Current state of IT GRC in financial services
Although the COVID-19 pandemic has caused massive disturbances and fluctuations in many industries, the banking and financial services industry has shown perseverance. That’s primarily due to the IT GRC model. This has allowed the industry to learn from its mistakes made during earlier financial crises.
Let’s explore what GRC is, the evolution of information technology enabling the GRC framework and its current state in the banking and financial services sector.
What Is GRC in Banking and Financial Services?
GRC stands for governance, risk and compliance. In the financial sector, GRC affects how institutions deal with risk. And how management ensures high-level decisions are aligned with both current regulations and organizational business objectives.
The scope of GRC in banking and financial services today has evolved to become a comprehensive approach that includes sustainability, quality assurance, ethics management, information security, and more.
Current State of IT GRC in Banking and Other Financial Services
Now that the concept of GRC has been defined, it’s time to delve into its current state.
Currently, the global financial industry is transitioning from old GRC models—based on inflexible processes and spreadsheets—to dynamic models, which use innovative technologies to visualize operations in real time for better decision-making.
Here’s an overview of the current state of information technology GRC in banking and other financial services.
Increased Regulatory Scrutiny
The financial services sector is one of the most regulated industries in the world. And that’s expected to increase because of the billions of dollars at risk to public and institutional investors. Risk exposure and complexity are growing, as fresh players enter the financial ecosystem. Some of those new players include payment gateways, digital banks and cryptocurrency exchanges.
Fortunately, the figures show the financial sector has managed to improve its internal processes and controls to the point of decreasing fines associated with non-compliance with regulations. The Ferergo Report states that global anti-money laundering (AML) and data privacy fines decreased by 47% during the first half of 2021.
Digital Transformation
During 2022, the migration of monolithic systems and processes to cloud-native applications is still a work in progress. This transition started during 2017. And it’s still expected to take a few more years to complete, thanks to complexity and sheer volume of legacy workloads.
The cloud holds great promise for the financial services sector. It can also be a supportive environment for GRC transformation in banks. Many organizations find advanced technology in the cloud much easier to access, leverage and scale. Some of those techs are artificial intelligence (AI), machine learning (ML), computer vision, deep learning, sentiment analysis, process intelligence, advanced data governance and quantum computing.
This titanic effort of time and resources to modernize applications through cloud computing is critical to the evolution of GRC during the next few decades.
Focus on Cyber Security
Recent Fortinet Statistics show the risk of cyber attacks in the financial sector continues to increase. Damage from ransomware is estimated to have cost $20 billion during 2021.
As the Solar Winds hack proved, attacks are becoming increasingly sophisticated. As a result, the scope of cyber security is not limited to the implementation of defense measures against external attacks. But also, the prevention of internal attacks, whether intentional or not.
Blockchain Technology Implementation
There’s no doubt the success of financial technology startups, such as Stripe or Kraken, has motivated traditional financial services organizations to take blockchain technology more seriously.
Moreover, the current work of several countries around the Central Bank Digital Currency (CBDC) is a sign the future of money is digital. For this reason, it’s not surprising that the adoption of blockchain tech throughout the sector has already begun.
The use of blockchain technology in GRC brings many benefits. That’s because it can create decentralized systems difficult to hack and can store an array of data. With this data being immutable, blockchain also allows for more effective auditing of each process.
However, blockchain is not a silver bullet for all woes affecting the financial sector, as it applies to GRC. For example, blockchain can’t go backwards. Data is immutable. So, any human errors become permanent. And discrepancies within a system can’t be fixed.
Other Risks Associated with GRC in Banking and Finance
Along the current GRC landscape, risks associated with geopolitical power shifts or pandemic-driven global economic slowdowns can’t be ruled out. Some experts even predict a stock market crash during 2022. This may potentially be one of the most significant risks for the financial sector in recent years.
The size of such an event only accentuates the need to deepen the implementation of a coherent IT GRC model, ensuring the proper decisions are made if there’s a global crisis affecting this sector.
Digital transformation is still one of the biggest challenges for the financial sector to address. The transition from the old IT GRC frameworks and their inflexible processes are a priority.
However, migrating applications to the cloud has been more difficult than expected. Especially because it requires re-evaluating many processes. This has much to do with the lack of standard practices, overlapping indicators, lack of role clarity (which affects governance) and lack of integration between the different IT GRC components, which doesn’t allow information from each system to be effectively used.
In short, the finance and banking sector faces the same challenges as other industries, which have an abundance of independent processes. Often, these processes and systems use different metrics.
While migration to the cloud implies separation of functions, it’s also true microservices must be able to share available data. This implies a consensus on the metrics and data sources used.
Conclusion
Meeting regulatory compliance standards is essential to your organization’s security strategy. With finance as one of the most regulated industries, it’s important for your organization in that sector to safeguard data, build client trust and keep the business compliant.
As the financial industry transitions to meet the standards of digital transformation, regulations are only expected to increase. Luckily, organizations are now making better decisions and learning from the mistakes made during earlier financial crises.
System Soft Technologies has a team of trusted experts with decades of joint experience in the banking technology solutions and financial industry. They have helped organizations move from compliance and risk avoidance to innovation and proactive insights, protecting their business models.
You can explore how working with a trusted partner like System Soft can help your organization navigate the complexities of regulatory compliance and provide governance, risk and compliance consulting. Follow System Soft on LinkedIn to read more upcoming blogs that probe IT GRC for both the healthcare and public sector markets.
About the Author: Craig Wilson
As an Enterprise Security Architect at System Soft Technologies, Craig is a CISSP-certified tech guru with multiple IT security certifications. Craig’s roles as Director of IT Infrastructure and Security, Cybersecurity Solutions Architect and Enterprise Solutions Architect, along with his expertise on enterprise organization security and governance, authenticates him as a trusted and valuable advisor on security best practices.