Exhibit 2.24 - PWC AMP Financial Advice Review dated 30/03/2015

86 Pages·2017·12.79 MB·English

AMP .6000.0003.8310
www.pwc.com.au CONFIDENTIAL
AMP
Financial advice review
March 2015
pwc
AMP.6000.0003.8311
AMP .6000.0003.8312
p-wc
Mr Brian Salter
Group General Counsel
AMP Limited
33 Alfred Street
Sydney NSW 2000
30 March 2015
Dear Brian,
AMP Advice - Financial Advice Review
You requested that we complete a review of the AMP Advice business to assess whether the control
framework is in line with ASIC's evolving industry expectations and how well it addresses ASIC's
current and emerging areas of focus given recent events within the Financial Planning industry.
In accordance with our statement of work dated 5 September 2014, we enclose our Final Report in
relation to our review.
In summary, we have found that AMP Advice is not operating significantly differently from the
majority of their industry peers at this point in time. However, it is clear that the expectations of the
regulator are continually evolving and rising and the industry, like AMP Advice, is continually taking
steps to enhance and improve to ensure these expectations are being met.
The findings from our review can be grouped as follows:
• People - We observed examples of strong leadership and strategic thinking within the AMP Advice
leadership team. Furthermore, people are passionate about AMP Advice and the value that the
organisation brings to clients and the financial markets. Everyone that we interviewed has the
intent of "doing the right thing" however in some areas of the business there is a lack of
collaboration outside of one's direct team.
• Process - There are some key risk management frameworks and processes that are either not
operating as designed or require updating to ensure that they meet ASIC's expectations and
industry better practice. Examples of these include the "3 Lines of Defence" framework, breach
reporting and complaints management processes as well as the techniques that are being used to
monitor the Adviser network. That said, the adviser files that we reviewed were well organised and
the documentation demonstrated compliance with appropriate regulations. This statement is
made with the exception of the Horizon's files and our findings in relation to these files are
detailed in the body of this report.
• Risk culture - One of the most important elements of a good risk culture is whether people within
the organisation feel safe to speak up and escalate issues. It is clear that AMP Advice have a culture
where people feel like they can voice their concerns without being punished for this. That said,
there was a lack of accountability and responsibility for managing compliance and risk evident
within parts of the AMP Advice business.
• Systems - Like many of the advice businesses within Australia, due to the merging of multiple
different advice businesses over time, there are multiple IT systems in place. This creates
PricewaterhouseCoopel'S, ABN 52780433757
Freshwater Place, 2 Southbank Boulevard, SOUTHBANK VIC 3006, GPO Box 1331, MELBOURNE VIC 3001
T: [phone], F:[phone], pwc.com.au
Liability limited by a scheme approved under Professional Standards Legislation.
AMP .6000.0003.8313
inefficiencies and additional risks for the business that often require the use of manual controls to
manage the risk that is created.
Given the above and our experience of where similar organisations have implemented successful
change, our recommendations include:
• Improve the way that risks are managed within the Advice business by:
Defining and communicating the responsibilities and accountabilities for the management of
risk within the business including clarifying that everyone within the business has a role to play.
Clarifying the roles of linel and 2 risk to ensure that there is the right amount of collaboration,
independence, review and challenge in each of the elements of the advice process.
Reducing the current roles and responsibilities ofline 1 risk and therefore also considering
whether the structure and size of that team is correct.
Increasing the role and responsibilities of both line 2 risk and Licensee resources. In respect of
line 2 risk this may require structural considerations and an increase in current resourcing
levels.
• Update monitoring and supervision policies and processes to ensure that they reflect ASIC's
expectations and industry better practice. In particular:
File review processes should be updated to enhance risk based monitoring such that advisers
who are the highest risk are monitored the most frequently.
Breach reporting processes should be refined to ensure that there is a consistent process that
enables the timely identification and reporting of breaches.
Complaints management processes should be updated to ensure that complaints are being dealt
with on a timely basis and that there is evidence maintained that supports how complaints are
being managed.
The techniques used to monitor the Adviser network should be expanded to include the use of
risk indicators and mystery shopping.
• Conduct a strategic review of the IT systems within the business and consider if they are and will
remain fit for purpose with reference to the strategic direction of AMP Advice. Consideration
should be given to the timeframes for implementing the "transformation" activities within the
business.
