IT Risk Tops List of Concerns for Board Members

A recent survey of Public Company Audit Committee Board Members about risk highlights the desire to focus more heavily on Information Technology ("IT") related risks. This is not surprising given that technological innovation continues at a rapid pace while it is also increasingly impacting every key facet of business today. The survey, conducted by the National Association of Corporate Directors and sponsored by KPMG, uncovered the following common board-level views about IT and other risk areas.

• They are not satisfied that their oversight of various IT risks is effective, or that the company's strategic planning process deals effectively with the pace of technology change and innovation.
• The one person they would most like to hear from more frequently is the CIO.
• They want to spend more time with the CRO and mid-level management/business-unit leaders; and few are satisfied that they hear dissenting views about the company's risks and control environment, or rate their company's crisis response plan as "robust and ready to go."
• The audit committee is devoting significant agenda time to legal/regulatory compliance risk, with the Foreign Corrupt Practices Act (FCPA), UK Bribery Act, and impact of the SEC's whistleblower "bounty" program of particular concern.

An integrated, enterprise-wide risk program is the key to addressing these items in a holistic and practical way.  If your company has not implemented such a program, meeting the demands of the board will be challenging.

Wheelhouse Announces New Strategic Alliance

Wheelhouse Advisors and Xactium are pleased to announce their new strategic alliance for the implementation of Xactium's Force.com Governance, Risk and Compliance applications.

Wheelhouse, a professional services firm specializing in Enterprise Risk Management & Control will be Xactium’s first US-based partner, operating in Atlanta, Georgia.

John A Wheeler, founder and Managing Principal of Wheelhouse Advisors brings over twenty years of strategic, operations and risk management professional to the firm. Prior to founding his company, John served as a Senior Vice President within the Corporate Risk Management division at a major U.S financial services company.

Dr. Andy Evans, Managing Director of Xactium, said: “This is a great opportunity for collaboration and signals the widening interest in our Force.com GRC Suite. Working with Wheelhouse will enable us to extend our reach to American markets and reinforce our position as a leading cloud risk solution provider. ”

John added: “We recognise the power of Xactium’s cloud-based solutions to provide clients with a complete, robust solution in a time frame they want. We look forward to extending our level of customer support with our new implementation services.”

The partnership follows a period of growth from Xactium, whose customer numbers have more than doubled in the last year. The potential for a future Xactium North America division will also be considered.

About Xactium: Xactium is a leading cloud-computing software company specialising in Governance, Risk and Compliance (GRC) solutions. Xactium helps customers efficiently and effectively access and manage risk and compliance activities without the need for complex, expensive risk software. Recent significant business wins include insurance brokers Jardine Lloyd Thompson; insurance and reinsurance group, RiverStone Europe; and Scottish water retailer, Business Stream.

About Wheelhouse Advisors: Founded in 2007, Wheelhouse Advisors serves corporate clients across the United States with the implementation and continuous improvement of their Enterprise Risk Management (“ERM”) programs. Their service offerings include: Bespoke Enterprise Risk Assessment, Independent Risk & Control Program Analysis, Financial Process Compliance; and Governance, Risk & Compliance Automation.

The Path to ERM Success

The path to success in implementing an Enterprise Risk Management (”ERM”) program can be found in greater integration and better technology - that’s according to a recent survey presented at the 2011 Risk and Insurance Management Society (”RIMS”) Conference in Vancouver, British Columbia. Entitled “Excellence in Risk Management VIII”, this is an annual independent survey of executives conducted for RIMS by Marsh. The most common focus area noted in the survey is a desire to strengthen enterprise or strategic risk management approaches. While more than half of the survey respondents indicated this desire, a majority saw the primary barrier to achieving this goal was a lack of understanding of the risk landscape across numerous silos of information.

As a result, 55% of the respondents expect to integrate risk management deeper into and across operations and 54% of respondents expect to perform day-to-day risk management activities more efficiently. To meet these expectations, organizations will need to improve the way they gather and report risk data through more cost-effective technology. The survey report supports this notion through the following observation. “It’s worth noting to risk managers that their counterparts in the C-suite were the most likely to view technology upgrades as a focus area. This should help pave the way for technology that can ease the time spent on mundane tasks and open the door to developing the deeper integration of risk management with other departments.”

