Understanding Governing Obligations and the Control Environment

Reported understanding and discussion of governing obligations were associated with higher governance, oversight, and control scores. Merely naming a law did not clearly distinguish the score, and training's adjusted association was sensitive to the comparison measure. These findings separate recognition of an obligation, perceived understanding, operational discussion, and preparation to apply it. They concern reported knowledge and practice, without an independent test of legal compliance.

The respondent's own understanding of the obligations retained an association with the score after adjustment for the comparison mean outside it at partial r = 0.27, management's understanding at 0.25, and the financial institution's discussion of the obligations at 0.20. Regulatory training had a negative adjusted coefficient of −0.35 that changed sign when the vendor capability items were omitted from the comparison mean. Respondents who named at least one governing law or regulation recorded a score of 4.06 (n = 548), against 3.90 among the 247 who answered that they did not know. Written references to a regulation, a regulator, or an audit obligation were rare, at 16 answers from 14 respondents on 12 engagements. Table 3.13 sets out the four rated items by rating band.

1 Knowledge of the Governing Obligations

The obligations items distinguish recognition, understanding, and reported exposure. Self-assessed understanding was associated with the score, whereas naming a law did not clearly distinguish it. The few written exposure accounts came from lower-scoring respondents. Together these findings connect knowledge with the reported control environment while limiting any inference that a named obligation or favorable understanding rating establishes compliance.

1.1 Governing Laws and Regulations Named by Respondents

Item C056 · The laws and regulations that govern the engagement, named in writing · 548 of 795 respondents named at least one

Naming a governing law or regulation did not clearly distinguish the reported control environment. The ability to name an obligation is different from understanding its operational implications or applying an effective control. The role pattern is also material, because all respondents answering that they did not know were individual contributors. The result does not establish equivalent legal knowledge or compliance among the groups.

Of the 795 respondents who answered, 548 (68.93%) named at least one law or regulation, on all 150 engagements. They recorded a score of 4.06, against 3.90 among the 247 who answered that they did not know (cluster-robust p = 0.198).

At the engagement level, the share naming a law was associated with the score at r = 0.07 (p = 0.403, n = 150 engagements), and after adjustment for the mean of the other 53 indicators the partial r was 0.00 (p = 0.983).

The difference that existed lay in role. All 150 engagement managers, all 29 portfolio directors who answered, and the one customer management executive who answered named a law, while 368 of the 615 individual contributors did, so every answer of I do not know came from an individual contributor. Among individual contributors alone, those who named a law recorded a score of 3.87, against 3.90 among those who did not (cluster-robust p = 0.836). The share naming a law moved within a narrow range across the indicator quintiles, from 97 of 153 respondents in the lowest to 109 of 158 in the highest, and across engagement status, from 117 of 164 respondents in Build-Out to 197 of 297 on canceled engagements.

Knowledge of the governing law sat beside failed controls in the written answers. An individual contributor on a regulatory return described entity codes that arrived inconsistent from two systems and were normalized by the delivery team without anyone asking.

“Happens most weeks, i do not always discuss about it with lead, just fix and revert back if they ask. And to be fair nobody has ever asked. The regulatory return data comes across with the entity codes inconsistent between the two systems they extract from, and if you load it straight the aggregation is wrong at the entity level. Which for a regulatory return is not a small thing. So we normalise it first. We have been normalising it first since the second month of the engagement. It is in nobody's process document. I have assumed my lead has passed it up because he is diligent about that sort of thing, though i do not actually know. What i do know is the returns that go out are right, and they are right because somebody here noticed the codes did not line up. Also if that person moves on, the next person may not notice, and the return would still go out, just wrong. That is the thing that i think about occasionally. Not the work itself, the work is fine, it is more that the” -Individual Contributor, KPO, Regulatory, audit, tax and legal

1.2 Respondent Understanding of the Governing Obligations

Survey item C057 · I fully understand how these laws, regulations, and similar affect the outsourcing engagement · Rated item analyzed only in Part 3

Greater self-reported understanding of governing obligations was associated with higher scores, including under the main adjustment. This connects awareness of the obligations with the reported control environment rather than treating a named law as evidence of governance. The measure remains a self-assessment. It does not independently test knowledge or demonstrate that the engagement complied with the obligations respondents had in mind.

