View
177
Download
0
Category
Preview:
Citation preview
Mohammad Fheili – fheilim@jtbbank.com
Information System Audit & Control Association
I.S.A.C.A.
Education Committee Event
Wednesday 25th, 2017
Gefinor Rotana, Beirut – Lebanon
“ISACA was incorporated in 1969 by a small group of individuals who recognized a need for a centralized source ofinformation and guidance in the growing field of auditing controls for computer systems. Today, ISACA serves140,000 professionals in 187 countries.”
Mohammad Fheili – fheilim@jtbbank.com
Mohammad Fheili “Over 30 years of Experience in Banking. mifheili@gmail.com (961) 3 337175
Risk & Capacity Building Specialist. Trainer in Risk, Compliance, and Capacity Building. University Lecturer: Economics, Risk, and Banking Operations Currently serves in the capacity of an Executive (AGM) at JTB Bank
in Lebanon. Served as:
• Senior Manager & Chief Risk Officer at Group Fransabank• Senior Manager at BankMed• Talent Development Advisor at ABL• Economist at the Association of Banks in Lebanon [ABL]
Mohammad received his college education (undergraduate &graduate) at Louisiana State University (LSU), and has beenteaching Economics and Finance for over 25 continuous years atreputable universities in the USA (LSU) and Lebanon (LAU).
Finally, Mohammad published over 25 articles, of those many are inrefereed Journals (e.g., Journal of Money Laundering & Control;Journal of Operational Risk; Journal of Law & Economics; etc.) andBulletins.”
Mohammad Fheili – fheilim@jtbbank.com
Qualitative Assessment of Risks in Electronic Banking & Automation…
Mohammad Fheili – fheilim@jtbbank.com
IntroductionIntroduction
Mohammad Fheili – fheilim@jtbbank.com
And many more . . .
Did You Live The Experience? … Dream vs. Reality?!
Didn’t you dream of having Super Power? Haven’t You Wished You Can Fly?Avatar…!
PG 13 PG 13PG 134
PG 13 PG 13
Motion‐Picture rating of PG 13advising parents that somematerial in the film may beunsuitable for children under 13.
Mohammad Fheili – fheilim@jtbbank.com
And many more . . .
This Is Where Dreams Are Made!
Mohammad Fheili – fheilim@jtbbank.com
Is He For Real?!The Good Old Days …
Mohammad Fheili – fheilim@jtbbank.com
We copied ‘Disney’s Mentality’ to ‘Banking’; and here is what we have . . .
Super Power
Real
Mohammad Fheili – fheilim@jtbbank.com
Mohammad Fheili – fheilim@jtbbank.com
The Cyber[Pretend] ChallengeQualitative Assessment of Risks in Electronic Banking & Automation…
Mohammad Fheili – fheilim@jtbbank.com
Are You Convinced that we have been evolving in that fashion?IF YES, then the extreme majority of anticipated/undertaken projects is about“Automation”, and/or IT Solutions….RESULTING in:1. Increasing Demands for IT skills,2. Technical skills is favored over soft skills3. Talent Development potentially biased4. etc.
The Absence of Such Technical Skills will reflect Negatively on the success of the majority ofprojects, and introduce an element of heightened Risks in the successful Completion ofPlanned Projects…
Are There More!
4th Industrial Revolution:which is characterizedby the fusion oftechnologies blurringthe lines between thephysical, digital, andbiological spheres.
Mohammad Fheili – fheilim@jtbbank.com
We Have Evolved Indeed… 1. Are We Better Off?2. Has it Been An Evolution or a Revolution?!3. Has ‘IT’ Made Our Lives Easier?4. Disruptive Technologies!5. ‘IT’ Has Induced Unbearable Complexities!
Technology combined with increasing day-to-day necessities (is it? Or Desires?) is the most significant driver of business change!
Mohammad Fheili – fheilim@jtbbank.com
Compatible Processing Speed
Mohammad Fheili – fheilim@jtbbank.com
My Phone
Smart Phone
Features 10s of Built‐In
Applications 100s of
Applications Available for Download
Mohammad Fheili – fheilim@jtbbank.com
My Moment!
