TraceRiskRegulatory Issues

Regulatory Issues

Risk Inventory

Risk Inventory is a “fourth” dimension of risk that provides insight into embedded elements of risk that are not specifically covered by a Key Risk Indicator. Subtle risks are inventoried in this way so that they can be studied orthographically. What does that mean? Orthographic representations of risk are from made from the front view (Subjects), the top view (Silos), the end view (COSO), and, from the inside out ( which is ‘Risk Inventory’). Examples of risk inventory are Product Development Risk, Customer Relations Risk, Training & Backup Risk and Denial of Service Risk.


COSO Integrated Framework – SOX 404 & FDICIA 112

Use Case COSO Integrated Framework – SOX 404 & FDICIA 112

Use Case: The New COSO Integrated Framework is an important development as it facilitates efforts by banks to develop cost-effective systems of internal control to achieve business objectives and sustain and improve performance. The new version is the predominant method for reporting on the effectiveness of internal control over financial reporting by public companies as required by Section 404 of the Sarbanes-Oxley Act.

Who Should Assess the Risk? Chief Administrative Officer, Chief Operating Officer, Chief Financial Officer, Internal Auditor

TraceRisk Demo Button


Corporate Governance & Ethics

Use Case for Assessing Corporate Governance & Ethics Risk
Why assess the risk? Given the important financial intermediation role of banks in the economy, the public and the market have a high degree of sensitivity to any difficulties potentially arising from any corporate governance shortcomings in banks. Poor corporate governance can contribute to a bank’s failure and can lead to markets losing confidence in the ability of the bank to properly manage its assets and liabilities, including deposits, which could in turn trigger a bank run or a liquidity crisis. In addition to its responsibilities to shareholders, the bank also has a responsibility to its depositors and to other recognized stakeholders. The presence of an effective corporate governance system helps to provide a degree of confidence that is necessary for the proper functioning of a community bank.

Who should assess the risks? Board Chairperson, Board Members, Chief Executive Officer / President, Legal Counsel
How to assess the risk: Rate the KRIs to determine if a threat would successfully exploit a vulnerability and to justify expenditures to implement countermeasures to protect the bank’s assets or reputation.
TraceRisk Demo Button

Concentrations of Credit

Use Case for Concentrations of Credit

Use Case: All banks have credit concentrations. In some cases, this is by choice as the institution seeks to develop expertise in a particular segment. In other cases, it may be the result of mergers or acquisitions. Alternatively, credit concentrations may be unavoidable due to a lender’s limited geographic footprint combined with its market’s dependence on a relatively few employers or industries. Whatever the reason, it is incumbent on management and the board of directors to ensure that the bank has an effective process in place to identify, measure, monitor, and control concentration risk. The board of directors also needs to ensure that the bank maintains adequate capital relative to concentration risks. Although each individual transaction within a concentration may be prudently underwritten, collectively the transactions are sensitive to the same economic, financial, or business development events. If something triggers a negative development, the risk is that the sum of the transactions may perform as if it were a single, large exposure. Identifying, measuring, and appropriately mitigating concentration risk is ultimately dependent on the accurate and timely receipt and analysis of data. The absence of a sufficiently robust set of data elements will hinder an institution’s ability to identify and monitor concentration risk, regardless of the data’s accuracy and timeliness.

Who Should Assess the Risk? Chief Credit Officer, Chief Lending Officer, Credit Administrator

 

button

Assessing Risk on Cybersecurity

Use Case for Assessing Risk on Cybersecurity

Why assess the risk? Banks must create, provision, and operate a formal incident response capability and report all incidents consistent with an incident response policy. Establishing an incident response capability should include the following actions:

  • Creating a cybersecurity incident response policy and plan
  • Developing procedures for performing incident handling and reporting
  • Setting guidelines for communicating with outside parties regarding incidents
  • Selecting a team structure and staffing model
  • Establishing relationships and lines of communication between the incident response team and other groups, both internal (e.g., legal department) and external (e.g., law enforcement agencies)
  • Determining what services the incident response team should provide
  • Staffing and training the incident response team

Banks should reduce the frequency of incidents by effectively securing networks, systems and applications.Preventing problems is often less costly and more effective than reacting to them after they occur. Thus, incident prevention is an important complement to an incident response capability. If security controls are insufficient, high volumes of incidents may occur. This could overwhelm the resources and capacity for response, which would result in delayed or incomplete recovery and possibly more extensive damage and longer periods of service and data unavailability. Incident handling can be performed more effectively if organizations complement their incident response capability with adequate resources to actively maintain the security of networks, systems, and applications. This includes training IT staff on complying with the bank’s security standards and making users aware of policies and procedures regarding appropriate use of networks, systems, and applications.

