Optimising risk management in the financial services industry

Round­table atten­dees
Andrea Brody, chief mar­ket­ing offi­cer, Riskon­nect
Kris­ten Drob­nis, chief risk offi­cer, Com­mon­wealth Finan­cial Net­work
Hung Lee, CISO, Kasasa
Ter­rance Phillips, head of enter­prise risk man­age­ment, Affin­i­ty Fed­er­al Cred­it Union
Joe Scar­la­to, chief strat­e­gy offi­cer, Low­ers Risk Group
Jean Tien, exec­u­tive direc­tor, busi­ness con­trols depart­ment, Mizuho

What are the cur­rent top oper­a­tional risks in finan­cial ser­vices in the US?

AB: Riskon­nect works with over 60 finan­cial insti­tu­tions across the US, and con­sis­tent­ly cyber risk def­i­nite­ly dri­ves the risk expo­sure. Improv­ing oper­a­tional risk and oper­a­tional risk is as much about peo­ple as it is about tech­nol­o­gy. For exam­ple, peo­ple work­ing from home due to the pan­dem­ic has increased secu­ri­ty expo­sure. Organ­i­sa­tions are strug­gling, and the solu­tion is an inte­grat­ed oper­a­tion approach to risk, start­ing back from the cus­tomer.

KD: Everyone’s now trans­form­ing to the cloud or embrac­ing arti­fi­cial intel­li­gence. And because we’re mov­ing at the speed of light­ning, peo­ple for­get about the old code. Many of the cyber issues stem from either code left behind or gaps in the old infra­struc­ture. This is how peo­ple are get­ting infil­trat­ed. Care­ful plan­ning and removal are essen­tial, and the board, man­age­ment and even cus­tomers should be ask­ing how data is being pro­tect­ed as the busi­ness goes through this migra­tion.

JS: Third-par­ty cyber risk is a big chal­lenge. At Per­icu­lus we are look­ing at assess­ing the cyber risk expo­sure for small- and medi­um-sized enter­pris­es and mit­i­gat­ing that risk through a stack of tech­ni­cal prod­ucts, such as fire­walls, antivirus soft­ware, dark-web mon­i­tor­ing tools, and more. Addi­tion­al­ly, we allow busi­ness­es to trans­fer their risk through our insur­ance part­ners. Addi­tion­al­ly, I feel it’s impor­tant to stress that human cap­i­tal is cyber risk. An informed employ­ee is crit­i­cal when it comes to cyber­se­cu­ri­ty. Insid­er threat is real. Ensur­ing your employ­ees are screened and mon­i­tored is the first step in pro­tect­ing your busi­ness.

TP: By def­i­n­i­tion, oper­a­tional risk is the risk of inad­e­quate peo­ple, process­es, sys­tems and exter­nal threats – but top of the list is peo­ple. Over the last year, like many organ­i­sa­tions, Affin­i­ty under­went a sig­nif­i­cant trans­for­ma­tion and, as an 85-year-old cred­it union, human cap­i­tal con­tin­ues to be a hot but­ton for us. Because of tech­nol­o­gy, we have been able to bol­ster our tal­ent and increase our human cap­i­tal, but it is a top risk.

HL: In my expe­ri­ence, a lot of the most mature organ­i­sa­tions inte­grate oper­a­tional risk and, specif­i­cal­ly, risk man­age­ment into their dai­ly process­es. For com­pa­nies with low­er data pri­va­cy and secu­ri­ty hygiene, some new reg­u­la­tions such as the Gen­er­al Data Pro­tec­tion Reg­u­la­tion or the Cal­i­for­nia Con­sumer Pri­va­cy Act might be mas­sive dis­rup­tors to their busi­ness. More mature organ­i­sa­tions con­sid­er the risks of new leg­is­la­tion com­ing in and have baked those pri­va­cy-by-design prin­ci­ples into their cul­ture and DNA.

JT: Rep­u­ta­tion­al risk is so impor­tant, and while it is broad, it is basi­cal­ly about brand expo­sure. It’s cru­cial to under­stand your oper­a­tion, work out the inher­ent risks, and take a good look at the con­trols. The risk analy­sis for large busi­ness­es will be dif­fer­ent to small­er organ­i­sa­tions. Still, regard­less of size you have to take a very proac­tive approach to review­ing the rep­u­ta­tion­al risk.