MobileMoment!
Mohammad Fheili – fheilim@jtbbank.com
My Book
eBook
Mohammad Fheili – fheilim@jtbbank.com
My Laptop
Slim & Super-Slim Laptop
Mohammad Fheili – fheilim@jtbbank.com
What’s [Explicitly] Missing in This Roadmap?!
Mohammad Fheili – fheilim@jtbbank.com
In SportsIn SportsInstant Replay
Mohammad Fheili – fheilim@jtbbank.com
The NCAAPlaying Rules Oversight Panel has approved an experimental rule that willallow the Big Ten and Mid‐American conferences to use instant replay oncertain plays within the restricted area arc during the 2016‐17 season.The experimental rule, which will be in effect only during conferenceplay, can be used when an official believes that an incorrect call wasmade on a restricted area ruling, or when a head coach makes an appealfor a review.If a coach appeals and the instant‐replay review determines the official’scall was correct, the appealing coach’s team will be charged a timeout. Ifthe call is reversed on appeal, no timeout will be charged.
In the NBAIf referees confirm the shot was made in time (or have noconclusive video to overturn their on‐court ruling), refereesalso look to confirm:• Whether the shot was a two‐ or three‐point attempt, or• Whether the shooter committed a boundary line violation
or the ball touched an out‐of‐bounds area, such as thestanchion, prior to entering the basket. If it did, the goalwould be disallowed.
If the shot was not made in time, referees will still try todetermine if any of the following occurred before the ball leftthe shooter's hand and adjust the shot and game clocksaccordingly:• The shooter stepped on a boundary line,• The 24‐second clock expired,• There was an 8‐second backcourt violation, or• A player or players committed an unsportsmanlike act or
unnecessary contact.Exception: Instant replay is not used in cases where the madebasket followed a throw‐in, free throw attempt or jump ballstarted with 0.2 or 0.1 on the game clock because players canonly tip the ball in those situations according to theComments on the Rules, Section II L.
The NFL’sinstant replay debate has been a hot‐button issue since games were firstregularly televised in the late 1940s. Traditionalists, hesitant to interferewith the purity of the game by removing human error, clashed with thoseeager to embrace technology and all that it offered the game.The NFL has come to embrace instant replay, but the process that led tothe state‐of‐the‐art system the league uses today was not alwaysseamless. The history of instant replay in professional football is filledwith stops and starts; missteps and controversy; and modifications andimprovements that continue to this day.Instant replay’s history begins in earnest four decades ago — with a manand a stopwatch.Is there any evidence or reason why FIFA is so against adding instantreplay to soccer?
Instant Replay
Mohammad Fheili – fheilim@jtbbank.com
Banking …. got complicated
ComplexityTechnology-Induced
Innovation that Displaces established Market Leaders, Technologies & Alliances PLUS Creates a new Market or Industry & Value Networks!
Mohammad Fheili – fheilim@jtbbank.com
BetweenHumanizing “The Technology’ & Digitizing “The Human-Client!”
Technology Has Altered Our Existence
Mohammad Fheili – fheilim@jtbbank.com
People Come First
Data Come First
The Age of Instant Interconnectivity…
More AboutTechnology‐Induced Complexity
Technology-induced complexity in Banking
Mohammad Fheili – fheilim@jtbbank.com
have led to:Increased Usage of Impersonal Electronic Services• Low Cost Electronic Services;• Widespread and Diffused Customer Base.This, in turn led to:Lower Customer Intimacy.Reduced Switching Costs Between Different Banks (Customers these days areconstantly shopping for the better deal)Increased Chances of Fraud and Credit RiskIncreased the Demand for Transparency
• Less Time to Know and Influence Customers.Research shows that Customer Interest peaks and falls rapidly especially inresponse to a Promotional Event.This makes it absolutely necessary for banks to optimally leverage allavailable customer touch points so as to be able to influence the customer(e.g., You find ads and offers on ATM receipts).
