Related provisions for BIPRU 12.9.22
1 - 20 of 98 items.
The FCA4 will consider the full circumstances of each case when determining whether or not to take action for a financial penalty or public censure. Set out below is a list of factors that may be relevant for this purpose. The list is not exhaustive: not all of these factors may be applicable in a particular case, and there may be other factors, not listed, that are relevant.4(1) The nature, seriousness and impact of the suspected breach, including:(a) whether the breach was deliberate
When deciding whether to take action for market abuse7, the FCA4 may consider the following additional factors:4(1) The degree of sophistication of the users of the market in question, the size and liquidity of the market, and the susceptibility of the market to market abuse.(2) The impact, having regard to the nature of the behaviour, that any financial penalty or public censure may have on the financial markets or on the interests of consumers:(a) a penalty may show that high
The FCA's4 rules on systems and controls against money laundering are set out in SYSC 3.2 and SYSC 6.3. The FCA4, when considering whether to take action for a financial penalty or censure in respect of a breach of those rules, will have regard to whether a firm has followed relevant provisions in the Guidance for the UK financial sector issued by the Joint Money Laundering Steering Group.44
In some cases it may not be appropriate to take disciplinary measures against a firm for the actions of an individual6 (an example might be where the firm can show that it took all reasonable steps to prevent the breach). In other cases, it may be appropriate for the FCA4 to take action against both the firm and the individual6. For example, a firm may have breached the rule requiring it to take reasonable care to establish and maintain such systems and controls as are appropriate
In addition to the general factors outlined in DEPP 6.2.1 G, there are some additional considerations that may be relevant when deciding whether to take action against an individual under6section 66 of the Act. This list of those considerations is non-exhaustive. Not all considerations below may be relevant in every case, and there may be other considerations, not listed, that are relevant.(1) The individual's6 position and responsibilities. The FCA4 may take into account the
6The FCA may take disciplinary action against an individual where there is evidence of personal culpability on the part of that individual. Personal culpability arises if the individual’s behaviour was deliberate or below the standard which would be reasonable in all the circumstances at the time of the conduct concerned.
The FCA will not discipline individuals6 on the basis of vicarious liability (that is, holding them responsible for the acts of others), provided appropriate delegation and supervision has taken place (see APER 4.6.13G, APER 4.6.14G, COCON 4.1.8G and COCON 4.2.17G to COCON 4.2.24G6). In particular, disciplinary action will not be taken against an approved person performing a significant influence function or a senior conduct rules staff member6 simply because a regulatory failure
9The FCA is able to take action against an SMF manager under section 66A(5) of the Act where: (1) there has been (or continues to be) a contravention of a relevant requirement by the SMF manager’sfirm;(2) at the time of the contravention, the SMF manager was responsible for the management of any of the firm’s activities in relation to which the contravention occurred; and(3) the SMF manager did not take such steps as a person in their position could reasonably be expected to take
3In addition to the general factors outlined in DEPP 6.2.1 G, there are some additional considerations that the FCA4 will have regard to when deciding whether to take action against a person that performs a controlled function without approval contrary to section 63A of the Act.4(1) The conduct of the person. The FCA4 will take into consideration whether, while performing controlled functions without approval, the person committed misconduct in respect of which, if he had been
The primary responsibility for ensuring compliance with Part VI of the Act, the Part 6 rules, the prospectus rules or a provision otherwise made in accordance with the Prospectus Directive or a requirement imposed under such provision rests with the persons identified in section 91(1) and section 91(1A) (Penalties for breach of Part 6 rules) of the Act respectively. Normally therefore, any disciplinary action taken by the FCA4 for contraventions of these obligations will in the
However, in the case of a contravention by a person referred to in section 91(1)(a) or section 91(1)(b) or section 91(1A) of the Act ("P"), where the FCA4 considers that another person who was at the material time a director of P was knowingly concerned in the contravention, theFCA4 may take disciplinary action against that person. In circumstances where the FCA4 does not consider it appropriate to seek a disciplinary sanction against P (notwithstanding a breach of relevant requirements