Source: Risk & Insurance Management Society, Excellence in Risk Management VIII

How to Strengthen Your IT Risk Management Program

An essential component of any Enterprise Risk Management (ERM) program today is IT risk management. With ever-increasing threats to privacy and information security, companies are looking to strengthen their risk governance processes in many ways.

A recent survey by Carnegie Mellon University’s CyLab highlights ten key steps to building a stronger ERM program with a focus on IT Risk. The CyLab 2010 survey is based on results received from 66 respondents at the board or senior executive level from Fortune 1000 companies. Twenty-seven percent of the respondents were board chairmen; 3 percent were outside directors; 47 percent were inside directors; and 50 percent were senior executives but not a board member. Forty-five percent of the participants were from critical infrastructure companies.

The survey revealed that governance of enterprise security is lacking in most corporations, with gaps in critical areas. If boards and senior management take the following ten actions, they can significantly improve their organizations’ security posture and reduce risk:

1. Establish a board risk committee separate from the audit committee and assign it responsibility for enterprise risks, including IT risks. Recruit directors with risk and IT governance expertise.

2. Ensure that privacy and security roles within the organization are separated and responsibilities are appropriately assigned. The CIO, CISO/CSO, and CPO should report independently to senior management.

3. Evaluate the existing organizational structure and establish a cross-organizational team that is required to meet at least monthly to coordinate and communicate on privacy and security issues. This team should include senior management from human resources, public relations, legal, and procurement, as well as the CFO, the CIO, CISO/CSO (or CRO), the CPO, and business line executives.

4. Review existing top-level policies to create a culture of security and respect for privacy. Organizations can enhance their reputation by valuing cyber security and the protection of privacy and viewing these as corporate social responsibilities.

5. Review the components of the organization’s security program and ensure that it comports with best practices and standards and includes incident response, disaster recovery, and breach response plans.

6. Establish privacy and security requirements for vendors based on key aspects of the organization’s security program, including annual audits or security reviews.

7. Conduct an annual audit of the organization’s enterprise security program, to be reviewed by the audit committee.

8. Conduct an annual review of the enterprise security program and the effectiveness of controls, to be reviewed by the board risk committee, and ensure that identified gaps or weaknesses are addressed.

9. Require regular reports from senior management on privacy and security risks and review annual budgets for IT risk management.

10. Conduct annual privacy compliance audits and review incident response and security breach notification plans.

These steps should be integrated into a holistic enterprise risk management approach to provide an effective and seamless program that is fully embraced at all levels within the organization. Doing so will not only raise a company’s risk mindfulness level, but also secure positive returns for key investors and stakeholders for years to come.

Cloud Security Concerns Are Diminishing

As software vendors look for ways to improve their product offerings, many are venturing into the cloud. However, for the most of the last decade as cloud computing (also known as Software as a Service or "SaaS") has evolved, some companies would not even consider the notion of using these products due to fears about data security. Now that the major cloud providers have refined their technological infrastructures, that fear is unwarranted. In this month's issue of Treasury & Risk Magazine, more evidence is provided to support the integrity of cloud-based software products. Here's an excerpt:

As cloud vendors mature, Web-based delivery of applications, storage and infrastructure is getting more secure and trustworthy. That doesn’t mean that the risks are gone—they’ve just migrated to a more difficult-to-manage form. Today, big-name cloud providers like Salesforce.com offer top-notch security, auditability and compliance. Even Google provides a compliant e-mail hosting solution for regulated industries such as healthcare and finance.

In fact, clouds can offer a security advantage over traditional software, since cloud providers specialize in making their application as secure as possible, spreading the costs of that effort among many customers. On their own, companies might not be able to afford the same level of security.

Coupled with the benefits of little or no maintenance as well as the minimal initial investment, the fact that cloud-based software is highly secure makes the business case for moving to the cloud a no-brainer for businesses looking for efficient and effective software solutions.

Risk Won't Wait

After several years of delaying funding on risk management and IT security due to economic pressures, more and more companies are realizing that they cannot wait any longer. The stakes are simply too high to rely on outdated technology and a bare-bones approach to addressing ever-increasing risks.  Here is what was reported in InformationWeek magazine earlier this week,

A unique convergence of circumstances makes this the perfect time to bring IT and business units together under the flag of a risk-oriented approach to security. Economic stress and cutthroat competition on a global scale mean every dollar you spend on security had better matter. Executives are increasingly being held personally accountable, and unified risk management as a discipline is finally reaching maturity.