Mohammad Fheili – fheilim@jtbbank.com
More AboutTechnology‐Induced Complexity The Introduction of any form of technology in a given production process orthe mere modification of an existing IT environment necessitates a number ofchanges which spillover on Bank Performance: Staff Skills, Workflows, Policies& Procedures, and a host of other changes. In today’s technologically intense production processes, informationtechnology (IT) risks cannot be considered independently of other types ofrisks since it reflects on our ability to serve and satisfy our clients. Because processes are Technology dependent, Accurate, Complete and timelydata collection has changed from being mostly qualitative to overwhelminglyquantitative. Recognizing these challenges and acknowledging that the Employee has arole to play in managing these risks will put management one step ahead.
Is not enough anymore!
Mohammad Fheili – fheilim@jtbbank.com
MAXIMIZE PROFIT subject to:RISK , REGULATORY, Compliance,Reporting, Etc. Constraints
RISK . . . Default Liquidity Maturity Others . . . REGULATORY . . . Basel I Basel II Basel III Basel IV (In the making)
TLAC Requirements Sanctions Rules USA_FATCA Requirements
OECD_CRS (1st Reporting 2017) ISA 700, 701, 705, 706, and 720 AML, Etc. . . .
Uses of Funds Sources of Funds
Reserves Loans Securities Other
Investments Fixed Assets . . .
All Types of Deposits
Borrowings Other
Sources Capital . . .
Off-Balance Sheet
With every Dollar in Profit a Bank Makes, it MUST satisfy
all these Regulatory Constraints
first!
Legal Issues . . .
FromOriginate‐To‐
hold ToOriginate‐To‐Distribute
(Decompose & Redistribute)
CRS: Common Reporting Standards, essentially inspired by FATCA, is a framework between governments to exchange information obtained from local financial institutions tocombat tax evasions.TLAC: The Proposed Minimum Total Loss Absorbing capacity requirements for Globally Systemically Important Banks (G‐Sibs). It aims to boost G‐Sibs’ capital and leverageratios, ensuring these banks are equipped to continue critical functions without threatening financial market stability or requiring taxpayer support.ISA: International Standard on Auditing.
Instead of to Off‐Balance Sheet; now toUnregulated Shadow Banking with less concerns over loan
monitoring & Follow up.
Deteriorated quality of Capital with the Introduction of new instruments and Tier 3
The Banking Model …. got complicated and Banks are forced to Automate.
Mohammad Fheili – fheilim@jtbbank.com
General Ledger
Clients & Settlement
P & L Risk Reporting
Core Analytical Engine
Other Models
Predictive Models
Regulatory Models
Asset‐Liability Management
Models
Risk Models
Business Strategy Analysis
Valuation Models
Pricing Models
Exposure Measurements
B ACD
These Risks could Exist Inside each Module and in the Interface between
Two or More Modules
Interface Between Modules
More AboutTechnology‐Induced Complexity
Mohammad Fheili – fheilim@jtbbank.com
Level Of Maturity in AML Compliance
Nature & Extent o
f Efforts Dep
loyed
DD
EDD
RBA
Due Diligence
Enhanced Due Diligence
Risk‐Based Approach to AML Compliance
Enhancing Compliance Capabilities …
AML Cost
Skills Needs
Know‐How
AML Analytics
AML Compliance require:The Use of Technology:Quantification/Data‐Rich vs.Judgment/Opinion‐Rich
Increase exposure to TechnologyFailures.
Different Sets of Skills arerequired.
Reliance on Technology mayReduce Frequency of Risk EventsBut Increase Impact if and whena Risk Event occur.
More AboutTechnology‐Induced Complexity
Mohammad Fheili – fheilim@jtbbank.com
Increasing Our Understanding of Potential Outcome (i.e., Business Impact of a Risk Event)
Increa
sing
Evide
nce on
Proba
bility of
occurren
ce (…
of a Risk Event)
Ambiguity
Unc
erta
inty
Ignorance
Complexity makes itdifficult, if not impossible,to understand the “RiskEnvironment” and Changing“Risk Characteristics”.A Bank is expected tocollect ALL needed data tomove closer to RiskManagement and Awayfrom: Ambiguity, Ignorance, and Uncertainty.