Understanding was associated with the score at r = 0.76 (95% CI 0.68 to 0.82, n = 150 engagements), and after that adjustment the association remained at partial r = 0.27 (p < 0.001), the strongest positive adjusted association of the four rated items.

Respondents who rated their understanding distressed recorded a score of 2.41 (n = 228), against 4.60 (n = 572) among the rest (cluster-robust p < 0.001). Of the 228, 168 (73.68%) had a score of 3 or below. Among the 484 who rated their understanding 4 to 7, 101 (20.87%) did, and none of the 88 who rated it 8 to 10 did (chi-square = 243.81, p < 0.001, Cramér's V = 0.55).

The association was observed within the canceled engagements at r = 0.61 and across the active stages at 0.64 to 0.71, and after Holm adjustment it held in 84 of the 86 segment levels tested. Within role it stood at 0.75 among individual contributors, 0.73 among engagement managers, and 0.66 among portfolio directors. Among individual contributors alone, 73.44% (141 of 192) of those who rated their understanding 1 to 3 had a score of 3 or below.

Eight respondents on 6 engagements wrote about their understanding of the obligations, and only one of the answers was negative. Six of the seven favorable answers came from canceled engagements and named regulatory understanding among what the respondent took from an engagement that failed. One individual contributor on a canceled engagement listed the regulatory accountability question, learned in depth, among what the engagement had given.

1.3 Management Understanding of the Governing Obligations

Survey item C058 · My management team fully understands these laws, regulations, and similar, and how they affect the engagement · Rated item analyzed only in Part 3

Respondents' assessments of management understanding were associated with the score, while many respondents could not provide a numeric assessment. This distinguishes management's reported knowledge from the workforce's visibility into that knowledge. Unknown answers identify uncertainty about management understanding and are excluded from the numeric rating comparison. They do not establish that management had low knowledge.

Of the respondents who answered, 265 answered that they did not know, and they recorded a score of 3.83. Among the respondents who gave a rating, management's understanding was associated with the score at r = 0.71 (95% CI 0.62 to 0.78, n = 150 engagements), and after adjustment for the mean of the other 53 indicators the association remained at partial r = 0.25 (p = 0.002).

Respondents who rated management's understanding distressed recorded a score of 2.42 (n = 149), against 4.73 (n = 367) among the rest (cluster-robust p < 0.001). Of the 149, 113 (75.84%) had a score of 3 or below, the highest such share of the four items. Among the 297 who rated it 4 to 7, 54 (18.18%) did, and none of the 70 who rated it 8 to 10 did (chi-square = 189.44, p < 0.001, Cramér's V = 0.61).

The association was observed within the canceled engagements at r = 0.63 and across the active stages at 0.66 to 0.69, and after Holm adjustment it held in 81 of the 84 segment levels tested. Within role it stood at 0.74 among individual contributors, 0.75 among engagement managers, and 0.71 among portfolio directors. Among individual contributors alone, 79.09% (87 of 110) of those who rated it 1 to 3 had a score of 3 or below.

No written answer addressed management's understanding of the obligations, and 265 respondents could not rate it, so the study holds no testimony on how management came to understand the obligations or failed to.

1.4 Regulatory or Compliance Exposure Reported by Respondents

Written pattern · All written answers to the open questions · 16 answers from 14 respondents on 12 engagements · Counted in Part 5, Experience, Pressure and Intent of the Delivery Workforce, section 10.2

The small group describing regulatory or compliance exposure had lower mean scores. These accounts connect perceived exposure with the control environment, but they do not establish a legal breach or an exposure rate for the study population. The engagement-level association was not clearly detected. The appropriate interpretation preserves the concern described and the limits of the small written base.

