Board and Senior Management Reporting. Eric Holmquist Managing Principal Enterprise Risk Management

Transcription

1 Board and Senior Management Reporting Eric Holmquist Managing Principal Enterprise Risk Management April 28, 2018

2 CONTENTS OVERVIEW AND COMMON CHALLENGES IT S ALL ABOUT ROLES LESS IS MORE, EXCEPT WHEN IT ISN T RISK APPETITE CONNECTS EVERYTHING SUMMARY AND Q&A 2

3 01 / OVERVIEW CAPC

4 Introduction Information is not knowledge. Albert Einstein Modern day information overload stops us from sufficiently engaging with our thoughts. Sam Owen, Relationship Coach 4

5 Common Challenges / The problem is not a lack of information, it s a lack of understanding Too much information Not enough information Backward looking information Unclear what actions to take Hard to interpret Lack of expertise 5

6 02 / ROLES CAPC

7 Roles It takes generosity to discover the whole through others. If you realize you are only a violin, you can open yourself up to the world by playing your role in the concert. - Jacques Yves Cousteau 7

8 Information Aligned to Roles / The right information for the right decision making What is the role of the board? What is the role of senior management? 8

9 Information Aligned to Roles / The right information for the right decision making For the Board, the focus has to be, Where are we going, and how do we feel about it? Then comes, Should we do it, can we do it, did we do it? In other words, strategic, focusing on the guardrails 9

10 Information Aligned to Roles / The right information for the right decision making Focusing on details is sometimes necessary, but can be distracting, even giving a false sense of accomplishment Right now, the Board should probably be focusing a lot on strategic risks, but that takes people into uncomfortable territory The goal is getting the right information to the right group at the right time For risk, we re largely talking about three major buckets, strategic, operational and external 10

11 03 / TECHNIQUE CAPC

12 Technique Information is a source of learning. But unless it is organized, processed, and available to the right people in a format for decision making, it is a burden, not a benefit. -William Pollard 12

13 Just Remember more Less is more, except when is more, although sometimes the board thinks that more is more be more would be more, when really less, but other times think that less, when more really would be would more13

14 Data, Data and More Data / Techniques for making information actionable Discussing what happened (backward) can be important to 1) validate people s assumptions and 2) provide context for a forward looking view However, risk management only exists in the future The goal is to be more forward looking, but how? This takes very deliberate effort and requires a risk view The balance depends on the bank Macro (we re planning) Detailed (we re resolving) 14

15 Scorecards Work / Industry Best Practices For Actionable information The simple fact is that scorecards focus the conversation, let people digest more information, and create dialog But have the detail available to support them Metrics make sure that they actually correlate to a tangible risk Use graphics intelligently This will create needless debate This will create conversation Managing a metric is not managing a risk Make the detail available if desired 15

16 Past as Prologue, The Future is Everything / Industry Best Practices For Actionable information Consider this, the high points of an information security report In the past 90 days we: Experienced no data security incidents Completed a penetration test with only minor findings Completed user training on InfoSec Attended two conferences on cybersecurity Validated 37 security related controls (via Internal Audits) What does the above tell me about our information security risk? 16

17 Past as Prologue, The Future is Everything / Industry Best Practices For Actionable information Consider this alternative At present: We have 37 third-parties with customer NPI, all in good standing We have 14 third-parties with access to our internal network We maintain systems with confidential information in 4 locations, all secure sites, but approximately 800 access points We have seen a 47% increase in external hacking attempts We have identified 17 potential vulnerabilities in our systems or databases, only 1 considered critical (with a 30 day remediation plan) We have concluded that our InfoSec risk rating is current Moderate, slightly above desire appetite, and anticipate being able to reduce that to Low to Moderate within 60 days 17

18 Success Strategies / Industry Best Practices For Actionable information Never assume people interpret information the same way Human nature is to not ask questions when it s obvious others understand (or give the impression they understand) Content should certainly follow the disclosure rule Don t duplicate efforts think about committee hierarchies Be careful with peer data are we talking apples and apples? Emerging risk is a very good place to focus 18

19 Tablets vs. Paper / Did we solve one problem and create others? It HAS to be paper! No! Tablets are cool! Everyone s using them! 19

20 Tablets vs. Paper / Did we solve one problem and create others? 20

21 Tablets vs. Paper / Did we solve one problem and create others? Neither is perfect, but one is probably preferred Tablets offer a lot of capabilities, which is good, but can take away from the perceived accessibility to information. Trackability may be a concern, but does it outweigh the benefit? 21

22 04 / RISK APPETITE CAPC

23 Risk Appetite The risk management needs to lift up from risk control to risk intelligence which can identify the potential business growth opportunities. - Pearl Zhu 23

24 Risk Appetite and Reporting / In both strategy and risk, the guardrail means everything If you haven t defined and agreed on risk appetite levels, risk management can only be so effective Otherwise, we re making assumptions about people s perspective on risk and acceptable risk levels Does everyone interpret information the same way? Can we quantify the impact of events? Do we know the threats and vulnerabilities? We re trying to change the narrative from What could go wrong? to Are we taking the right risks? Have we defined the boundaries for senior management and staff? Does everyone understand the limits of risk taking? 24

25 05 / FINAL THOUGHTS CAPC

26 Final Thoughts / Pulling it all together If the materials being presented to senior management and the Board don t prompt a discussion, then either nothing is happening or the reports aren t right You can t focus only on How are we doing in getting there? You have to also be thinking about where there is and does that still make sense. A pretty good focal point is What s changed (or changing)? Ask yourself, what would I want to know in order to understand where we are at, or make an informed decision on something? Remember, risk always lies in the assumptions, so when considering any proposal or risk position, always ask, What are your assumptions? 26

27 Contact Information Eric Holmquist Managing Principal Worldwide Offices Bangalore - Bratislava - Brussels - Chicago - Dallas Edinburgh - Frankfurt - Geneva - Herndon - Hong Kong - Houston - Johannesburg - Kuala Lumpur - London New York - Orlando - Paris - Singapore - Toronto - Zurich