Banks should document their guidelines for interactions with other organizations regarding incidents. During incident handling, the bank will need to communicate with outside parties, such as other incident response teams, law enforcement, the media, vendors, and victim organizations. Because these communications often need to occur quickly, banks should predetermine communication guidelines so that only the appropriate information is shared with the right parties.

Banks should be generally prepared to handle any incident but should focus on being prepared to handle incidents that use common attack vectors. Incidents can occur in countless ways, so it is not feasible to develop step-by-step instructions for handling every incident. Different types of incidents merit different response strategies. The attack vectors are:

  • External/Removable Media: An attack executed from removable media (e.g., flash drive, CD) or a peripheral device
  • Attrition: An attack that employs brute force methods to compromise, degrade, or destroy systems, networks or services
  • Web: An attack executed from a website or web-based application
  • Email: An attack executed via an email message or attachment
  • Improper Usage: Any incident resulting from violation of a bank’s acceptable usage policies by an authorized user, excluding the above categories
  • Loss or Theft of Equipment: The loss or theft of a computing device or media used by the organization, such as a laptop or smartphone.
  • Other: An attack that does not fit into any of the other categories.

Banks should emphasize the importance of incident detection and analysis throughout the organization. In a bank, millions of possible signs of incidents may occur each day, recorded mainly by logging and computer security software. Automation is needed to perform an initial analysis of the data and select events of interest for human review. Event correlation software can be of great value in automating the analysis process. However, the effectiveness of the process depends on the quality of the data that goes into it. Banks should establish logging standards and procedures to ensure that adequate information is collected by logs and security software and that the data is reviewed regularly.

Banks should create written guidelines for prioritizing incidents. Prioritizing the handling of individual incidents is a critical decision point in the incident response process. Effective information sharing can help an organization identify situations that are of greater severity and demand immediate attention. Incidents should be prioritized based on the relevant factors, such as the functional impact of the incident (e.g., current and likely future negative impact to business functions), the information impact of the incident (e.g., effect on the confidentiality, integrity, and availability of the bank’s information), and the recoverability from the incident (e.g., the time and types of resources that must be spent on recovering from the incident).

Banks should use the lessons learned process to gain value from incidents. After a major incident has been handled, the bank should hold a lessons learned meeting to review the effectiveness of the incident handling process and identify necessary improvements to existing security controls and practices. Lessons learned meetings can also be held periodically for lesser incidents as time and resources permit. The information accumulated from all lessons learned meetings should be used to identify and correct systemic weaknesses and deficiencies in policies and procedures. Follow-up reports generated for each resolved incident can be important not only for evidentiary purposes but also for reference in handling future incidents and in training new team members.

Who should assess the risks? Information Technology Officer, Data Security Officer, Electronic Banking Officer, Operations Administrator, Cash Management/ACH Officer

How to assess the risk: Rate the KRIs to determine if a threat would successfully exploit a vulnerability and to justify expenditures to implement countermeasures to protect the bank’s assets or reputation. Use the “Focus Risk Assessment” tool for in-depth analysis of risks and mitigation techniques.

Schedule a Demo

Appraisals & Evaluations

Use Case for Assessing Risk on Appraisals & Evaluations

Why assess the risk? Appraisal regulations substantially set forth in FFIEC Guidance on Appraisals & Evaluations require, at a minimum, that real estate appraisals be performed in accordance with generally accepted uniform appraisal standards promulgated by the Appraisal Standards Board, and that such appraisals be in writing. This guidance pertains to all real estate-related financial transactions originated or purchased by a regulated institution or its operating subsidiary for its own portfolio or as assets held for sale, including activities of commercial and residential real estate mortgage operations, capital markets groups, and asset securitization and sales units.

Who should assess the risks? Credit Administrator, Chief Appraisal Officer, Chief Credit Officer, Loan Servicing Mgr.

How to assess the risk: Rate the KRIs to determine if a threat would successfully exploit a vulnerability and to justify expenditures to implement countermeasures to protect the bank’s assets or reputation. Use the “Focus Risk Assessment” tool for in-depth analysis of risks and mitigation techniques.


Allowance for Loan & Lease Loss Risk

Use Case:
The purpose of the ALLL is to reflect estimated credit losses within a bank’s portfolio of loans and leases. Estimated credit losses are estimates of the current amount of loans that are probable that the bank will be unable to collect given the facts and circumstances since the evaluation date (generally the balance sheet date). That is, estimated credit losses represent net charge-offs that are likely to be realized for a loan or group of loans as of the evaluation date. The ALLL is presented on the balance sheet as a contra-asset account that reduces the amount of the loan portfolio reported on the balance sheet. The risk to the bank is that the ALLL is miscalculated which can lead to over / underfunding of the allowance and provision accounts, erroneous Call Reporting and adverse capital, earnings, regulatory and reputational implications.

