Issue #60

Editor's Letter - What a year: Editor Carrie Cook takes stock of the past 12 months, including those unexpected political developments.   News: Analysis of the major risk-related news stories of the past few weeks, including more problems for Wells Fargo, the Italian banking crisis and systems outages at major banks.   If You Ask Me : Annie Searle: Our stateside columnist Annie Searle reflects on recent political events, what they mean for the regulatory and risk management landscape – and for life as we know it.   Spotlight - Behavioural economics in a post-truth world: Cathy Hampson, author of An Introduction to Behavioural Risk, applies the theory of behavioural economics to a world where telling the truth is no longer a deal breaker.   Regulatory Update: An update on the latest regulatory developments including anti-money laundering proposals from BCBS and a warning from the Central Bank of Ireland on risk management deficiencies.   Case Study - Wells Fargo: a closer look: In this operational risk case study, Manoj Kulwal from RiskSpotlight dissects the Wells Fargo sales fraud scandal and extracts some useful lessons for risk managers.   Leaving a legacy: Carrie Cook takes a look at the complex issue of legacy systems in banks and why leaving outdated technology behind is harder than it sounds.   Sharing Scenarios - New system implementation project failure: We explore a risk which many firms are likely to face in the near future as they replace legacy technology with newer emergent technology.   Risk Classifications - Employee violation of duties owed to company: RiskBusiness’ Mike Finlay explores a risk category which is of particular concern given increased regulatory scrutiny on firms, their governance and the actions of employees, officers and directors.   Dear CEO: Every month, an anonymous senior executive of a financial services firm writes a letter to the CEO about concerns they have always wanted to raise.

Issue #59

Editor's Letter - Uncertain times ahead: Editor Carrie Cook discusses the impact of unexpected political events on the future of banking and the growing impetus for banks to manage political risk.   News: Analysis of the major risk-related news stories of the past few weeks, including fines for money-laundering breaches, Trump’s decision to dismantle Dodd Frank and the Rolls Royce bribery scandal.   Interview - Paul Hopkin, technical director, Institute of Risk Management: Carrie Cook speaks to Paul Hopkin from the Institute of Risk Management about the organisation’s latest guidance on managing bribery risk, produced in partnership with Transparency International.   How To... Implement a working anti-bribery compliance programme: Bribery and corruption expert Severin Wirz provides a step-by-step guide on how to build, implement and enforce a successful antibribery compliance programme, looking at high-profile examples of where some firms have fallen short.   The case for certifying your anti-bribery programme: Compliance expert Kristy Grant-Hart takes a look at the benefits of becoming certified under the new ISO 37001 anti-bribery standard.   Spotlight - Political risk: a growing uncertainty for global financial institutions: Mark Elkommos from HSBC Bank Egypt considers the links and overlaps between operational risk and political risk in these politically uncertain times.   Regulatory Update: An update on the latest regulatory developments including cyber risk guidance from FinCEN, advice from the SFC on client identity verification and news from the SEC as Trump prepares to take the helm.   Book Review - The Weakest Link: An extract from "The Weakest Link: Why your employees might be your biggest cyber risk" by digital strategy expert Jeremy Swinfen Green and cyber security veteran Paul Dorey.   Time to smell the coffee - lessons learned from the Dyn, Liberia and Tesco hacks: Cyber security expert Graeme McGowan reports on the spate of recent cyber attacks and how they’ve exposed the extent of the vulnerability presented by interconnected devices and legacy systems and networks.   Risk Classifications - Know your customer failures and violations: Continuing with our regular feature on data classification issues and guidelines, in this issue, RiskBusiness’ Mike Finlay explores failure by the firm to comply with rules, regulations or other requirements relating to the identity of its clients, customers and other third parties.   Dear CEO: Every month, an anonymous senior executive of a financial services firm writes a letter to the CEO about concerns they have always wanted to raise.

