb new regulatory demands while accruing cost efficiencies and competitive advantages, it suggested.

Deloitte further noted that the financial services industry has been hit by an avalanche of regulation in the last five years. This has included capital adequacy measures such as Basel II and Solvency II, and those addressing market practices, such as ‘Treating Customers Fairly’ and MiFID.

Investment banks, commercial banks and insurers have all been affected by regulations from a variety of jurisdictions.

Russell Collins, head of financial services at Deloitte, added: “Even financial institutions applying current best practices have a significant way to go before they achieve the optimum return on governance and control investments. To achieve this, they need to clearly articulate their risk appetite and build stronger linkages to risks taken and risks reported.”

Deloitte made a number of suggestions to improve controls in financial institutions. These included appointing a fully-accountable, board-level individual to oversee controls; using effective technology to automate controls and monitor transactions in real time to avoid errors; and implementing tools that allow managers and risk experts to collaborate in making decisions and to evidence control of significant risk from all sources.

The report also highlighted differences between large and small financial institutions. It found that despite the complexity of multiple jurisdictions and greater compliance demands, larger institutions spend on average 4% of their total expense base on governance and compliance activities. In smaller institutions, this figure rises to 6%.

Gentle further observed that: “There appears to be a growing and uneven regulatory burden which may act as a competitive disadvantage to smaller financial institutions.”

The report reveals considerable divergence in who is responsible for integrating governance and control functions. Just 41% of respondents stated that the audit committee or board have overall control of governance and compliance systems.

Collins concluded: “Governance, risk and control is one of the biggest issues facing financial institutions today. As the bar of regulation and control continues to rise, senior executives must demonstrate to the relevant authorities and to investors that they are in control."