WHAT IS REMEDIATION

Mistakes happen. In complex industries such as financial services, there are numerous situations where mistakes can happen, causing errors to propagate through the myriad systems. When this happens, some type of remediation is required to fix the mistakes and ensure customers are protected. While these mistakes are rarely intentional, they are relatively common. It could be as minor as an agent typing inaccurate information into the system or using an outdated policy, or broader, such as a data mapping error during a system conversion.

Most mistakes are caught either directly by customers or through reviews conducted by internal teams such as quality assurance, compliance, or audit. In the case of customer-identified issues, these can usually be resolved quickly with little or no impact to additional customers. For larger, systemic issues, the repair process is more involved and often requires the efforts of a dedicated team. A typical remediation effort includes:

1. Issue identification and root cause determination
2. Impacted population identification
3. Resolution approach development
4. Remediation execution/implementation

Larger remediation efforts are rarely planned in advance and require reallocating resources from other roles or bringing in external resources. Both are disruptive to ongoing operations.

THE LIMITATIONS OF PREVENTION

Preventing errors is always ideal, but often complicated by control limitations, training capacity, staff turnover, or inherited issues. The variety of business scenarios is also a factor that makes comprehensive prevention difficult – there are simply too many situations to consider, and as the occurrence of each situation diminishes, the economic viability of systematic controls is reduced.

The next best option to prevention, is the rapid identification and remediation of errors. Fortunately, the need for rapid identification has created a broad range of studies and methodology related to the science of controls, which essentially fall into two categories:  prevention and identification of errors. On the prevention side, controls take many forms, including systematic and procedural. Systematic controls tend to cover high-volume, standardized things like validating formats and options prior to data collection or forcing transactions through pre-determined steps to ensure compliance with rules and policies. Procedural controls are simply manual versions of controls that have not yet been automated, and can include exception reports, quality checks, or transaction authorization protocols. Procedural controls generally suffer from the potential for human error, making them somewhat less effective than systematic controls, but also more flexible and quicker to implement. On the identification side, controls are varied and distributed across several teams, under the theory of three lines-of-defense, which includes different teams looking at processes from different perspectives to prevent and identify the greatest number of issues.

The concepts, tools, and approaches to both prevention and identification are mature in most industries and continue to evolve as new technologies reduce the cost of implementation. The approach to remediation, however, often receives far less attention and, due to the variety of issues encountered, has been more difficult to automate. Remediation is often accomplished by temporary teams or professional services firms, and while this approach is useful, it is also accompanied by high costs, business disruption, and lengthy schedules required to bring resources up-to-speed on the business and its tools.

A permanent remediation capability can address many of these issues, and the capacity can be adjusted to meet the requirements, size, and complexity of the organization or augmented by external resources in specific circumstances.

PERMANENT TEAMS AND METHODS

A permanent remediation capability has many benefits and should be considered for organizations of all sizes. The capability will create consistency in response and improve overall customer experience by accelerating the initiation and execution of remedial activities. It is, however, important to actively manage the capability to ensure it does not become a replacement for good operational quality control.

There are several ways in which a permanent capability will accelerate remediation efforts:

1. Organizational familiarity:  permanent teams will be familiar with the organization, reporting hierarchies, and resources, and be able to quickly engage stakeholders.
2. Experience with tools and systems:  remediation efforts often require teams to utilize or perform maintenance on the various systems in use by the organization or use project management platforms to report and track progress. Larger enterprises often use similar tools and vendors across different departments, such as file repositories, collaboration platforms, or marketing firms, and permanent teams will be able to take learnings from project-to-project to quickly initiate new efforts. Specific to project management and executive reporting, standard templates and configurations will already be developed, reviewed, accepted, and in broad use, allowing them to be easily applied to new efforts.
3. Business policy familiarity:  each organization has unique policies, standards, and often regulations to which it must adhere. Permanent teams will naturally be part of ongoing training and certification programs that implement these policies and standards, and not require special sessions or events prior to starting an effort. This has become a particularly time-consuming activity when onboarding external teams into highly regulated industries such as financial services, which may require lengthy background checks before individuals are allowed to access account or customer data.
4. System and facility access:  basic team logistics like username-password credentials and facility access cards often delay the initiation of remediation efforts, especially when specific external resources are not known until contracting in completed.
5. Stewards of repeatable processes and tools: finally, permanent teams become stewards of repeatable processes, standards, and tools, which create execution consistency and outcome predictability. Here it is important to balance the business routines with results, to avoid creating unnecessary overhead and administration.

Many of the characteristics of permanent teams can also be accomplished with long-term agreements with external teams, but will naturally involve additional costs. Permanent teams will also need to account for staff turnover, which can have similar impacts to engaging external teams.

A permanent remediation team will develop standards and skills that are unique to the organization and variety of efforts undertaken, and a basic toolkit will allow the team to rapidly initiate new efforts and form the basis of its repeatable process. The basic toolkit should include:

• Project management approach:  project management and related tools are some of the most reusable components of a remediation effort. Stakeholder familiarity accelerates impact analysis, project management platforms and templates can be pre-configured and approved, and engagement protocols can be standardized. A permanent team will be able to quickly initiate a new effort using these standard tools and project management protocols, shortening timelines and producing familiar results.
• Communications:  remediation efforts require communications to internal audiences, like employees and management, and potentially external audiences, like customers, vendors, or regulators. The permanent team will establish communication protocols for these audiences that can be reused in subsequent efforts. The external communications may include the use of third-party vendors like printers or advertising agencies, and the permanent team will establish relationships that can accelerate the execution of new efforts.
• Vendor management:  many remediation efforts include or impact activities that are performed by third-parties, and the permanent remediation team will establish protocols to coordinate with internal operations, procurement, and vendor management teams to effect changes at the third-parties.

Establishment of a permanent remediation capability does not suggest a failure of controls or lines-of-defense structures, but, rather, recognizes that issues are likely to happen regardless of the investments made in prevention, and provides the smart organization with a rapid-response capability to ensure the best customer experience and operational integrity.