Presentation on theme: "Governance, Risk & Compliance An Integrated Framework"— Presentation transcript:
1Governance, Risk & Compliance An Integrated Framework People, Processes & PlatformDr Neil DodgsonDirector Risk and Compliance SolutionsEMEA Financial Services
2Safe Harbor StatementThe following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decision. The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle.
4Governance, Risk, and Compliance (GRC) At-a-Glance Set and evaluate performance against objectivesAuthorize business strategy & model to achieve objectivesCultureEstablish an organizational climate and individual mindset that promotes trust, integrity, and accountabilityGovernanceCultureRisk ManagementIdentify, assess, and address potential obstacles to achieving objectivesIdentify / address violation of mandated and voluntary boundariesRiskComplianceComplianceEncourage / require compliance with established policies and boundariesDetect non-compliance and respond accordinglyKey Message: Governance, risk and compliance management should be viewed as related functions, with common activities, that are best approached in a comprehensive and integrated fashion.We can go through and define the individual components of GRC further. Governance authorizes the strategic directives for an organization to follow. Risk management assesses the areas of exposure and potential impacts. And Compliance is the tactical action to mitigate risk.The essential takeaway though is that governance, risk and compliance management should be viewed as related functions, with common activities, that are best approached in a comprehensive and integrated fashion.Common information, processes and systems can be leveraged to help address all three functions, so that they no longer lead separate “lives” within the company. At its essence, GRC can and should help to overcome the cost and risk of silos – whether these are organizational, functional, or process silos.Source: Open Compliance and Ethics Group
5Good GRC is Good Business: Reputational & Strategic Risk Executives Seek Returns from GRC Investment Source: Lord & Benoit, 2006Share-price performance of companies complying with SOX rules28%26%6%Control weakness in 2004, but none in 2005No control weaknesses inReported control weaknessPrice of control deficiency for$1 billion companySource: University of Wisconsin, 2006$10 million in higher cost of equity capitalSavings on legal liability avoidance from GRC investmentSource: General Counsel Roundtable, 2006Spending on ComplianceSavings on Lower Legal Liability$1$5# of GRC projectsAd hoc ApproachPlatform ApproachResources for innovationOpportunity cost of siloed GRCCost of GRCKey Message: GRC Drives Principled PerformanceThere is no doubt that organizations are very concerned about the cost of compliance. Research from the industry analyst AMR estimates that spending on compliance will total $27 billion, and efforts by regulatory bodies to simplify and provide further guidance to organizations attests to the continuing outcry to contain costs.In light of this focus on cost containment, is it even practical to talk about gaining returns from a GRC investment? The answer is yes. As the Open Compliance and Ethics Group elegantly states, the whole point of GRC is to drive “principled performance”. A recent study conducted by the consulting firm Lord & Benoit revealed that companies that reported a clean bill of health with respect to financial reporting saw their share-price performance increase by 28%. In contrast, those companies that had ongoing violations saw their share prices drop by 6%. Perhaps the most interesting finding however, is in the second column, that shows that companies can recover – if they fixed control violations in year 2, their performance also improved by 26%.Another way to look at the benefits of overall good GRC is in the cost of borrowing. A recent study from the University of Wisconsin shows that companies reporting internal control deficiencies have an increased risk of misstating their financials, which causes the cost of equity to increase by about 1 percent. For a company with a market capitalization of $1 billion, a 1 percent increase in capital cost would be equivalent to a $10 million movement.Looking from the perspective of legal liability, there are concrete returns to be had from compliance spending. Research from the General Counsel Roundtable finds that each additional dollar of compliance spending saves an organization, on average, $5.21 in improved avoidance of legal liabilities, harm to the organization’s reputation and lost productivity.Finally, while an ad-hoc, or as some would call it “fig-leaf” approach to GRC, may initially cost less, over time as the number and complexity of GRC requirements increase, a project by project approach will invariably cost more than a platform approach which addresses multiple requirements simultaneously.Lord & Benoit Study:University of Wisconsin Study:General Counsel Roundtable:
6What Are the GRC Management Challenges? Enterprise-Wide Responsibility CFO / VP ofFinanceChief Compliance Officer (CCO)Chief Risk Officer (CRO)CIOCEOIncreasing efficiency & consistency of compliance processesReducing fees & regulatory actions by reducing compliance violationsPlanning and oversight of compliance management resourcesIdentifying and implementing optimal detective & preventive controlsReducing the total cost of GRCTimely notification of control issues, material weaknesses and violationsAccurate & comprehensive information on financial results, compliance and auditBalancing the range of enterprise risksEvaluating business requirements and technical risk capabilitiesReducing organizational cost of risk exposure and cost of mitigation or acceptanceEnsuring Auditable, secure informationAutomating GRC information managementEliminating multiple internal GRC solutionsImplementing IT platform for GRC standardization, simplification & securityCreating transparency in risk management processes is essential to helping organizations build trust and control performance volatility. Yet delivering this transparency requires more than a framework. Companies need leadership that can manage risk across business units and integrate financial techniques with organizational best practices. Many enterprises have established an executive position to handle this challenge: the Chief Risk Officer (CRO). In this emerging role, the CRO must weigh business requirements against technical capabilities, balance a range of risk portfolios, and compare the cost of risk exposure against the cost of mitigation or acceptance.Responsibilities of the compliance Program Management Office and chief compliance and governance officers are expanding to oversight of the processes developed in enterprise risk management. Compliance and corporate governance needs are driving organizational changes and reskilling. Board members and senior executives are demanding better “control” over more timely corporate information throughout their organization.