Technology‐Induced Complexities give birth to an environment withamplified risk characteristics
Mohammad Fheili – fheilim@jtbbank.com
A Perspective … A Perspective …
Mohammad Fheili – fheilim@jtbbank.com
Data acquisition Data analysis Data cableData domain Data element Data farmingData governance Data integrity Data maintenanceData management Data mining Data modelingData visualization Computer data processing Data publicationData remanence Data set Data warehouseDatabase Datasheet Environmental data rescueFieldwork Metadata Open dataData Migration Data Conversion Data Cleansing Data structure Raw Data Secondary DataEtc …
Data …
Mohammad Fheili – fheilim@jtbbank.com
• Client Information Profile• Balances • Interest Rates• Commissions & Charges • Maturity
• Payments• Provisions • Overdue Balances• Outstanding Balances
Formulas to Calculate Data Framework to Locate Data Framework to warehouse Data Framework for Compliance
Calculation Engines Financial Statements Chart of Accounts Regulations
Core (Raw) Data Calculated Data
Mohammad Fheili – fheilim@jtbbank.com
It’s More about the People Behind the Technology than
Technology itself!
Between “Innocence” AND “Criminal”
Intentions Behind every Risk Event!
Mohammad Fheili – fheilim@jtbbank.com
Let’s Start with
Mohammad Fheili – fheilim@jtbbank.com
The United States is dealing with a nastybird flu outbreak.Sixteen states have reported cases of highlypathogenic H5 ‘Avian Flu’ among flocks ofbirds like turkeys and chickens as well aswild birds.
Travel Back in Time to: May 13th, 2015
Mohammad Fheili – fheilim@jtbbank.com
Mohammad Fheili – fheilim@jtbbank.com
It’s May 2015, and you’re ona Visit to the USA. You wereasked by a Dear Friend,who’s a Zoo Keeper, to pickOne animal to take care ofalone for a day and inside a25m2 room…YOU CAN’T DECLINE!Feel free: To ask any question. I’m
the Animal Keeper! To do what you deem
necessary to succeed.
You’re THE ZOO KEEPER
Mohammad Fheili – fheilim@jtbbank.com
1
3
You were asked by a ZooKeeper to pick Oneanimal to take care of,for a day, inside a 25m2
room; and alone?Feel free: To ask any question.
I’m the AnimalKeeper!
To do what youdeem necessary tosucceed.
2
4
Mohammad Fheili – fheilim@jtbbank.com
Survey Says!
Mohammad Fheili – fheilim@jtbbank.com
In 2015, 38% more security incidents were detectedthan in 2014.
Theft of “hard” intellectual property increased 56%in 2015.
Staff remain the most cited source of compromise(Risks).
Risk Events attributed to business partners climbed22%.
Source: Global State of Information Security Survey, March 2016
Mohammad Fheili – fheilim@jtbbank.com
Suppliers / Partners
35%34%
30% 29%
18%22%
15%
19%
13%16%
20152014Current
EmployeesFormer
EmployeesCurrent Service
Providers/Consultants/Contractors
Former Service Providers/Consultants
/Contractors
Sources of Risk EventsSource: Global State of Information Security Survey, March 2016
More AboutSecurity Compromised
Mohammad Fheili – fheilim@jtbbank.com
Sources: EIU/SHRM Foundation Survey: “Managing Human Resources in a Changing World”
Mohammad Fheili – fheilim@jtbbank.com
& Business Implications
12Disruptive12
Mohammad Fheili – fheilim@jtbbank.com
Mohammad Fheili – fheilim@jtbbank.com
Mohammad Fheili – fheilim@jtbbank.com
Mohammad Fheili – fheilim@jtbbank.com
Mohammad Fheili – fheilim@jtbbank.com
Mohammad Fheili – fheilim@jtbbank.com
Mohammad Fheili – fheilim@jtbbank.com
Mohammad Fheili – fheilim@jtbbank.com
Mohammad Fheili – fheilim@jtbbank.com
Mohammad Fheili – fheilim@jtbbank.com
Mohammad Fheili – fheilim@jtbbank.com
Mohammad Fheili – fheilim@jtbbank.com
Mohammad Fheili – fheilim@jtbbank.com
Sources: EIU/SHRM Foundation Survey: “Managing Human Resources in a Changing World”
Technological Innovationsare happening & BusinessEnvironment is changingMUCH FASTER thanCurriculums in Universitiesare resulting in an alarminggap between the skillsproduced by educationalinstitutions and thoserequired by BusinessOrganizations.
