The CSA staff’s typical criteria for approving or accepting a consultant

When the regulators approve of this-or-that consultant before allowing the firm to take him/it on, they generally ask the following.

• Can the consultant prove that it has sufficient knowledge, resources and staff to properly evaluate the firm’s compliance system and controls and supervision structure at all locations from which the firm operates, and appropriately address any weaknesses or deficiencies?  
• Can he/it demonstrate that he/it has extensive experience with that type of firm, the key problems that it is to solve ('remediate' is the universal watchword here, on both sides of the Atlantic) and the relevant laws and regulations?  
• Is he/it independent of the firm? Can he/it demonstrate (presumably to the regulators) that he/it has no conflicts of interest with respect to the job? He/it might be 'dependent' or a conflict might exist if he/it has an existing business, personal or family relationship with the firm and/or its individuals. He/it might have previously acted for the firm in an advisory capacity when the firm ceased to be compliant; this would certainly remove his/its independence.  
• Can he/it act independently of the firm that is, after all, paying for his/its services? He/it must never act as a paid advocate for the firm’s assertions and must instead form his/its own views about the right approaches that the firm should take on the road to righteousness.
• What is the regulator’s prior experience with the consultant? This might cover his/its conduct, quality of work (recommendations, testing and reporting), and the effectiveness and efficiency of previous consulting engagements.
• Can the consultant show the regulators, through prior experience, that he/it can "effectively persuade and influence the firm to enhance its culture of compliance and mindset, and to improve its practices and procedures to address deficiencies"?
• Can he/it show that he/it has the capacity and resources to complete the engagement on time?

For some engagements, not all of these criteria will apply. For others, more must. A consultancy firm might have performed well on a previous occasion, but this is no guarantee that it will be approved for another because all engagements are unique.

If the consultant is a lawyer or law firm, solicitor-client privilege may apply to communications between it and others, which may be inconsistent with the unrestricted communications required by the regulatory decision. In this case, regulators in some jurisdictions may ask the firm to waive its solicitor-client privilege as it relates to the consultant and the engagement.

Reading between the lines, it seems evident that the regulators favour the appointment of people like them, i.e. ex-compliance officers or people who have been regulators themselves.

The firm's background checks on consultants

Just as regulators do not recommend software vendors to financial firms, neither to they endorse or recommend any consultants or keep lists of approved consultants. It is up to the firm in question to find out whether this-or-that prospective consultant has the knowledge, experience, independence and resources for the job before it proposes him/it to the regulators. To do this job it should ask the following questions.

• What is the consultant’s education, 'designations' (an "ultimate designated person," in Canadian parlance, is primarily responsible for promoting a culture of compliance and overseeing a firm's compliance system) and employment history?
• What types of past engagements has the consultant worked on? What were the results?
• Is the consultant able to start soon after being engaged? If not, when is he/it ready to start?  
• Is there more than one person employed by the consultant to provide back-up, support, expertise and continuity?

Here are some ways in which a firm might settle on the right consultant.

• In the context of a regulatory decision, it could simply ask the regulators about its options and choices.
• It could obtain referrals from lawyers, public accountants, security industry contacts, service providers and any industry or trade bodies of which it is a member.
• It could read websites, online reviews and social media postings that mention compliance people and associations or societies of compliance people.

Regulatory decisions

A firm may be required to hire a consultant as the result of regulatory action by the CSA staff, a decision of a director, or an order from a regulator after a compliance review or an enforcement investigation of the firm that spotted some non-compliance with securities laws. Such orders are called regulatory decisions and it is these that frame the consultant's job in some circumstances.

A regulatory decision typically tells the firm not to hamper the consultant when he/it wants to provide regulators with copies of its books and records that it has uncovered. It also forces the firm to provide him/it with reasonable access to said books and records and to require its employees to co-operate with him/it.

The final report or attestation letter that ends the exercise typically has to be approved by the regulators. Only then can the terms of the regulatory decision, whatever it is, be satisfied and the consultant's job be over.