Deloitte Global Survey: With Deregulatory Moves and Emerging Technologies, Financial Institutions Are Beginning to Reengineer Their Risk Management Systems, Albeit Slowly

NEW YORK, Jan. 23, 2019 /PRNewswire/ -- In a volatile market environment and with the edict to "do more with less," many financial institutions are beginning efforts to reengineer their risk management programs, according to a new survey by Deloitte Global, with emerging technologies in the driver's seat.

Seventy percent of the financial services executives surveyed said their institutions have either recently completed an update of their risk management program or have one in progress, while an additional 12 percent said they are planning to undertake such a renewal effort. A big part of this revitalization will be leveraging emerging technologies, with 48 percent planning to modernize their risk infrastructure by employing new technologies such as robotic process automation (RPA), cognitive analytics, and cloud computing.

"Financial institutions face a formidable set of challenges posed by today's more complex and uncertain risk environment," said Edward Hida, a partner with Deloitte Risk and Financial Advisory at Deloitte US and the author of the report. "With budget cuts common — and a big focus on effectiveness and efficiency as the torrent of regulatory change has slowed — this will require institutions to rethink their traditional assumptions and employ fundamentally new approaches."

"Digital technologies have the potential to fundamentally reengineer virtually every aspect of risk management," said Hida. "Financial institutions are now at the early stages of this transformation of their risk management functions."

Only a minority of institutions are employing these types of technology currently, and often in small doses within their organization. The technologies that institutions surveyed most often reported using were cloud computing (48 percent), big data and analytics (40 percent), and business process modeling tools (38 percent). Most surprisingly, given the attention paid to the potential of RPA to reduce costs and improve accuracy by automating repetitive manual tasks without human involvement, only 29 percent of respondents said their institutions are currently using it.

Other tools are being used by even fewer institutions such as machine learning (25 percent), business decision modeling tools (24 percent), and cognitive analytics (including natural language processing/natural language generation) (19 percent).

"These tools can reduce costs by automating manual tasks such as developing risk reports or reviewing transactions," according to Hida. "They can also automatically scan a wide variety of data in the internal and external environments to identify and respond to new risks, emerging threats, and bad actors. Some banks have developed real leading-edge platforms for identifying potential conduct risk situations, for example."

The findings from the eleventh biennial edition of the survey of financial institutions — titled "Reimagining Risk Management to Mitigate Looming Economic Dangers and Nonfinancial Risks" — are based on the responses of 94 financial institutions around the world, representing a total of US$29.1 trillion in aggregate assets. The institutions surveyed provide a range of financial services, including banking (61 percent), investment management (49 percent), and insurance (46 percent).

Continued Growing Importance of Cybersecurity Risk
Financial services executives were also asked in the survey which three risk types they believed would increase the most in importance for their institution over the next two years. The broad consensus was that cybersecurity is the number-one challenge.

Two-thirds of respondents (67 percent) named cybersecurity as one of the three risks that would increase the most in importance for their business over the next two years, far more than for any other risk. Yet, only about half of the respondents felt their institutions were extremely or very effective in managing this risk.

Although cybersecurity also held the pole position in the survey's 2016 edition, there was a dramatic uptick in the current survey. More respondents considered it as one of the three risk types that would increase most in importance (67 percent, up from 41 percent) and cited it as the number-one risk (40 percent, up from 18 percent).

For specific types of cybersecurity risks, respondents most often considered their institutions to be extremely or very effective in managing disruptive attacks, financial losses or fraud, cybersecurity risks from customers, loss of sensitive data and destructive attacks, each above the 50 percent mark. They were less likely to consider their institutions to be this effective when it came to threats from nation-state actors (37 percent) or cybersecurity risks from third-party providers (31 percent).

"In addition to their supervision of individual institutions, regulators across the globe are beginning to address the risks that cyberattacks could pose to the financial system as a whole," said Ed Powers, Risk and Financial Advisory Cyber Risk Services leader at Deloitte US. "Given the increasing interconnections among financial institutions, their technology partners and financial markets around the world, good cyber governance and oversight is imperative to the ability to respond and recover effectively when a threat is detected or an attack is realized. It is well known that a cyberattack has the potential to quickly damage the global financial system."

Among the survey's other findings:

• When asked to assess the overall effectiveness of their institution in managing risk, 82 percent of respondents considered it to be extremely or very effective, an increase from 69 percent in 2016.
• While institutions have become more skilled at managing financial risks, non-financial risks continue to assume greater prominence as the exposure and consequences from these risks has become more evident. Respondents were less likely to consider their institutions extremely or very effective in areas including reputation risk (57 percent), business resilience risk (54 percent), model risk (51 percent), conduct and culture risk (50 percent), strategic risk (46 percent), third-party risk (40 percent), geopolitical risk (35 percent) and data integrity risk (34 percent).
• 83 percent of respondents expected that regulatory requirements on their institutions would increase over the next two years, with one-third expecting a significant increase.   
• Credit risk was seen most often as being extremely or very challenging to manage in commercial real estate (31 percent).

Financial institutions confront significant challenges in effectively employing the "three lines of defense" risk governance model – which details the appropriate roles in risk management of business units, the risk manage­ment function, and internal audit – according to the survey. This model has long been a regulatory expectation and a prevailing practice. Forty-three percent of survey respondents said their institutions either have revised their three lines of defense model, are reassessing or are planning to reassess their models. Deloitte Global expects the impact of emerging technologies to be a key consideration in these changes.

"Financial institutions will need to consider how to effectively reengineer their 'three lines of defense' in this technology-powered environment," said Hida. "One of the biggest issues in the three lines of defense will be making sure that business units are engaged in their 'first line' role—as the survey found that more than half said their institutions have increased, or plan to increase, the risk management responsibilities of business units to manage the risks they assume. There is a great deal of work to do in this arena in the volatile environment that companies face today."

The report can be found online at https://www.deloitte.com/insights/globalrisksurvey

About Deloitte
Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited ("DTTL"), its global network of member firms, and their related entities. DTTL (also referred to as "Deloitte Global") and each of its member firms are legally separate and independent entities. DTTL does not provide services to clients. Please see www.deloitte.com/about to learn more.

Deloitte is a leading global provider of audit and assurance, consulting, financial advisory, risk advisory, tax and related services. Our network of member firms in more than 150 countries and territories serves four out of five Fortune Global 500^® companies. Learn how Deloitte's more than 286,000 people make an impact that matters at www.deloitte.com.

SOURCE Deloitte Global