The Future of Banking April 26, 2018 How to Utilize ERM to Invoke a - PDF document

WELCOME The Future of Banking April 26, 2018 How to Utilize ERM to Invoke a Positive Change Within Your Institution Steven Bank and Jessica Miller April 26, 2018 1

Agenda • Current Risk Landscape • Key Risk Areas for Financial Institutions • Managing and Monitoring Risk through ERM • Benefits and Successful Use of ERM 3 Bio for Steven Bank • Risk Advisory Services Manager with Schneider Downs – September 2016 • Prior: Risk and Control Director – JP Morgan Chase Mortgage Bank • 25+ Years in Internal Audit and Risk Advisory Management Prior experience as a controller with a large public • manufacturing company. • Strong background and experience overseeing and conducting risk mitigation strategies including enterprise risk management program implementations, risk-based internal audits, process improvement reviews and governance risk and control activities to help companies improve their operational, financial and regulatory processes and oversight. • Certified Public Accountant (OH) and Certified Internal Auditor 4 2

Bio for Jessica Miller • Risk Advisory Services Manager with Schneider Downs – June 2013 • Prior: PNC Bank • 10 Years in Internal Audit and Risk Advisory Management • Previously worked for a large regional, publicly-traded financial institution with products and services in consumer and commercial banking. Previous to that, worked for a small regional accounting firm specializing in community and regional banking. • Strong background and experience in banking including creation and monitoring of the annual risk assessment and annual audit plan, management of audit execution, as well as providing periodic reporting, industry hot topics and training to boards and audit committees. • Graduate of the ABA National School of Compliance • Certified Financial Services Auditor 5 6 3

Current Risk Landscape for Financial Service Organizations Cu Current rrent Landsca Landscape • Political (regulatory), economic and technological environment • Race to stay ahead of competitors • Technological advances to customers. Resulting R Re Risk t to O Organization • Challenges to effectively monitor and manage risks. • Understanding impact on the organization and customer 7 Points of Focus for Current Regulatory Agenda • Cybersecurity • BSA/AML/OFAC, and Fair Lending • Easing burden to lend money • Regulatory relief 8 4

Key Risk Areas for Financial Service Organizations • Cyber Security Risk • End User Computing (EUC) Risk • Changes in Regulatory Landscape Risk • Vendor Management Risk • Strategic Risk • Reputation Risk • Liquidity Risk and Capital Availability • Culture Risk • Market Risk • Human Capital Risk • Credit Risk • Operational Risk • Technology Risk 9 Polling Question Setup Please text SCHNEIDERDOWNS to 22333 This will allow you to answer the polling questions that we have designed for this presentation. 10 5

11 Cyber Security Risk Remains the top concern for Financial Services companies and regulators. • Innovative technologies to compete in the market and provide advanced end-user capabilities. • Organization adapting to keep up with the changing times. • Users opting to use online technologies and applications 12 6

Changes in Regulatory Landscape Risk Primary Concerns: • Constant changing of rules and regulations • Increased scrutiny of regulators 13 Changes in Regulatory Landscape Risk Examples – Current Regulatory Requirements: • Capital and Liquidity: CCAR, DFAST, Basel III, Basel IV, Recovery and Resolution Plans • Credit Risk: IFRS 9/CECL • Market Risk: FRTB • Cyber: NY Cybersecurity Rule 23 NYCRR 500 • Privacy/Third-Party Risk – GDPR 14 7

Reputation Risk Primary Concern: Reputational damage can occur from a multitude of symptoms • Fraud • Cyber crimes • Operational breakdowns • Third parties 15 Managing and Monitoring Risk through ERM Incorporation of an Entity-Wide Enterprise Risk Management (ERM) Program 16 8

What is Enterprise Risk Management (ERM)? • A continuance process to identify, analyze, mitigate and monitor potential events that create uncertainty in the achievement of an organization’s business objectives. • An approach for evaluating risks within each business function to evaluate whether the risks being taken are too little or too much. 17 Key Drivers of ERM • Protection of Life and Limb • Protection of Capital • Maximization of Earnings • Achievement of Strategic Goals and Objectives • Stakeholder Expectations • Compliance with Laws and Regulations 18 9