Plus, the money is there. Thirty-five percent of the 563 respondents to our InformationWeek Analytics IT Risk Management Survey say their companies' IT risk management programs will get more funding in 2011 than they did last year. Very few will see cuts.

Don't be left behind. With leaps in technology occurring in a matter of months rather than years, no company can afford to delay their improvements in risk management.

Information Technology is a Core ERM Building Block

As the year nears an end, many folks are looking to 2011 in anticipation of the regulatory impact beset by the Dodd-Frank Act of 2010. One of the primary impacts discussed today in Bank Systems & Technology magazine is the specter of the new Office of Financial Reform. Financial services companies of all shapes and sizes will soon be subject to the requests for data from this new agency to support its mission of reporting emerging risks to the U.S. Congress. Here's an overview of what companies can expect.

The Dodd-Frank legislation establishes the Office of Financial Reform (OFR), a new department within the U.S. Department of the Treasury that is tasked with gathering and reporting to lawmakers information regarding potential risks and threats within the nation's financial industry. To accomplish this, the OFR's director can use his or her subpoena power to gather data from any financial institution.

Simply, says Michael Atkin, director of the Enterprise Data Management Council, a nonprofit trade association focused on managing and leveraging data, the regulation gives banks' corporate leadership a new opportunity to examine the growing problem of managing skyrocketing amounts of data and finally to budget appropriately to meet the challenge. "It kicked the practice of data management into high gear," Atkin says. "We're now set up for addressing the data dilemma that we have because we finally have a reason that is not subject to the whim of a business case. It is a regulatory requirement."

The OFR director, who has not yet been appointed, will make his or her report to Congress in 2012, adds Atkin. But that initial report, he notes, likely will be more on the state of the industry than a detailed analysis of its data, giving financial institutions a window of several years to prepare for potential requirements. "The implications from an infrastructure perspective are about getting the core building blocks of risk management in place," Atkin relates.

Now is the time, as Atkin says, to get your "core building blocks of risk management in place". Wheelhouse Advisors can help. Visit www.WheelhouseAdvisors.com to learn more.

Fear of Innovation is a Huge Risk

At a time when crisis management has been the primary focus, no other industry is better positioned for an innovation leader to emerge than is financial services. Most financial services companies have retrenched and allowed their product development and technology to wither on the vine. Customers have suffered from sharp declines in service quality as a result. The company (or companies) with the fortitude to make significant investments in innovation will capture significant market share and greater profits. Three areas of innovation have been hot topics at this week's 2010 Bank Administration Institute's Retail Banking Conference.

1) The mobile phone is the new branch. Twenty-five percent of consumers have ditched their wireline phone and gone completely wireless. This of course puts increased pressure on banks to invest in mobile banking and payments. Yet except for remote check capture via mobile phones from banks like USAA, real innovation remains elusive. Most of the industry innovations are being driven not by banks, but by specialist companies like mFoundry, ClariMail, Monitise, Mocapay, PayPal, Bling and Obopay.  This while bankers complain that their major tech suppliers, including First Data, Fidelity, Fiserv and Jack Henry, are just not moving fast enough to meet their needs.
2) Social Networking is a dangerous tool for customer interaction but necessary. Banks get that social networking are here to stay. And many believe it has the potential to be something other than a digital version of a call center. But social networking is not a controlled environment and that scares bankers. It should. Sites like Twitter and Facebook provide a podium for every whack job to speak his or her mind. The benefactors of the uncertainties that retail banks have about how to use and measure social media effectiveness are likely IBM, SAS, SAP and Microsoft and could provide a watershed year for a slew of nimble-footed specialist firms who are building business to consumer (B2C) enterprise grade measurement and engagement tools.
3) Cloud Computing: the outlook remains cloudy. Instinctively it would seem that cloud computing technology would be a critical weapon to break down the line of business silos that exist in retail banks. This seems especially true given consumer demands to have an experience they value, on their terms, on the bank interaction channel of choice — online, mobile, ATM or branch, irrespective of the type of business a consumer wants to transact with the bank. Consumers value convenience and they want to define what convenience looks like. But banks seem crippled to navigate the abyss of implementation schemes, cost sharing, regulatory compliance, security and customer ownership issues.

Fear of innovation is a very real risk that many companies face in today's uncertain environment. The value of innovation is at its maximum during times of complexity and chaos. Those companies that work to escape the fear and embrace innovation will be the ultimate winners, while those that do not will suffer a painful fate.