Throughout our review, we raised two issues (relating to the results of the Horizon file reviews and
complaints) that we believe AMP needed to consider and determine if they constituted a significant
breach reportable to ASIC. We were involved in the process that AMP went through to determine if
these issues were significant. The process that AMP went through was both robust and appropriate.
We concur with the outcome of this process that neither issue constituted a significant breach
reportable to ASIC.
Due to the inherent limitations of any business systems, policies, procedures and controls it is possible
that errors or irregularities may occur and not be detected. Our procedures are not designed to detect
4
AMP .6000.0003.8314
r·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·_·1
i CONTAINS CONFIDENTIALINFORMATION :
~ !
1_._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._ . .i
all weaknesses in procedures as they are not perfonned continuously throughout the period and our
procedures were perfonned on a test basis.
This report has been prepared solely for the directors of AMP. Except as required by law, our report
may not be disclosed nor its contents published in any way (including on an internet website) without
the prior written approval of PwC. PwC consents to the provision of this report to ASIC, however PwC
does not accept any responsibility to ASIC or any party other than AMP.
We have enjoyed conducting this review with you and have greatly appreciated the openness,
transparency and willingness to assist of everyone involved.
If you would like to discuss any aspects of our report, please contact me on
Yours sincerely,
Nicole Salimbeni
Partner
5
AMP .6000.0003.8315
AMP .6000.0003.8316
Executive suntntary
Context
Recently the financial advice industry has come under heavy scrutiny. There have been regulatory reforms
introduced in the form of the Future of Financial Advice (FOFA), high profile issues in relation to
Commonwealth Financial Planning and Macquarie Equities which have led to heavy media scrutiny and
political events such as the recent Inquiries into the financial system and the conduct of the Australian
Securities and Investments Commission (ASIC).
As a result of this scrutiny, the industry is undergoing a significant amount of change. The expectations of ASIC
are increasing and their focus on ensuring compliance with regulations has heightened.
In addition to the external environment, since the integration of AMP Limited (AMP) and AXA Limited (AXA),
over the last 12 months, AMP Advice has embarked on a process of standardisation ('harmonisation') in certain
parts of the two businesses in order to drive efficiency and effectiveness.
In response to the recent internal and external events and the increasing expectations of ASIC, AMP Advice
requested that PwC ('we') complete a review of AMP Advice to assess whether the control framework is in line
with ASIC's evolving industry expectations and how well it addresses ASIC's current and emerging areas of
focus. As such, this report includes findings both in relation to how well AMP Advice meets both ASIC's current
and our understanding of ASIC's evolving expectations which shows a continual rising ofthe bar.
Scope and approach
Our review covered the following Licensees which are part of AMP Advice:
• AMP Financial Planning Pty Limited ('AMPFP')
• Charter Financial Planning Limited (,Charter')
• Genesys Wealth Advisers Limited ('Genesys')
• Hillross Financial Services Limited ('Hillross')
• ipac Securities Limited ('ipac')
• SMSF Advice Pty Limited (,SMSF Advice')
• AMP Direct pty Limited (,AMP Direct')
• Jigsaw Support Services Limited ('Jigsaw').
The work we performed in conducting our review included:
• Conducting formal interviews with a selection of management, staff and Advisers to understand AMP
Advice's approach and processes for ensuring compliance with regulatory obligations.
• Reviewing key documentation that explains how the key systems, processes and controls are designed within
AMP Advice.
• Conducting sample testing of key systems, processes and controls to determine they are operating effectively
and as designed.
• Conducting sample testing of Adviser files to assess whether they comply with regulatory requirements.
AMP
PwC
AMP .6000.0003.8317
Executive summary
Due to harmonisation, there are some processes and controls that are performed consistently across all
Licensees and if this was the case they were assessed and tested centrally.
The framework that we applied when performing this review is outlined in Section 2 of this report and again in
Appendix A along with the detailed scope and areas of focus.
Comparison to the industry
In summary, AMP Advice is not operating significantly differently from the majority of their industry peers at
this point in time. However, it is clear that the expectations of the regulator are continually evolving and rising
and the industry, like AMP Advice, is continually taking steps to enhance and improve.
