The risk function

Accountability for risk at a core firm

No rule makes anyone the senior manager for risk at a core SMCR firm, which is what almost every external UK AIFM is. SYSC 24 Annex 1 4.2R ticks the risk oversight prescribed responsibility for enhanced scope firms only, and the Chief Risk Officer function is enhanced scope too. Risk is carried because a Statement of Responsibilities says so, and where the function has moved since that document was drafted, the individual named in it is still the one the FCA will ask. Allocating risk oversight to the compliance oversight function is defensible; doing it without a record is not.

Equal authority, and the evidence for it

FUND 3.7.4(1)(d) requires the risk management function to be represented in the governing body, or the supervisory function where one exists, with at least the same authority as portfolio management. The rule states a comparison, so the evidence must be comparative: whether the risk representative votes; whether the terms of reference give portfolio management a casting vote or a quorum it cannot block; whether a recorded disagreement exists across two or three years of minutes; and what followed the last one.

FUND 3.7.4(2) adds two proportionate safeguards: a risk committee, where one exists, must be appropriately resourced with non-independent members having no undue influence over the function, so a committee of the chief investment officer and the chief executive fails on membership; and the function must be independently reviewed by internal audit or, where there is none, by an external party appointed by the governing body rather than engaged by the person whose decisions are reviewed. FUND 3.7.4(3) puts establishing the safeguards, reviewing them and taking remedial action on the governing body.

Control over the data

FUND 3.7.4(1)(a) requires decisions taken by the risk management function to be based on reliable data subject to an appropriate degree of control by the function itself. At a small AIFM position data and valuations arrive from the administrator or a pricing agent, and limit utilisation is often calculated by the investment team. A function reporting a utilisation it did not compute and cannot recompute is reporting the front office's view of its own compliance.

The control need not be ownership of the system, but a check the function performs and can show: recalculation of the largest exposures each reporting date, reconciliation of the administrator's position file to the firm's records, and a log of differences found and cleared.

Risk oversight of a delegated portfolio

The FCA's April 2024 censure of Link Fund Solutions turned on this. As authorised fund manager of the LF Woodford Equity Income Fund, Link did not pick the holdings; the finding against it concerned its oversight of the delegate and its failure to ensure liquidity concerns raised with it were acted on. Delegating portfolio management does not delegate the risk obligation, and the finding concerns what happened after a concern was raised.

The file has to show when the risk function last raised a liquidity or concentration concern about a delegate's portfolio, what the delegate did, and what the manager did when the delegate disagreed.

The proposed tiering by firm size

Draft ALTS 5.3.2R would require a small UK AIFM to maintain a risk management function functionally and hierarchically independent from portfolio management, except where that would not be proportionate taking into account the nature, scale and complexity of its business. That escape has no counterpart in the unqualified FUND 3.7.2R(1). Draft ALTS 5.4.2R gives a medium AIFM none, and large AIFMs would keep the current detail plus a risk function with directive power over other functions in certain cases.

Draft ALTS 5.3.5G is more specific on limits than anything in force: a small AIFM should set a limit for each material risk identified; a limit should be quantitative unless it would be unreasonable for it to be; and the limits should cover at least market, credit, liquidity, counterparty and operational risk.