7Risk & Compliance Officers What Keeps You Awake at Night?DATAPrison
8GRC Requirements and Complexity Increase Across the Map Records RetentionIT GovernanceFinancial Reporting ComplianceWorkforce GovernanceData PrivacyAudit ManagementCredit Risk MgmtMarket Risk MgmtOperational Risk MgmtStrategic AlignmentLegal DiscoverySupply Chain TraceabilityService Level ComplianceServiceFinanceSales & MktgPurchasingSuppliersCustomersEngineeringSOXJSOXFDABasel IIEU DirectivesHIPAAGLBA…U.S.GermanyJapanU.K.FranceChinaCanadaIndiaManufacturingApps ServerData WarehouseDatabaseMainframesEnterprise ApplicationsMobile Devices
11Governance, Risk & Compliance PeopleKnow Your Employee
12Foster a Culture of Ethics and Excellence with Workforce Governance Self-Paced Employee LearningEnsure employees understand regulations and policies in most time- and cost-effective mannerProve employee acknowledgment of accountabilityTrust single source of authoritative information for policy and procedure reference<Business Driver> Federal sentencing guidelines in the U.S. and corporate governance practices in the EU outline the importance of training all company employees on critical compliance and ethics standards. If we think back to the OCEG diagram for GRC, that essential concept of a culture for compliance is the essence of workforce governance.<Need> Global organizations need to deliver standardized and up-to-date training on a variety of concerns where a heightened risk of improper conduct exist. These areas include for example, vendor relations, intellectual property, revenue recognition, sexual harassment, and so on. Companies must prove that employees have undertaken the training and demonstrate adequate understanding.<Oracle’s Solution> Oracle’s enterprise-wide learning management system delivers targeted seminars, courses, and tests to employees online and on-demand. In this way, companies can significantly reduce training costs, ensure that staff are adequately and consistently trained in the latest GRC requirements, and monitor the results of the training. For example, if there is an area where employees consistently score low in terms of understanding, perhaps the policy needs to be simplified or the training material needs to be improved. With Oracle’s learning management system and policy and procedure portal, this insight can be fed back into the Compliance and Ethics Program Group for further optimization. Moreover, records showing employee sign-off on training programs provide evidence of employee acknowledgment and accountability.Central Policy & Procedure Portal
14A Holistic GRC framework for: SOX requires Identification of Risks and the management of Controls thru AssessmentsRCSA - Operational Risk requires the Identification of Risks and the management of Controls thru Self AssessmentsMiFID and RegNMS require Client Suitability and Transaction SurveillanceAML requires KYC and Transaction SurveillanceFraud Detection Requires both Transaction Monitoring and Risk & Control Self AssessmentA Common Process understanding for Compliance and Operational Risk would be a first step to GRC convergence14
16Recent Incidents and possible lessons learned Identifies the need for an independent Compliance monitoring system that can detect suspicious or irregular activity among all trades and orders in the organization.Identifies danger of using in-house systems for Compliance monitoringIdentifies lack of adequate Surveillance and Behaviour Pattern Detection.Good Risk management DOES NOT Equal Good COMPLIANCEIdentifies an ongoing need for Operational Risk to be more closely monitored and enforced within the financial organizations.Near-Real-Time alert generation of potentially fraudulent behaviours, irregular behaviours, excessively large positions, and other suspicious patternsAn holistic view across all areas is required to provide transparency across multiple-asset classes and jurisdictions to avoid hidden P&LIntegrated GRC systems16
18One Implementation Solves Many Problems Change In BehaviourHigh Risk InstructionsWash TradesImprovementPricePossible CTRHidden NetworksRapid MvtStructuringNetwork of AccoHigh Risk GeoSanctions ListInsider TradingPainting the TapeParkingATM FraudAbusiveSqueezesTrading AheadJrnls Btwn Unrel.300+nENTERPRISE SURVEILLANCEFraud and Identity TheftTrading Compl.AMLOpRisk Key IndicatorsBrokerSurveillanceCustomer Cross SalesInvestment ManagerSurveillanceBest ExCustSuitabi.BEHAVIOR DETECTIONPLATFORMBehavior Detection EnginesFinancial Services Data Model(FSDM)Workflow ManagerScenario Development ToolkitData IngestionGlobal Retail BankingCorresp. BankingGlobal Private BankingGlobal Fixed IncomeGlobal Capital MarketsMBSRetail BrokerageAssetMgmtGlobal Instl BrokerageGlobal LiquidityGlobal WholesaleIntegrated behavior detection solution
