Industry Trends and Customer Case Studies in Managing Governance, Risk, and Compliance

Transcription

1 WHITE PAPER Industry Trends and Customer Case Studies in Managing Governance, Risk, and Compliance Sponsored by: Workiva Marc DeCastro September 2015 IN THIS WHITE PAPER This IDC Financial Insights white paper explores some of the key industry trends surrounding governance, risk, and compliance (GRC), with particular focus on the financial services industry. One of the outcomes of the global financial crisis in 2008 was the awareness that when it came to the process of managing risk, financial performance, and compliance, numerous organizations were relying too much on manual processes and they continue to do so to this day. While sometimes the oversights of managing GRC by using traditional documents and spreadsheets may seem minor, the reality is that this process is by nature tremendously inefficient and can lead to costly fines and damage to an institution's reputation. The white paper presents case studies of two institutions that adopted a more automated and centralized process to handle their GRC needs. The benefits were great for these institutions as the process not only addressed adherence to regulatory requirements but also allowed the institutions to focus more on the meaning behind the numbers and spend less time on calculating what the numbers were and figuring out where they came from. Within the organization, the processes and policies along with the IT solutions must be able to properly measure, analyze, and communicate enterprisewide risk activities and reporting. At the core of this is having tools and analytic solutions that are agile enough to help mitigate risk and leverage real-time data and reports throughout the organization. Overview of Financial Services Industry Trends As we continue to see adoption of 3rd Platform technologies, the financial services industry finds itself in a period that will be defined by an explosion of innovation and value creation on top of the 3rd Platform's foundation and a new wave of core technologies "innovation accelerators" that radically extend its capabilities and applications. Within the financial services industry, these innovation accelerators are oftentimes aided by an increase in regulatory requirements and adherence to new compliance and reporting requirements. The ability to leverage these solutions will provide an improvement not only in ramping up new systems but also in driving efficiencies out of existing and future business processes. Specific drivers are impacting all investments in IT within financial services organizations, and some solutions, such as Workiva Wdesk, address multiple drivers. September 2015, IDC Financial Insights #FI258979

2 The specific drivers identified are as follows: Legacy modernization Leveraging the 3rd Platform Industry profitability and growth Focus on the customer experience Mobile financial services Risk, security, regulatory, and compliance IT as a business Internet of Things (IoT) Future of work Organizations that are making IT investments should use these drivers in determining which projects are approved and how to properly measure cost versus benefit. Short-Term Technology Drivers and Decision Imperatives Moving from GRC to Enterprise Risk Management In many organizations, the journey from being more reactive toward GRC to becoming more strategic is lengthy and potentially expensive. The higher and more complex the business outcomes that are targeted, the longer the cycles of use and expanded investment horizons. The maturity curve takes organizations from reacting, to filling gaps, to some level of enterprise risk. The long-term objective should be to deliver a strategic enterprise risk management platform that is integrated, is operationally aware, and provides real-time management reports. Today, there appears to be too much emphasis on the collection of data points and content systems and not enough emphasis on integration and automation. There is a common misbelief that systems must be rigid and complex to be effective, when oftentimes a simplified approach is all that is required. Overly complex platforms may end up hindering an organization from properly delivering insight to larger groups of stakeholders. Cloud Adoption IDC Financial Insights forecasts that within five years, half of new applications launched by financial institutions will be cloud-first applications. We have begun to get some clarity on what can be done on the cloud as well as the convergence of regulations on the cloud globally, and this will make financial institutions less hesitant in cloud deployments. Some large global banks will even begin to move more mission-critical applications to the cloud, which will allow more standards to be set and best practices to be developed by the industry. Financial institutions should begin to develop formalized plans to address cloud-based solutions, including vendor management, service-level agreements, and business requirements. Innovation to Better Manage Risk Risk analytics, data aggregation, and regulation will dominate the compliance risk officer's (CRO's) agenda for the near term as organizations chase innovative products and services that allow them to better manage risk. Regulatory change and operational efficiency place equal pressure on risk investments as risk functions stay squarely in the middle of operational initiatives at the enterprise level. The challenge is that these initiatives must support accelerated business demands, with initiatives directly connected to relationship profitability, new product development, cybersecurity, and system modernization IDC Financial Insights #FI