Mean scores were 2.83 for the 14 respondents describing exposure and 4.01 for the other 836 (cluster-robust p = 0.005). Among individual contributors alone, the 10 who described exposure stood at 2.65, against 3.88 among the other 657 (cluster-robust p = 0.008).

At the engagement level, the share describing exposure was associated with the score at r = −0.14 (p = 0.099, n = 150 engagements), and after adjustment for the mean of the other 53 indicators the partial r was −0.08 (p = 0.309). The 12 engagements were too few for the exposure to separate engagements by their governance.

Exposure was described by 8 of the 283 respondents with a score of 3 or below, 6 of the 528 above 3 to 7, and none of the 39 above 7. It appeared on canceled engagements and in every stage except Transition/Cut-Over, and it reached 10 of the 667 individual contributors and 4 of the 150 engagement managers, with no clearly detected difference by role after Holm adjustment. No segment family differed after Holm adjustment.

The 16 answers came from all written answers to the open questions, and 9 of them were written on canceled engagements. Part 5 counts 20 answers on 14 engagements that referred to a regulation, a regulator, or an audit obligation, among the written answers on the manual alteration methods alone, so the two counts rest on different bases. Respondents described a regulatory deadline that would not wait for a rerun, a tool that misquoted regulatory guidance to a borrower in hardship, and compliance reports that cleared a non-compliant letter.

“The vendor rolled the non-compliant investor letter into a monthly 'draft accuracy' composite score that averaged it against hundreds of routine internal messages, so the single high-risk failure barely moved the number the client saw.” -Individual Contributor, CXM, Client servicing and communications

“the problem is same case, same data, different result next run, so i correct it manually before it goes to QA, this happen more than i like to admit on dispute side, you rerun same chargeback case and get different recommendation back, no warning, no explanation, and dispute case cannot have mistake in it because Reg E deadline does not care that model changed its mind, so i sit there and go through informations again myself before submitting, i raise it with my lead every time truthfully, we dont log it separate though, its just treated as part of normal QA now, feels like nobody upstream really want to hear about it anymore, i said it enough time already, card network side is no better, evidence file come in miscoded half the time and we wait weeks for any answer while deadline get closer and closer, so between that and model flipping on same case i end up doing double work most day, im tired of explaining same problem over and over to be honest, feedbacks from client escalation channel is slow too so even when we do flag something upstream nothing move fast, i just check output twice now before i trust it and if the two run disagree i take whichever one match what i already know about the case, its not ideal but dispute deadline dont move for anyone so” -Individual Contributor, BPO, Payments, cards and disputes

Part 5 (Experience, Pressure and Intent of the Delivery Workforce, section 10.2) reports the regulatory references in the answers on manual alteration.

2 Discussion and Training on the Governing Obligations

Discussion and training concern how obligations enter day-to-day governance. Reported discussion by the financial institution was positively associated with the score under the main adjustment. Training effectiveness showed a more model-dependent result. Their distinct patterns support separate treatment of communication and preparation, rather than a single conclusion about legal awareness.

2.1 Discussion of the Obligations by the Financial Institution's Team

Survey item C059 · The customer's team actively discusses these laws, regulations, and similar with our team · Rated item analyzed only in Part 3

More active discussion of governing obligations by the financial institution's team was associated with higher scores. The indicator concerns whether obligations enter the joint operational conversation, beyond whether respondents can name or understand them individually. The positive adjusted estimate supports a conditional association with the control environment. Discussion itself remains distinct from evidence that the required controls were implemented effectively.

Discussion was associated with the score at r = 0.79 (95% CI 0.72 to 0.84, n = 150 engagements), and after that adjustment the association remained at partial r = 0.20 (p = 0.017).

