Automation risk isaca2017

Mohammad Fheili – [email protected]

Information System Audit & Control Association

I.S.A.C.A.

Education Committee Event

Wednesday 25th, 2017

Gefinor Rotana, Beirut – Lebanon

“ISACA was incorporated in 1969 by a small group of individuals who recognized a need for a centralized source ofinformation and guidance in the growing field of auditing controls for computer systems. Today, ISACA serves140,000 professionals in 187 countries.”


Mohammad Fheili “Over 30 years of Experience in Banking. [email protected] (961) 3 337175

Risk & Capacity Building Specialist. Trainer in Risk, Compliance, and Capacity Building. University Lecturer: Economics, Risk, and Banking Operations Currently serves in the capacity of an Executive (AGM) at JTB Bank

in Lebanon. Served as:

• Senior Manager & Chief Risk Officer at Group Fransabank• Senior Manager at BankMed• Talent Development Advisor at ABL• Economist at the Association of Banks in Lebanon [ABL]

Mohammad received his college education (undergraduate &graduate) at Louisiana State University (LSU), and has beenteaching Economics and Finance for over 25 continuous years atreputable universities in the USA (LSU) and Lebanon (LAU).

Finally, Mohammad published over 25 articles, of those many are inrefereed Journals (e.g., Journal of Money Laundering & Control;Journal of Operational Risk; Journal of Law & Economics; etc.) andBulletins.”


Qualitative Assessment of Risks in Electronic Banking & Automation…


IntroductionIntroduction


And many more . . .

Did You Live The Experience? … Dream vs. Reality?!

Didn’t you dream of having Super Power? Haven’t You Wished You Can Fly?Avatar…!

PG 13 PG 13PG 134

PG 13 PG 13

Motion‐Picture rating of PG 13advising parents that somematerial in the film may beunsuitable for children under 13.


And many more . . .

This Is Where Dreams Are Made!


Is He For Real?!The Good Old Days …


We copied ‘Disney’s Mentality’ to ‘Banking’; and here is what we have . . .

Super Power

Real



The Cyber[Pretend] ChallengeQualitative Assessment of Risks in Electronic Banking & Automation…


Are You Convinced that we have been evolving in that fashion?IF YES, then the extreme majority of anticipated/undertaken projects is about“Automation”, and/or IT Solutions….RESULTING in:1. Increasing Demands for IT skills,2. Technical skills is favored over soft skills3. Talent Development potentially biased4. etc.

The Absence of Such Technical Skills will reflect Negatively on the success of the majority ofprojects, and introduce an element of heightened Risks in the successful Completion ofPlanned Projects…

Are There More!

4th Industrial Revolution:which is characterizedby the fusion oftechnologies blurringthe lines between thephysical, digital, andbiological spheres.


We Have Evolved Indeed… 1. Are We Better Off?2. Has it Been An Evolution or a Revolution?!3. Has ‘IT’ Made Our Lives Easier?4. Disruptive Technologies!5. ‘IT’ Has Induced Unbearable Complexities!

Technology combined with increasing day-to-day necessities (is it? Or Desires?) is the most significant driver of business change!


Compatible Processing Speed


My Phone

Smart Phone

Features 10s of Built‐In

Applications 100s of

Applications Available for Download


My Moment!

MobileMoment!


My Book

eBook


My Laptop

Slim & Super-Slim Laptop


What’s [Explicitly] Missing in This Roadmap?!


In SportsIn SportsInstant Replay


The NCAAPlaying Rules Oversight Panel has approved an experimental rule that willallow the Big Ten and Mid‐American conferences to use instant replay oncertain plays within the restricted area arc during the 2016‐17 season.The experimental rule, which will be in effect only during conferenceplay, can be used when an official believes that an incorrect call wasmade on a restricted area ruling, or when a head coach makes an appealfor a review.If a coach appeals and the instant‐replay review determines the official’scall was correct, the appealing coach’s team will be charged a timeout. Ifthe call is reversed on appeal, no timeout will be charged.

In the NBAIf referees confirm the shot was made in time (or have noconclusive video to overturn their on‐court ruling), refereesalso look to confirm:• Whether the shot was a two‐ or three‐point attempt, or• Whether the shooter committed a boundary line violation

or the ball touched an out‐of‐bounds area, such as thestanchion, prior to entering the basket. If it did, the goalwould be disallowed.

If the shot was not made in time, referees will still try todetermine if any of the following occurred before the ball leftthe shooter's hand and adjust the shot and game clocksaccordingly:• The shooter stepped on a boundary line,• The 24‐second clock expired,• There was an 8‐second backcourt violation, or• A player or players committed an unsportsmanlike act or

unnecessary contact.Exception: Instant replay is not used in cases where the madebasket followed a throw‐in, free throw attempt or jump ballstarted with 0.2 or 0.1 on the game clock because players canonly tip the ball in those situations according to theComments on the Rules, Section II L.