Technological Innovationsare happening & BusinessEnvironment is changingMUCH FASTER thanCurriculums in Universitiesare resulting in an alarminggap between the skillsproduced by educationalinstitutions and thoserequired by BusinessOrganizations.
Mohammad Fheili – fheilim@jtbbank.com
Sources: EIU/SHRM Foundation Survey: “Managing Human Resources in a Changing World”
Mohammad Fheili – fheilim@jtbbank.com
Sources: EIU/SHRM Foundation Survey: “Managing Human Resources in a Changing World”
Loyalty to one’s profession is gaining over loyalty to the Organization
Mohammad Fheili – fheilim@jtbbank.com
Sources: EIU/SHRM Foundation Survey: “Managing Human Resources in a Changing World”
Mohammad Fheili – fheilim@jtbbank.com
√
√√
Sources: EIU/SHRM Foundation Survey: “Managing Human Resources in a Changing World”
Mohammad Fheili – fheilim@jtbbank.com
Rising Cyber-RisksBeware…!
Mohammad Fheili – fheilim@jtbbank.com
People, System, and Processes belong to the same Risk FamilyPRIMARY SECONDARY
PEOPLE
Employee Fraud / Malice (Criminal)
PROCESSES
Payment / settlement / delivery risk
SYSTEMS
Technology investment risk
EXTERNAL
Legal / Regulatory Risk / Public Liability
Unauthorized activity / Employee misdeed (Willful) Employment LawWorkforce disruption Loss or lack of key personnel
Documentation or contract riskValuation / Pricing Internal / External reporting and complianceProject risk / Change management Selling Risks
System development and implementationSystems failuresSystems security breachSystems capacity
Criminal Activities Out-sourcing / Supplier RiskIn-sourcing RisksDisaster and Infrastructural utilities FailuresPolitical and Government Risks
Operational Risk
Mohammad Fheili – fheilim@jtbbank.com
Implicate the Employee Or Eradicate the Business
It is about People and
Culture
Mohammad Fheili – fheilim@jtbbank.com
Combating Operational Risks Rests in Your Risk Culture
…Keeping in mind that the absence of a well defined ‘Risk Culture’ is a statement of ‘Risk Culture’ … Se Beware!
Mohammad Fheili – fheilim@jtbbank.com
You start with the “Man in the Mirror”!
Every individual comes toan organization with his/erown personal Perception ofRisk.
Every individual comeswith his/er own Inventoryof Moral Values and thesehave a great influence overthe decisions they make onday‐to‐day basis.
The Man In The Mirror . . . The Man In The Mirror . . .
Mohammad Fheili – fheilim@jtbbank.com
People vary in all sorts of ways and this includes their predisposition toward Risk.Two specific Traits:1. The extent to which people are either: spontaneous and challenge convention or organized, systematic and compliant.
2. The extent to which people may be: cautious, pessimistic and anxious, or optimistic, resilient and fearless.
Organizations need to pay attention to the ethical profile of those working in theirbusiness because it significantly influence individual’s Decision Making: Ethic of Obedience (Rule Compliance, Spirit of the Law, etc.) Ethic of Care (Empathy, Concern, Respect, etc.) Ethic of Reason (Wisdom, Experience, Prudence, etc.)
