Banking Reform and IT Risk
Unless you work in the financial services industry, the proposal Treasury Secretary Henry Paulson issued last week to reform U.S. financial institution regulations won't have much, if any impact on how your business runs. But it could benefit your IT strategy to pay attention as the debate over the proposal unfolds.
Paulson's proposal suggests several short-term and longer-term steps to better coordinate regulation of the U.S. financial system. The intent is twofold: to improve oversight—in order to be able to identify more quickly an impending fiscal crisis like the implosion of the subprime mortgage market—and to modernize the current regulatory structure to account for the risks and opportunities of global financial markets.
When Enron collapsed and the dotcom bubble burst, we got Sarbanes-Oxley, and IT departments ended up with a big headache as they scrambled to implement accounting controls. I think financial industry reform will be different. For one thing, hammering out the details may take years. "There may be some IT implications at some time, but it's going to be several technology generations from right now before we get the first requirement," says John Von Stein, executive vice president and CIO with The Options Clearing Corp.(Von Stein says his company has not taken a position on any of Paulson's proposals).
Furthermore, whatever those requirements end up being, from today's vantage point, it doesn't look like they would directly impact every public company, the way Sarbanes-Oxley did (take our poll and say whether or not you agree). Changes to how financial companies are regulated would affect the economy as a whole, but new requirements would likely fall primarily on the financial services industry. Changes on the table include merging the SEC and the Commodities Futures Trading Commission and giving the Fed more power to investigate banks—including direct federal oversight of the payment and settlement systems that financial institutions use to move money.
Yet, the fact that some federal officials—in a Republican administration, no less—consider government oversight of corporate business systems to be a critical piece of the reform agenda should make every CIO stop and think. Howard Rubin, president of the consultancy Rubin Systems and a research associate at MIT’s Center for Information Systems Research. Rubin consults with financial services companies, and he says the Paulson plan "could be a bellwether of more transparency into the activities of business."
Rubin thinks that if the government can define the parameters for one type of corporate information system, it won't be too long before regulators set quality standards for other types of systems—and then use those standards to rate corporate risk. I'm not sure I agree. Sarbanes-Oxley and the current financial reform proposals were each a response to market quakes. Policymakers have shown little appetite to regulate in any comprehensive way the IT-related risks that are confined to individual companies (for instance, data security).
But I do think that investors want better disclosure of business and IT risks. My colleague Thomas Wailgum recently looked at how Wall Street evaluates corporate technology and concluded that IT matters most when there's a problem with it. Meanwhile, we have private-sector risk management initiatives like the Payment Card Industry Data Security Standard, which the major credit card companies have imposed on merchants to secure transaction data and protect the card companies from fraud.
"The things that you do in IT—how they change the risk profile of your company from a business standpoint—that whole area isn't very well mapped" in most companies, says Rubin. "Risk
Print
Paulson's proposal suggests several short-term and longer-term steps to better coordinate regulation of the U.S. financial system. The intent is twofold: to improve oversight—in order to be able to identify more quickly an impending fiscal crisis like the implosion of the subprime mortgage market—and to modernize the current regulatory structure to account for the risks and opportunities of global financial markets.
When Enron collapsed and the dotcom bubble burst, we got Sarbanes-Oxley, and IT departments ended up with a big headache as they scrambled to implement accounting controls. I think financial industry reform will be different. For one thing, hammering out the details may take years. "There may be some IT implications at some time, but it's going to be several technology generations from right now before we get the first requirement," says John Von Stein, executive vice president and CIO with The Options Clearing Corp.(Von Stein says his company has not taken a position on any of Paulson's proposals).
Furthermore, whatever those requirements end up being, from today's vantage point, it doesn't look like they would directly impact every public company, the way Sarbanes-Oxley did (take our poll and say whether or not you agree). Changes to how financial companies are regulated would affect the economy as a whole, but new requirements would likely fall primarily on the financial services industry. Changes on the table include merging the SEC and the Commodities Futures Trading Commission and giving the Fed more power to investigate banks—including direct federal oversight of the payment and settlement systems that financial institutions use to move money.