Issue #58

Editor's Letter - Round and round we go: Editor Carrie Cook discusses the perpetual cycle of misconduct and fines in the financial industry and wonders whether we will ever be able to get off the ride.   News: Analysis of the major risk-related news stories of the past few weeks, including the latest developments at Wells Fargo, more fines and litigation at RBS and a detailed look at the ongoing crisis at Deutsche Bank.   Spotlight - Blockchain and the markets: through an operational risk lens: Blockchain is the hot new topic within financial services. While adoption of the new technology is exciting, there are always risks. In this report, Helen Pykhova and Meredith Gibson find out what distributed ledger technology means for operational risk.   Regulatory Update: An update on the latest regulatory developments including the UK’s Criminal Finances Bill, an update to the FCA’s Senior Managers Regime and cyber security guidelines for the financial sector released by the G7.   How To... Create an internal control system: Internal control and risk management are vital components of sound governance, something a number of institutions are perhaps struggling to demonstrate lately. Here, RiskBusiness’ Mike Finlay presents a step-by-step guide to building and implementing an internal control system.   Sound practice guidance on conduct: a preview: The Institute of Operational Risk is preparing its long-awaited Sound Practice Guidance on Conduct. This article provides a preview of the ongoing work by its authors: Ariane Chapelle, Jimi Hinchliffe and Mark Laycock.   If you ask me: When does ‘taking full responsibility’ have consequences?: Risk expert Annie Searle shares her thoughts on recent incidents of major misconduct in the industry and asks whether financial institutions and regulators will ever get to grips with the conduct challenge.   Dear CEO: Every month, an anonymous senior executive of a financial services firm writes a letter to the CEO about concerns they have always wanted to raise.

Issue #57

Editor's Letter - Culture Club: Culture is a term which has become inextricably linked with banking misconduct. But what does it really mean?   News: Analysis of the major risk-related news stories of the past few weeks, including the sales scandal at Wells Fargo, the latest fines data and a misconduct case at Barclays Wealth and Investment Bank.   Regulatory Update: An update on the latest regulatory developments including a landmark in whistleblower payouts for the SEC and concerns about fintech at the Bank of England.   Interview - Paul Rippon: We catch up with deputy CEO of Monzo, Paul Rippon, to get the lowdown on what the app-based alternative bank hopes to achieve, the challenges its faced so far and what it’s really like working in fintech after years of working in traditional banking.   Opinion - The Culture Wars: Risk expert Howard Stein ponders the corruption and misappropriation of the term ‘culture’ – and why business is so obsessed with it.   How To... Manage and Set Operational Risk Appetite: Author and head of operational risk for MUFG Securities EMEA, Michael Grimwade, shares his step-by-step guide on how to define and manage a firm’s operational risk appetite.   Opinion - Risk Culture Building is not a Concept; it’s a Mindset: Horst Simon explains why confusing the separate roles of governance, risk and compliance can be detrimental to building a sound risk culture within the firm.   Sharing Scenarios - Software Coding Error: This month, we explore a continuous risk whenever the firm builds its own software applications: the risk of a software coding error.   Risk Classifications - Improper or Aggressive Advertising, Sales Practices or Contract Terms: Mike Finlay explores a risk category which is coming under increasing scrutiny from industry regulators.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to the CEO detailing some of the issues they have always wanted to raise.

Issue #56

Editor's Letter: Staying ahead of the game: Cyber crime and the technological revolution are top of the agenda for the financial sector. But are banks taking it seriously enough?   News: Analysis of the major risk-related news stories of the past few weeks, including major reforms from the Competition and Market’s Authority, European banks’ stress tests and the Volkswagen emissions scandal.   If you ask me: Can the centre hold?: Regular columnist and risk expert, Annie Searle, ponders the global impact of recent high-profile risk events and what this means for business and safety.   Regulatory Update: An update on the latest regulatory developments including a MiFID II consultation from the FCA, an enforcement outcomes report from ASIC and new governance standards for Malaysia’s banks.   Cyber criminals are causing seismic shifts in the digital landscape: Cyber security expert Chris Underhill shares his views on how businesses should be addressing cybercrime as the challenge becomes increasingly difficult for firms to manage.   How To... Create an effective anti-money laundering/counter-terrorism financing programme: Mark Elkommos, AML investigations manager at HSBC Bank Egypt, explains how firms should be developing strong anti-money laundering monitoring capabilities to safeguard the financial system from the abuses of financial crime.   Spotlight: 21st century corporate defence: Corporate defence management strategist, Sean Lyons, identifies and dissects the various elements needed to develop a sustainable and effective corporate defence strategy.   Cyber security: Shaping behaviour to improve compliance: Protecting against cybercrime is a complex challenge. But what if you could tap into the skills of other disciplines to shape the behaviour of individuals to be more vigilant about IT security? Chris Rivinus reports.   Sharing Scenarios: System intrusion followed by ransomware infection: In keeping with the thematic coverage of cybercrime, we explore an ever-increasing threat combining extortion and business disruption: the deployment of ransomware against the firm.   Risk Classifications: Know-your-customer failures and violations: Mike Finlay explores a risk category often confused with losses and exposures relating to money laundering and tax avoidance; namely, the failure to undertake adequate know-your-customer precautions.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.

