Risk Management 101
All bankers have this responsibility
What is managing risk?
Legislation enacted to drive strong controls over financial reporting for publicly traded companies
What is Sarbanes-Oxley (SOX)?
Control gaps that are within our risk appetite (moderate or low)
What are control weaknesses?
Documents that outline expected behaviors to guide and direct people.
What are policies?
Moderate for Information Technology and Information Security Risk
What is our risk appetite for information risk?
The two subcategories of information risk managed by Webster Technology
What are Information Technology and Information Security?
KPMG
Who is Webster's external auditor?
Control gaps that exceed our moderate risk appetite (high or critical)
What are issues?
Documents outlining established, finite and quantifiable requirements to meet control objectives
What are standards?
Preventative, Detective, Directive, and Corrective
What are the types of controls?
A process review documenting process flows, identifying risks and controls, and assessing control effectiveness.
What is a Risk and Control Self-Assessment (RCSA)?
To identify SOX controls in place for a key process or system that supports the bank's financial statements
What is the purpose of a SOX walkthrough?
Tracked in the IT Risk Repository and out-of-appetite issue remediation is monitored in LogicManager.
Where are issues and control weaknesses tracked?
Established uniform technical criteria, processes and methods, such as required configurations (hardening standards).
What are technical standards?
Minimal, low, moderate, high and critical
What are the levels of risk in our enterprise risk taxonomy?
By implementing appropriate controls
What is quarterly?
High/critical issues require remediation plans within 30 days. Moderate/low findings are prioritized by process owners against other process improvements
How should process owners address issues and control weaknesses?
Detailed documentation of steps to meet the requirements of the standards, intended for day-to-day use.
What are procedures?
Risk acceptance, Remediation, Transfer/Sharing, Avoidance
What are the types of risk treatment?
Through boundaries and thresholds expressed in the Risk Appetite Statement
How does management determine whether risks it assumes are warranted?
An application that stores information that feeds Webster's financial statements
What is an in-scope SOX application?
Self-Identified, by Control Functions (2nd or 3rd lines of defense), or by third parties (external auditors or regulators).
How might issues or control weaknesses be identified?
A document that identifies the top risks in key technology processes, control objectives, and quantitative measures of effectiveness at mitigating those risks.
What is the risk appetite statement (RAS)?
Through relevant measures of risk management effectiveness (key risk indicators and key control indicators)
How do we assess risk management effectiveness?