Mastering Technology Risks

Around the world, banks are innovating at a breakneck speed to follow the pace set by firms like Apple, Netflix, and Amazon. But as banks rapidly adopt new digital tools and solutions to meet customer expectations, they are exposed to a battery of technology risks that can bring down their operations. These not only include cybersecurity risks, but also software or hardware outages, and system failures due to power cuts, weather events or even terrorist attacks.??

Banks have a long history of mastering risks, from credit and market threats to liquidity and operational hazards. But technology risk is a different beast. It is more complex, harder to pinpoint, and continues to evolve as banks digitally transform. It can cascade unexpectedly into other forms of risk, such as market or liquidity risk resulting from a trading or settlement system outage. As it grows, it threatens every part of a bank’s value chain—a technology risk event can not only inflict serious harm on the bank, but also its customers, partners, and the wider economy.?

These new risks are on the radar of bank executives. During the second quarter of 2023, ThoughtLab surveyed 750 banking executives for ServiceNow .? We found that two-thirds of bank CEOs surveyed say that technology risk has grown significantly over the last few years, and over 7 out of 10 say that it is now the biggest risk their banks face. More than half of all executives surveyed (52%) said that managing the risks of digital innovation is crucial for future growth and financial success.???

However, not all bank executives believe their firms are ready to manage the technology risks they face over the next two years. This is true for just under half of all banks surveyed—particularly for smaller institutions. For instance, 61% of banks with assets under $25 billion are not highly prepared for tech risk, compared with just 19% of banks with over $100 billion in assets.?

As part of the study analysis, ServiceNow and ThoughtLab created a maturity framework to examine the progress that banks are making in adopting best practices in technology risk management. We divided respondents into three groups: beginners taking their first steps in managing technology risk, intermediates in mid-implementation, and those most advanced in risk management, which we designated as leaders.???

We found that technology risk leaders adhere to five key best practices:?

1. Leaders make data a single source of truth—and insight. They enable visibility and decision-making by structuring and combining enterprise-wide data for use by cross-functional teams. They also use advanced analytics to monitor and assess technology risks as they arise.??

1. Leaders build risk processes that are highly automated and managed through integrated risk platforms. These platforms provide banks with a full view of cyber, technology, enterprise, and operational risks as well as a common set of tools to manage them.?

1. Leaders invest in next-gen technologies to manage tech risk activities end-to-end. These include modernized IT systems on the cloud, cybersecurity technologies and AI. They make these tools accessible to IT, security, and risk management heads, and digitize and automate workflows to reduce human mistakes and boost productivity.??

1. Leaders bring teams together to manage technology risks. Leaders understand that having the right organization and culture is crucial for managing tech risk and ensuring resilience. To do this, not only must they carry the message to every part of the bank—and every employee—but also make sure that a wide range of people across the enterprise are involved, trained, and working together, with defined roles.?

1. Leaders rethink governance for today’s risks. To cope with current and upcoming regulations, leaders take concrete steps to improve their ability to identify, measure, test, and report evolving technology risks and incorporate them into their risk appetite frameworks. They understand that the board and senior management must be actively involved—and need the expertise and data to make the right decisions.?

For banks in today’s world, mastering technology risks will require a long-term effort made more difficult by the speed and evolution of digital innovation. To succeed, banks will need to implement a more enlightened approach to risk and operational resilience, including building a clear roadmap at the start of their journeys.?

?