Issue #55

Editor's Letter - Where to start?: The events of the past few weeks have been demonstrative of the hugely diverse challenges risk managers face every day.   News: Analysis of the major risk-related news stories of the past few weeks, including the latest from the Financial Policy Committee, industry reactions on Brexit and a regulatory fine for Santander.   Ariane Chapelle on Brexit and the Randomness of Life: Economics and operational risk expert and lecturer, Ariane Chapelle, shares her initial observations on what Brexit means for risk management and explains why it’s now down to us to decide how the result will impact our future.   If You Ask Me : Good Operational Risk Management Begins with Good Training: Getting people to understand and engage with operational risk as a discipline can be challenging. Here, industry expert Elena Pykhova shares her tips on how to deliver a memorable and effective training programme for operational risk.   Collateral Damage: The financial sector is notoriously high pressure, but is enough attention paid to the victims of this extremely stressful, profit driven world? Carrie Cook takes a look at why risk managers should prioritise mental health.   Regulatory Update: An update on what firms are saying about the Basel Committee on Banking Supervision’s proposals to scrap the advanced measurement approach.   How To... Identify the Firm’s most Relevant Risks: Operational risk expert and regular The Risk Universe columnist, Manoj Kulwal, shares his tried-and-tested method for identifying and prioritising a firm’s key risks.   Spotlight - The Six Degrees of Risk – Managing Business Exposure in a Digital Universe: Bronwyn Kunhardt, global MD of tech company and risk intelligence specialist Polecat, addresses supply chain risk.   Sharing Scenarios - Business Disruption from a Change in Government or Military Coup: Following the attempted coup in Turkey, we consider the potential implications.   Risk Classifications - Insider Trading: Mike Finlay explores a risk category often considered to arise more at the organisational level than the individual.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.

Issue #54

Editor's Letter - Let's get one thing clear: Will transparency ever really prevail in global business, or is it simply an inevitable operational risk, asks editor Carrie Cook.   News: Analysis of the major risk-related news stories of the past few weeks, including the latest on the Fifa scandal, an update on the JPMorgan hacking case and more market manipulation.   Spotlight - Behind the mask : lessons learned from the Panama Papers: Bribery and corruption expert, Alexandra Wrage, shares her views on what organisations can learn from the Panama Papers scandal and how we can move towards greater transparency.   Regulatory Update: An update on recent regulatory developments, including FINRA’s plans to tackle culture issues and new foreign exchange market rules.   Big data and financial risk : The case for operational risk management: What does the future look like for operational risk measurement and management as big data becomes an increasingly important industry tool? Alfredo B. Roisenzvit reports.   Managing risk in an international financial institution: In a departure from our usual opinion column format, we asked a panel of IFI risk managers to share their opinions on the differences in practices and risks between IFIs and commercial banks.   Aon Risk Solutions hosts 'megatrends' discussion panel: Carrie Cook reports from Aon Risk Solutions’ recent panel event which brought together industry leaders to discuss current and future trends on the risk management agenda.   Risk Classifications - Tax non-compliance or tax violations - clients and customers: In light of recent tax evasion scandals, RiskBusiness’ Mike Finlay takes a look at its potential impact on firms.   Islamic finance : strengthening corporate governance practices: MENA consultant Lina Tayara discusses the findings of the Orient Consulting Services Islamic Finance Survey.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.