19Enterprise Risk,Compliance & Performance Management DatabasesBI DashboardsAnalytics ServerProfitability /Risk EngineData WarehouseManaging Risk, Performance & Profitability Across the EnterpriseProfitabilityPerformanceRisk ManagementComplianceExample: SBA integration into OFSA to enable end to end customer profitabilityMulti Dimensional ProfitabilityCustomer Profitability Available to Front OfficeProduct and Branch ProfitabilityActivity Based CostingTransfer PricingPlanning & BudgetingPerformance ScorecardsOperational Cost AnalysisRisk Adjusted Performance MgmtRisk Assessment/ QuantificationCredit, Market & Operational RiskComplete & Transparent Audit TrailAsset/Liability MgmtRegulatory ComplianceBasel IISOXAnti-Money LaunderingRegulatory ReportingInternal Controls Manager
20COMPANY OVERVIEWFifth largest bank holding company in the US, based on assets under mgmtThird-largest U.S. full-service brokerage firm, based on client assets under mgmt$700 million in managed assets110,000 employeesCUSTOMER PERSPECTIVE"We have been extremely impressed with the ability to bring data together from disparate sources and make it easy to access and leverage across the organization.”Brian Collins, Technical SponsorCHALLENGES / OPPORTUNITIESLack of a centralized view of Investment Bank Deposit, Loans, Product Fees, and SalesGRC-related data from multiple, non-integrated data sources & applicationsTime-consuming and labor-intensive core data managementPoor data quality and inadequate user satisfactionRESULTSDelivered role-based access to multiple data sources for Fixed Income, Treasury, and Investment Banking in 100 daysProvided over 300 key performance, risk and compliance metrics on a consolidated, real-time dashboardSaved up to 80 hours each month with Automated Variance AnalysisExpects to increase cross sell and up sell revenue by 75%SOLUTIONSBusiness Intelligence (Analytics)Reveleus Basel II
21Customer Example Tier 2 Regional Bank, within US Top 25, 321 branches Executive DashboardProductsTop BottomReportingScorecardRAROCProfitabilityTransactionsRole based dashboards driving insight from robust detail account level data containing statistical information, revenue, expense and derived calculations from a single source
26<Insert Picture Here> Richard Thomas Information Commissioner Information Commissioners Office"Business and public sector leaders must take their data protection obligations more seriously… privacy must be given more priority in every UK boardroom. Organisations that fail to process personal information in line with the Principles of the Data Protection Act not only risk enforcement action by the ICO, they also risk losing the trust of their customers."How can laptops holding details of customer accounts be used away from the office without strong encryption? How can millions of store cards fall into the wrong hands? How can online recruitment allow applicants to see each others’ forms? How can any bank chief executive face customers and shareholders and admit that loan rejections, health insurance applications, credit cards and bank statements can be found, unsecured in non-confidential waste bags?
27Information Risk Continues Unabated Information Security Becomes Part of Overarching GRC Strategy 50% of 1,000 executives polled said information technology is the most challenging area in achieving Sarbanes-Oxley 404 complianceSource: KPMG 404 Institute, 2006Key Message: There can be no accountability and integrity without information securityThe second key driver that we’ve heard from customers with regards to GRC is in the area of information security. It’s probably safe to say that you or one of your friends and family has been a victim of a breach in information security. In my case for example, a laptop was stolen from the program office of my graduate school. That laptop contained unencrypted and sensitive information for all the students, including social security numbers, and as a consequence, I had to call all of my credit card companies and place a security alert for potential identity theft which lasted several months.As one can imagine, the damage to the brand and reputation of an organization that suffers such a control failure, can be irreparable in terms of irate customers, patients, and constituents. Because of this, CIOs and CISOs (Chief Information Security Officers) now consider that the governance of security is part and parcel of a coherent risk management strategy. After all, how can you have accountability and integrity without information security?
28Key GRC Foundation Components Data Classification, Categorisation & SecurityHow customers’ use Oracle Label Security assign and protect sensitive or high risk data categoriesHow this can be extended to cater for non-oracle structured dataIdentity & Access ManagementHow customers use Oracle Identity Manager, Oracle Access Manager, Oracle Risk Based Authentication and Oracle Role Manager, to attest, manage, control, provision and de-provision access to systems and dataSegregation of Duties ControlsHow customers use Oracle database Vault to protect high risk data from the insider threatAudit ControlsHow customer use Oracle Audit Vault to ‘trust but verify’ access and changes to key data items