In its efforts to further raise the bar for corporate governance standards, the Malta Financial Services Authority (‘the MFSA’) has recently issued a revamped Corporate Governance Code for authorised entities (‘the Code’).  Through the new Code, the MFSA encourages entities to adopt a prudent and consumer-focused corporate culture which in turn enables enhanced protection for investors and consumers and promotes stability and integrity in local markets.  Fundamentally, the Code serves to strengthen (or instil in certain instances) the compliance culture within authorised entities.

While applicable to all legal authorised entities (except those that fall within the scope of the Capital Markets Rules), the MFSA clarifies that the application of the code is based on the principle of proportionality and is to be applied on a best effort basis.  The MFSA further notes that the Code is not legally binding or tied to any reporting obligations.  In doing so, the regulator therefore recognises that there is no single path to an effective corporate governance structure and that a single approach cannot be applied to all authorised entities. 

The Code has been widely debated pre- and post-publication by industry practitioners with most emphasis being made on the fact that the Code is principles-based and to be applied on a best effort basis and proportionately.  So, how do we strike a balance?

Piecing up the corporate governance puzzle is no mean feat particularly in a financial services sector characterised by high staff turnover amongst a limited pool of experienced professionals.  However, caution should be exercised on the grave pitfalls of engaging in a ticking-the-box compliance exercise.   

While it is widely acknowledged that progress has been made over the recent years in enhancing governance structures and controls, in many cases a thoughtful approach to corporate governance is lacking, often a result of a tick-box approach and an anything goes mentality.   

One of the key pillars of the revamped Code is The Effective Board.  The use of the word ‘effective’ by the MFSA is fitting in this ambit in view of the noticeable gaps in the effectiveness of Boards which persist to date:

• Non-executive directors – serve a key role in providing checks and balances to the Board of Directors. Notwithstanding efforts in various fora, including the Institute of Directors – Malta and the MFSA itself, there is still little appreciation of the importance of the role of non-executive directors in the corporate structure;
• The role of the Chair – the pivotal role of the Chair is generally underestimated, often considered to be a figure-head rather than the leader of the board of directors;
• Collective suitability of the Board of Directors – performing a regular assessment of the collective suitability of the board remains a sore point for directors;
• Diversity, inclusion, and succession planning – fundamental aspects especially for small boards, remain overlooked.
• Outsourcing – there remains the falls sense of comfort in outsourcing key functions. The Board is fundamental in selecting the right outsourcing service provider (which should be able to offer the right skill set and time commitment) and overseeing the effectiveness of the outsourcing partner.  Most importantly, the Board retains accountability for the outsourced service.

The MFSA has issued clear expectations on how authorised entities are to strengthen their corporate governance structures.  It is now up to the industry to take advantage of this long-awaited revamp of the Code and strive towards achieving compliance in a smart and effective way.  Key to this is understanding your current position (gap analysis) and devise a medium-term plan on how to reach the regulatory bar.  Financial and operational failures normally result from inappropriate governance and oversight.  On the other hand, demonstrating effective corporate governance builds trust that is necessary to attract business and investment towards the company. Embedding such an effective culture before being subject to either listing requirements or regulation, renders the adoption of sound governance principles less painful.

Embark (Malta) Limited helps embed a corporate compliance culture that adds value. We can assist you in developing an effective corporate governance framework. Contact us today!

“The only constant is change” – But is it really? Think again!

Risk has steadily become part of the equation and mastering the art of risk management has become more important in every aspect, be it in business or in everyday life.

Beyond the obvious disruption brought about by the unprecedented pandemic, we will be highlighting the top risks likely to affect the business world. The number of risks goes far wider than the ones identified in this article. However, the intention is to highlight the salient ones which are proving to be considerably challenging for businesses to manage.

Cyber Security Risk

An increasing cause of disruption and consequently reputational harm are cyber-attacks. Considered as the modern robbery, businesses must be prepared to manage cyber attacks and threats that could impact the business financially, its operations and in worst cases, bring it to a halt.

How to mitigate – Invest in a strong IT function updated with the latest IT technologies.

Third Party Risk

Doing business with new alliances and other third-parties until recently may have been much simpler. Today, we are faced with a new reality. Background verifications on partners and other business relationships have become the norm. This has created some disruptions and added responsibilities and costs prior to onboarding new relationships be it clients, partners or any other business relationship. This is also set to grow further with the advent of ESG (Environmental Social Governance) regulations in the sense that any business with third parties will, in the near future, require the parties to be compliant to ESG regulations. The monitoring is ongoing and not just at on-boarding stage.

How to mitigate – The options are to either build a strong compliance unit. If this is not feasible, you can outsource this role to a professional.

Governance of the Organisation

Organisational governance is concerned with the rules, processes and procedures and the control environment in which the business operates. An examination of the business will help assess whether its present governance is in line with the expected rule book.

How to mitigate – A consultant can provide an outsider’s perspective, identifying gaps and propose means to address them.

Data Governance

Data – a very valuable asset of an organisation which must be protected. There is a risk attached to this data and the company must be aware of the way its data is being managed. This includes accessibility of the data, security, use and how it is being collected.

How to mitigate – Apply restrictions at every level. Not all employees need to have access to all data. In addition, a strong IT function and engaging a Data Protection Officer will add value to your business.

Business Continuity

Have you ever thought if one of the key roles in your businesses had to go missing? Would the business continue operating smoothly? Business continuity planning is key in ensuring that businesses do not risk serious disruptions. It assesses how prepared is the business in case such had to occur, how it reacts in crisis situations and its ability to respond to changes.

How to mitigate – Planning is often underestimated. However, planning should not stop at setting targets for the coming years only. It needs to encompass Business Continuity Planning.

Talent Risk

Also linked to the above, is the risk of loosing top talent. An era of digitalisation is redefining work. Other than employees moving to the highest bidder, investment in technology must be in place ensuring that the business is up to date with the latest trends and how the work gets done.

How to mitigate – Keep going and keep growing. You stand still and you fall behind. This ensures that top talent is continually challenged.

Our aim is to raise awareness and educate more businesses about dealing with management of risks and addressing short-comings. We are a phone call away. If you are interested in a free consultation feel free to drop us a line.