Featured Product

    ECB Presents Outcomes from Analysis of IT Risks at Supervised Banks

    July 24, 2020

    ECB published a report on the outcome of the Supervisory Review and Evaluation Process (SREP) IT risk questionnaire. The report presents the key observations and conclusions based on an analysis of the IT risk questionnaire, for which self-assessments were submitted to ECB Banking Supervision in the first quarter of 2019 by the significant supervised institutions. The key observations are in the areas of IT governance, data quality management and IT risk management, data integrity risk, IT security, IT outsourcing, and IT audit and examinations. Overall, the institutions reported an improvement in addressing critical findings, though the majority of critical findings not addressed for more than a year are related to IT security risk. Considering the increasing use of IT outsourcing, including cloud computing, ECB Banking Supervision emphasized that it expects full compliance with the applicable regulation regarding outsourcing within the respective timeline.

    In the light of the EBA guidelines on Information and Communication Technology (ICT) risk assessment under SREP, ECB Banking Supervision together with the national competent authorities developed a dedicated SREP IT risk assessment methodology. This includes the IT risk questionnaire as a form of standardized information collection from supervised institutions for the comprehensive assessment of all IT risk areas. Throughout 2019, ECB Banking Supervision has continued to treat IT and cyber risks as a supervisory priority. The recent horizontal analysis reveals a number of observations:

    • The supervised institutions are seen to have shifted to more prudent self-assessments, but for some IT risk areas they remain too optimistic in their self-assessments. IT governance has been characterized by overly optimistic self-assessment by the institutions while data quality management and IT risk management were reported as the weakest among all areas.
    • The analysis shows that data integrity risk continues to be of concern. It is desirable that institutions align their data quality frameworks with the ECB Banking Supervision letter that had set out supervisory expectations on risk data aggregation capabilities and risk reporting practices.
    • With respect to IT security, the analysis confirmed that IT security continues to be a significant challenge for institutions. It also highlights the need for institutions to further improve their IT security control measures. From a general point of view, IT and cyber risk should form part of the banks’ general risk governance and management framework, and there should be broad awareness of these risks across the entire organisation.
    • The continued reliance on end-of-life (EOL) systems for critical business processes requires a high degree of management attention. Therefore, it is desirable that institutions continue working on simplifying their IT systems and ensuring sufficient agility. ECB Banking Supervision plans to increase its focus on institutions that report having EOL systems supporting critical banking activities, with the aim of decreasing their dependency on EOL systems.
    • The analysis showed an increase in IT outsourcing, with a slightly higher concentration of risk at the level of individual institutions. Several institutions have reported losses due to unavailability and/or poor quality of outsourced services. ECB Banking Supervision is placing greater emphasis on outsourcing activities, including cloud outsourcing, and their monitoring by the institutions. In line with the EBA guidelines on outsourcing arrangements, ECB Banking Supervision expects full compliance with the applicable regulation regarding outsourcing within the respective timeline.
    • The institutions reported an improvement in addressing critical findings. The majority of critical findings not addressed for more than a year are related to IT security risk. It would be desirable that all of the institutions’ critical IT functions to be assessed by their internal IT audit functions.

    This publication is designed to share insights from the analysis and increase awareness on the overall IT risk management within the supervised institutions. The desired outcome would be for institutions to further improve their resilience, which is seen as a critical factor for financial stability.

     

    Related Link: Report (PDF)

     

    Keywords: Europe, EU, Banking, SREP, Technology Risk, Governance, Outsourcing, Cyber Risk, Cloud Computing, EBA, ECB

    Related Articles
    News

    Regulators Fine Goldman Sachs for Risk Management Failures

    FCA and PRA in the UK, FED in the US, and the authorities in Singapore have fined Goldman Sachs for risk management failures in connection with the 1Malaysia Development Berhad (1MDB).

    October 23, 2020 WebPage Regulatory News
    News

    Canada Hosts International Conference of Banking Supervisors

    BCBS announced that OSFI and the Bank of Canada hosted the 21st International Conference of Banking Supervisors (ICBS) virtually on October 19-22, 2020.

    October 22, 2020 WebPage Regulatory News
    News

    FCA Proposes More Measures to Help Insurance Customers Amid Crisis

    FCA proposed guidance on how firms should continue to seek to help customers who hold insurance and premium finance products and may be in financial difficulty because of COVID-19, after October 31, 2020.

    October 21, 2020 WebPage Regulatory News
    News

    EBA Issues Opinion to Address Risk Stemming from Legacy Instruments

    EBA issued an opinion on prudential treatment of the legacy instruments as the grandfathering period nears an end on December 31, 2021.

    October 21, 2020 WebPage Regulatory News
    News

    ESRB Publishes Non-Bank Financial Intermediation Risk Monitor for 2020

    ESRB published the fifth issue of the EU Non-bank Financial Intermediation Risk Monitor 2020 (NBFI Monitor).

    October 21, 2020 WebPage Regulatory News
    News

    HM Treasury Publishes Policy Statement Amending Benchmarks Regulation

    HM Treasury announced that the new Financial Services Bill has been introduced in the Parliament.

    October 21, 2020 WebPage Regulatory News
    News

    APRA Initiates Action Against a Bank for Liquidity Compliance Breach

    APRA announced that it has increased the minimum liquidity requirement of Bendigo and Adelaide Bank for failing to comply with the prudential standard on liquidity.

    October 21, 2020 WebPage Regulatory News
    News

    PRA Consults on Implementation of Certain Provisions of CRD5 and CRR2

    PRA published the consultation paper CP17/20 to propose changes to certain rules, supervisory statements, and statements of policy to implement elements of the Capital Requirements Directive (CRD5).

    October 20, 2020 WebPage Regulatory News
    News

    US Agencies Finalize Rule to Reduce Impact of Large Bank Failures

    US Agencies adopted a final rule that applies to advanced approaches banking organizations and aims to reduce interconnectedness in the financial system as well as to reduce contagion risks associated with the failure of a global systemically important bank (G-SIB).

    October 20, 2020 WebPage Regulatory News
    News

    US Agencies Finalize Rule on Net Stable Funding Ratio Requirements

    US Agencies (FDIC, FED, and OCC) adopted a final rule that implements the net stable funding ratio (NSFR) for certain large banking organizations.

    October 20, 2020 WebPage Regulatory News
    RESULTS 1 - 10 OF 6004