Yet, the fact that some federal officials—in a Republican administration, no less—consider government oversight of corporate business systems to be a critical piece of the reform agenda should make every CIO stop and think. Howard Rubin, president of the consultancy Rubin Systems and a research associate at MIT’s Center for Information Systems Research. Rubin consults with financial services companies, and he says the Paulson plan "could be a bellwether of more transparency into the activities of business."
Rubin thinks that if the government can define the parameters for one type of corporate information system, it won't be too long before regulators set quality standards for other types of systems—and then use those standards to rate corporate risk. I'm not sure I agree. Sarbanes-Oxley and the current financial reform proposals were each a response to market quakes. Policymakers have shown little appetite to regulate in any comprehensive way the IT-related risks that are confined to individual companies (for instance, data security).
But I do think that investors want better disclosure of business and IT risks. My colleague Thomas Wailgum recently looked at how Wall Street evaluates corporate technology and concluded that IT matters most when there's a problem with it. Meanwhile, we have private-sector risk management initiatives like the Payment Card Industry Data Security Standard, which the major credit card companies have imposed on merchants to secure transaction data and protect the card companies from fraud.
"The things that you do in IT—how they change the risk profile of your company from a business standpoint—that whole area isn't very well mapped" in most companies, says Rubin. "Risk
Most Discussed Posts
Cloud computing has emerged as one of the most significant game changers to hit the technology landscape in the past 20 years. With this massive expansion of the cloud, the perception of the IT organization is shifting from a utility player to a change agent. This eBook breaks down five ways progressive organizations are using cloud-based IT Management solutions to help drive innovation and become more strategic, including: adding visibility and analytics, speeding up time-to-value, lowering costs, improving prioritization, and providing a blueprint for future cloud deployments.
Read the white paper to see how IBM helped Citigroup deliver new services and enhancements to their 200 million customers faster.
There are 3 ways to modernize legacy applications: rewrite completely, acquire packaged solutions or migrate existing code. This paper explains why it's best to migrate and how IBM® Rational® software can help.
Accommodating specific lines of business can result in a hybrid ecosystem of applications and servers. The resulting complexity of this architecture makes for an environment that is costly to maintain and difficult to change when addressing new challenges.
This whitepaper will help you to define a mobile device passcode policy. Security managers must attempt to reconcile two opposing goals. They must: 1) create a passcode policy that is strong enough to protect the device if it is lost or stolen, while: 2) not annoying users with needless length or complexity.
This whitepaper, authored by The Radicati Group, looks at the key reasons organizations should consider moving to a cloud-based archiving solution. Email archiving solutions enable organizations to store, monitor, and collect electronic data exchanged by their users to comply with internal policies and regulations.
ATERNITY will showcase a 30-minute demo on how Fortune 500 companies are leveraging its award-winning FPI Platform to deliver a user-centric approach to Proactive IT Management.
For businesses to move forward and tap into the ever-expanding universe of Internet users and network-enabled devices, it's critical to learn how to make the transition to IPv6. Learn the critical steps your organization must take to make a seamless transition-and keep your business world connected.
Learn how IT teams can protect against spear phishing tactics. Harry Sverdlove, chief technology officer of Bit9 offers a frank discussion about spear phishing - the most common technique used in today's advanced attacks.
Learn how to build a solid business case for your migration to Red Hat Enterprise Linux so you can run leaner, innovate faster, be more flexible and own the New Now.
Social media isn't about you; it's about everything around you. As you consider how your customers want to communicate with you, social media is something that can't be ignored. But what should your strategy be? Is social media "just another channel?" What kind of a plan makes sense for your contact center and for your customers? Join our experts as they share their insight and research results.
Hardware tokens were a popular method of strong authentication in past years but the cumbersome provisioning and distribution tasks, high support requirements and replacement costs have limited their growth. The additional log-in steps that hardware tokens require and the resulting user frustrations have limited adoption and make them impractical for larger scale partner and customer applications.
Sponsored Links