Respondents who rated the financial institution's discussion distressed recorded a score of 2.39 (n = 231), against 4.64 (n = 570) among the rest (cluster-robust p < 0.001). Of the 231, 168 (72.73%) had a score of 3 or below. Among the 481 who rated it 4 to 7, 100 (20.79%) did, and none of the 89 who rated it 8 to 10 did (chi-square = 239.42, p < 0.001, Cramér's V = 0.55).

The association held after Holm adjustment in all 85 segment levels tested, the only one of the four items to do so. It held within the canceled engagements at r = 0.65 and across the active stages at 0.67 to 0.71. Within role it stood at 0.78 among individual contributors and 0.74 among engagement managers and fell to 0.53 among portfolio directors. Among individual contributors alone, 75.38% (147 of 195) of those who rated it 1 to 3 had a score of 3 or below.

No written answer addressed the financial institution's discussion of the obligations directly. An engagement manager on a canceled regulatory engagement reported that the financial institution's compliance staff answered every call, while the delivery team could not learn which of three regional versions of the control the work was to follow.

“i felt for their compliance people to be candid. They answered every time we called. The problem was that surveillance runs three different ways in three regions over there and nobody could tell us which one we were supposed to build to.” -Engagement Manager, ITO, Regulatory, audit, tax and legal

2.2 Regulatory Training

Survey item C060 · The training available to me effectively teaches me about these laws, regulations, and similar · Rated item analyzed only in Part 3

Reported effectiveness of regulatory training was associated with the wider score, but its adjusted coefficient was sensitive to the comparison measure. Training concerns whether the workforce is equipped to apply the obligations to its work. Its negative coefficient in the main adjusted model should not be read as training worsening governance. The category-removal result limits that interpretation and leaves effectiveness as a reported assessment.

Training was distressed for 48.25% of the respondents who rated it, against 28.50% to 28.88% for the other three rated items.

Training was associated with the score at r = 0.81 (95% CI 0.74 to 0.86, n = 150 engagements), the highest of the four items. After adjustment for the mean of the other 53 indicators, the partial r was −0.35 (p < 0.001). The result stayed inverse when the financial institution readiness block was omitted from the comparison mean (−0.25, p = 0.002), when the AI technology block left it (−0.30, p < 0.001), and when the third-party block left it (−0.24, p = 0.004). It reversed to 0.10 (p = 0.232) when the vendor capability block was omitted from the comparison mean.

Respondents who rated training distressed recorded a score of 2.74 (n = 385), against 5.09 (n = 413) among the rest (cluster-robust p < 0.001). Of the 385, 244 (63.38%) had a score of 3 or below. Among the 402 who rated training 4 to 7, 28 (6.97%) did, and none of the 11 who rated it 8 to 10 did (Monte Carlo chi-square = 284.31, p < 0.001, Cramér's V = 0.60).

The association was observed within the canceled engagements at r = 0.72 and ranged across the active-stage groups from 0.67 in Build-Out to 0.80 in Production. After Holm adjustment, it was significant in 85 of the 86 segment levels tested. Within role it stood at 0.80 among individual contributors, 0.77 among engagement managers, and 0.64 among portfolio directors. Among individual contributors alone, 65.59% (204 of 311) of those who rated training 1 to 3 had a score of 3 or below.

Five respondents on 5 engagements wrote about regulatory training, and all five answers were negative. None described one of the 26 forms of a control bypassed or not working. The answers described individual contributors placed on regulated work without training in its rules, who learned sanctions lists, suitability rules, and returns from colleagues or from the financial institution's own manuals.

“What they gave us for training was two weeks of generic e-learning and nothing on sanctions or aml typologies at all. i came in not knowing what a structuring pattern looks like and i learned it from the analyst sitting next to me. kindly note this is the whole reason my numbers here are low. everything else i can live with” -Individual Contributor, BPO, Financial crime and client onboarding

“To be fair the hands on agent training was useful, I use it daily. The regulatory side they could not teach us, we learn that from the client's returns” -Individual Contributor, KPO, Regulatory, audit, tax and legal