Over the past two years, we have seen an increasing number of GDPR claims being made alleging that an individual’s data protection rights have been breached.
Many of the proposals set out in the 2014 consultation (see our e-briefing on this here) have been carried through into the new Regulatory Framework documents, which will take effect on 1 April 2015 (as expected).
We set out below the four key messages that RPs need to take from the Regulator’s latest proclamations, as you consider your organisation’s approach to the new Regulatory Framework:
1. Prioritise compliance
It is an absolute priority for Registered Providers (RPs) as soon as possible to get to grips with the Regulator’s new requirements and expectations as they come in to force on 1 April 2015. There is no formal “grace period” contained in the Regulatory Framework to accommodate transitional action by RPs moving towards compliance, probably because there is very little in the Regulatory Framework that is materially different to the version published for consultation. The Regulator’s view is clearly that its direction of travel has been apparent for some time, and therefore RPs should have had time to plan for this day accordingly. RPs that are significantly non-compliant with the new Regulatory Framework when it comes in to force on 1 April 2015 will face little sympathy from the Regulator, particularly where this marks an increase in risk to the social housing assets.
The Decision Statement reiterates that the Regulator’s key (and in most cases, only) priority is the protection of social housing assets.
2. Beware the Code
The Housing & Regeneration Act 2008 gives the Regulator the power to introduce a Code of Practice, and this was a prominent part of the consultation. The Regulator indicated that the proposed Code would be akin to guidance – setting out how RPs could demonstrate compliance with the Regulatory Framework – rather than binding, but that the Regulator could use non-compliance with the Code as an indicator of non-compliance with the Standards. Confused? We all were, it seems.
Helpfully, the Regulator has sought to clarify the position in its Decision Statement and draft new Code, confirming that the Code is an “important regulatory tool”, notwithstanding that it remains (technically) non-binding. The Regulator will “have regard to” the Code when assessing compliance with the Standards, but breach of the Code will not be a breach of the Standards where you can show that you aren’t actually breaching the Standards. Everyone clear at the back?
The Code is helpful in that it gives depth to the Standards, and uses examples as a way of “showing the path” to compliance for RPs. However, as it principally focusses on “what” compliance looks like rather than “how” it can be delivered practically, RPs cannot use it as a blueprint for regulatory compliance. It is the “how” that boards need to focus on, and potentially the area which gives the greatest scope for creative and innovative solutions.
3. Anticipate discovery
The risk of discovery of non-compliance by the Regulator has increased since the Regulator adopted its re-energised programme of engagement (set out in a revised “Regulating the Standards” publication in 2014). More and more RPs are finding themselves subject to deeper scrutiny by the Regulator, which is revealing “non-compliance” on a significant scale. The trigger points for a regulatory finding of non-compliance have also changed significantly, including out-of-date or incomplete gas servicing records, failure to adequately comply with value for money requirements, and instances of fraud, all being viewed as manifestations of deep and serious governance failings.
As well, from 1 April 2015 all RPs will be required to certify publicly their compliance with the Regulatory Standards in their annual accounts (in the narrative report accompanying the financial statements). Boards will need to consider specifically whether they can give this statement, and whether they have adequate assurance of compliance from the “operational spine” of the organisation. Governance reviews are likely to be a feature on the forward plans of many organisations.
The implications of non-compliance are heightened, given the changing Regulatory attitude to risk, and the Regulator has shown it is not afraid to impose the ultimate gradings of non-compliance – V4/G4 – notwithstanding the consequences to the individual RPs themselves. By adopting this bullish approach very publicly with a handful of RPs, the Regulator has cleverly positioned itself to exact maximum co-operation from other RPs that the Regulator may view as on the path to non-compliance. We are seeing a significant increase in the number of “voluntary undertakings” demanded by the Regulator of RPs as the price for avoiding a significant downgrade.
4. Review structures, this time focussing overwhelmingly on risk
“Risk” is mentioned 98 times in the Decision Statement (and annexures) and, in the eyes of the Regulator, organisations cannot focus too deeply on the risks that their organisation (or more to the point, the social housing assets) are exposed to.