The Principles are set out in PRIN 2.1.1 R. The Principles are a general statement of the fundamental obligations of firms under the regulatory system. The Principles derive their authority from the FCA's4 rule-making powers set out in section 137A4(General rule-making power) of the Act. A breach of a Principle will make a firm liable to disciplinary action. Where the FCA4 considers this is appropriate, it will discipline a firm on the basis of the Principles alone.444
The Listing Principles and Premium Listing Principles5 are set out in LR 7. The Listing Principles set out in LR 7.2.1 R5 are a general statement of the fundamental obligations of all5listed companies. In addition to the Listing Principles, the Premium Listing Principles set out in LR 7.2.1A R are a general statement of the fundamental obligations of all listed companies with a premium listing11. The Listing Principles and Premium Listing Principles5 derive their authority from
In certain cases, it may be appropriate to discipline a listed company on the basis of the a Listing Principle or, if applicable, a Premium Listing Principle,5 alone. Examples include the following:5(1) where there is no detailed listing rule5 which prohibits the behaviour in question, but the behaviour clearly contravenes a Listing Principle or, if applicable, a Premium Listing Principle;55(2) where a listed company has committed a number of breaches of detailed rules5 which
When deciding how to proceed in such cases, the FCA4 will examine the circumstances of the case, and consider, in the light of the relevant investigation, disciplinary and enforcement powers, whether it is appropriate for the FCA4 or another authority to take action to address the breach. The FCA4 will have regard to all the circumstances of the case including whether the other authority has adequate powers to address the breach in question.444
In some cases, it may be appropriate for both the FCA4and another authority to be involved, and for both to take action in a particular case arising from the same facts. For example, a breach of RIE rules may be so serious as to justify the FCA4 varying or cancelling the firm's Part IV permission, or withdrawing approval from approved persons, as well as action taken by the RIE. In such cases, the FCA4 will work with the relevant authority to ensure that cases are dealt with efficiently
The FCA4 will not take action against a person over behaviour7 which does not amount to market abuse. Behaviour is less likely to amount to market abuse where it7 (a) conforms with the Takeover Code or rules of an RIE and (b) falls within the terms of MAR 1.10.4G to 1.10.6G7 which state7 that behaviour7 so conforming is unlikely to, of itself,7 amount to market abuse. The FCA4 will seek the Takeover Panel's or relevant RIE's views on whether behaviour7 complies with the Takeover
If any of the circumstances in DEPP 6.2.26 G apply, and the FCA4 considers that the use of its disciplinary powers under section 123 or section 129, or of its injunctive powers under section 381 or of its powers relating to restitution under section 383 or 384 is appropriate, it will not take action during an offer to which the Takeover Code applies except in the circumstances set out in DEPP 6.2.27 G.4
1The FCA, together with several other UK authorities, has powers under Part 8 of the Enterprise Act to enforce breaches of consumer protection law. Where a breach has been committed, the FCA will liaise with other authorities, particularly the Competition and Markets Authority (the CMA), to determine which authority is best placed to take enforcement action. The FCA would generally expect to be the most appropriate authority to deal with breaches by authorised firms in relation
1The FCA has powers under Part 8 of the Enterprise Act both as a “designated enforcer” in relation to domestic and Community infringements and as a “CPC enforcer” which gives the FCA and other CPC enforcers additional powers in relation to Community infringements so that they can meet their obligations as “competent authorities” under Regulation (EC) No.2006/2004 on co-operation between national authorities responsible for enforcement of consumer protection laws (the CPC Regulation).
1The FCA may also apply, if necessary without notice, for interim enforcement orders where immediate temporary prohibition of the relevant conduct is expedient pending full consideration by the court. Such interim orders can also be sought pre-emptively in relation to Community infringements, but again only preventing conduct in the course of business.
1The FCA’s investigative powers in support of its Enterprise Act enforcement powers are set out in Schedule 5 to the CRA. The FCA can, under Schedule 5, require any person to provide it with information which will enable it to (i) exercise or consider exercising its functions as an enforcer; or (ii) determine whether a person is complying with an enforcement order, an interim enforcement order or an undertaking given as described below. If the FCA requires a person to provide
1Before the FCA may apply for an enforcement order, including an interim enforcement order, it must: (1) give notice to the CMA of its intention to apply for an enforcement order; and (2) unless the application relates to breach of an undertaking given to the court (other than one to provide information), consult the person against whom the enforcement order would be made.