Issue #53

Editor's Letter - A Different View: Sometimes the view from the outside can be much clearer than the one in the centre of the action. Editor Carrie Cook discusses the value of hearing a different perspective.   News: Analysis of the major risk-related news stories of the past few weeks, including the UK’s first major insider trading conviction, more scandal surrounding 1MDB and what the future looks like for IT in banking.   Spotlight - Managing Risk in Harsh Environments: Nick Kochan takes a look at the complex risks mining and resource companies face when working in politically and geographically hostile environments and speaks to Strategia, a firm run by former army general Sir Richard Shirreff.   Regulatory Update: An update on recent regulatory developments, including the FCA’s proposals to improve wholesale debt markets, a CFPB consultation on banning ‘gotcha’ clauses and plans for an audit trail from the SEC.   How To... Make Big Changes with Big Data: Kirsty Rutter from Eaton Risk Advisory shares her tips on how to make better use of big data to manage operational risk – and how to convince stakeholders that you know what you’re doing.   Event Review - Institute of Operational Risk roundtable: Carrie Cook shares highlights from an operational risk roundtable discussion hosted by the IOR and attended by leading operational risk practitioners from Royal Bank of Scotland, Bank of Ireland and Barclays   Interview and Book Review - Joris Luyendijk: We speak to Dutch author and acclaimed journalist, Joris Luyendijk, about his international best seller, Swimming with Sharks: My Journey into the World of Bankers – also reviewed in this issue by Nick Leeson.   Sharing Scenarios - Vendor Performance Failures: This month we elaborate on last month’s scenario and focus on vendors, suppliers or service providers who fail to perform in the manner contracted and expected of them.   Risk Classifications - Market or Trading Rules Violations – Front-running and Best Execution: RiskBusiness’ Mike Finlay explores an extremely topical risk category which relates to firms manipulating the financial markets for their own gain .   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.

Issue #52

Publisher's Letter - The downside to tax avoidance: Publisher-in-chief Mike Finlay ponders the recent Panama Papers tax scandal and asks what this could mean for the banks linked to the story.   News: Analysis of the major risk-related news stories of the past few weeks, including a reaction from the operational risk community on the recent Basel Committee consultation.   If You Ask Me - Risk assessments are too backwards facing: Compliance expert and author, Kristy Grant-Hart, gives her view on how to create the perfect risk assessment, from the viewpoint of the compliance department.   Spotlight - Fintech – innovation and compliance: Andrew Frost explores the regulatory challenges faced by UK fintechs and discusses why compliance and regulation should be considered from the outset.   Regulatory Update: An update on recent regulatory developments, including the FCA’s business plan for the year ahead and new guidance from the FDIC.   How To... Build an international compliance programme: Experts in compliance training, Rhodri Kettle and Jonathan Bowdler, provide a step-by-step guide for operational risk professionals hoping to develop an effective compliance programme.   Event review: New Generation Operational Risk 2016: Carrie Cook reports on the Center for Financial Professional’s annual dedicated event for operational risk practitioners.   The Encryption Dustup: Our regular expert columnist Annie Searle takes a look at the implications of data protection laws in relation to the Apple encryption case.   Sharing Scenarios - Vendor Billing Fraud: The Risk Universe presents a scenario on a current operational risk topic and invites readers to take part. This month we focus on vendor billing fraud.   Data Classifications - The Bangladesh Bank hack: In a change to our regular feature on data classification issues and guidelines, RiskBusiness’ Mike Finlay takes a look at a recent operational risk event which affected several firms and cost one at least US$81m.   Dear CEO: Every month, an anonymous senior executive of a financial services firm writes a letter to the CEO about concerns they have always wanted to raise. This month, the chief risk officer muses on recent global events and the potential ramifications for the firm.

Issue #51

Editor's Letter - Is insurance worth buying?: Risk professionals and their senior management boards are increasingly looking at risk transfer and seeing whether or not they need insurance as part of the programme, says editor Liz Booth.   News: Analysis of the major risk-related news stories of the past few weeks, including the Basel Committee’s consultation on the new standardised approach to operational risk capital calculation.   If You Ask Me : Risk Transfer – Apply, but Take Care: Walter Dutschke from the Institute of Operational Risk takes a look at the ins and outs of risk transfer and discusses the main challenges faced by operational risk professionals when it comes to insurance.   Spotlight - Measuring Likelihood of Events and Impacts: Regular columnist Manoj Kulwal shines a spotlight on the best way to measure the likelihood of risk events and their various impacts, taking into consideration different possible contexts.   Regulatory Update: An update on recent regulatory developments, including a new compliance initiative from the FCA, swaps transactions rules from the SEC and the launch of the senior managers regime.   Modern Slavery and Exploitation – Is Your Business Risk Ready?: Ian Livsey from the Institute of Risk Management explains why financial services firms should be just as aware of the Modern Slavery Act 2015 as any other business.   How To... Define and Implement KRIs: Jeremy Zierler, head of risk for Vanguard’s Institutional Investor Group, provides a practical guide on how to define and implement a set of key risk indicators for the firm.   Sharing Scenarios - External Insurance Fraud: The Risk Universe presents a scenario on a current operational risk topic and invites readers to take part. This month we focus on fraudulent acts against insurance cover.   An end to the habits of a lifetime?: John Hurrel from Airmic discusses the emerging challenges for those responsible for buying insurance and the implications of the Insurance Act 2015, due to come into force later this year.   Risk Classifications - Non-compliance with Insurance Regulation: RiskBusiness’ Mike Finlay focusses on an insurance risk category which has become an increasing issue for many firms.   Dear CEO: Every month, an anonymous senior executive of a financial services firm writes a letter to the CEO about concerns they have always wanted to raise. This month, the chief risk officer suggests it’s time to stop overcomplicating risk management