The Risks of Cloud Computing

As we emerge from the economic downturn, more and more companies are considering “cloud computing” solutions as a way to keep information technology costs in control.  However, some companies are fearful of the unknown aspects of managing information within the cloud.  These fears may be justified, but they can certainly be alleviated by conducting a thorough risk assessment and vendor due diligence exercise prior to venturing into the cloud.

It all starts with what the company is looking to achieve through cloud computing and whether the investment is worth the risk.  For example, will the application hosted in the cloud be customer facing and subject to strict regulatory standards?  If so, then the risk assessment should include the probability and impact of events such as a data breach or unplanned downtime.

Once the risk assessment has been completed and the investment decision has been made, then a comprehensive due diligence exercise should be conducted.  Some vendors may suggest simply relying on their SAS 70 report from their external auditing firm rather than performing a due diligence exercise.  While SAS 70 reports are useful, they are not specific to the relationship between the two companies.  It is imperative that the following areas are examined in relation to a company’s current information security policies and overall operating expectations.

1. Organizational and Human Resource Security


2. Access Control


3. Asset Management


4. Physical and Environmental Security


5. Operations and Change Management


6. Disaster Recovery and Business Continuity


7. Privacy


8. Regulatory Compliance

Like any other partnership or outsourcing agreement, the time to address potential risks and issues with cloud computing is at the very beginning of the relationship.  By doing so, both the company and the vendor will benefit from the opportunity to understand each other’s expectations.  It will also serve as the foundation for a successful cloud computing solution.

If your company would like to learn more about performing a cloud computing risk assessment and due diligence exercise, email us at NavigateSuccessfully@WheelhouseAdvisors.com.

CFOs and CIOs Find Common Ground

A recent article in CFO magazine discusses the critical partnership between corporate CFOs and CIOs.  As is often the case, these two executives have difficulty speaking the same language.  CFOs are certainly more focused on the financial and risk aspects of any major information technology undertaking.  On the other hand, CIOs tend to focus on the innovation and efficiencies that they can bring to the business through greater automation.  Here is what CFO magazine noted from a recent roundtable discussion with CFOs and CIOs.

If one trait of CIOs could be changed, the executive said bluntly, they would develop more appreciation for prudent risk-taking. "They're always coming up with these very capital-intensive programs that are essentially faith-based initiatives. The projects are not well supported with metrics, the numbers don't work, but they want to run off and take the risk."  Similarly, one CFO at the table, who also asked not to be named, chimed in: "Stop saying that it's going to produce 2,000% ROI. Nobody believes you."  The first executive did allow, though, that there are two sides to the issue. Finance leaders, he acknowledged, often lose sight of the fact that "we have to have some vision, too." Rather than being just numbers-driven, CFOs have to find room for belief in innovation and "understand the power of a better idea."

To be truly successful, the two executives must find common ground.  Wheelhouse Advisors provides practical solutions to bridge the gap between CFOs and CIOs leading to stronger business results.  To learn more, visit www.WheelhouseAdvisors.com.

Maximize Your GRC Technology Investment

As we move into a new year, more companies are looking to integrate their risk management initiatives to simplify and streamline how they address risk and compliance activities.  In a recent article by Forrester Research, analyst Chris McClean discusses how Governance, Risk and Compliance ("GRC") software solutions can help companies in their pursuit of integration.  Here are the three primary benefits that companies have realized from their investment in technology.

1. Greater process efficiency -- Compliance requirements continue to swell, and the risk landscape is getting more complex. Above all else, customers cited process automation as the core value of their GRC platform implementations. Workflow management capabilities help keep everyone on task, and centralized content management and reporting reduce the need to jump back and forth between different systems. In addition, ongoing improvements in automated controls and control-testing functionality generate even greater efficiency gains. The manager of corporate compliance for a large pharmaceutical company told Forrester: "Managing all GRC initiatives in one platform saves time, resources and money. The ability to build a solid foundation for our compliance program in a relatively short time frame allows us to focus on the acute compliance issues facing our industry."

2. Convergence of GRC efforts -- As well as increasing efficiency, converging the various efforts relevant to governance, risk and compliance fosters cooperation between business functions and improves overall GRC insight. Comparing exposure across different categories of risk or using risk assessments to generate audit scopes are just two examples of GRC convergence benefits. An operational risk management director for a large financial services company said that one of the biggest benefits of implementing a GRC platform was the ability to "integrate the risk disciplines, including internal audit, ORM [operational risk management], SOX and compliance."