Summary offindings
Below is a summary of our key findings from our review. This table includes our observations both in relation to
what is working well and where there are opportunities for improvement. All themes in the table below are
considered significant in nature although we have ordered the themes starting with our view on the most
important areas for consideration.
Report
Theme Summary of findings section
Strategic • There is a clear acceptance by AMP Advice management of the need to drive
direction & change within the advice industry to ensure a sustainable business for the
advice future. It is the distinct intent of management that AMP Advice will drive this
leadership within the market and lead by example. This is evident given there have been
(People) recent public announcements such as partnering with the St James Ethics
Centre, the raising of Adviser education standards and the introduction of a
client advice review panel.
• Internally, the leadership team are also focused on the sustainability of the
business. The establishment of Project Blue is a strong example of how the
Advice Business is positioning itself for the future in aiming to provide advice
in an efficient, effective, compliant and client-centric way. Another example of
this is the training and technical support that AMP provides its Advisers - we
have received consistently positive feedback on this service throughout our
review.
• Management have been focused on the synergies that can be gained through 2.4.2
harmonisation of key advice processes given the merging of the AMP and AXA
businesses - this is both from an efficiency and risk management perspective.
• Management have moved away from the industry focus on the quantity of 2·1.3
Advisers within the group to being focused on the quality of Advisers within
the business. Selection and on-boarding processes within the group have been
revised and enhanced to reflect this strategic direction .
.......................................... _. ............................................................................................................................................................................................... .........................
,. ,
Risk culture • One of the most important elements of a good risk culture is whether people 2·9·3
(Risk within the organisation feel safe to speak up and escalate issues. It is clear that
Culture) AMP Advice have a culture where people feel like they can voice their concerns
without being punished for this.
• That said, there was a lack of accountability and responsibility for managing
compliance and risk evident within parts of the AMP Advice business. It was
consistently described to us that the management of compliance "had been
outsourced to the Client Solutions & Advice Services (CSAS) team".
• Although well supported by the Advice & Banking Leadership team, the
Director of Client Solutions & Advice Services team does not appear to have
the level of authority that we would expect of this role. A senior role which has
overall responsibility for the risk and compliance framework should be a direct
report to the business leader and should be part of the management team to
ensure the authority to drive the management of risks in the appropriate way.
AMP
PwC ii
AMP .6000.0003.8318
Executive summary
Report
Theme Summary of findings section
• The AMP Line 2 risk team does not have the level of authority and influence 2·9-4 -
within the Advice business that we would expect to ensure the development of 9·1
a strong risk culture.
.......................................... _. ............................................................................................................................................................................................... ........................
,. .,
Adviser • Our review of Adviser files found that in general files were well organised 2·4·4 -
compliance and the documentation demonstrated compliance with appropriate 4·1
(Process) regulations. Moreover, we found that the auditing and vetting process was
operating as designed.
• The comment above is made with the exception of Horizons. In the case of
Horizons, we identified a range of exceptions on the file, including that
some advisers were providing insurance advice to clients where we were
unable to evidence through our review of the files that this advice was in
the best interest of the client. We note that AMP considered whether this
finding constituted a significant breach reportable to ASIC and concluded
that it was not significant. We oversaw this process which we deemed to be
thorough and robust. We also note that there is a detailed plan in place to
address this finding. We make a similar observation in relation to our
finding relating to complaints as outlined below.
2.10·4 -
Leadership, • Client Solutions & Advice Services (CSAS) are responsible for too many
10.1
size, skill and elements of the monitoring and supervision process which could cause a
capability of conflict and does not require input and ownership from the Licensee teams to
CSAS ensure the shared accountability for risk and compliance. Examples of this
(People)
include:
- CSAS are both responsible for the file reviews and also the oversight of
all remedial actions to address the issues identified. There is no line 2
risk monitoring of this.
- CSAS are responsible for the identification, determination and
reporting of breaches with little input from the business, line 2 risk or
legal.
- CSAS are responsible for changes to advice processes and procedures
without review and input from line 2 risk.
- CSAS are responsible for the assessment, escalation and resolution of
complaints with little input from the business, line 2 risk or legal.
2.10·4 -
• While the Director Client Solutions and Advice Services is highly regarded for
10.2
his technical skills both within AMP and the industry, the level of skill and
capability we have observed in the broader team would suggest a possible lack
of leadership, skill and experience to implement fundamental change within
this area. In addition there is approximately 270 staff within the CSAS team.
