Per yesterday teleconference, you are ok to the changes proposed for R1, R2-C1 and C2. You mentioned that you will be amending R1-C3 & C4, let me have the changes once you complete.
For R3, I have spoken to GORM Channels Risk Manager, and he shared the same view that unless there is regulatory requirement to perform such mystery shopping, else if we just assessed based on customer impact, is it really as high as 3? 3-Moderate means Individual customers or segments will be disadvantaged. Is it that serious? We are of the view that the customer impact will just be 1 which means the risk would only be L and can be excluded from KRCSA.
Also, mystery shopping is the control to manage any potential risk of customer complaint. So if you want to include, it shd have been risk of customer complaint rather risk of vendor not performing its role? You then check effectiveness of this control by checking that a vendor is engaged and they provide report to update results.
If there is regulatory impact, then the risk shd be breach of regulatory reqts which then must be included. In Spore, MAS Fair Dealing Guideline and Financial Advisor Acts do require Bank to check that the salespeople are conducting sales according to the established sales process, thus PFS may include this in their KRCSA. In UOBS, our channels staff do not sell investment/insurance pdts.
In UOBT, is there similar regulatory requirement in UOBT?