2019年-德勤全球_Breaking_down_the_global_risk_management_survey_10页_431kb

Summary of the 11th Edition Global Risk Management Survey

Core Content

The 11th Edition Global Risk Management Survey by Deloitte highlights the increasing importance of nonfinancial risk management in the financial services industry. While financial institutions are generally effective in managing traditional financial risks (e.g., market, credit, liquidity), they face significant challenges in addressing nonfinancial risks, such as cybersecurity, conduct and culture, and third-party risk. These nonfinancial risks are becoming more prevalent and impactful, often leading to major incidents that affect both financial and reputational outcomes.

Main Points

1. Nonfinancial Risks Are Gaining Importance

• Financial institutions are less effective in managing nonfinancial risks compared to traditional financial risks.
• Nonfinancial risks include cybersecurity, conduct and culture, third-party risk, compliance, model risk, and geopolitical risk.
• These risks are not only financially damaging but also threaten an institution's reputation and brand.

2. Cybersecurity Risk is a Top Priority

• Cyberattacks have become more sophisticated, targeting financial institutions for data theft, ransomware, unauthorized payments, and system disruption.
• 67% of respondents identified cybersecurity as one of the top three risks increasing in importance over the next two years, with 40% naming it as the most important.
• Challenges in managing cybersecurity include:
  • Keeping up with changing business needs (e.g., cloud, mobile, analytics)
  • Addressing threats from nation-state actors, hacktivists, and insiders
  • Hiring skilled cybersecurity professionals
• Institutions are turning to predictive analytics and automation to manage the volume and complexity of cyber threats.

3. Conduct and Culture Risk is Critical

• Misconduct and unethical behavior at financial institutions have led to regulatory and legislative focus on conduct and culture risk.
• Only 50% of respondents felt their institutions were extremely or very effective in managing this risk.
• Advanced technologies like cognitive analytics, machine learning, and natural language processing can help detect misconduct in unstructured data.
• A strong risk culture is essential, and institutions are encouraged to formalize conduct and culture programs.

4. Third-Party Risks Present Unique Challenges

• Third-party service providers introduce risks like nonperformance, data breaches, intellectual property theft, and legal violations.
• These risks can cascade into reputational and cybersecurity threats for the institution.
• Only 40% of respondents felt their institutions were extremely or very effective in managing third-party risks.
• 34% were effective in managing reputational risk, and 36% in cybersecurity and data protection from third-party relationships.

5. Operational Risk Management Faces Ongoing Challenges

• The Basel Committee has updated operational risk capital calculation methods, replacing the Advanced Measurement Approach (AMA) with the Standardized Measurement Approach (SMA).
• The SMA relies on internal loss data and business indicators, requiring accurate and comprehensive data.
• Only 56% of respondents felt their institutions were extremely or very effective in managing operational risk.
• Key challenges include:
  • External loss event data (31%)
  • Causal event analysis (32%)
  • Scorecards (36%)
  • Key risk indicators (45%)
• Internal loss data remains inadequately developed in most institutions, with less than 40% considering it extremely or very well developed.

Key Information

• Survey Methodology: Based on responses from 94 financial institutions globally, with total combined assets of US$29.1 trillion.
• Participating Institutions: Represent a range of asset sizes and financial services:
  • 26% with less than US$10 billion in assets
  • 36% with US$10 billion to less than US$100 billion
  • 37% with US$100 billion or more
  • Provide services in banking (61%), investment management (49%), and insurance (46%).
• Recommendations:
  • Adopt a holistic nonfinancial risk framework.
  • Invest in advanced technologies for risk detection and prevention.
  • Improve risk data governance and IT systems.
  • Formalize conduct and culture programs.
  • Enhance governance structures by grouping nonfinancial risk management under the Chief Risk Officer (CRO).

Conclusion

The survey emphasizes that financial institutions must rethink their risk management strategies to address the growing complexity and impact of nonfinancial risks. With the introduction of new regulatory frameworks and the increasing sophistication of threats, innovation and integration are key to effective risk management in the evolving financial landscape.

References

• James Lewis, Economic impact of cybercrime—No slowing down, McAfee, February 2018
• Stacy Cowley, Banks adopt military-style tactics to fight cybercrime, New York Times, May 20, 2018
• Office of Financial Research, 2017 Annual Report to Congress, US Department of the Treasury, December 5, 2017

Contacts

• Bob Contri, Global leader | Financial Services Industry, Deloitte Global
  Email: bcontri@deloitte.com
  Phone: +1 212 436 2043

• J.H. Caldwell, Global Financial Services leader | Deloitte Risk and Financial Advisory, Deloitte & Touche LLP
  Email: jacaldwell@deloitte.com
  Phone: +1 704 227 1444

• Edward T. Hida II, CFA, Survey editor | Deloitte Risk and Financial Advisory, Deloitte & Touche LLP
  Email: ehida@deloitte.com
  Phone: +1 212 436 4854

Acknowledgments

• Contributions from Deloitte Touche Tohmatsu Limited member firms.
• Special thanks to Bayer Consulting for survey administration and support.

Subject Matter Advisors

• Gerhard Schroeck, Frankfurt, Germany
  Email: gschroeck@deloitte.de

• Michael Pieper, Frankfurt, Germany
  Email: mipieper@deloitte.de

• Francisco Porta, Madrid, Spain
  Email: fporta@deloitte.es

• Ricardo Martinez, New York, New York, US
  Email: rimartinez@deloitte.com

Deloitte

Deloitte is a leading global provider of audit and assurance, consulting, financial advisory, risk advisory, tax, and related services. With a network of member firms in over 150 countries and territories, Deloitte serves four out of five Fortune Global 500 companies.
For more information, visit www.deloitte.com.