3 Challenges Ahead Despite progress and some clarity regarding current governance and reporting needs, challenges remain. Governance/Risk/Compliance and Reporting Hurdles As financial institutions reinvent themselves by evolving business models to find new sources of revenue and improve financial performance, regulators will be keeping a watchful eye to ensure that organizations maintain appropriate reserves, aren't taking large operational risks, and are making sure that consumers and business customers are protected. During this evolution, new guidelines will almost certainly be developed. Successful compliance and reporting in this kind of environment is more a matter of agility than brute force. To properly focus on the business, institutions need to automate as much of the collection, analysis, and reporting of data as they can. Institutions must shift from a responsive approach to compliance and reporting to a much more anticipatory approach. Continued evolution of the financial services industry is absolutely necessary for institutions to survive, but the associated change in how compliance and reporting is done is a critical requirement. Organizational Implementation Many institutions have started placing more focus on the CRO to not only help with regulatory compliance but also assist in line-of-business risk management and even product development. This is a significant shift in strategy for many organizations and represents the positive leveraging of operational and credit risk data to introduce and/or improve products and services. Unfortunately, unless data collection, analysis, and reporting are automated, the CRO will continue to drive manual and overly complex efforts to gather the information needed and then produce the reports necessary to prove compliance with regulations. This complexity is often the result of multiple line-of-business organizations within the institution that separately maintain compliance data in those silos, leading to a significant challenge for the CRO. A robust compliance and reporting platform needs to look beyond IT and the CRO function and extend out to all lines of business as well as the organization's executives in order to provide needed content and information. Getting to Future State Future of Governance/Risk/Reporting In an environment of new regulatory uncertainty, 30% of top compliance functions will introduce new technologies, business processes, and metrics to minimize conduct failures. Globally, the supervisory approach to conduct risk has become more outcome based rather than proactive. This has required financial institutions to experiment with new technology to minimize the impact of conduct risk as it is increasingly seen as a major contributor to poor financial results. The inability to comply with domestic and international standards, reporting, and policies has already resulted in major fines. Financial services organizations need to prepare for financial authorities stepping up to protect all groups of customers and establish a dedicated enterprise risk format looking to next-generation governance, risk, and compliance platforms to provide newfound support IDC Financial Insights #FI

4 Changing Internal Participation in GRC The ability to create an internal culture that provides incentive for business decisions that protect both customers and businesses will be looked upon favorably by regulators while simultaneously providing efficiencies and potential new revenue streams for successfully implemented solutions. This will require corporatewide acceptance that compliance needs to live with all employees and contractors, not just with the CRO. Having a system in place that is easy to use and geared toward handling basic processes and protecting data integrity will provide the first step toward having an enterprise approach to risk management. Cloud Adoption and Approval Financial services companies, as a whole, have been slow to adopt the public cloud for a number of reasons. Security is the most often cited cause for the hesitation around the public cloud. Recent conversations with IT executives in financial services, however, point to a different, but related, fear regulatory oversight itself. In the minds of these executives, especially those in top-tier organizations, large infrastructure providers have the wherewithal to secure cloud environments some executives even secretly admit that large IT providers can probably provide more robust cloud security than in-house IT teams but what troubles them is the regulatory impact of outsourcing their sensitive financial performance and risk data to third parties. Should a public cloud based data breach take place, for example, where does the liability lie? Nonetheless, most IT executives are comfortable building private cloud infrastructures for sensitive, mission-critical data and applications an important first step to the adoption of external cloud services. Workiva Wdesk Platform Wdesk is a cloud-based productivity suite that is reinventing the foundation of GRC systems. Wdesk allows firms to create and collaborate on numerous corporate functions including compliance, risk, and audit. It combines text documents, presentations, spreadsheets, and charts in one environment. The ability to link data together ensures that everything is up to date and that there is one record of the truth. Many organizations find that they have numerous pieces of data spread among multiple departments, oftentimes across different regions. Having siloed data not only is expensive but also can jeopardize the accuracy of reports and subject regulated institutions to potential fines by regulators. Wdesk allows organizations to properly address the issue of disparate data sources to build a single record of the truth. Organizations that currently have multiple contributors across various departments or business units and need to be able to assign varying levels of permissions and controls would be a prime candidate for using the Wdesk platform. Wdesk is an enterprise collaboration and productivity suite that allows multiple people to concurrently edit a single document without having to "check the document out." Being able to link text and numbers across various documents and set up and reuse frameworks would likely improve operational efficiencies at most organizations. A key benefit of Wdesk is the ability to eliminate version control because the platform tracks ownership of all changes, even as multiple people are accessing the same document at the same time. Being able to truly collaborate in this manner is helpful in keeping employees on the same page as well as identifying areas of concern within the organization. Since the Workiva Wdesk platform is on the cloud, there are some additional benefits. First, as with most cloud offerings, there is a lower total cost of ownership. Because Wdesk is flexible and lightweight, implementation can usually be done in days compared with weeks or months for most in-house solutions. Wdesk allows for a lower reliance on IT, and with a user interface that is familiar to most, training is simplified, and employees can be up and running quickly. Patches and new releases 2015 IDC Financial Insights #FI

