FCA Reviews Technology Change Management in Financial Services Sector
FCA published the findings from a review that looked at how financial firms manage technology change, the impact of change failures, and the practices utilized in the industry to help reduce the impact of incidents resulting from change management. While there is no single approach, process, or control that improves change success rates, the analysis found that stronger governance, day-to-day risk management, increased automation, and more robust testing and planning can contribute to successful change activity and less disruption.
Based on the review, FCA found that firms with higher change success rates had the following common characteristics:
- Firms with well-established governance arrangements have a higher change success rate. There was a positive correlation between the longevity of governance arrangements and higher change success rates in the sampled firms. The data showed that robust governance can help reduce the number and impact of operational incidents resulting from change.
- Relying on high levels of legacy technology is linked to more failed and emergency changes. FCA found that firms with a lower proportion of legacy infrastructure and applications had a higher change success rate. Firms with a lower proportion of legacy technology also had a lower proportion of changes being deployed as emergencies and had a higher chance of those emergency changes being successfully deployed.
- Firms that allocated a higher proportion of their technology budget to change activities experienced fewer change related incidents. Firms that had the lowest proportion of changes resulting in an incident dedicated between 50% and 75% of their information technology budget to these change activities.
- Frequent releases and agile delivery can help firms to reduce the likelihood and impact of change related incidents. FCA found that firms that deployed smaller, more frequent releases had higher change success rates than those with longer release cycles. Firms that made effective use of agile delivery methodologies were also less likely to experience a change incident.
- Effective risk management is an important component of effective change management capabilities. Firms that experienced less incidents due to failed changes mitigated the risk of technology change by leveraging a wide range of technical and business knowledge to ensure that potential impacts were well understood.
In addition, FCA identified the following areas that could lead to increased operational disruption when carrying out change activity:
- Most firms do not have complete visibility of third-party changes. According to firms’ incident reporting, in 2019, over 20% of incidents at third-parties were caused by change. Workshop attendees suggested that third-party contracts could be better utilized to provide greater clarity on how changes are communicated and on the potential impact to the information technology estate of a client firm.
- Firms’ change management processes are heavily reliant on manual review and actions. Repeatability and consistency throughout the lifecycle of a change and its deployment could help reduce the burden of assurance activity and could also allow for a higher degree of confidence when implementing technology change.
- Legacy technology impacts firms’ ability to implement new technologies and innovative approaches. Firms that classified a higher proportion of their technology estate as legacy had lower adoption rates for DevOps, micro-architecture, and public cloud, which could affect the ability of these to benefit from innovative approaches.
Related Links
Keywords: Europe, UK, Banking, Securities, Technology Risk, Governance, Fintech, Change Management, Operational Risk, Third-Party Arrangements, Cloud Computing, Outsourcing Arrangements, FCA
Previous Article
RBNZ to Reinstate Loan-to-Value Ratio RestrictionsRelated Articles
APRA Finalizes Reporting Standard for Operational Risk Requirements
APRA finalized the reporting standard ARS 115.0 on capital adequacy with respect to the standardized measurement approach to operational risk for authorized deposit-taking institutions in Australia.
ECB Publishes Guide for Determining Penalties for Regulatory Breaches
ECB published a guide that outlines the principles and methods for calculating the penalties for regulatory breaches of prudential requirements by banks.
MAS Sets Out Good Practices to Manage Operational Risks Amid COVID
MAS and The Association of Banks in Singapore (ABS) jointly issued a paper that sets out good practices for the management of operational and other risks stemming from new work arrangements adopted by financial institutions amid the COVID-19 pandemic.
ACPR Announces New Data Collection Application for Banks and Insurers
ACPR announced that a new data collection application, called DLPP (Datalake for Prudential), for collecting banking and insurance prudential data will go into production on April 12, 2021.
BCB Maintains CCyB at 0%, Initiates First Cycle of Regulatory Sandbox
BCB announced that the Financial Stability Committee decided to maintain the countercyclical capital buffer (CCyB) for Brazil at 0%, at least until the end of 2021.
EBA Consults on Pillar 3 Disclosure Standards for ESG Risks Under CRR
EBA is consulting on the implementing technical standards for Pillar 3 disclosures on environmental, social, and governance (ESG) risks, as set out in requirements under Article 449a of the Capital Requirements Regulation (CRR).
ESAs Issue Advice on KPIs on Sustainability for Nonfinancial Reporting
ESAs Issue Advice on KPIs on Sustainability for Nonfinancial Reporting
EIOPA Launches Study on Non-Life Underwriting Risk in Internal Models
EIOPA has launched a European-wide comparative study on non-life underwriting risk in internal models, also kicking-off of the data collection phase.
SRB Publishes Overview of Resolution Tools Available in Banking Union
SRB published an overview of the resolution tools available in the Banking Union and their impact on a bank’s ability to maintain continuity of access to financial market infrastructure services in resolution.
EU Amends CRD4 and CRD5 as Part of Capital Markets Recovery Package
EU published Directive 2021/338, which amends the Markets in Financial Instruments Directive (MiFID) II and the Capital Requirements Directives (CRD 4 and 5) to facilitate recovery from the COVID-19 crisis.
