BankInfoSecurity.com - Information Security News, Regulations, & Education

Bank Information Security Articles

Risk Management Agenda: 9 Steps to Success in '09

Credit
Eligible
As a BankInfoSecurity.com annual member, this content can be used toward your membership credits and transcript tracking. Click For More Info
Amidst the Turmoil, be Sure to Manage Your Institution's Risk - and Your Own Career
January 5, 2009 - Linda McGlasson, Managing Editor

This article was originally created for BankInfoSecurity.com, and contains information that should interest our GovInfoSecurity.com readers.
Share

Comment on this article

OK, welcome to the first full work week of the New Year.

Holidays are over, 2008 is behind us, everyone is back at work this week. What's on the agenda?

Following is a list of seven key priorities - your Risk Management Marching Orders for 2009.

1. Be Ready for Change. And lots of it, given the year we just experienced with the industry, marketplace and some of our largest institutions changing drastically. Change will happen in a moment's notice. No longer can a banker think that change is measured in months or weeks. Now expect it to happen overnight, or even in hours. It won't be easy, but be ready to be nimble and quick on your feet to meet the challenges.

2. Be Ready for Regs. Your compliance team has to be ready to shift and roll with regulatory changes that we know are coming with the new Administration. This includes audit teams and board member briefings on the changes that are going to be happening within the industry after the dust settles and the new administration begins its work. Remember that your regulators won't only be reviewing your practices, but will also look to see if you've got stringent processes to review the companies and vendors your institutions does business with. (The biggest breaches in the recent past occurred not at institutions but at their vendors.) Key words of the New Year: Vendor management.

3. Restore Your Customers' Confidence. Don't argue about how the subprime mortgage crisis is not affecting your institution, or that you weren't the cause of it. The damage is done, we're all impacted, and so now you've got to have a plan to fix it and fast. Build the confidence because everything hinges on this one thing.

Click to Get Updates on the Latest Information Security News

4. Shore up Your Business Practices. Review and audit everything. Make sure there are no holes in your risk management approach. You need to build your business, you need those depositors, and in this new landscape the battle of 2009 will be about who has the most deposits. The frenzy of marketing your product lines will begin now. It's either attracting and keeping depositors, or lining up behind the other institutions in the TARP lines at Treasury.

5. Watch for the Insider Threat. With all the whirl of changes going on, M & A activity and the rest of what's happening with regulatory changes and other events, don't take your eye off what matters inside your institution. You are a target, don't forget it. During drastic times, a disgruntled, downsized employee may try to take advantage of the opportunity and with their pink slip take with them valuable data. Tough times don't build character, remember; they reveal it. You might not like some of the characters you employ when you see how they respond to financial stress.

6. Know Your Business Partners. It gets back to vendor management, but beyond information security processes. At the same time you're reviewing your own business practices, check on those you're depending on for your bottom line. Unless you do check, those at the other end may be at the same ethical level of Mr. Madoff. Who wants to explain that relationship to the board?

7. Follow Your Own Best Instincts. Forget following the Wall Street risk management best practices. Take a page from community banking institutions. Go back to your father's old risk management tomes and look to take a back to basics approach. This approach is working well for some of the most successful independent banks and credit unions in the country. Yes, it is hard work, but nobody said it would be easy.

8. Manage Everyone. This means you cover your bases and manage up, down and even sideways. Communicate clearly every step you're taking with shareholders, senior managers and your board. If you're the person on the board or one of them responsible for attesting to the institution's financials, let regulators know everything when it happens. Learn from the mistakes you saw played out very publicly in 2008. And remember: When a knife is falling, it's a lot easier to catch a knife by the handle than trying to catch it by the blade.

9. Manage Your Own Career. Keep your skill sets sharp. No one cares about your future more than you do. In these times of economic uncertainty, your job may be in question, no matter where you are or how much experience you have. Be ready for anything to happen, and if it does occur, then you won't be caught by surprise.




Next Related Article:


Question
Question
?What tops your own Risk Management Agenda for 2009?
Here's your chance to be a part of the dialogue and engage with your peers! Just enter your comment to the right, click submit to send it to our Editor. All entries are posted anonymously.
Please login if you would like to post a comment on this question.

"I offer these comments on items 1-9:

1. I would offer "Focus on business agility." The difference is that external factors should not be the underpinning motive to develop or modify business processes. An agile business takes advantage of emerging market opportunities as new revenue streams.

2. Agreed. However, most compliance initiatives are a net 80% overlap. There are very few actual "brand new" compliance requirements -- sometimes redeploying existing assets or making slight architecture changes can get you to 100% with little additional capex or overhead.

3. Combine with #8: Manage expectations. Make sure your INTERNAL and EXTERNAL customers know what to realistically expect, and make sure your organization can deliver based on those expectations.

4. I would offer: "Audit your auditors". Bring in a consultant to validate your risk management approach.

5. Agreed.... but you've been doing that all along, right? It doesn't take a market down-turn to bring out the greed in people. The industry has seen a wave of data breaches originating from insiders this past year.

6. CONSOLIDATE your vendors. FY09 is going to be a tight year -- use this as a springboard to drop "risky" vendors or low-volume vendors in order to consolidate buying power and reduce risk. Conversely, don't put all your eggs in one basket -- if you have a large vendor that doesn't know it's in trouble yet, this could be a big problem for you later. Make sure you have a "vendor continuity strategy" as part of your business continuity plan.

7. Be an "unreasonable man" --

"The reasonable man adapts himself to the world; the unreasonable one persists in trying to adapt the world to himself. Therefore all progress depends on the unreasonable man."

-George Bernard Shaw

The point is: follow the basic rules of common sense:

- If something is too good to be true, it's false

- Nothing in life is "free"

- There's no such thing as a "sure thing" (no risk)

Please do yourself and the market a favor by being as "unreasonable" as possible.

8. See #3: Focus on expectation management. "Manage everyone" seems focused on micro-management -- you have valuable staff resources that are capable of self-management, but expectations need to be managed (both incoming and outgoing).

9. As a consultant, I've seen this happen over and over again. Complacency can lead you to a very bad position if your current job ceases to exist. Make sure you have a financial plan for hard times, and definitely keep up with current marketable skills for your position. It's easy to say "work won't pay for training", or "work stays at work", but the reality is that you have to manage your own destiny. It is well worth the investment of a little money and a few hours a week to take a class on your own dime in order to stay current.