5 are done seamlessly, allowing the business lines to spend more time with the software and less time interfacing with internal IT on upgrades. Finally, offering the solution on the cloud provides flexibility and improved availability. Organizations that choose to give remote access to their employees could allow updates and reviews from locations outside the office from a hotel room or an employee's home or remote office. The ability to remotely submit a filing prior to a deadline could mean the difference between being compliant and facing potential fines or upsetting senior management. Workiva Wdesk Customer Case Studies We conducted in-depth interviews with two of the leading financial services companies to understand how they were able to utilize Wdesk to better position themselves for internal and external auditors and meet reporting needs. These customers also discovered some additional benefits as they achieved a more thorough understanding of the product and solution set offered by Workiva. Case Study 1: U.S. Fintech Firm Type of Financial Services Firm Online credit marketplace Buyer of Workiva Solution Chief audit executive Old Reporting Environment Prior to Workiva Wdesk Lending Club was developing its enterprise risk management program and was in pilot with another solution when it discovered Wdesk. At that time, Lending Club was tracking most of its reporting and governance in database and spreadsheet programs, a process that is repeated at many financial institutions today. Solutions that the company evaluated often required a significant number of dedicated internal IT resources as well as external consultants. As a technology start-up, Lending Club naturally leaned toward better technology as a way to address its reporting and compliance requirements. This is where Lending Club felt that Wdesk was different, since it can support simple processes already in place, not requiring massive configuration changes, predefined processes, or ongoing configuration, which can often change within the organization. Challenges and Goals Lending Club wanted a streamlined GRC system to support and enhance a mature enterprise risk management function and, as a publicly traded company, had a strong focus on SEC reporting. Workiva Wdesk Solution Lending Club began using Wdesk in early 2015 for both SEC filing and risk management. Specifically: Investor reporting Board reporting Managerial reporting Enterprise risk management SOX reporting SEC reporting 2015 IDC Financial Insights #FI