Who Should Assess the Risk: Chief Credit Officer, Chief Lending Officer, Credit Administrator, Chief Financial Officer


Assessing Risk on Cybersecurity

Use Case for Assessing Risk on Cybersecurity

Why assess the risk? Banks must create, provision, and operate a formal incident response capability and report all incidents consistent with an incident response policy. Establishing an incident response capability should include the following actions:

  • Creating a cybersecurity incident response policy and plan
  • Developing procedures for performing incident handling and reporting
  • Setting guidelines for communicating with outside parties regarding incidents
  • Selecting a team structure and staffing model
  • Establishing relationships and lines of communication between the incident response team and other groups, both internal (e.g., legal department) and external (e.g., law enforcement agencies)
  • Determining what services the incident response team should provide
  • Staffing and training the incident response team

Banks should reduce the frequency of incidents by effectively securing networks, systems and applications. Preventing problems is often less costly and more effective than reacting to them after they occur. Thus, incident prevention is an important complement to an incident response capability. If security controls are insufficient, high volumes of incidents may occur. This could overwhelm the resources and capacity for response, which would result in delayed or incomplete recovery and possibly more extensive damage and longer periods of service and data unavailability. Incident handling can be performed more effectively if organizations complement their incident response capability with adequate resources to actively maintain the security of networks, systems, and applications. This includes training IT staff on complying with the bank’s security standards and making users aware of policies and procedures regarding appropriate use of networks, systems, and applications.

Banks should document their guidelines for interactions with other organizations regarding incidents. During incident handling, the bank will need to communicate with outside parties, such as other incident response teams, law enforcement, the media, vendors, and victim organizations. Because these communications often need to occur quickly, banks should predetermine communication guidelines so that only the appropriate information is shared with the right parties.

Banks should be generally prepared to handle any incident but should focus on being prepared to handle incidents that use common attack vectors. Incidents can occur in countless ways, so it is not feasible to develop step-by-step instructions for handling every incident. Different types of incidents merit different response strategies. The attack vectors are:

  • External/Removable Media: An attack executed from removable media (e.g., flash drive, CD) or a peripheral device
  • Attrition: An attack that employs brute force methods to compromise, degrade, or destroy systems, networks or services
  • Web: An attack executed from a website or web-based application
  • Email: An attack executed via an email message or attachment
  • Improper Usage: Any incident resulting from violation of a bank’s acceptable usage policies by an authorized user, excluding the above categories
  • Loss or Theft of Equipment: The loss or theft of a computing device or media used by the organization, such as a laptop or smartphone.
  • Other: An attack that does not fit into any of the other categories.

Banks should emphasize the importance of incident detection and analysis throughout the organization. In a bank, millions of possible signs of incidents may occur each day, recorded mainly by logging and computer security software. Automation is needed to perform an initial analysis of the data and select events of interest for human review. Event correlation software can be of great value in automating the analysis process. However, the effectiveness of the process depends on the quality of the data that goes into it. Banks should establish logging standards and procedures to ensure that adequate information is collected by logs and security software and that the data is reviewed regularly.

Banks should create written guidelines for prioritizing incidents. Prioritizing the handling of individual incidents is a critical decision point in the incident response process. Effective information sharing can help an organization identify situations that are of greater severity and demand immediate attention. Incidents should be prioritized based on the relevant factors, such as the functional impact of the incident (e.g., current and likely future negative impact to business functions), the information impact of the incident (e.g., effect on the confidentiality, integrity, and availability of the bank’s information), and the recoverability from the incident (e.g., the time and types of resources that must be spent on recovering from the incident).

Banks should use the lessons learned process to gain value from incidents. After a major incident has been handled, the bank should hold a lessons learned meeting to review the effectiveness of the incident handling process and identify necessary improvements to existing security controls and practices. Lessons learned meetings can also be held periodically for lesser incidents as time and resources permit. The information accumulated from all lessons learned meetings should be used to identify and correct systemic weaknesses and deficiencies in policies and procedures. Follow-up reports generated for each resolved incident can be important not only for evidentiary purposes but also for reference in handling future incidents and in training new team members.

Who should assess the risks? Information Technology Officer, Data Security Officer, Electronic Banking Officer, Operations Administrator, Cash Management/ACH Officer

How to assess the risk: Rate the KRIs to determine if a threat would successfully exploit a vulnerability and to justify expenditures to implement countermeasures to protect the bank’s assets or reputation. Use the “Focus Risk Assessment” tool for in-depth analysis of risks and mitigation techniques.