1The periods for notification and consultation is (both of which can be waived by the CMA) are: (1) 14 days before an application for an enforcement order is made unless, just as to consultation, the person to be consulted is a member of or represented by a body operating an approved consumer code, in which case the period is 28 days; or (2) 7 days in the case of an application for an interim enforcement order, unless the application relates to breach of an undertaking given to
1The aim of consultation is to ensure that any action taken is necessary and proportionate, and to ensure that businesses are given a reasonable opportunity to put things right before the courts become involved. The consultation period starts when the person receives the FCA's request for consultation and runs whether or not that person agrees to be consulted and/or is available for consultation.
1The Enterprise Act also makes provision for enforcers and courts to accept undertakings from persons who have committed breaches or, in respect of Community infringements, are considered likely to do so. The undertaking confirms that the person will not, amongst other things, commence, continue or repeat the conduct which constituted or, as to a Community infringement, would constitute the breach, although, as above, such a pre-emptive prohibition will only apply to conduct in
(1) 1A person subject to enforcement action may agree to a financial penalty or other outcome rather than contest formal action by the FCA.4Alternatively, they may enter into a focused resolution agreement and in this way partly contest the proposed action (see DEPP 5.1.8AG to DEPP 5.1.8DG).54(1A) 5Further, even if the person subject to enforcement action wishes to fully contest the proposed enforcement action, they may choose to do so by (i) agreeing to the FCA issuing the required
Settlement discussions may take place at any time during the enforcement process if both parties agree. This might be before the giving of a warning notice, before a decision notice, or even after referral of the matter to the Tribunal. But the FCA4 would not normally agree to detailed settlement discussions until it has a sufficient understanding of the nature and gravity of the suspected misconduct or issue to make a reasonable assessment of the appropriate outcome. Settlement
The terms of any proposed settlement:(1) will be put in writing and be agreed by FCA4 staff and the person concerned;4(2) may refer to a draft of the proposed statutory notices setting out the facts of the matter and the FCA's4 conclusions; 4(3) may, depending upon the stage in the enforcement process at which agreement is reached, include an agreement by the person concerned to: (a) waive and not exercise any rights under sections 387 (Warning notices) and 394 (Access to Authority
5The terms of any proposed focused resolution agreement:(1) will be put in writing and be agreed by FCA staff and the person concerned;(2) may refer to a draft of the proposed warning notice; and (3) may, depending upon the stage in the enforcement process at which agreement is reached, include an agreement by the person concerned to: (a) waive and not exercise any rights under sections 387 (Warning notices) and 394 (Access to Authority material) of the Act to notice of, or access
(1) 5The purpose of this section is to define a procedure (the “expedited reference procedure”) enabling a person subject to enforcement action to challenge the proposed action before the Tribunal without engaging with the FCA’s internal decision-making process.(2) DEPP 5.1.8FG to DEPP 5.1.8IG set out the circumstances in which the expedited reference procedure is available, the steps a person must take to make use of the procedure, and how the procedure operates, depending on
5To use the expedited reference procedure, the person subject to enforcement action must notify the FCA that they:(1) wish to make an expedited reference to the Tribunal; and(2) waive and will not exercise any rights under section 387(2) of the Act in respect of the warning notice given (or to be given) in relation to the proposed action.
5Once a decision notice has been given as part of the expedited reference procedure (whether by the settlement decision makers or the RDC), it is the responsibility of the person subject to enforcement action to seek to refer the matter to the Tribunal under the Act if they so wish. If the matter is not referred to the Tribunal within the time required under section 390(1) of the Act, the FCA will, on taking the action to which the decision notice relates, give a final notice
3The FCA does not have a set of enforcement priorities that are distinct from the priorities of the FCA as a whole. Rather, the FCA consciously uses the enforcement tool to deliver its overall strategic priorities. The areas and issues which the FCA as an organisation regards as priorities at any particular time are therefore key in determining at a strategic level how enforcement resource should be allocated. FCA priorities will influence the use of resources in its supervisory
3This does not mean that the FCA will only take enforcement action in priority strategic areas. There will always be particularly serious cases where enforcement action is necessary, ad hoc cases of particular significance in a markets, consumer protection or financial crime context, or cases that the FCA thinks are necessary to achieve effective deterrence.
3The combination of the priority given to certain types of misconduct over others and the FCA's risk-based approach to enforcement means that certain cases will be subject to enforcement action and others not, even where they may be similar in nature or impact. The FCA's choice as to the use of the enforcement tool is therefore a question of how the FCA uses its resources effectively and efficiently and how it ensures that it is an effective regulator.
