Perspectives
Perspective 013Governance

Boards rarely ask the MLRO what would make their job easier. They should.

A small question, almost never asked on the record, that surfaces more practical risk reduction than any formal paper. A practitioner's note on what changes when a chair invites the answer.

By Everett MorganSummer 20267 min read
Quiet executive boardroom at dusk, a single closed folder on the table
Executive summary

The most useful question I have heard a chair ask an MLRO is also the one I have heard least often. It takes five minutes, costs nothing, and surfaces more practical risk reduction than any formal paper.

This is a companion note to Guide 005, Board Oversight of Financial Crime. The guide describes the full Board year. This piece sits on a single question that is missing from almost all of them.

Key takeaways
  1. 01

    Most Boards review the MLRO's report, approve the appetite, sign off the calendar, and thank the MLRO for attending. Very few ask, on the record, what would make their job easier in the year ahead.

  2. 02

    The answers tend to be specific in a way that the formal papers never are: a single piece of MI that does not yet exist, a working relationship with a business head that is more difficult than it should be, a technology workaround carrying risk for longer than is comfortable, a deputy who needs to be formally appointed.

  3. 03

    These items rarely appear in formal Board papers because they are not Board decisions. They are the friction the MLRO works around every day. Until somebody asks.

  4. 04

    Asking the question is a five-minute act. Acting on one or two of the answers, year on year, is the difference between a Board that supports its MLRO in name and one that supports them in practice.

  5. 05

    Boards that do this consistently retain their MLROs longer. The MI looks the same either way. The retention of the MLRO does not.

  6. 06

    The chair owns the question. It cannot be delegated to the CEO, the CRO or the company secretary, because the candour of the answer depends on the relationship.

I have sat through more annual financial crime sessions than I can count. The shape is always the same. The MLRO presents the report. The Board tests the headline numbers. The appetite is approved or refreshed. The calendar for the year is confirmed. The MLRO leaves the room having delivered. The chair thanks them.

What I have almost never seen, and I am including some genuinely well-run Boards in this, is a chair turn to the MLRO at the end of the discussion and ask, on the record, what would make their job easier in the year ahead. Not what the MLRO would like to bid for in the budget. Not what they would like to escalate. Not what they would say if they were running the firm. What would make the job easier.

Why the question is missing

There are good reasons it is missing. The Board agenda is full. Financial crime is one item among many. The chair is conscious that an open question to a regulated person, in front of the executive, can be heard as an invitation to escalate. The MLRO, for their part, has spent the previous fortnight preparing answers to questions they expect to be asked, not the ones they wish were.

There are also less good reasons. Some chairs do not want to hear an answer that implies the executive has not been listening during the year. Some MLROs would not answer candidly if asked, because the relationship is not yet at the point where candour is safe. Some Boards are running their financial crime sessions as a compliance ritual, in which the wrong question would slow things down.

None of those reasons survive contact with the work the MLRO actually does. The job is harder than the formal papers describe. It is harder in specific, often small, ways that accumulate into the friction that drives MLRO turnover.

What the answers actually look like

I have asked the question, on the chair's behalf or in private sessions I have been asked to chair, in perhaps thirty engagements. The answers are remarkably consistent in shape and remarkably specific in content. None of them have ever appeared on a formal Board paper.

A single piece of MI that does not yet exist, because the data sits in a system that does not talk to the dashboard. The MLRO has built a workaround. It works. It also fails silently when the workaround breaks, which it does, and nobody apart from the MLRO knows when.

A working relationship with a business head that is more difficult than it should be. Not adversarial, just slow. Approvals that should take a day take a week. Files that should be flagged are flagged after the fact. The MLRO has stopped raising it because the last attempt produced a polite conversation and no change.

A technology workaround that has been carrying risk for longer than is comfortable. The promised replacement is on a roadmap. The roadmap slipped twice. The MLRO does not want to escalate because it would be heard as criticism of the CTO, who has been supportive in other ways. So the risk sits.