Where is Your Organization’s Weak Link in Managing Risk 19 Incorporation of an Entity-Wide ERM Program The need to understand the critical risks we face • ERM provides a holistic organizational view of risk • Risk should be understood and measured • Preserves value and reduces downside exposure • Connects risk, strategy and decision-making to enhance organizational performance. 20 10

What is COSO ERM 2017? • Committee of Sponsoring Organizations of the Treadway Commission (COSO) • Provide thought leadership through the development of frameworks – Enterprise risk management, – Internal control and governance – Fraud deterrence. • Provide management with a holistic view of risk throughout the organization • Consider risk in strategy setting and driving performance 21 What is COSO ERM 2017? Framework organized into 5 interrelated phases: 1. Governance and Culture 2. Strategy and Objective Setting 3. Performance of a Risk Assessment 4. Information, Communication and Reporting 5. Review and Revision 22 11

Governance and Culture • Governance – the organization’s tone, oversight for ERM • Culture – ethical values, desired behaviors 23 Governance and Culture During this Phase: • Define responsibility for oversight and governance of the ERM program • Establish the operation structure for the organization • Define, assess and drive the desired culture • Define the organization’s: – Mission Statement – Vision – Core Values • Define approach for obtaining resource talent 24 12

Strategy and Objective Setting Enterprise risk management, strategy and objective setting work together in the strategic planning process. • A risk risk appe appeti tite is established and aligned with strategy; • Busin Business obje ss objectiv ives put strategy into practice while servicing as a basis for identifying, assessing and responding to risk. 25 Strategy and Objective Setting During this phase: • Define key strategies for achieving organizational success • Align to the mission statement, vision and core values • Establish business objectives to achieve strategies • Set risk measurement (risk appetite) statements • Define performance measures 26 13

Performance Measures Aligning performance with the business objectives: • Develop key performance measures • Define performance targets • Determine risk tolerances • Develop key risk indicators • Establish monitoring • Define actions when thresholds are exceeded 27 28 14

Performance of a Risk Assessment During this phase - For each key business function: • Assess inherent risk for critical risk factors – Business Impact – Probability of Occurrence – Velocity of Onset to the Business – Frequency of Occurrence • Identify all critical risks • Prioritize the critical risks • Determine risk responses 29 Identifying the Risks 30 15

Identifying the Risks Str Strategy Traditional vs. Leading Edge aditional vs. Leading Edge Cultur ure/C e/Conduct nduct Huma Human Capi Capital Risk T Risk Types pes Operational/T erational/Transac saction ion Vend ndor or/Sub ub-c -con ontract actor Interdependencies on Int on othe other units r units Financial C Finan ial Captu pture and e and R Repor portin ing Te Technology Adv Advancing ing t the Cause Financia nancial En Envi vironm nmental Operational Opera Market/Price Mar Com Compli lian ance ce Lega gal/Regu gulat latory Exte ternal - - Competito tors/ Econ onom omy/In y/Innovation tions Liquidity Li quidity Reputation Re on Fraud Fr Traditionally, risk was viewed more from a Wast ste a e and M Mismanageme agement financial risk perspective. The new standard Safety Saf ty an and Se d Security ty is to look at risk throughout the enterprise. Other Othe 31 Identifying the Risks Traditional vs. Leading Edge aditional vs. Leading Edge Te Technology Pri Privacy and acy and Securi Security ty Soci Social Med Media and a and Ne Netw tworki orking Mob Mobile De Devi vice ces Malware and Mal are and Vi Viru ruses Spam, Spam, Scams Scams and and Phi Phishi hing Cor Corporate Esp e Espion onag age Te Technology Re Regulatory ( (ERM) Cloud Computing Cloud Com Hard rdwa ware a and Softwa ware Fa Failure 32 16