5 essentials for building resiliency across technology and operations

A version of this article first appeared in the BAI Executive Report: Navigating effective risk management. You’ll find more insight within on prepping for CRA enforcement, liquidity and credit risk, the CRE outlook, fraud considerations and more.

The digital age has done a lot of good for banking, but it has also made managing risk front and center. Now, more than ever, banks must consider adopting automation and artificial intelligence (AI) to navigate digital-fueled risks that can include cyberattacks, fraud, internal software failures and system misconfigurations, to name a few.

These challenges stymie broader operations, putting executives on high alert. In fact, two-thirds of chief executive officers report that technology risk has grown significantly over the last few years, according to a survey of 750 global banking executives conducted by ServiceNow and ThoughtLab.

More than seven in 10 CEOs consider tech vulnerabilities the biggest risk their bank faces. The problem won’t resolve itself and the financial impact is growing: A staggering 64% of CEOs expect the issue to increase over the next two years. What’s more, regulators have taken notice, making tech vulnerabilities more critical than ever.

They’re demanding increased accountability from boards and senior executives. As regulators continue to tighten governance over the financial services industry, rules and regulations focused on cyber resilience and operational resilience have significant institutional liabilities for noncompliance, while regulations focused on Senior Manager Regimes add personal liabilities to institutional liabilities.

It should come as no surprise that companies haven’t fully embraced risk, compliance and control automation to streamline and fortify operational technology. Many have focused investment on customer-facing technology over the past decade, or are using numerous, disjointed tools that further encumber an already complex operating environment.

Lack of automation leads to hours spent on manual processes, while organizational silos make tracking down critical data cumbersome. That’s expensive, but also leaves institutions potentially vulnerable in the eyes of fraudsters and regulators alike.

Where to start?

Despite warning stats piling up, the situation isn’t entirely grim. Addressing—and, dare we say, taming—the danger can pay off by helping companies ensure greater control while also helping the bottom line. More than half of the banks surveyed say that managing the risks of digital innovation is crucial for future growth and economic success.

Even more CFOs (62%) and CROs (58%) hold this belief. Our research found five best practices among the banks ahead of the curve when addressing technology risk and resilience.

1. Single source of truth. Banks with the most success report that collecting, analyzing and sharing data across the enterprise is vital. All responders need access to current and trustworthy data.
2. Invest in cutting-edge technology. Simply put, solving this issue requires a financial investment. Savvy leaders identify modernized IT systems, cloud and other tools that enable better orchestration of technology risks and cybersecurity defenses as their most important tech investments. More than half of risk leaders say that cybersecurity orchestration will be one of the most important tech investments over the next two years. They’re also boldly adopting AI, including fast-growing generative AI, and machine learning.

3. Give risk a voice. Banking is notoriously siloed—siloed data and tools are the top technical challenge risk teams face. Now, more than ever, conquering technology, cyber, and the larger scope of operational risks requires integrations to give context to risk and compliance data. Much like the race to develop 360-degree views of the customer over the past decade, the needs from risk and compliance teams should be heard for what they are – requirements to be more efficient and effective.
4. Unify teams. As these silos are broken down, banks must have the right people and processes in place to combat technology risk, which requires ensuring that a wide range of people across the enterprise are involved, trained and working together. Their roles might be clearly defined in frameworks, policies and procedures, but internal audits and regulatory exams are focused on execution that adheres to those risk governance documents. Only modern technology, extended across the enterprise, can track who does what in relation to who should be doing it. Nearly three-quarters of leaders report that cybersecurity personnel play a critical role in efforts to manage tech risk. Leaders most often complement them with experts in digital transformation (65%), operational risk (62%), data privacy (61%) and IT risk management (56%). To keep cross-functional teams coordinated, leading firms adopt technology that unites all three lines.

5. Rethink governance. To play their role effectively, leaders need access to current information, not information extracted a month ago, which is common in the industry. If boards don’t have access to up-to-date insights, they need to give risk management a voice and support investments that yield a single source of truth, created through integrations of people, processes and technology that merges risk, compliance and control data with operational data.

Progress in action

Tying this all together requires a steadfast focus on digital transformation by moving more services to the cloud and harnessing technology to make operations more agile. Integrated risk platforms offer a full view of cyber, technology, enterprise and operational risks, as well as a common set of tools to manage them more effectively and more efficiently.

In the coming months, nearly all leaders in technology risk management—and as much as three-quarters of less mature organizations—will use an integrated risk platform. This will be essential for banks as they strive to incorporate technology and cyber risk into their overall operational risk and resilience frameworks to create a holistic risk approach.

The most successful banks are integrating with what’s commonly known as a configuration management database (CMDB), a key component to forming a single source of truth. Easy access to this veritable map of operations allows analysts to quickly identify affected systems, their locations and how vulnerable they are to multiple attacks.

Response teams can then prioritize security incidents and vulnerabilities among an overload of alerts. Remediation is further expedited with streamlined response technology, for instance via a single console that can interact with other security tools.

The CMDB can also be leveraged to map important or critical services to businesses or functions that support the services, to processes executed as part of the services, to underlying technology that supports the services, and across third or fourth parties that help deliver the important or critical services on your behalf. Digitally connecting these concepts and elements of operational resilience allows a firm to extend concepts used by leaders to manage technology and cyber risks to managing the larger scope of operational risks and ensuring operational resilience in a truly integrated way across people, processes, technology, and third parties.

Smartly designed workflows are critical for security as well. For instance, a security playbook might distinguish between Tier 1 personnel’s gatekeeping security work and team members charged with preemptively hunting down complex threats.

It must be easy to identify authorized approvers and experts and quickly escalate issues as appropriate. Understanding and better enforcing the security of “need to know” data is also essential in an expanding digital landscape.

Finally, banks should collect detailed metrics to track performance, drive post-incident reviews and enable process improvements.

Collaboration is a smart defense

It’s also increasingly important to think of risk, security and technology teams as working toward the same goals, never in competition and as the beneficiaries of the others’ contributions. When this trio works together to orchestrate and monitor processes on one platform intelligently, banks can:

» Improve risk posture, addressing risks and threats before they become breaches or audit findings.

» Bolster security, which can help optimize resilience and productivity.

» Reduce costs as automation is built into every aspect of risk and compliance management.

» Accelerate innovation, which can yield impactful results that mitigate risk.

Responding holistically, deftly and always with the best use of resources in mind are top priorities for information security leaders who want to be at the top of their game.

Michael Murphy is Risk Transformation Officer at ServiceNow.