Issue #50

Editor's Letter - Time to take responsibility?: Is it time for financial institutions to start taking responsibility for their actions?   News: Analysis of the major risk-related news stories of the past few weeks, including a new report from the UK’s Insurance Taskforce and the true cost of financial crime.   If You Ask Me : Risk and Control Assessment: A Piece of Cake?: Operational risk expert Seda Karaman explains why risk and control assessments should be like baking a birthday cake.   Regulatory Update: An update on recent regulatory developments, including a warning from UK regulators for spread-bet firms and a new CEO takes the helm at the FCA.   The Fourth Dimension of Financial Crime: As links between organisations and vendors become increasingly complex, the way in which we manage this area of risk must also evolve. Tom Turner reports.   Spotlight - Iran is Open, Now What?: What will the lifting of sanctions on Iran mean for economic risk and political relations? Lina Tayara looks at the risks and opportunities for firms looking to do business in Iran.   How To... Develop an Effective Insider Threat Programme: As insider threats become an increasing risk for businesses, expert Michael Theis uses his wealth of experience to provide a step-by-step guide on how firms can protect themselves.   Sharing Scenarios - Falsified or Fictitious Financial Information: This month, the scenario explores the impact of a client or customer providing falsified, fictitious, incomplete or misleading financial information to the firm.   Looking Ahead: Risk 2016 And Beyond: As the annual risk reports are released in their droves, Carrie Cook reviews what some of the leading publications say about the risk landscape for 2016.   Risk Classifications - Fraudulent Internal Credit Application for an Existing Customer: RiskBusiness’ Mike Finlay takes a look at a risk category which combines customer or client identify theft with credit fraud – a fraudulent credit facility application by an employee against an existing customer or client’s name.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.

Issue #49

Editor's Letter - Well intentioned resolutions: Just two weeks into 2016 and those New Year’s resolutions are already a distant memory, says editor Liz Booth.   News: Analysis of the major risk-related news stories of the past few weeks, including what a Brexit could mean for the City, an interesting start to the year for the FCA and JPMorgan tax case update.   Spotlight - What you need to know about big data: John Salmon and Luke Scanlon take us through what firms need to know about the legal and operational risks of handling big data in light of newly agreed EU legislation.   How To... Build a risk culture for the future: Risk expert Horst Simon looks at the steps firms should take to build a risk culture which can withstand emerging threats in a changing world.   Regulatory Update: An update on recent regulatory developments, including FINRA’s priorities for 2016, FTC big data guidelines, Basel’s risk modelling plans and more.   If You Ask Me - Annie Searle: Regular contributor Annie Searle gives her take on what the financial industry can do to help stamp out terrorism.   An old risk in a new risk’s clothing?: Ellen Davis of Thomson Reuters explains why cyber risk will never be off the agenda for operational risk professionals.   Sharing Scenarios - Online banking system outages: This month, the scenario explores impact of internet or online banking outages and the implications for the firm, including client and customer discontent.   Interview - Kristy Grant-Hart: The Risk Universe caught up with compliance expert and author Kristy Grant-Hart recently to discuss her new book, "How to Be a Wildly Effective Compliance Officer", and to hear why she thinks compliance is a sometimes misunderstood profession.   Risk Classifications - Application failures and errors: RiskBusiness’ Mike Finlay takes a look at a risk category which has received a great deal of media coverage in recent months and caused disruption at a number of global firms; application failures and errors   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to the CEO detailing some of the issues they have always wanted to raise.