How is the shift to hybrid work­ing like­ly to affect oper­a­tional risk?

JS: Many organ­i­sa­tions have intro­duced a bring-your-own-device (BYOD) pol­i­cy, and peo­ple use their smart­phones or tablets to have vir­tu­al meet­ings and com­mu­ni­cate with cus­tomers. Not many busi­ness­es have a mature BYOD pol­i­cy for today’s envi­ron­ment, which is an impor­tant oper­a­tional risk.

HL: Lead­ers must lead by exam­ple, accept this new real­i­ty, and not yearn for life in the office like it was in 2019. There are many dif­fer­ent new threats as well as new risks asso­ci­at­ed with this new real­i­ty. Also, we are going through the ‘great res­ig­na­tion’ – it’s easy to ditch and switch your job. Tal­ent attrac­tion and reten­tion are the most sig­nif­i­cant oper­a­tional risks because you have to have the right play­ers on the team to win when it comes to lim­it­ing risks and com­bat­ing threats.

KD: This is an oppor­tu­ni­ty risk for organ­i­sa­tions to get the right human cap­i­tal. We have to plan for remote work­ing and dri­ve aware­ness and edu­ca­tion. Cost sav­ings can be made by not hav­ing build­ings. More than that, organ­i­sa­tions can cat­a­pult into the future and act on ESG strate­gies.

TP: This new envi­ron­ment has made us more aware of what we can do, and it’s up to the lead­ers to be account­able and lead a remote work­ing team as best we can. We have moved to 100% remote, and we’re not going back. I meet up with my team in per­son peri­od­i­cal­ly, and we will catch up over lunch. I do the same with my ven­dors. Hav­ing emo­tion­al intel­li­gence is so vital now.

JT: As peo­ple are work­ing at home, there is less sep­a­ra­tion between work and between the office and home. There is more of a bleed. Strong and car­ing man­age­ment is crit­i­cal. There is a super­vi­sion and vis­i­bil­i­ty issue, but there has to be an ele­ment of trust and auton­o­my. As a man­ag­er, you have to focus on what the team is doing, not what they are not doing, because peo­ple are work­ing around their home lives more now.

AB: I think lead­ers are dis­card­ing a rear-view mir­ror approach. Organ­i­sa­tions are focus­ing on busi­ness resilien­cy and crit­i­cal vul­ner­a­bil­i­ties – things like man­dat­ing the need to expand to include sec­ond-line over­sight to sup­port oper­a­tional excel­lence. Clear­ly, human fac­tor risks will have to be bet­ter mon­i­tored and assessed.

What tech­nol­o­gy and tools should finan­cial ser­vices organ­i­sa­tions use to lim­it the impact of future crises?

KD: It is now just over 20 years since the 9/11 attacks, and unfor­tu­nate­ly, organ­i­sa­tions haven’t nec­es­sar­i­ly learnt from that. If your tech­nol­o­gy falls over – as it did a few weeks ago with the Aka­mai issue – what are you going to do? You need to go back to basics.

HL: A lot of busi­ness­es don’t do enough risk assess­ment. I would argue that enter­prise risk assess­ment is a dai­ly task. Risk assess­ments will hap­pen every day if you suc­ceed at embed­ding risk and cus­tomer-cen­tric­i­ty into your organ­i­sa­tion­al DNA.

JS: Reg­u­la­tions and stan­dards are not mov­ing as fast as the digi­ti­sa­tion of organ­i­sa­tions. It’s impor­tant for the enter­prise to decide how fast they want to move when assess­ing their risk. With con­tin­u­ous assess­ment through prod­ucts – like Riskon­nect and Mas­ter­card Cyberquant – a busi­ness can eval­u­ate the risk by domain and com­part­men­talise it, so that each depart­ment owns their own risk domain and then com­bined that for an aggre­gat­ed risk view for the organ­i­sa­tion.

TP: Again, emo­tion­al intel­li­gence is so cru­cial for deliv­er­ing these mes­sages to the board. Because of our line of work, we have to deliv­er bad news, and there’s a skill in doing that. That’s why, in this time of uncer­tain­ty, I seek out the best tal­ent with this skill set.

For more infor­ma­tion please vis­it riskonnect.com

Spon­sored by

Riskon­nect