德勤全球-Future-of-risk-management-in-financial-services_9页_1mb

报告摘要

Future of Risk Management in Financial Services: Integrating Risk and Agile Projects

Core Content

The financial services industry is undergoing rapid transformation driven by the need for speed, flexibility, and innovation. Traditional risk management practices, which emphasize thorough planning and gate-based control, are increasingly at odds with Agile project management, which prioritizes iterative development, customer collaboration, and rapid feedback. This document outlines the challenges and opportunities of integrating risk management with Agile methodologies, emphasizing the need for a new operating model to align both functions effectively.

Main Points

Industry Trends: Financial institutions must adapt to a fast-paced environment characterized by digital disruption, evolving customer expectations, and new competitive threats. Agile methodologies are being adopted to accelerate product development and improve customer experience.
Agile Methodology: Agile is a mindset and approach that emphasizes collaboration, flexibility, and continuous improvement. It includes practices like sprints, scrums, and user stories, and is commonly used in software development but is now being applied across various industries and project types.
Risk Management Challenges: Traditional risk management approaches, which are often reactive and centralized, struggle to keep up with Agile’s iterative and decentralized nature. This leads to misalignment, inefficiency, and increased risk exposure.
Agile-Risk Operating Model: To overcome these challenges, institutions need to develop an Agile-Risk Operating Model that integrates risk management into the Agile project lifecycle. This model should address five key areas:
- Interaction and Governance: Define how risk management professionals (RCPs) will engage with Agile teams throughout the project lifecycle.
- Decision Rights: Clarify the decision-making responsibilities of each line of defense, particularly the first and second lines, to avoid overlap and conflict.
- Talent: Identify the necessary skillsets and organizational structures for each line of defense to support Agile projects effectively.
- Tools and Accelerators: Leverage technology to automate risk assessments, improve monitoring, and integrate controls into processes.
- Change Management Strategy: Implement a strategy to foster a risk-aware culture and ensure smooth adoption of Agile-Risk integration.
Integration Benefits: A well-designed Agile-Risk Operating Model can increase speed to market, reduce duplication of effort, and improve early risk identification and mitigation. It allows institutions to maintain control while delivering innovation quickly.

Key Information

Agile vs. Waterfall: Agile projects move in small, incremental steps, with frequent customer feedback and adjustments, while the traditional waterfall model involves lengthy planning phases and gate-based approvals.
Three Lines of Defense:
- Line 1: Business units that own and manage risks.
- Line 2: Risk management function that provides oversight and challenge.
- Line 3: Internal audit that validates the risk and control framework.
Case Studies:
- A North American bank developed an Agile-Risk Operating Model with Deloitte, aligning risk management with Agile practices and enabling more effective risk involvement in projects.
- An Australian bank adopted an "Enterprise Agile" model, embedding risk and compliance experts into delivery teams to support customer-centric innovation.
Symptoms of Misalignment:
- Lack of clear guidance for delivery teams on risk engagement.
- Inconsistent or late involvement of risk professionals.
- Conflicting expectations and unclear roles between Agile teams and RCPs.
- Inefficient processes and duplicated efforts due to poor communication.
Deloitte’s Four Levers of Risk Transformation:
1. Strategy: Involve risk management in strategic planning and product development.
2. People: Develop a risk-aware culture and ensure risk professionals have the necessary skills and mindset.
3. Three Lines of Defense: Realign responsibilities and ensure clarity in roles.
4. Technology: Use automated tools and emerging technologies to enhance risk management capabilities.

Conclusion

Integrating risk management with Agile projects is a critical step in the transformation of financial institutions. It requires a shift in mindset, redefining how risk professionals engage with projects, and leveraging technology to support real-time risk assessment and control. By developing an Agile-Risk Operating Model and focusing on collaboration, clarity, and innovation, institutions can enhance their ability to manage risk effectively while delivering faster, more flexible services to customers.

Endnotes

The need for risk management to adapt is part of a larger trend toward transformation in response to a volatile environment.
Regulatory changes, such as the EU’s General Data Protection Regulation (GDPR), are increasing the complexity of risk management.
Deloitte's research highlights the importance of collaboration and clear governance in achieving successful Agile-Risk integration.

Contacts

Edward Hida – Partner, Deloitte Risk and Financial Advisory
ehida@deloitte.com
Matt Devine – Director, Financial Advisory
mdevine@deloitte.ca
Bruno Melo – Partner, Risk Advisory
brmelo@deloitte.ca
Tom Alstein – Director, Risk Advisory
toalstein@deloitte.com.au