In all cases, before 4it proceeds with an investigation, the FCA will satisfy itself that there are grounds to investigate under the statutory provisions that give the FCA powers to appoint investigators. Another consideration will be whether the FCA is under a Community obligation to take action on behalf of, or otherwise to provide assistance to, an authority from another EU member state. EG 2.5.14discusses the position where other authorities may have
4The FCA’s referral criteria are published on the Enforcement section of the FCA’s website: http://www.fca.org.uk/about/enforcement/referral-criteria. In considering whether an enforcement investigation is likely to further the FCA’s aims and objectives, the FCA will consider factors that address the following issues:(1) any available supporting evidence and the proportionality and impact of opening an investigation;(2) what purpose or goal would be served if the FCA were to end
4In relation to non-criminal market abuse investigations, the revised referral criteria will be similarly applied in deciding whether to open such an investigation. However, given the often limited alternatives to enforcement action available to address market abuse (with many of the subjects typically unauthorised), greater emphasis will be given to the egregiousness and deterrence value of a particular case when making such decisions.
1The FCA wishes to encourage firms to exercise judgement about, and take responsibility for, what the Principles mean for them in terms of how they conduct their business. But we also recognise the importance of an environment in which firms understand what is expected of them. So we have indicated that firms must be able reasonably to predict, at the time of the action concerned, whether the conduct would breach the Principles. This has sometimes been described as the “reasonable
1To determine whether there has been a failure to comply with a Principle, the standards we will apply are those required by the Principles at the time the conduct took place. The FCA will not apply later, higher standards to behaviour when deciding whether to take enforcement action for a breach of the Principles. Importantly, however, where conduct falls below expected standards the FCA considers that it is legitimate for consequences to follow, even if the conduct is widespread
1The FCA will exercise the power to make an electronic commerce activity direction on a case-by-case basis. When deciding whether to make a direction, the FCA will undertake an assessment of whether the circumstances of the particular case meet the policy conditions set out in regulation 6.
1However, there are likely to be circumstances in which the FCA will need to use the electronic commerce activity direction power. Examples could include where it was necessary to stop the behaviour complained of, or to make the continued provision of services by the incoming ECA provider conditional upon compliance with specified requirements. Overall, the FCA may use the direction power: (1) where: (a) the behaviour complained of was causing, or had the potential to cause,
1The FCA will consider the full circumstances of the case when deciding whether exercising the direction power, without first taking the procedural steps set out in regulation 6, is an appropriate response to such concerns. The factors the FCA may consider include those listed in paragraph 19.9.4 of this guide. There may be other relevant factors.
1The FCA's decision to make, revoke or vary an electronic commerce activity direction will generally be taken by the RDC Chairman. However, this is subject to two exceptions. (1) In an urgent case and if the Chairman is not available, the decision will be taken by an RDC Deputy Chairman and where possible, but subject to the need to act swiftly, one other RDC member. (2) If a provider who has been notified of the FCA's intention to make
In addition to the factors considered in Step 2 for cases against firms (DEPP 6.5A) and cases against individuals (DEPP 6.5B),1 the following considerations are relevant.1(1) In general, the FCA's2 approach to disciplinary action arising from the late submission of a report will depend upon the length of time after the due date that the report in question is submitted.2(2) If the person concerned is an individual, it is open to him to make representations to the FCA2 as to why
1The FCA will consider all the relevant circumstances when it determines the period of limitation. Set out below is a list of factors that may be relevant for this purpose. The list is not exhaustive: not all of these factors may be applicable and there may be other factors, not listed, that are relevant.
1The following factors may be relevant when determining the period of limitation: (1) whether the FCA may be minded to reapprove the approved person in the future, for example if the approved person takes action specified by the FCA during the period of limitation;(2) the approved person's expected lost earnings if the FCA imposes a short period of limitation; (3) whether imposing a short period of limitation would cause the approved person serious financial hardship.