Mohammad Fheili – fheilim@jtbbank.com
Risk Culture
Personal Predisposition
of Risk
Personal Ethics
Behavior
Organizational Culture
Individual values and beliefs andattitudes toward risk contribute toand are affected by the wider overallculture of the organization.It is useful to consider Organizationalculture in relation to two keydimensions:1. Sociability: People Focus (based on
how well staff get on socially)2. Solidarity: Task Focus (based on
goal oriented and teamperformance)
Mohammad Fheili – fheilim@jtbbank.com
Risk Management Is Everybody’s Business
Staff Business Unit Senior Management
Assessment & Follow Up
Acceptance or Mitigation of Identified Risks
Follow Up on Decided Actions
Oversight & Control
Reports to Enable Senior Management Appraisal
IdentificationReporting
Registration of Incidents and Monitoring of the
Internal Control Environment
Problems with Risk Cultureare frequently found at theroot of organizationalscandals and collapses.
Every individual comes to an
organization with his/er own personal
perception of Risk
It Starts Here
Risks Tracking … Finding The Trail
Mohammad Fheili – fheilim@jtbbank.com
Participative Risk Management
Full and Consistent Communication & Coordination
with all Business Units
Autocratic Risk Management
I Know what to do, and I will do it all alone. My way or the highway!
Mohammad Fheili – fheilim@jtbbank.com
Poor
Unclear
Lack of Insight
Over Confidence
No Challenge
Fear of Bad News
Indifference
Slow
Gaming
Beat the System
Good
Clear
Good Insight
Confident But Careful
Constructive Challenge
Reward Honesty
Diligence
Fast
Coordinating
Play By The Rules
Communication
Tolerance
Level Of Insight
Openness
Confidence
Challenge
Level of Care
Speed of Response
Cooperation
Adherence to Rules
Transparency of Risk
Acknowledgement of Risk
Responsiveness To Risk
Respect For Risk
High Risk Low Risk
Risk Culture Framew
ork
Beware of the Weak End of the Continuum!
Mohammad Fheili – fheilim@jtbbank.com
What Drives Individual PerformanceAnd Shapes Risk Culture?
Mohammad Fheili – fheilim@jtbbank.com
Abilities
Knowledge
(Knowledge + Skills)X(Attitude) = Abilities
Formal + Self-Acquired
To Perform & Excel And Grow
SkillsTechnical + Soft
Human Capital Accumulation = ∑Abilities
The NOT so visible Argument that we often
forget
Mohammad Fheili – fheilim@jtbbank.com
Skill Marketability
Loyalty To TheOrganization
Loyalty To One’s Profession
Skill Marketability Reflects Favorably OnThe Career And The Salary Of TheIndividual
Loyalty To The Organization MayHelp The Individual Sustain ACompany‐Specific Employment
Loyalty To One’s Profession Exerts TheNecessary Pressure On Knowledge AndSkill Build‐Up (Benefiting Both TheIndividual & The Organization)
It Makes You PunctualIt Makes You Knowledgeable
Mohammad Fheili – fheilim@jtbbank.com
Talent Laundering • Talent Versus Ethic• Hard Work• Abundance of Qualificationsovershadow the need to probe aboutEthics.
• Individuals with Bad Ethics seekEmployment only to feed theircriminal intentions.
• Talents tainted with Bad Ethics is onlyafter short term gains.
• Those who are loyal to theirprofession hold the highest degrees ofProfessional & Personal Ethics.
Mohammad Fheili – fheilim@jtbbank.com
Final Thoughts
Final Thoughts
Mohammad Fheili – fheilim@jtbbank.com
Brilliant Surgery!
Well Done!Shame the
patient died.
Outcomes
Mohammad Fheili – fheilim@jtbbank.com
Risk Management of Today has been Contaminated & Disrupted bythe Complexity of Technologies and Technological Innovations.… Risk Management ought to be as Simplistic as the Environment itexists in.
Mohammad Fheili – fheilim@jtbbank.com
Recommended