In our experience this team appears to be larger than we would expect.
Particularly in relation to the number of resources in Advice Compliance. We
would also expect to see a more deliberate 3 Lines of Defence (3LOD) model
which would include more risk management activities being performed by
both the Licensees and line 2 risk.
2·sa·4-
• The results from our file audits suggest that the capability and experience of
sa.l;
the auditing and vetting staff members varies and as a result there are
sa·3
inconsistent audit and vetting outcomes.
Risk framework • The 3LOD model is considered by ASIC to be the key governance, risk and 2.10·4 -
as it relates to control framework for effectively managing risk however it does not appear to 10.1
be operating consistently and in the manner we would expect within AMP
AMP
PwC iii
AMP .6000.0003.8319
Executive summary
Report
Theme Summary of findings section
the advice Advice.
business
• The quantity of line 2 risk resources is less than general industry practice and 2.10·4 -
(People,
line 2 risk is not represented at the Advice and Banking Leadership team. 10.1
Process)
• Line 2 is not consistently involved in oversight of key decision-making such as 2.10·4 -
breaches, complaints remediation and there is no integrated risk-based 10.1
assurance plan for monitoring and oversight at the line 2 level.
• The use of Key Risk Indicators (KRIs) to monitor, manage and escalate risks 2.10·4 -
within the business is limited. 10.1
Monitoring and • The file review checklist which is used to review Adviser files has recently been
supervision reviewed and revised. The checklist is reflective of best industry practice.
framework • While there is an acknowledgement that there are new/more efficient ways of 2·sa·4-
(Process) conducting some of the activities being used to monitor and supervise sa.2
Advisers, to provide the same assurance but in a more efficient and effective
way, this thinking is yet to be implemented. Examples of this include mystery
shopping, risk-based Adviser audits, Adviser coaching & on-site training,
targeted data analytics to detect risky/outlier Adviser behaviour as well as
strategic trend analytics to identify key issues/hotspots in the advice lifecycle.
This type of thinking will be particularly important with the development of
Project Blue.
.... ·· .. ·
"'B~~~~h~~"""""""""-"~""'ASic'h~~'~~~~~ti~'~~~~~~'~~d"~"~~~~~'~ib'~~~~h';~~~rti~~'~~~i'~i~rifi~~i'it~""""""''''2:5b:·2
(People, expectations in relation to AFSL requirements under S912D of the
Process) Corporations Act. Our review has highlighted a number of areas that do not
meet these standards.
• Firstly, there are two distinct breach reporting processes depending on the 2.Sb-4 -
nature of the breach. Adviser-specific incidents are dealt with by a team in Sb.2
CSAS whilst all other AFS incidents are dealt with by line 2 Risk. These appear
to be operating in isolation so there is the risk that incidents are missed,
duplicated and/or inconsistent outcomes are reached.
• The process operated by CSAS is done in isolation without consistent 2·SB.4 -
consultation and involvement of the business, line 2 Risk and Legal. What's Sb.1
more there is no defined process for escalating and reporting potential
breaches. Informally this is done in different ways for different Licensees.
• In some but not all instances we reviewed, the starting premise for the breach
and significance tests appears to be focused on the individual Adviser rather
than the Licensee which is very different from the industry and incongruent
with ASIC's recent announcements.
• Incidents at AMP tend to be self-reported or identified serendipitously - the
Licensees are not taking proactive steps to identify trends and indicators that
point to potential breaches. Furthermore root-cause analysis of incidents and
breaches that are identified is not conducted which means that potential
systemic issues are not identified, and similar issues are likely to reoccur as
rectification is not fed into continuous improvement of processes, training and
behaviour. Better industry practice incorporates both of these elements into
their incident and breach frameworks.
• We note that when we verbally raised this issue during our review in November
2014, AMP Advice implemented immediate steps to revise and update their
breach reporting process to address these findings .
.......................................... _. ............................................................................................................................................................................................... .........................
,. ,
Complaints • There is an opportunity for AMP to reduce the number of days that it is taking to 2.8·4 -
(People, resolve outstanding complaints. Our analysis showed there are parts of the 8.1
complaints process where there are significant unexplained delays in resolving
AMP
PwC iv