Responsive Risk Management. Francesca Gomez, Deloitte

Transcription

1 Responsive Risk Management Francesca Gomez, Deloitte

2 Session agenda About me A look at the new risk landscape for digital How are organisations responding? Enabling digital risk management

3 About me Artificial Intelligence Human Computer Interaction Control design for digital product development Regulatory change management Regulatory remediation. Internal Audit Ops Risk Control testing

4 Session agenda About me A look at the new risk landscape for digital How are organisations responding? Enabling digital risk management

5 It is not the strongest of the species that survive, nor the most intelligent, but the one most responsive to change. Darwin s Theory

6 Digital driven change Digital technology is constantly changing, creating new opportunities and threats for businesses. Platforms Data Mobile Channels IoT Acquisitions Tools Markets Revenue streams Cloud Devices Apps Competitors Cyber Networks Expectations Concepts

7 How are businesses adapting? New business models Product and service innovation Acquisitions of startups Data use Strategic partnerships and investments New channel use + multichannel

8 How does this change the risk landscape? Speed Uncertainty Change Risk taking as business enabler Fast changing business New tech not tried and tested New 3 rd party dependencies Changing external threats Regulatory uncertainty Dynamic Risk

9 Risk management in digital is not just about responding to the latest technology risks. New approaches to managing risk in the face of uncertainty and change are required.

10 Session agenda About me A look at the new risk landscape for digital Industry responses Enabling digital risk management

11 CESG (Information Security Arm of GCHQ) Digital Our goal is to support the creation of a culture and environment where risk management activities are effective, with people creating systems with an excellent user experience and good enough security to meet business needs. Beta publication of principles: cesgdigital.blog.gov.uk/

12 Gartner research It is neither possible, nor practical, to use "traditional" approaches to security and risk of exclusion and rigid control. A more flexible approach is needed, one that focuses on the most important information and monitors the ecosystem to identify potential threats. This flexible approach balances the delivery of business outcomes, with the security of the organization. Gartner Toolkit: Risk-Based Security, Blosch, M. & Walker, M.J., 30 April blogs.gartner.com

13 Digital Risk Management Institute The DRM Institute is an independent, expert, non-profit organization led by business executives, risk officers and CISOs to analyze industry-specific digital risk scenarios, create standard DRM knowledge, and promote best practices for managing digital business risk.

14 Start-ups - Digital Banks and Acquisitions Digital Challenger Banks New digital challenger banks need to balance obtaining/ keeping their banking licence with rapid innovation and growth Start-up Acquisitions Larger organisations acquiring start-ups need to integrate them into their control framework without damaging innovation and culture Fostering the right culture to embed doing the right thing Innovative approaches to knowledge sharing of key topics Leveraging technology for risk processes Risk-based approaches to determine what requires central governance Invest vs acquire decision based on maturity of the start-up Keep prioritising speed and flexibility in technology infrastructure decisions

15 Emerging trends Accept uncertainty to make timely decisions First priority is to enable the business Continuous risk management over one-off assessment Monitor the external ecosystem Embed the right risk culture

16 Session agenda About me A look at the new risk landscape for digital Industry responses Enabling digital risk management

17 Managing dynamic risk Move at speed Handle uncertainty Managing Digital Risk Respond to change Effective Design of Enablers for Digital Risk Management

18 COBIT 5 enterprise enablers Source: COBIT 5, figure ISACA All rights reserved.

19 Culture, Ethics and Behaviour Encourage innovation in the risk space Test and learn within organisation s risk appetite Collaborate and share best practises cross-function and cross-market collaboration Innovate Test and learn Collaborate Link risks to core objectives to make consideration of these part of core business decision making Use immersive training to bring risks to life

20 Information Oversight and ownership of digital assets and information Risk based classifications/ hierarchy to inform areas requiring central governance and controls Emerging datasets and use cases evaluated and built into guardrails ahead of business need Oversight and ownership Risk based classifications Use for risk decisions As an internal enabler to make data driven risk decisions

21 Services, Infrastructure and Applications Services Infrastructure Applications Fraud and device analytics Monitoring and escalations Vulnerability management Secure Scalable Fast integrations Digital content management Digital workflow tools Real-time monitoring tools Useful services that drive adoption Applications support digital processes provide usable Management Information

22 Key takeaways Managing risk in digital requires helping the business to handle uncertainty, move at speed and respond to change The industry is responding in different ways, through collaboration, pilot studies and building new approaches Risk based approaches can help balance risk exposure with the ability to innovate/ grow in digital Design of business enablers can optimise risk management for digital