FCA Reviews Technology Change Management in Financial Services Sector
FCA published the findings from a review that looked at how financial firms manage technology change, the impact of change failures, and the practices utilized in the industry to help reduce the impact of incidents resulting from change management. While there is no single approach, process, or control that improves change success rates, the analysis found that stronger governance, day-to-day risk management, increased automation, and more robust testing and planning can contribute to successful change activity and less disruption.
Based on the review, FCA found that firms with higher change success rates had the following common characteristics:
- Firms with well-established governance arrangements have a higher change success rate. There was a positive correlation between the longevity of governance arrangements and higher change success rates in the sampled firms. The data showed that robust governance can help reduce the number and impact of operational incidents resulting from change.
- Relying on high levels of legacy technology is linked to more failed and emergency changes. FCA found that firms with a lower proportion of legacy infrastructure and applications had a higher change success rate. Firms with a lower proportion of legacy technology also had a lower proportion of changes being deployed as emergencies and had a higher chance of those emergency changes being successfully deployed.
- Firms that allocated a higher proportion of their technology budget to change activities experienced fewer change related incidents. Firms that had the lowest proportion of changes resulting in an incident dedicated between 50% and 75% of their information technology budget to these change activities.
- Frequent releases and agile delivery can help firms to reduce the likelihood and impact of change related incidents. FCA found that firms that deployed smaller, more frequent releases had higher change success rates than those with longer release cycles. Firms that made effective use of agile delivery methodologies were also less likely to experience a change incident.
- Effective risk management is an important component of effective change management capabilities. Firms that experienced less incidents due to failed changes mitigated the risk of technology change by leveraging a wide range of technical and business knowledge to ensure that potential impacts were well understood.
In addition, FCA identified the following areas that could lead to increased operational disruption when carrying out change activity:
- Most firms do not have complete visibility of third-party changes. According to firms’ incident reporting, in 2019, over 20% of incidents at third-parties were caused by change. Workshop attendees suggested that third-party contracts could be better utilized to provide greater clarity on how changes are communicated and on the potential impact to the information technology estate of a client firm.
- Firms’ change management processes are heavily reliant on manual review and actions. Repeatability and consistency throughout the lifecycle of a change and its deployment could help reduce the burden of assurance activity and could also allow for a higher degree of confidence when implementing technology change.
- Legacy technology impacts firms’ ability to implement new technologies and innovative approaches. Firms that classified a higher proportion of their technology estate as legacy had lower adoption rates for DevOps, micro-architecture, and public cloud, which could affect the ability of these to benefit from innovative approaches.
Related Links
Keywords: Europe, UK, Banking, Securities, Technology Risk, Governance, Fintech, Change Management, Operational Risk, Third-Party Arrangements, Cloud Computing, Outsourcing Arrangements, FCA
Previous Article
HM Treasury Allows Extended Repayment Delay Under COVID Loan SchemeRelated Articles
ESAs Issue Multiple Regulatory Updates for Financial Sector Entities
The three European Supervisory Authorities (ESAs) issued a letter to inform about delay in the Sustainable Finance Disclosure Regulation (SFDR) mandate, along with a Call for Evidence on greenwashing practices.
ISSB Makes Announcements at COP27; IASB to Propose IFRS 9 Amendments
The International Sustainability Standards Board (ISSB) of the IFRS Foundations made several announcements at COP27 and with respect to its work on the sustainability standards.
IOSCO Prioritizes Green Disclosures, Greenwashing, and Carbon Markets
The International Organization for Securities Commissions (IOSCO), at COP27, outlined the regulatory priorities for sustainability disclosures, mitigation of greenwashing, and promotion of integrity in carbon markets.
EBA Finalizes Methodology for Stress Tests, Issues Other Updates
The European Banking Authority (EBA) issued a statement in the context of COP27, clarified the operationalization of intermediate EU parent undertakings (IPUs) of third-country groups
OSFI Sets Out Work Priorities and Reporting Updates for Banks
The Office of the Superintendent of Financial Institutions (OSFI) published an annual report on its activities, a report on forward-looking work.
APRA Finalizes Changes to Capital Framework, Issues Other Updates
The Australian Prudential Regulation Authority (APRA) finalized amendments to the capital framework, announced a review of the prudential framework for groups.
BIS Hub and Central Banks Conduct CBDC and DeFI Pilots
The Bank for International Settlements (BIS) Innovation Hubs and several central banks are working together on various central bank digital currency (CBDC) pilots.
ECB Sets Deadline for Banks to Meet Its Climate Risk Expectations
The European Central Bank (ECB) published the results of its thematic review, which shows that banks are still far from adequately managing climate and environmental risks.
ESAs, ECB, & EC Issue Multiple Regulatory Updates for Financial Sector
Among its recent publications, the European Banking Authority (EBA) published the final standards and guidelines on interest rate risk arising from non-trading book activities (IRRBB)
EC Adopts Final Rules Under CRR, BRRD, and Crowdfunding Regulation
The European Commission (EC) recently adopted regulations with respect to the calculation of own funds requirements for market risk, the prudential treatment of global systemically important institutions (G-SIIs)
