1. Driving change in information risk within the financial services industry Subtitle Date

2. 1 © 2013 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. Agenda ■BYOD ■BYOD and eDiscovery ■The Cloud and eDiscovery ■Big Data and eDiscovery ■Social Media ■Fines and Regulation

3. 2 © 2013 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. Overview This presentation will give an overview on: New Challenges for IM in the Financial Industry The Risks involved The consequences of getting it wrong

4. 3 © 2013 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. BYOD- Bring your own Device Huge interest in BYOD Everyone likes to use their new “i thing..”

5. 4 © 2013 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. BYOD- Bring your own Device BYOD is the ability of the employee to use their own device for work Fuelled by the IT consumer revolution Main driver is satisfaction and productivity of the employees (?) IT cost reduction: Cisco determined savings between $300 and $1300 per worker

6. 5 © 2013 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. BYOD- Risks for Information Management New openings/opportunities for security breaches Increased difficulty to comply with confidentiality and regulation (SEC/Dodd Frank) Heightened possibility of data loss: theft/employee leaving Loss of control of content on the device

7. 6 © 2013 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. BYOD and eDiscovery Risks BYOD devices can become embroiled in eDiscovery, private data becoming part of litigation Related the costs for discovery and legal holds can multiply thanks to the inflated number of private devices and the volumes of data they hold Important to reflect risks in separate BYOD policy Research indicates only 20% of workers have signed a BYOD policy....

8. 7 © 2013 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. The Cloud and eDiscovery Risks Ownership and Control Cost Destruction of data Jurisdiction issues

9. 8 © 2013 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. Big Data and eDiscovery Risks Additional Risks created through Big Data Applications: Unstructured data Quantity too high for traditional methods to evaluate data Litigation costs: the more data the higher the bill

10. 9 © 2013 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. Big Data and eDiscovery Risks Possible answers: Predictive code Integrating servers and Systems Automated processes

11. 10 © 2013 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. Social Media: New Risks for Compliance External Risks New information sources Directing and policing the information flow Internal Risks All Social Media interactions are falling under Information Management Regulations. Need to be archived and supervised

12. 11 © 2013 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. Fines and Regulations Failing to address new risks leads to painful sanctions In December 2012 Citigroup was fined $750,000 for failing to retain millions of emails. In February 2013 the Financial Industry Regulatory Authority fined five affiliates of ING $1.2 million for failing to retain or review millions of email records periods ranging to more than six years. HIPAA Regulation (Health Insurance Portability and Accountability Act), can fine healthcare organizations up $1.5 million in annual fines for failure to protect the personal health information of patients.

13. 12 © 2013 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. Contact For questions or further discussions: Email: roger.poole@kpmg.co.uk

14. Thank you Presentation by Name Surname

15. © 2013 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. The KPMG name, logo and “cutting through complexity” are registered trademarks or trademarks of KPMG International Cooperative (KPMG International). The information contained herein is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavour to provide accurate and timely information, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. No one should act on such information without appropriate professional advice after a thorough examination of the particular situation.