Mobile Call Recording

Introduction

Mobile Call Recording is a risk management issue. Landline call recording systems have been deployed to ensure risks are managed with good record keeping from desktop phones, but mobile phones remain largely off the governance radar.

Regardless of regulators, it is good governance to record all relevant phone calls, both on landlines and mobile phones.

To be able to perform to client and company expectations, many staff need to use their mobile phones to conduct at least some of their business.Some firms' policies ban the usage of mobile phones but in reality this guideline is often flouted to win business or for personal convenience. Any advice, deals, transactions or other verbal aggrements that have taken place over unrecorded mobile phones are a major source of risk that undermines existing investments in landline call recording systems.

Rogue traders are always going to find a way of bypassing internal controls, for example by using personal phones or face to face meetings. However by recording mobile phones senior management will be seen by stakeholders and regulatorsto have taken all reasonable steps to manage risk.

Risk

In today‟s cautious financial market environment, risk management is increasingly under the spotlight. The good reputation of any business in the financial services sector is vital for success not only with customers but also with investors, business partners, regulators, rating agencies and staff.

The FSA and Call Recording

Why the FSA want calls recorded?

The FSA considers telephone recording to be valuable evidence when investigating market abuse, and in particular insider dealing and market manipulation.
In addition the FSA considers that good quality recording of voice conversations helps regulated firms and the FSA detect and deter inappropriate behaviour so leading to increased market confidence and greater price efficiency.

FSA Requirements

From March 2009, the FSA will require regulated firms to record all telephone conversations and electronic communications relating to client orders and the conclusion of transactions in the equity, bond, and derivatives markets. The recordings must be retained for at least 6 months.

Are mobile phones included in the FSA’s requirements?

The FSA has exempted mobile phones for the time being but is reviewing this exemption in September 2009 in line with an EU review regarding the addition of a taping requirement under the Markets in Financial Instruments Directive (MiFID). The FSA estimates that 41% of firms are currently making „relevant‟ conversations on mobile phones. The FSA‟s independent consultants stated in the FSA‟s Policy Statement PS08/1* that:

“it seems unlikely to make regulatory sense to record landlines if you cannot cover mobile phones as well (otherwise one creates clear incentives to conduct illicit conversations through mobile phones, and the cost of installing and maintaining the fixed-line-only recording machine is incurred for no reason”

*Source: FSA Policy statement PS08/1 regarding “Telephone Recording: recording of voice conversations and electronic communications", March 2008.
http://www.fsa.gov.uk/pubs/policy/ps08_01.pdf 

Best Practice and Controls

By recording mobile phone calls, it is possible to add new Best Practice statements to Internal Audit reports that further differentiate a company on the strength of its cutting edge risk management and IT controls framework and protect senior management.
Whilst there are a variety of technologies that can be used to record mobile phones, some of these introduce additional technology risks. An IT auditor should be able to review the quality of record keeping from mobile phones against Best Practice statements.

Technology Risk Assessment

When assessing mobile call recording solutions, their impact on IT risk and controls needs to be evaluated. For example, where 1=low and 5=high.

Clearly with the increasing use of mobiles for business and the likelihood of mobile call recording becoming a regulatory requirement in future the need exists for an easy to use, cost effective, secure method of recording mobile phone calls.
The mobile gateway solutions available often come with inherent technology risks in reliability, the effectiveness of controls and variable costs. To address these risks, an effective mobile call recording solution needs to be simple to use, leveraging existing mobile and recording facilities and cannot be bypassed by mobile users.

Key Success Factors

MultipartyTalk‟s approach to mobile call recording addresses people and controls, as well as underlying technologies. The key success factors for mobile call recording are:

• Identification of the risks that mobile call recording would help mitigate:The easiest way to identify the level of risk is to look at customer complaint files and a company‟s litigation history. Are there any cases where complaints and disputes have arisen over who said what? Have there been disputes that have been escalated to legal, where a record of conversations on company mobiles would have helped protect customer confidence, reputation and reduce legal costs? If so, what has been the cost and impact of such disputes
• Mandate a company security policy: The decision to record company mobiles may not be a popular one because employees will be reluctant to make personal phone calls if they are being recorded. The decision to record mobiles needs to be mandated at executive level, with input from the Compliance Officer and communicated to employees as a company security policy. 
• Assess the wider operational impact: Is there a clear preference for an on-site solution integrated with existing recording and PBX systems or a remotely hosted system? In each case, have the potential risk and implementation issues been identified, documented and discussed before engaging a vendor? 
• Standardisation of the mobile device
  How much additional cost, complexity and user support will be required for supporting multiple mobile devices? MultipartyTalk standardises on the RIM BlackBerry solution because it is highly stable, secure and reliable.
• Define which mobile devices should be recorded day to day: Who will be recorded and why with regard to potential regulatory requirements and risk profiles? Is this decision reflected in Internal Audit reports based on a risk assessment profile that will outweigh any user preference issues?
• Define the scenarios where recording should be applied to devices on a temporary basis or at the user’s discretion. Are there defined risk scenarios where mobiles that would not ordinarily be recorded should be? For example:An employee working from home or hot-desking, Training and assessment of new staff who are often out of the office and Disaster recovery situations where recorded mobiles can be used when business can no longer be conducted from office landlines.

MultipartyTalk’s Solution

MultipartyTalk can deliver a separate, off the shelf or hosted solution for recording mobiles or deploy customer premise equipment for larger numbers of mobile phones. This means that the benefits of recording mobiles can be gained by any size of company – from global investment banks down to regional brokerages and hedge funds.

The MultipartyTalk solution is:

• Secure - Automatic recording is the default security setting for the recording of all incoming and outgoing calls.
• Flexible - Discretionary recording can be enabled so that specific mobile users can enable recording when they need it.
• Transparent - All parties are informed that a call is being recorded.
• Specialised – For BlackBerry users only
• Manageable - Easy to deploy and support from the BES on any mobile network.
• Cost effective - Integrated or outsourced (with no need for Capex).
• Mobile-centric - no new PBX call costs.
• Designed with risk management in mind – clear exception reporting and risk triggers.
• As secure as existing landline call recording - integrating with the BES, PBX and call recording systems.

Conclusion

Whilst a reputation for integrity is built over time, it can be quickly destroyed. There is always the risk of decline due to the damaging impact of disputes, litigation and regulatory investigations.
How prepared a company is to weather storms of disruption, depends on the strength of its internal controls. Record keeping is a central pillar of internal controls and includes the recording of relevant phone calls.
The technology does exist to make it simple, secure and seamless to record company owned mobile devices. By not recording mobiles, landline call recording is rendered pointless and reputational risk is left unmanaged in our increasingly mobile-centric business culture.
It need not be.