A deputy who needs to be formally appointed. The candidate exists. The MLRO has been training them. The paperwork has been with HR for four months. None of it is urgent until the day the MLRO is on sick leave and the firm discovers that the deputy is not deputised on the regulator's records.

None of these are Board decisions. That is the point. They are the operating reality the MLRO works around every day. They do not belong on a formal paper, because the formal paper is not the right vehicle. They belong in a five-minute conversation at the end of the annual session, on the record, with the chair inviting the answer.

What happens when the question is asked

The first time it is asked, the MLRO usually pauses. The pause tells you the question is unexpected. The first answer is often a half-answer, because the MLRO has not been invited to give a full one and is testing the room. The chair does well to wait, and to invite a second answer.

The second answer is usually the real one. It is specific, it is operational, and it is almost always something the executive could fix in a quarter if the Board indicated it cared.

The decisions that follow are small. A line in the minutes that HR will complete the deputy paperwork in the next thirty days. A note that the CEO will speak to the business head whose approvals are slow. A request to internal audit to look at the data flow that the MLRO has been working around. None of these are Board decisions either, but the minute records that the Board is aware, and that is what makes them happen.

The MI will look the same either way. The retention of the MLRO will not.

Why the chair owns this, not the CEO

The question only works if the MLRO believes the answer will be heard, and acted on, without being relitigated by the executive in the meantime. That belief depends on the chair. The chair controls the agenda, controls the minute, and controls the private session in which the question can be returned to a month later if nothing has happened. The CEO cannot offer the MLRO that protection, because the CEO is part of the executive the MLRO is sometimes working around.

This is not a comment on the CEO. It is a comment on the structural position. The MLRO's escalation channel runs to the chair of the Risk or Audit Committee, in writing, with no executive intermediary. That channel is rarely used because it is reserved for material issues. The annual question about friction sits one rung lower than that channel. It is the five-minute conversation that prevents the friction from becoming material in the first place.

A note on what not to ask

The question is not, "What do you need?" The MLRO will answer in budget terms, because that is the question they have learned to answer. The question is not, "What do you want to escalate?" The MLRO will answer with the items already in the formal pack, because the question implies a formal channel.

The question is, "What would make your job easier in the year ahead?" That phrasing invites the operating answer. It does not ask for a budget bid. It does not ask for an escalation. It asks for the small things, on the record, that the formal machinery does not have a place for.

What I would do this year

If you chair a Board that meets the MLRO once a year, add the question to next year's agenda now, before the rest of the pack is built. Tell the MLRO it is coming. Allow them to prepare an honest answer rather than a polite one. Take the answer in two parts, the items the Board can help with and the items the executive will be asked to address. Record both in the minute. Return to them at the half-year, in private if necessary, to ask which have moved.

If you are an MLRO reading this, the question may not be asked of you this year. You can still write the answer down. Bring it to the chair separately. The conversation will be the same. The minute will be cleaner if the question is asked from the chair rather than offered from the MLRO, but the substance is what matters, and the substance is the same.

Guide 005 sets out the broader Board year, the papers worth reading twice and the decisions that cannot be delegated. This piece is the single question that should appear in the last five minutes of the annual session. Download the full guide and work through the calendar in the appendix before the next Board cycle begins.

About the author
Everett Morgan
Founder & Principal Adviser, Claritas Risk Advisory

Everett has more than twenty years' experience in financial crime, AML governance, regulatory compliance and operational risk gained within Deutsche Bank, Morgan Stanley and BNP Paribas. He established Claritas Risk Advisory to provide smaller regulated financial institutions with experienced independent judgement, practical insight and proportionate recommendations.

Need an independent perspective?

Preparing for regulatory change starts with understanding where your organisation stands today.

If you would like to discuss your financial crime framework or explore how Claritas Risk Advisory can help, I would be pleased to arrange a confidential conversation.

Let's start with a conversation