Deloitte Global Survey: With deregulatory moves and emerging technologies, financial institutions are beginning to reengineer their risk management systems, albeit slowly

28 March 2019 - In a volatile market environment and with the edict to “do more with less,” many financial institutions are beginning efforts to reengineer their risk management programs, according to a new survey by Deloitte Global, with emerging technologies in the driver’s seat.

Seventy percent of the financial services executives surveyed said their institutions have either recently completed an update of their risk management program or have one in progress, while an additional 12 percent said they are planning to undertake such a renewal effort. A big part of this revitalization will be leveraging emerging technologies, with 48 percent planning to modernize their risk infrastructure by employing new technologies such as robotic process automation (RPA), cognitive analytics, and cloud computing.

“Financial institutions face a formidable set of challenges posed by today’s more complex and uncertain risk environment,” said Hani Khoury, Partner and Risk Advisory Leader, Deloitte Middle East. “With budget cuts common—and a big focus on effectiveness and efficiency as the torrent of regulatory change has slowed—this will require institutions to rethink their traditional assumptions and employ fundamentally new approaches.”

“Digital technologies have the potential to fundamentally reengineer virtually every aspect of risk management,” said Khoury. “Financial institutions are now at the early stages of this transformation of their risk management functions.”

Only a minority of institutions are employing these types of technology currently, and often in small doses within their organization. The technologies that institutions surveyed most often reported using were cloud computing (48 percent), big data and analytics (40 percent), and business process modeling tools (38 percent). Most surprisingly, given the attention paid to the potential of RPA to reduce costs and improve accuracy by automating repetitive manual tasks without human involvement, only 29 percent of respondents said their institutions are currently using it.

Other tools are being used by even fewer institutions such as machine learning (25 percent), business decision modeling tools (24 percent), and cognitive analytics (including natural language processing/natural language generation) (19 percent).

“These tools can reduce costs by automating manual tasks such as developing risk reports or reviewing transactions,” according to Khoury. “They can also automatically scan a wide variety of data in the internal and external environments to identify and respond to new risks, emerging threats, and bad actors. Some banks have developed real leading-edge platforms for identifying potential conduct risk situations, for example.”

The findings from the eleventh biennial edition of the survey of financial institutions—titled “Reimagining Risk Management to Mitigate Looming Economic Dangers and Nonfinancial Risks”—are based on the responses of 94 financial institutions around the world, representing a total of US$29.1 trillion in aggregate assets. The institutions surveyed provide a range of financial services, including banking (61 percent), investment management (49 percent), and insurance (46 percent).

Continued Growing Importance of Cybersecurity Risk

Financial services executives were also asked in the survey which three risk types they believed would increase the most in importance for their institution over the next two years. The broad consensus was that cybersecurity is the number-one challenge.

Two-thirds of respondents (67 percent) named cybersecurity as one of the three risks that would increase the most in importance for their business over the next two years, far more than for any other risk. Yet, only about half of the respondents felt their institutions were extremely or very effective in managing this risk.

Although cybersecurity also held the pole position in the survey’s 2016 edition, there was a dramatic uptick in the current survey. More respondents considered it as one of the three risk types that would increase most in importance (67 percent, up from 41 percent) and cited it as the number-one risk (40 percent, up from 18 percent).

For specific types of cybersecurity risks, respondents most often considered their institutions to be extremely or very effective in managing disruptive attacks, financial losses or fraud, cybersecurity risks from customers, loss of sensitive data and destructive attacks, each above the 50 percent mark. They were less likely to consider their institutions to be this effective when it came to threats from nation-state actors (37 percent) or cybersecurity risks from third-party providers (31 percent).

“In addition to their well-established supervision of operational risk, many financial regulators in the Middle East are either establishing or have already established cyber security specific regulation and oversight functions with a focus to address the risks that cyberattacks could pose to the financial system as a whole,” said Fadi Mutlak, Partner and Cybersecurity Leader, Deloitte Middle East. “Given the increasing interconnections among financial institutions, their technology partners and financial markets around the world, good cyber governance and oversight is imperative to the ability to respond and recover effectively when a threat is detected or an attack is realized. It is well known that a cyberattack has the potential to quickly damage the global financial system.”

Among the survey’s other findings:

• When asked to assess the overall effectiveness of their institution in managing risk, 82 percent of respondents considered it to be extremely or very effective, an increase from 69 percent in 2016.
• While institutions have become more skilled at managing financial risks, non-financial risks continue to assume greater prominence as the exposure and consequences from these risks has become more evident. Respondents were less likely to consider their institutions extremely or very effective in areas including reputation risk (57 percent), business resilience risk (54 percent), model risk (51 percent), conduct and culture risk (50 percent), strategic risk (46 percent), third-party risk (40 percent), geopolitical risk (35 percent) and data integrity risk (34 percent).
• 83 percent of respondents expected that regulatory requirements on their institutions would increase over the next two years, with one-third expecting a significant increase.
• Credit risk was seen most often as being extremely or very challenging to manage in commercial real estate (31 percent).

Financial institutions confront significant challenges in effectively employing the “three lines of defense” risk governance model – which details the appropriate roles in risk management of business units, the risk management function, and internal audit – according to the survey. This model has long been a regulatory expectation and a prevailing practice. Forty-three percent of survey respondents said their institutions either have revised their three lines of defense model, are reassessing or are planning to reassess their models. Deloitte Global expects the impact of emerging technologies to be a key consideration in these changes.

“Financial institutions will need to consider how to effectively reengineer their ‘three lines of defense’ in this technology-powered environment,” said Khoury. “One of the biggest issues in the three lines of defense will be making sure that business units are engaged in their ‘first line’ role—as the survey found that more than half said their institutions have increased, or plan to increase, the risk management responsibilities of business units to manage the risks they assume. There is a great deal of work to do in this arena in the volatile environment that companies face today.”

The report can be found online here.

About Deloitte:

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited (“DTTL”), its global network of member firms, and their related entities. DTTL (also referred to as “Deloitte Global”) and each of its member firms are legally separate and independent entities. DTTL does not provide services to clients. Please see www.deloitte.com/about to learn more.

Deloitte is a leading global provider of audit and assurance, consulting, financial advisory, risk advisory, tax and related services. Our network of member firms in more than 150 counties and territories, serves four out of five Fortune Global 500® companies. Learn how Deloitte’s approximately 280,000 people make an impact that matters at www.deloitte.com.

About Deloitte & Touche (M.E.):

Deloitte & Touche (M.E.) (DME) is a licensed member firm of Deloitte Touche Tohmatsu Limited (DTTL) and is a leading professional services firm established in the Middle East region with uninterrupted presence since 1926. DME’s presence in the Middle East region is established through its affiliated independent legal entities which are licensed to operate and to provide services under the applicable laws and regulations of the relevant country. DME’s affiliates and related entities cannot oblige each other and/or DME, and when providing services, each affiliate and related entity engages directly and independently with its own clients and shall only be liable for its own acts or omissions and not those of any other affiliate.

DME provides audit and assurance, tax, consulting, financial advisory and risk advisory services through 25 offices in 14 countries with more than 3,300 partners, directors and staff. It has also received numerous awards in the last few years which include, Middle East Best Continuity and Resilience provider (2016), World Tax Awards (2017), Best Advisory and Consultancy Firm (2016), the Middle East Training & Development Excellence Award by the Institute of Chartered Accountants in England and Wales (ICAEW), as well as the best CSR integrated organization.