The NFL’sinstant replay debate has been a hot‐button issue since games were firstregularly televised in the late 1940s. Traditionalists, hesitant to interferewith the purity of the game by removing human error, clashed with thoseeager to embrace technology and all that it offered the game.The NFL has come to embrace instant replay, but the process that led tothe state‐of‐the‐art system the league uses today was not alwaysseamless. The history of instant replay in professional football is filledwith stops and starts; missteps and controversy; and modifications andimprovements that continue to this day.Instant replay’s history begins in earnest four decades ago — with a manand a stopwatch.Is there any evidence or reason why FIFA is so against adding instantreplay to soccer?

Instant Replay


Banking …. got complicated

ComplexityTechnology-Induced

Innovation that Displaces established Market Leaders, Technologies & Alliances PLUS Creates a new Market or Industry & Value Networks!


BetweenHumanizing “The Technology’ & Digitizing “The Human-Client!”

Technology Has Altered Our Existence


People Come First

Data Come First

The Age of Instant Interconnectivity…

More AboutTechnology‐Induced Complexity

Technology-induced complexity in Banking


have led to:Increased Usage of Impersonal Electronic Services• Low Cost Electronic Services;• Widespread and Diffused Customer Base.This, in turn led to:Lower Customer Intimacy.Reduced Switching Costs Between Different Banks (Customers these days areconstantly shopping for the better deal)Increased Chances of Fraud and Credit RiskIncreased the Demand for Transparency

• Less Time to Know and Influence Customers.Research shows that Customer Interest peaks and falls rapidly especially inresponse to a Promotional Event.This makes it absolutely necessary for banks to optimally leverage allavailable customer touch points so as to be able to influence the customer(e.g., You find ads and offers on ATM receipts).


More AboutTechnology‐Induced Complexity The Introduction of any form of technology in a given production process orthe mere modification of an existing IT environment necessitates a number ofchanges which spillover on Bank Performance: Staff Skills, Workflows, Policies& Procedures, and a host of other changes. In today’s technologically intense production processes, informationtechnology (IT) risks cannot be considered independently of other types ofrisks since it reflects on our ability to serve and satisfy our clients. Because processes are Technology dependent, Accurate, Complete and timelydata collection has changed from being mostly qualitative to overwhelminglyquantitative. Recognizing these challenges and acknowledging that the Employee has arole to play in managing these risks will put management one step ahead.

Is not enough anymore!


MAXIMIZE PROFIT subject to:RISK , REGULATORY, Compliance,Reporting, Etc. Constraints

RISK . . . Default Liquidity Maturity Others . . . REGULATORY . . . Basel I Basel II Basel III Basel IV (In the making)

TLAC Requirements Sanctions Rules USA_FATCA Requirements

OECD_CRS (1st Reporting 2017) ISA 700, 701, 705, 706, and 720 AML, Etc. . . .

Uses of Funds Sources of Funds

Reserves Loans Securities Other

Investments Fixed Assets . . .

All Types of Deposits

Borrowings Other

Sources Capital . . .

Off-Balance Sheet

With every Dollar in Profit a Bank Makes, it MUST satisfy

all these Regulatory Constraints

first!

Legal Issues . . .

FromOriginate‐To‐

hold ToOriginate‐To‐Distribute

(Decompose & Redistribute)

CRS: Common Reporting Standards, essentially inspired by FATCA, is a framework between governments to exchange information obtained from local financial institutions tocombat tax evasions.TLAC: The Proposed Minimum Total Loss Absorbing capacity requirements for Globally Systemically Important Banks (G‐Sibs). It aims to boost G‐Sibs’ capital and leverageratios, ensuring these banks are equipped to continue critical functions without threatening financial market stability or requiring taxpayer support.ISA: International Standard on Auditing.

Instead of to Off‐Balance Sheet; now toUnregulated Shadow Banking with less concerns over loan

monitoring & Follow up.

Deteriorated quality of Capital with the Introduction of new instruments and Tier 3

The Banking Model …. got complicated and Banks are forced to Automate.


General Ledger

Clients & Settlement

P & L Risk Reporting

Core Analytical Engine

Other Models

Predictive Models

Regulatory Models

Asset‐Liability Management

Models

Risk Models

Business Strategy Analysis

Valuation Models

Pricing Models

Exposure Measurements

B ACD

These Risks could Exist Inside each Module and in the Interface between

Two or More Modules

Interface Between Modules



Level Of Maturity in AML Compliance

Nature & Extent o

f Efforts Dep

loyed

DD

EDD

RBA

Due Diligence

Enhanced Due Diligence

Risk‐Based Approach to AML Compliance

Enhancing Compliance Capabilities …

AML Cost

Skills Needs

Know‐How

AML Analytics

AML Compliance require:The Use of Technology:Quantification/Data‐Rich vs.Judgment/Opinion‐Rich

Increase exposure to TechnologyFailures.

