Monday 25 January 2021

Financial firms redesigning risk management systems: study

BEIRUT, March 28, 2019

In a volatile market environment and with the edict to “do more with less,” many financial institutions are beginning efforts to reengineer their risk management programs, according to a new survey by Deloitte Global.

Seventy per cent of the financial services executives surveyed said their institutions have either recently completed an update of their risk management program or have one in progress, while an additional 12 per cent said they are planning to undertake such a renewal effort.

A big part of this revitalization will be leveraging emerging technologies, with 48 per cent planning to modernize their risk infrastructure by employing new technologies such as robotic process automation (RPA), cognitive analytics, and cloud computing.

“Financial institutions face a formidable set of challenges posed by today’s more complex and uncertain risk environment,” said Hani Khoury, partner and Risk Advisory leader at professional services firm Deloitte Middle East.

“With budget cuts common—and a big focus on effectiveness and efficiency as the torrent of regulatory change has slowed—this will require institutions to rethink their traditional assumptions and employ fundamentally new approaches.”

“Digital technologies have the potential to fundamentally reengineer virtually every aspect of risk management,” said Khoury. “Financial institutions are now at the early stages of this transformation of their risk management functions.”

Only a minority of institutions are employing these types of technology currently, and often in small doses within their organization. The technologies that institutions surveyed most often reported using were cloud computing (48 per cent), big data and analytics (40 per cent), and business process modelling tools (38 per cent). Most surprisingly, given the attention paid to the potential of RPA to reduce costs and improve accuracy by automating repetitive manual tasks without human involvement, only 29 per cent of respondents said their institutions are currently using it.

Other tools are being used by even fewer institutions such as machine learning (25 per cent), business decision modelling tools (24 per cent), and cognitive analytics (including natural language processing/natural language generation) (19 per cent).

“These tools can reduce costs by automating manual tasks such as developing risk reports or reviewing transactions,” according to Khoury. “They can also automatically scan a wide variety of data in the internal and external environments to identify and respond to new risks, emerging threats, and bad actors. Some banks have developed real leading-edge platforms for identifying potential conduct risk situations, for example.”

Continued growing importance of cybersecurity risk

Financial services executives were also asked in the survey which three risk types they believed would increase the most in importance for their institution over the next two years. The broad consensus was that cybersecurity is the number-one challenge.

Two-thirds of respondents (67 per cent) named cybersecurity as one of the three risks that would increase the most in importance for their business over the next two years, far more than for any other risk. Yet, only about half of the respondents felt their institutions were extremely or very effective in managing this risk.

Although cybersecurity also held the pole position in the survey’s 2016 edition, there was a dramatic uptick in the current survey. More respondents considered it as one of the three risk types that would increase most in importance (67 per cent, up from 41 per cent) and cited it as the number-one risk (40 per cent, up from 18 per cent).

For specific types of cybersecurity risks, respondents most often considered their institutions to be extremely or very effective in managing disruptive attacks, financial losses or fraud, cybersecurity risks from customers, loss of sensitive data and destructive attacks, each above the 50 per cent mark. They were less likely to consider their institutions to be this effective when it came to threats from nation-state actors (37 per cent) or cybersecurity risks from third-party providers (31 per cent).

“In addition to their well-established supervision of operational risk, many financial regulators in the Middle East are either establishing or have already established cyber security specific regulation and oversight functions with a focus to address the risks that cyberattacks could pose to the financial system as a whole,” said Fadi Mutlak, partner and Cybersecurity leader, Deloitte Middle East.

“Given the increasing interconnections among financial institutions, their technology partners and financial markets around the world, good cyber governance and oversight is imperative to the ability to respond and recover effectively when a threat is detected or an attack is realized. It is well known that a cyberattack has the potential to quickly damage the global financial system.”
Among the survey’s other findings:

•    When asked to assess the overall effectiveness of their institution in managing risk, 82 per cent of respondents considered it to be extremely or very effective, an increase from 69 per cent in 2016.

•    While institutions have become more skilled at managing financial risks, non-financial risks continue to assume greater prominence as the exposure and consequences from these risks has become more evident. Respondents were less likely to consider their institutions extremely or very effective in areas including reputation risk (57 per cent), business resilience risk (54 per cent), model risk (51 per cent), conduct and culture risk (50 per cent), strategic risk (46 per cent), third-party risk (40 per cent), geopolitical risk (35 per cent) and data integrity risk (34 per cent).

•    83 per cent of respondents expected that regulatory requirements on their institutions would increase over the next two years, with one-third expecting a significant increase.

•    Credit risk was seen most often as being extremely or very challenging to manage in commercial real estate (31 per cent).

Financial institutions confront significant challenges in effectively employing the “three lines of defence” risk governance model – which details the appropriate roles in risk management of business units, the risk management function, and internal audit – according to the survey. This model has long been a regulatory expectation and a prevailing practice. Forty-three per cent of survey respondents said their institutions either have revised their three lines of defence model, are reassessing or are planning to reassess their models. Deloitte Global expects the impact of emerging technologies to be a key consideration in these changes.

“Financial institutions will need to consider how to effectively reengineer their ‘three lines of defence’ in this technology-powered environment,” said Khoury. “One of the biggest issues in the three lines of defence will be making sure that business units are engaged in their ‘first line’ role—as the survey found that more than half said their institutions have increased, or plan to increase, the risk management responsibilities of business units to manage the risks they assume. There is a great deal of work to do in this arena in the volatile environment that companies face today.” – TradeArabia News Service


calendarCalendar of Events