1The factors the FCA will consider when deciding whether to use the section 166 power include: (1) If the FCA's objectives for making further enquiries are predominantly for the purposes of fact finding i.e. gathering historic information or evidence for determining whether enforcement action may be appropriate, the FCA's information gathering and investigation powers under sections 167 and 168 of the Act are likely to be more effective and more appropriate than the power under
1Where it exercises this power, the FCA will make clear both to the firm and to the skilled person the nature of the concerns that led the FCA to decide to appoint a skilled person and the possible uses of the results of the report. But a report the FCA commissions for purely diagnostic purposes could identify issues which could lead to the appointment of an investigator and/or enforcement action.
1Section 59(1) is relevant where the firm directly employs the person concerned. Under the provision, a firm ('A') must take reasonable care to ensure that no person performs a controlled function under an arrangement entered into by A in relation to the carrying on by it of a regulated activity, unless the appropriate regulator (as defined in section 59(4) of the Act) approves the performance by that person of the controlled function to which the approval relates.
1Section 59(2) is relevant where the person is employed by a contractor of the firm. It requires a firm ('A') to take reasonable care to ensure that no person performs a controlled function under an arrangement entered into by a contractor of A in relation to the carrying on by A of a regulated activity, unless the appropriate regulator (as defined in section 59(4) of the Act) approves the performance by that person of the controlled function to which the approval
1An important consideration before an enforcement investigation and/or enforcement action is taken forward is the nature of a firm’s overall relationship with the FCA and whether, against that background, the use of enforcement tools is likely to further the FCA's aims and objectives. So, for any similar set of facts, using enforcement tools will be less likely if a firm has built up over time a strong track record of taking its senior management responsibilities seriously and
1On its web site, the FCA gives2 anonymous examples of where it has decided not to investigate or take enforcement action in relation to a possible rule breach because of the way in which the firm has conducted itself when putting the matter right. This is part of an article entitled ‘The benefits to firms and individuals of co-operating with the FCA2’. However, in those cases where enforcement action is not taken and/or a formal investigation is not commenced,
1These Regulations give effect to the Distance Marketing Directive.24 Under the Regulations, the FCA can enforce breaches of the Regulations concerning “specified contracts”. Specified contracts are certain contracts for the provision of financial services which are made at a distance and do not require the simultaneous physical presence of the parties to the contract. 24 Directive 2002/65/EC
1The FCA may also prosecute offences under the Regulations which relate to specified contracts. It will generally be appropriate for the FCA to seek to resolve the breach by obtaining an undertaking before it applies for an injunction or initiates a prosecution. Where a failure by a firm to meet the requirements of the Regulations also amounts to a breach of the FCA'srules, the FCA will consider all the circumstances of the case when deciding whether to take action for a breach
(1) 1The FCA's3 approach to determining penalties described in DEPP 6.5 to DEPP 6.5C is intended to ensure that financial penalties are proportionate to the breach. The FCA3 recognises that penalties may affect persons differently, and that the FCA3 should consider whether a reduction in the proposed penalty is appropriate if the penalty would cause the subject of enforcement action serious financial hardship.333(2) Where an individual or firm claims that payment of the penalty
(1) In assessing whether a penalty would cause an individual serious financial hardship, the FCA3 will consider the individual’s ability to pay the penalty over a reasonable period (normally no greater than three years). The FCA's3 starting point is that an individual will suffer serious financial hardship only if during that period his net annual income will fall below £14,000 and his capital will fall below £16,000 as a result of payment of the penalty. Unless the FCA3 believes
(1) The FCA3 will consider reducing the amount of a penalty if a firm will suffer serious financial hardship as a result of having to pay the entire penalty. In deciding whether it is appropriate to reduce the penalty, the FCA3 will take into consideration the firm’s financial circumstances, including whether the penalty would render the firm insolvent or threaten the firm’s solvency. The FCA3 will also take into account its statutory objectives3, for example in situations where
Persons subject to enforcement action may be prepared to agree the amount of any financial penalty, or the length of any period of suspension, restriction, condition,5 limitation or disciplinary prohibition5 (see DEPP 6A)4, and other conditions which the FCA seeks to impose by way of such action. These4 conditions might include, for example, the amount or mechanism for the payment of compensation to consumers. The FCA recognises the benefits of such agreements, as4 they offer