3. Consistency of processes and methodologies -- Getting different functions to work with each other is one thing, but getting them to use the same processes and methodologies is much harder. GRC platforms allow organizations to create standard templates for documenting and assessing risks, controls, incidents and other elements of GRC. Consistency also leads to convergence and efficiency and is often an initial driver for the development of a GRC program. The director of risk and compliance for a top high-tech company succinctly explained to Forrester that one of the most important values of GRC technology was the creation of a "consistent way to manage compliance, operational and ERM [enterprise risk management] projects." Pay close attention to this aspect of GRC value. As risk and compliance become more complex, consistency will quickly become a necessity.

Wheelhouse Advisors can help your company identify the right technology solution and implement a program that will maximize the benefit of your technology investment.  Visit www.WheelhouseAdvisors.com to learn more.

The Role of IT and Risk Management in the Financial Crisis

Information Technology (IT) continues to play an ever larger role in the overall risk profile for major corporations across the globe.  A recent article in The Economist discusses the role IT played in the recent financial crisis.  While the financial services industry invests massive amounts in IT, the industry still does not invest enough in risk management tools that will help avert future crises.  Here is what the article noted.

No industry spends more on information technology than financial services: about $500 billion globally, more than a fifth of the total (see chart below). Many of the world’s computers, networking and storage systems live in the huge data centres run by banks. “Banks are essentially technology firms,” says Hugo Banziger, chief risk officer at Deutsche Bank. Yet most in the industry agree that its woeful IT systems have, in Mr Banziger’s words, “exacerbated the crisis”. The industry spent billions on being able to trade faster and make more money, but not nearly enough on creating the necessary transparency. “Banks had lots of tools to create leverage, but not many to manage risk,” says Roger Portnoy of Daylight Venture Partners, a venture-capital firm that invests in risk-management start-ups.

Wheelhouse Advisors provides solutions to financial services companies looking to strengthen their risk management practices with better information technology tools.  Together with our strategic partners, Wheelhouse Advisors can deliver cost-effective solutions that can be easily implemented within a complex environment.  Visit www.WheelhouseAdvisors.com, to learn more about our services and our strategic partners.

IT Organizations Adjust to "New Normal"

The "new normal" is taking hold as businesses emerge from the economic recession and look to 2010 and beyond. Greater emphasis on disciplined decision making supported by a complete understanding of associated risks will become part of the norm.  To that end, one of the major Information Technology ("IT") market intelligence firms, IDC, recently published a report on what IT organizations should be doing to adjust to the "new normal".  Here is what IDC suggests as priorities for IT organizations.

1. Cost and Funding Management: IT organizations will increasingly be forced to develop cost profiles, including the business value of solutions, to support investment decisions. This will not be an easy or pleasant task, and has been a requirement that has dogged IT organizations for years.


2. Sourcing and Platform Strategies: As new options become available to achieve an IT or business objective, IT organizations will have more room to experiment, innovate, and change, but will also have to justify their choices more conclusively.


3. Equipment Leasing and Software Financing: Commercial organizations will return to IT leasing and financing as a means of bolstering their access to IT resources.


4. Life Cycle Management: IT organizations have already extended the planned deployment of many major systems, but they still need to develop the tools and management processes to quantify the underlying cost implications of these longer asset lifecycle models.


5. IT Financial Management Tools: As IT platforms and business processes increasingly move toward a mix of in-house and third-party provision, the need for IT financial management software, tools, and best practices to better enable IT organization operational decision-making will become apparent.

Does your IT organization have the necessary tools and supporting business practices to operate in this new environment?  If not, Wheelhouse Advisors can help.  Visit www.WheelhouseAdvisors.com to learn more.

Building Trust to Support Growth in 2010

This week, Information Technology ("IT") executives from around the globe have gathered in Orlando at the Gartner Symposium/ITxpo.  A big focus of the event is how IT can become more transparent and accountable in order to support business growth in 2010.  The key is balancing risk management with performance management.  Here is what Gartner analysts have to say on the subject.

Risk management is about accepting that IT organizations cannot protect the company from everything, so they will have to make conscious decisions about what they will do to protect themselves, and what they will not do. They must learn to balance risk and performance. People need IT organizations to share information, so that they can trust them. IT leaders should accommodate letting outside information in, and sharing inside information appropriately. CIOs shouldn`t think they can shut down the two-way flow of information because they can`t stop it.