The Regulator originally suggested that it may consider limiting the amount of non-social housing activity that RPs could carry out. The logic behind this appears to have been that, in a world where RPs are subject to considerable risk arising out of their social housing activities, it was sensible for them to avoid taking on even more risk by diversifying.
However, in the Consultation, responding to significant concern from the sector, the Regulator retreated from this position and instead proposed restrictions on RPs’ ability to use (specifically, on-lend or invest) “social housing” funds in non-social housing activities without Regulatory consent. This prompted considerable unease amongst respondents and, again, this has been dropped from the final proposals, except in some specific cases (index-linked financing and within non-registered groups).
Therefore the mechanisms by which the Regulator could itself have policed risks arising out of non-social housing activities have not been carried forward into the Framework (for most RPs). Instead, the onus on identifying and managing risk falls on RPs themselves. The Regulator will “mark their homework”, through its regulatory scrutiny role, and, via the Framework and the Code. In this respect, its expectations are for organisations:
- To anticipate how current and future risks to the business and its activities interweave, specifically through multi-variant stress-testing of activities and business plans, and to ensure your long-term viability through your business planning and corporate structure;
- To have a detailed and functional record (the “asset and liabilities register”) that clearly identifies “what is owned and what is owed and how these are connected”. This means assets and liabilities in their widest sense, not just property / social housing, and using this tool to make provision for the liabilities in your strategic planning and business operation; and
- Through the first two bullet points above, to have a thorough understanding of the totality of your risks and the effectiveness of your risk management and mitigation strategies (you need to ensure that you have “an appropriate methodology to model and communicate risk flows”). To the extent these involve housing activities “outside” the RP, does this really protect the RP and its assets from risk?
The practical reality for many RPs is that they already have to adopt uncomfortable corporate and funding structures simply to carry out non-social housing activities, because of a variety of influencers such as procurement, tax, charity law, employment and pensions issues as well as Regulatory and funding ones. Corporate structures can be a mass of interdependencies, contracts, practices and fund-flows and limiting risk to the RP specifically may not have been the overriding priority when they were set up, but it now needs to be.
Despite the fact that you may have gone through what feels like an exhaustive assurance process to set up structures to deliver your activities, you may need to review them afresh now, specifically to identify whether the structures of themselves create material risks that you need to consider.
Organisations really will need to ‘get under the skin’ of their businesses to see what their risks are and how to manage them.
To read the full outcome of the consultation about changes to the Regulatory Framework, the proposed new Financial Viability and Governance Standards and the Code of Practice click here.
Look out for our detailed e-briefings covering:
- asset management;
- finance; and
- the rent standard.
We will also be running a seminar looking at each aspect of the Regulatory Framework and Code in Birmingham on 25 February 2015. For details of how to book your place, please click here.
For more information
If you have any questions about the new Regulatory Framework and Code of Practice, or would like to discuss how it will affect your organisation, please contact:
Property including charging and asset management:
Anthony Collins Solicitors are delighted to announce that they have been ranked as a Band 1 firm in Chambers and Partners 2022.
Alice Kinder, pensions and employment solicitor takes on the role in representing and supporting more than 5,500 legal professionals located across Birmingham and the Greater Midlands.
Our annual virtual employment law update catches up on the cases, legislation and changes over the last 12 months.
Anthony Collins Solicitors are presenting a series of podcasts with employees to raise awareness about disabilities around the firm.
Answering key questions about the details and practicalities of mandatory vaccinations in care home settings.
Anthony Collins Solicitors (ACS) has appointed a new partner to its market-leading social housing property team.
On 7 September 2021, the Regulator of Social Housing (RSH) published its annual consumer review.
From today (1 October 2021) there is yet more change on the possession front!
We are delighted to secure our position as a top-tier firm in five of our practice areas in the Legal 500 2022 edition.
To receive invitations to our events, as well as information and articles on legal issues and sector developments that are of interest to you, please sign up to Newsroom.