6Where DEPP 6.7.3AG specifies that the reduction will be within a range, the decision maker identified by DEPP 6.7.3BG will determine the appropriate figure within the range. Factors relevant to this determination may include:(1) the extent to which the position taken by the person subject to enforcement action on the disputed issues at the time the focused resolution agreement is entered into is reflected in the terms of the decision notice.(2) any saving of time or public resources
(1) Any settlement agreement6 between the FCA3 and the person concerned will therefore need to include a statement as to the appropriate penalty discount in accordance with this procedure.3(2) In certain circumstances the person concerned may consider that it would have been possible to reach a settlement at an earlier stage in the action, and argue that it should be entitled to a greater percentage reduction in penalty than is suggested by the table at DEPP 6.7.3G (3). It may
1The possibility of settlement does not, however, change the fact that enforcement action is one of the tools available to the FCA to secure our statutory objectives. The FCA seeks to change the behaviour not only of those subject to the immediate action, but also of others who will be alerted to our concerns in a particular area. There is no distinction here between action taken following agreement with the subject of the enforcement action and action resisted by a firm before
1Settlements in the FCA context are not the same as ‘out of court’ settlements in the commercial context. An FCA settlement is a regulatory decision, taken by the FCA, the terms of which are accepted by the firm or individual concerned. So, when agreeing the terms of a settlement, the FCA will carefully consider its statutory objectives and other relevant matters such as the importance of sending clear, consistent messages through enforcement action, and will only settle in appropriate
3The FCA will consider the circumstances of each case, but will ordinarily publicise enforcement action where this has led to the issue of a final notice. The FCA may also publicise enforcement action where this has led to the issue of a decision notice. The FCA will decide on a case-by-case basis whether to publish information about the matter to which a decision notice relates, but expects normally to publish a decision notice if the subject of enforcement action decides to
3Publishing notices is important to ensure the transparency of FCA decision-making; it informs the public and helps to maximise the deterrent effect of enforcement action. The FCA will upon request review warning notice statements, decision notices, final notices and related press releases that are published on the FCA's website. The FCA will determine at that time whether continued publication is appropriate, or whether notices and publicity should be removed or amended.
3In cases where the FCA publishes a warning notice statement and the FCA subsequently decides not to take any further action, or where it publishes a decision notice and the subject of enforcement action successfully refers the matter to the Tribunal, the FCA will make it clear on its website that the warning notice or the 2decision notice no longer applies. The FCA will normally do this by publishing a notice of discontinuance with the consent of the person to whom the notice
1The FCA's approach to taking enforcement action under the Immigration Regulations will mirror its general approach to enforcing the Act, as set out in EG 2. It will seek to exercise its enforcement powers in a manner that is transparent, proportionate and responsive to the issue and consistent with its publicly stated policies. It will also seek to ensure fair treatment when exercising its enforcement powers. Finally, it will aim to change the behaviour of the person who is
1The Immigration Regulations apply the procedural provisions of Part 9 of the Act, as modified by the Immigration Regulations, in respect of matters that can be referred to the Tribunal. Referral to the Tribunal in respect of decision notices given under regulation 25(1) of the Immigration Regulations are treated as disciplinary referrals for the purpose of section 133 of the Act.
2The FCA will not bring disciplinary proceedings against a person for failing to be open and co-operative with the FCA1 simply because, during an investigation, they choose not to attend or answer questions at a purely voluntary interview. However, there may be circumstances in which an adverse inference may be drawn from the reluctance of a person (whether or not they are a firm or individual1) to participate in a voluntary interview. If a person provides the FCA with misleading
2If a person does not comply with a requirement imposed by the exercise of statutory powers, they may be held to be in contempt of court. The FCA may also choose to bring proceedings for breach of Principle 11,1 Statement of Principle 4 or COCON 2.1.3R1 as this is a serious form of non-cooperation.
1This means that there will be situations in which the FCA has powers to investigate and take action under both the Act and the Money Laundering Regulations. The FCA will consider all the circumstances of the case when deciding what action to take and, if it is appropriate to notify the subject about the investigation, will in doing so inform them about the basis upon which the investigation is being conducted and what powers it is using. The FCA will adopt the approach outlined
1The FCA will adopt a risk-based approach to its enforcement under2 the Money Laundering Regulations. Failures in anti-money laundering or counter-terrorist financing2 controls will not automatically result in disciplinary sanctions, although enforcement action is more likely where a firm has not taken adequate steps to identify its2 risks or put in place appropriate controls to mitigate those risks, and failed to take steps to ensure that controls are being effectively implemented.