Gartner analysts said that the quality of data underpinning metrics such as measuring business productivity, profits, value, and efficiency of services delivered is inadequate. This stems from siloed and inconsistent business data, and from an over reliance on spreadsheets. Even where there have been investments in business intelligence, it`s not giving the business what it needs. The challenge for IT leaders is getting the information that everyone can believe in, and that everyone in the organization will trust. "IT leaders need robust information architectures and governance, coupled with data quality and integration capabilities to create an enterprise view across these silos," said Nigel Rayner, research vice president at Gartner. "You will need to rationalize and link performance measures across the business in an enterprise metrics framework. When the data is consistent, and everyone believes it, then you have built trust."

Wheelhouse Advisors recently partnered with Apptio, the leading provider of IT Financial Management solutions, to help companies achieve a balanced risk and performance management approach. Apptio’s on-demand IT Financial Management solutions provide greater visibility into the cost, utilization and operations of IT products and services so that businesses can identify ways to reduce IT costs, make better IT decisions and provide the business with a true Bill of IT. World class companies such as Blue Cross Blue Shield of Kansas, BNP Paribas, EMD Chemical and Starbucks use Apptio’s IT cost analysis capabilities to reduce cost and achieve greater visibility into their IT costs and cost drivers. For more information, please visit www.apptio.com.

A Risk & Financial Management Balancing Act

Information Technology ("IT") is quickly becoming one of the primary areas within a company that is not only laden with risk, but also regulatory complexity.  At the same time, IT is one of the first areas to which companies look for cost reduction in an economic recession.  The combination of these factors demands better decision making and priority-setting by IT risk professionals and finance managers to meet the needs of the business while properly managing risk. In this month's issue of Information Security Magazine, an IT risk professional at credit information provider Equifax shares his view of this challenge.

Let's face it, we are entering an era of tighter statutory requirements and rapidly changing regulations. But focusing solely on statute requirements can lead to a disjointed strategy that is neither comprehensive nor aligned with business goals. While compliance mandates are often used to drive security investments, compliance by itself does not ensure a company's security posture.

Instead, businesses must look beyond their technology and compliance needs and understand the challenges of ensuring their company's security posture. Achieving this level of transparency requires the right mix of innovation, talent and technology underscored by a strategy that addresses risk at the broadest level. This is where relationships with business partners and vendors can play a valuable role. By joining forces with industry-leading third-party providers, companies gain access to new thinking and innovation to address key needs and challenges. With the right strategy and technology partnerships, businesses can drive a consistent and global set of security practices focused on risk reduction and information security.

Wheelhouse Advisors is uniquely positioned to help companies address their risk and security challenges while meeting the financial demands of the businesses they support.  To learn more, email us at NavigateSuccessfully@WheelhouseAdvisors.com or visit our website at www.WheelhouseAdvisors.com.

Weak Links in Risk Management Programs

An article published in the current issue of Bank Systems & Technology discussed the weak links in the risk management infrastructures of some of the larger financial institutions during last year's economic meltdown.  It seems that many institutions had to rely on highly manual, time consuming processes to understand their full risk exposures. Here is their view.

Weaknesses in the infrastructure often limited banks to identifying and aggregating exposures across the bank. A fragmented risk architecture dispersed over a multitude of systems made the reconciliation of the relevant data a time-consuming exercise, which was at best semi-automated, but more often a manual process. This led to banks needing far too long to aggregate their exposures and other relevant accounting and risk figures on a firmwide level. In the bankruptcy case of Lehman Brothers, for example, it was reported that it took some banks more than three weeks to determine their overall exposure to Lehman.

An inflexible risk environment within the banks rendered them incapable of reacting to sudden changes driven by external and internal circumstances—for example, the ability to perform ad hoc stress tests to assess the impact of new stress scenarios designed to address a rapidly changing environment.

In short, the interlinkage among risk types was not captured. The recent crisis has exposed the strong dependency among credit risk, market liquidity and funding liquidity pressures. Banks need to move away from silo-based risk management to achieve a more integrated and connected way of managing risk.

An integrated approach is not only required, it is also the most cost-effective solution in times like these.  Wheelhouse Advisors provides services to help companies build an integrated risk management program.  Visit www.WheelhouseAdvisors.com to learn more.

