MAS Sets Out Good Practices to Manage Operational Risks Amid COVID
MAS and The Association of Banks in Singapore (ABS) jointly issued a paper that sets out good practices for the management of operational and other risks stemming from new work arrangements adopted by financial institutions amid the COVID-19 pandemic. The paper covers operational risks associated with outsourcing and other third-party arrangements, along with risks in the areas of information/data governance, cybersecurity, fraud and staff misconduct, and legal and regulatory compliance. The paper shares good practices adopted by financial institutions to mitigate such risks and encourages institutions to adopt these risk-mitigation practices on a risk-proportionate basis, according to their risk profiles and business activities. The mitigation practices set out in the paper are also applicable to non-bank financial institutions.
The paper predominantly focuses on the areas of risks where changes, due to remote working, have a direct impact on the risks and risk management challenges faced by financial institutions (referred to as direct risks). However, poorly managed direct risks of remote working could lead to heightened risks in areas that may not be directly impacted by remote working (referred to as indirect risks). The paper provides examples of indirect credit, market, and reputational risks. For instance, changes in validation processes that are conducted for credit assessment and monitoring purposes, such as replacement of customer site visits (for example, to ascertain existence of collateral pledged) with customer calls, could affect the ability of a financial institution to identify red flags in customer circumstances. The paper sets out the key actions that financial institutions are encouraged to adopt to manage remote working risks and these actions include the following:
- With respect to establishing appropriate internal control mechanisms, financial institutions are encouraged to implement compensating controls to manage identified risks within risk appetite statements approved by Board and senior management. Financial institutions are also encouraged to adopt robust change management procedures so that staff members understand and implement the new processes and controls as intended.
- With respect to outsourcing and other third-party arrangements, financial institutions should evaluate changes to vendor risk profiles with remote working, such as by assessing vendors’ remote working controls and operational resilience. Financial institutions should also implement appropriate safeguards and contingency plans to ensure continuity of services.
- For appropriate data/information governance, financial institutions should assess the risks and implications of information loss when determining which activities can be performed remotely. Financial institutions need to strengthen preventive and detective controls to mitigate these risks.
- To mitigate cyber risk, financial institutions are encouraged to implement controls to ensure that remote working infrastructure of staff, including personal devices, are secured. Financial institutions should also continue to adopt sound and robust technology risk management practices, to manage hardware and software deployed to facilitate large-scale remote working, including during the pandemic.
Keywords: Asia Pacific, Singapore, Banking, Insurance, Securities, COVID-19, Operational Risk, Operational Resilience, Technology Risk, Cyber Risk, Outsourcing Arrangements, Internal Controls, MAS
Related Articles
FINMA Approves Merger of Credit Suisse and UBS
The Swiss Financial Market Supervisory Authority (FINMA) has approved the takeover of Credit Suisse by UBS.
BOE Sets Out Its Thinking on Regulatory Capital and Climate Risks
The Bank of England (BOE) published a working paper that aims to understand the climate-related disclosures of UK financial institutions.
OSFI Finalizes on Climate Risk Guideline, Issues Other Updates
The Office of the Superintendent of Financial Institutions (OSFI) is seeking comments, until May 31, 2023, on the draft guideline on culture and behavior risk, with final guideline expected by the end of 2023.
APRA Assesses Macro-Prudential Policy Settings, Issues Other Updates
The Australian Prudential Regulation Authority (APRA) published an information paper that assesses its macro-prudential policy settings aimed at promoting stability at a systemic level.
BIS Paper Examines Impact of Greenhouse Gas Emissions on Lending
BIS issued a paper that investigates the effect of the greenhouse gas, or GHG, emissions of firms on bank loans using bank–firm matched data of Japanese listed firms from 2006 to 2018.
HMT Mulls Alignment of Ring-Fencing and Resolution Regimes for Banks
The HM Treasury (HMT) is seeking evidence, until May 07, 2023, on practicalities of aligning the ring-fencing and the banking resolution regimes for banks.
MFSA Sets Out Supervisory Priorities, Issues Reporting Updates
The Malta Financial Services Authority (MFSA) outlined its supervisory priorities for 2023
German Regulators Issue Multiple Reporting Updates for Banks
Deutsche Bundesbank published the nationally deactivated validation rules for the German Commercial Code (HGB) users on the taxonomy 3.2, which became valid from December 31, 2022
BCBS Report Examines Impact of Basel III Framework for Banks
The Basel Committee on Banking Supervision (BCBS) published results of the Basel III monitoring exercise based on the June 30, 2022 data.
PRA Consults on Prudential Rules for "Simpler-Regime" Firms
Among the recent regulatory updates from UK authorities, a key development is the first-phase consultation, from the Prudential Regulation Authority (PRA), on simplifications to the prudential framework that would apply to the simpler-regime firms.