Different Sets of Skills arerequired.

Reliance on Technology mayReduce Frequency of Risk EventsBut Increase Impact if and whena Risk Event occur.



Increasing Our Understanding of Potential Outcome (i.e., Business Impact of a Risk Event)

Increa

sing

Evide

nce on

Proba

bility of

occurren

ce (…

of a Risk Event)

Ambiguity

Unc

erta

inty

Ignorance

Complexity makes itdifficult, if not impossible,to understand the “RiskEnvironment” and Changing“Risk Characteristics”.A Bank is expected tocollect ALL needed data tomove closer to RiskManagement and Awayfrom: Ambiguity, Ignorance, and Uncertainty.

Technology‐Induced Complexities give birth to an environment withamplified risk characteristics


A Perspective … A Perspective …


Data acquisition Data analysis Data cableData domain Data element Data farmingData governance Data integrity Data maintenanceData management Data mining Data modelingData visualization Computer data processing Data publicationData remanence Data set Data warehouseDatabase Datasheet Environmental data rescueFieldwork Metadata Open dataData Migration Data Conversion Data Cleansing Data structure Raw Data Secondary DataEtc …

Data …


• Client Information Profile• Balances • Interest Rates• Commissions & Charges • Maturity

• Payments• Provisions • Overdue Balances• Outstanding Balances

Formulas to Calculate Data Framework to Locate Data Framework to warehouse Data Framework for Compliance

Calculation Engines Financial Statements Chart of Accounts Regulations

Core (Raw) Data Calculated Data


It’s More about the People Behind the Technology than

Technology itself!

Between “Innocence” AND “Criminal”

Intentions Behind every Risk Event!


Let’s Start with


The United States is dealing with a nastybird flu outbreak.Sixteen states have reported cases of highlypathogenic H5 ‘Avian Flu’ among flocks ofbirds like turkeys and chickens as well aswild birds.

Travel Back in Time to: May 13th, 2015



It’s May 2015, and you’re ona Visit to the USA. You wereasked by a Dear Friend,who’s a Zoo Keeper, to pickOne animal to take care ofalone for a day and inside a25m2 room…YOU CAN’T DECLINE!Feel free: To ask any question. I’m

the Animal Keeper! To do what you deem

necessary to succeed.

You’re THE ZOO KEEPER


1

3

You were asked by a ZooKeeper to pick Oneanimal to take care of,for a day, inside a 25m2

room; and alone?Feel free: To ask any question.

I’m the AnimalKeeper!

To do what youdeem necessary tosucceed.

2

4


Survey Says!


In 2015, 38% more security incidents were detectedthan in 2014.

Theft of “hard” intellectual property increased 56%in 2015.

Staff remain the most cited source of compromise(Risks).

Risk Events attributed to business partners climbed22%.

Source: Global State of Information Security Survey, March 2016


Suppliers / Partners

35%34%

30% 29%

18%22%

15%

19%

13%16%

20152014Current

EmployeesFormer

EmployeesCurrent Service

Providers/Consultants/Contractors

Former Service Providers/Consultants

/Contractors

Sources of Risk EventsSource: Global State of Information Security Survey, March 2016

More AboutSecurity Compromised


Sources: EIU/SHRM Foundation Survey: “Managing Human Resources in a Changing World”


& Business Implications

12Disruptive12















Technological Innovationsare happening & BusinessEnvironment is changingMUCH FASTER thanCurriculums in Universitiesare resulting in an alarminggap between the skillsproduced by educationalinstitutions and thoserequired by BusinessOrganizations.

Technological Innovationsare happening & BusinessEnvironment is changingMUCH FASTER thanCurriculums in Universitiesare resulting in an alarminggap between the skillsproduced by educationalinstitutions and thoserequired by BusinessOrganizations.





Loyalty to one’s profession is gaining over loyalty to the Organization




√

√√



Rising Cyber-RisksBeware…!


People, System, and Processes belong to the same Risk FamilyPRIMARY SECONDARY

PEOPLE

Employee Fraud / Malice (Criminal)

PROCESSES

Payment / settlement / delivery risk

SYSTEMS

Technology investment risk

EXTERNAL

Legal / Regulatory Risk / Public Liability

Unauthorized activity / Employee misdeed (Willful) Employment LawWorkforce disruption Loss or lack of key personnel

Documentation or contract riskValuation / Pricing Internal / External reporting and complianceProject risk / Change management Selling Risks

System development and implementationSystems failuresSystems security breachSystems capacity

Criminal Activities Out-sourcing / Supplier RiskIn-sourcing RisksDisaster and Infrastructural utilities FailuresPolitical and Government Risks

Operational Risk


Implicate the Employee Or Eradicate the Business

It is about People and

Culture


Combating Operational Risks Rests in Your Risk Culture

…Keeping in mind that the absence of a well defined ‘Risk Culture’ is a statement of ‘Risk Culture’ … Se Beware!