The IT Risk Paradox

Companies working to integrate and improve their Information Technology ("IT") applications are also inadvertently increasing the risk level across the entire enterprise.  Two professors from Carnegie Mellon University discuss this paradox in an article written this month for the Harvard Business Review.  Here is what they have to say about the problem.

Standard risk-management strategies are too outmoded to help companies contain catastrophic IT-linked risks. These strategies tend to assume that the risks are well understood and that the possibility of extreme events is tiny. As a result, organizations typically concentrate on ensuring that they have good policies and procedures for managing known risks and are using high-quality processes for creating and operating IT. But this old-fashioned focus can prevent firms from seeing new risks.

How do you identify events that, by definition, are hard to anticipate? Start by instilling from the top down an organizational culture that encourages employees to take ownership of risks and weigh their potential rewards and hazards. This means modeling risks and analyzing their business impact and, even more important, making the process integral both to corporate risk management systems and to every stage of IT system development. The culture must encourage employees to bring concerns about risk forward early, particularly when IT is being applied in new ways. 

Developing the proper organizational culture is critical not only for managing IT risks, but for all risks. Wheelhouse Advisors can help your company develop the frameworks and methodologies to create the optimal risk management culture.  Visit www.WheelhouseAdvisors.com to learn more.

Get Ahead of the Risk Curve

Capital investment will be limited this year due to the continuing financial crisis.  However, there is one area that will see increases as a result of the crisis - risk management.  To get ahead of the risk curve, financial services companies as well as non-financial companies will need to invest more in technology and people. Here is what one analyst had to say recently.

Dana Wiklund, a research director in the risk management practice at Financial Insights, a unit of International Data Group Inc., said banks are willing to spend in a few key areas, including this kind of risk analysis.  "Risk is an area of investment this year," he said. "This is an area where, if banks haven't done their homework up till now, this is going to be a priority for them."  Shareholders, boards and examiners are asking tough questions about how executives are analyzing risk and how they are implementing the necessary fixes, he added. "They have to make the investment."

Is your company prepared to make the necessary investments in order to get ahead of the risk curve?  If so, then contact Wheelhouse Advisors to learn how you can implement the necessary enhancements in the most efficient and cost-effective way.  

Beyond the Models

A great deal of the blame relating to the current financial crisis has been focused on the improper use of computer models in determining the amount of risk within a company's portfolio.  A recent article in Bank Systems & Technology Magazine discusses key considerations for employing models to determine accurate risk levels.   The article also notes that proper model usage alone is not the answer.  The author rightly states, 

"Although selecting the right modeling tools for risk management is essential, one further mistake companies commonly make doesn’t have anything to do with tools. It is essential to ensure that corporate culture avoids the typical silo approach to running a business. As we continue to follow news on the economy, it becomes clear that companies that conduct risk management in business silos expose their firms to unnecessary and avoidable risks. Tying true enterprise-wide risk management to business performance management, along with implementation of the right tools, is the only way for companies to ensure long-term success."

Having an appropriate risk framework and governance structure is critical to creating a strong culture focused on effectively managing risks.  Wheelhouse Advisors can provide cost-effective solutions to help companies break-down the silos and implement successful enterprise risk managemement programs.  Visit www.WheelhouseAdvisors.com to learn more.

Keys to Success

A recent article at eWeek.com highlights the keys to a successful implementation of technology in support of an Enterprise Risk Management or Governance, Risk & Compliance ("GRC") program.  While the keys to success are fairly straightforward, it is surprising how many companies fail to address them prior to selecting a technology solution.   The keys to success are:

1. Define what ERM or GRC means to your organization.


2. Survey your organization's regulatory and compliance landscape.


3. Determine the most logical entry point and develop a phased approach.


4. Establish a clear business case, considering both short-term and long-term value.


5. Determine how success will be measured. 

Interestingly, the author of the article is a representative of one of the major GRC technology vendors.  While some vendors may want companies to rush to a purchase decision, this author agrees it is critical for companies to gain this perspective prior to evaluating solutions.  He states,

"With these steps complete, you will be in a much stronger position to qualify vendors and solutions and to determine the best fit for your organization, based on a well-defined project scope and equally well-defined business requirements and associated benefits."

Wheelhouse Advisors can provide an independent viewpoint and work with your company to achieve the keys to success.  Visit www.WheelhouseAdvisors.com to learn more.