You start with the “Man in the Mirror”!

Every individual comes toan organization with his/erown personal Perception ofRisk.

Every individual comeswith his/er own Inventoryof Moral Values and thesehave a great influence overthe decisions they make onday‐to‐day basis.

The Man In The Mirror . . . The Man In The Mirror . . .


People vary in all sorts of ways and this includes their predisposition toward Risk.Two specific Traits:1. The extent to which people are either: spontaneous and challenge convention or organized, systematic and compliant.

2. The extent to which people may be: cautious, pessimistic and anxious, or optimistic, resilient and fearless.

Organizations need to pay attention to the ethical profile of those working in theirbusiness because it significantly influence individual’s Decision Making: Ethic of Obedience (Rule Compliance, Spirit of the Law, etc.) Ethic of Care (Empathy, Concern, Respect, etc.) Ethic of Reason (Wisdom, Experience, Prudence, etc.)


Risk Culture

Personal Predisposition

of Risk

Personal Ethics

Behavior

Organizational Culture

Individual values and beliefs andattitudes toward risk contribute toand are affected by the wider overallculture of the organization.It is useful to consider Organizationalculture in relation to two keydimensions:1. Sociability: People Focus (based on

how well staff get on socially)2. Solidarity: Task Focus (based on

goal oriented and teamperformance)


Risk Management Is Everybody’s Business

Staff Business Unit Senior Management

Assessment & Follow Up

Acceptance or Mitigation of Identified Risks

Follow Up on Decided Actions

Oversight & Control

Reports to Enable Senior Management Appraisal

IdentificationReporting

Registration of Incidents and Monitoring of the

Internal Control Environment

Problems with Risk Cultureare frequently found at theroot of organizationalscandals and collapses.

Every individual comes to an

organization with his/er own personal

perception of Risk

It Starts Here

Risks Tracking … Finding The Trail


Participative Risk Management

Full and Consistent Communication & Coordination

with all Business Units

Autocratic Risk Management

I Know what to do, and I will do it all alone. My way or the highway!


Poor

Unclear

Lack of Insight

Over Confidence

No Challenge

Fear of Bad News

Indifference

Slow

Gaming

Beat the System

Good

Clear

Good Insight

Confident But Careful

Constructive Challenge

Reward Honesty

Diligence

Fast

Coordinating

Play By The Rules

Communication

Tolerance

Level Of Insight

Openness

Confidence

Challenge

Level of Care

Speed of Response

Cooperation

Adherence to Rules

Transparency of Risk

Acknowledgement of Risk

Responsiveness To Risk

Respect For Risk

High Risk Low Risk

Risk Culture Framew

ork

Beware of the Weak End of the Continuum!


What Drives Individual PerformanceAnd Shapes Risk Culture?


Abilities

Knowledge

(Knowledge + Skills)X(Attitude) = Abilities

Formal + Self-Acquired

To Perform & Excel And Grow

SkillsTechnical + Soft

Human Capital Accumulation = ∑Abilities

The NOT so visible Argument that we often

forget


Skill Marketability

Loyalty To TheOrganization

Loyalty To One’s Profession

Skill Marketability Reflects Favorably OnThe Career And The Salary Of TheIndividual

Loyalty To The Organization MayHelp The Individual Sustain ACompany‐Specific Employment

Loyalty To One’s Profession Exerts TheNecessary Pressure On Knowledge AndSkill Build‐Up (Benefiting Both TheIndividual & The Organization)

It Makes You PunctualIt Makes You Knowledgeable


Talent Laundering • Talent Versus Ethic• Hard Work• Abundance of Qualificationsovershadow the need to probe aboutEthics.

• Individuals with Bad Ethics seekEmployment only to feed theircriminal intentions.

• Talents tainted with Bad Ethics is onlyafter short term gains.

• Those who are loyal to theirprofession hold the highest degrees ofProfessional & Personal Ethics.


Final Thoughts

Final Thoughts


Brilliant Surgery!

Well Done!Shame the

patient died.

Outcomes


Risk Management of Today has been Contaminated & Disrupted bythe Complexity of Technologies and Technological Innovations.… Risk Management ought to be as Simplistic as the Environment itexists in.


Date post:	07-Feb-2017
Category:	Technology
Upload:	mohammad-fheili
View:	177 times
Download:	0 times