6 Benefits from Wdesk Implementation Seamless conversion. Workiva provided Lending Club executives with a demo that was set up using actual data provided by Lending Club. The demo, in essence, became the production platform in use today, and the longest part of the implementation process was the procurement process. One source of truth for all Lending Club's risks and controls. The Wdesk platform provides a single platform on which Lending Club was able to create a single risk catalog, ensuring everyone in the organization is speaking the same language through a centralized and documented process. Consolidated reporting. The nature of Lending Club's business means that the company deals with large global institutions that often request specific reports. Providing these reports ad hoc was inefficient. Being able to track questions centrally allows Lending Club to report back to its investors and to provide its employees with information in real time or in near real time. More time to spend on improving and growing the business. Lending Club has been able to spend more resources to grow its business while adding a level of maturity to its risk management processes. Having a one-stop, streamlined solution in place gives confidence to the financial institutions with which Lending Club does business. Case Study 2: U.S. Financial Services Firm Type of Financial Services Firm This established U.S. financial services firm provides credit and deposit services and is ranked as one of the top 25 largest by assets in the United States. The name of this firm could not be disclosed and is referenced in this case study as "Top 25 Bank." Buyer of Workiva Solution Vice president of external reporting and accounting Old Reporting Environment Prior to Workiva Wdesk The process at Top 25 Bank was similar to the process many organizations use to handle their reporting and filing requirements. Primarily, a series of documents and spreadsheets were edited and sent around for edits and comments using Microsoft products and corporate s. Top 25 Bank had challenges embedding spreadsheet graphics into its documents and had numerous tedious and manual processes that were not adding value but were necessary to properly format and validate the data. For management reviews, it generated hardcopy documents and hand-delivered them to the reviewers. As Top 25 Bank started drafting larger documents that were pulling in documents and data from various departments within the organization, it recognized that it needed a better way to centralize, govern, and file, which is why it ended up going to Workiva. Challenges and Goals Top 25 Bank was using a financial printer to handle XBRL (extensible Business Reporting Language), something it was interested in changing. As the regulatory environment was becoming more intense, Top 25 Bank wanted to make sure that it brought XBRL in-house to have a better understanding of and visibility into what the XBRL tags meant. The challenge was that few people within the organization understood XBRL, and Top 25 Bank wanted to ensure that more employees understood the process. With a few successful document conversions onto Wdesk, Top 25 Bank began to expand and put additional documents on the platform. At first, there was concern about how to properly train and provide access to a growing population of users. This concern turned out to be a nonissue for Top 25 Bank 2015 IDC Financial Insights #FI

7 as today over 200 individuals with varying degrees of input are using the platform. This would have been almost impossible prior to Wdesk. Top 25 Bank wanted an environment where it could have more transparency and control while increasing the number of individuals who have access to the environment. Another challenge Top 25 Bank faced was to make sure it had consistency in the data being presented to regulators. Prior to Wdesk, there was a feeling of uncertainty regarding the consistency of the information provided. While Top 25 Bank felt that any inconsistencies were minor, it did not like the lack of control and possibility of fines being levied. Other challenges being faced were instances where the bank needed to manually produce and file reports. Automated filing features that are built into Wdesk have allowed the bank to bypass these manual processes, which is a significant time saver. This was also one of the first cloud-based solutions being implemented by Top 25 Bank, and thus, the initial security reviews were complex and lengthy. In particular, there was initial resistance from IT. This process, which took almost a year, paved the path for Top 25 Bank to implement more cloud-based solutions and has also streamlined the risk review process for all its vendors as it now has a better sense of what questions to ask vendors. Top 25 Bank attributes its success with Workiva Wdesk as being the catalyst to implementing additional cloud-based solutions within the organization. Workiva Wdesk Solution Top 25 Bank originally went live with Wdesk in 2011 when Wdesk was called WebFilings. The bank started using Wdesk for its SEC reporting, but over time, it has expanded the documents on Wdesk. Today, it is using the platform for the following: SOX reporting SEC reporting Comprehensive capital analysis and review Resolution plans for financial industry Benefits from Wdesk Implementation Greater efficiencies realized. The solution has enabled Top 25 Bank to use its internal staff in smarter ways, primarily because staff members are not necessarily focused on administrative-type tasks such as pulling together regulatory reports from multiple documents. Top 25 Bank is able to do more with less, an important attribute in today's financial services budgetary environment. Better revenue and margins realized. The corporate risk group for Top 25 Bank is now more focused on leveraging the data collection and providing analysis on the information presented in a dashboard-type presentation layer. It is able to look at the data to find real results for revenue opportunities and trends over time. Exceeding reporting deadlines. Prior to Wdesk, Top 25 Bank seemed to be up against the wall in ensuring that it had appropriately tagged and reviewed XBRL prior to filing. Internal sign-offs have become more efficient because of the process of approving content that pinpoints exactly what needs to be reviewed. Status reports were time consuming to prepare and often caused internal finger-pointing prior to Wdesk. Now that everyone is using the same versions in real time for reporting and gathering data, there is no room for blaming the process or not having access to good data. User-friendly solution interface. Once Top 25 Bank had seen a demo, it knew that the staff's transition would be fairly easy. The difficult task identified by Top 25 Bank was not using and understanding how Wdesk would work but learning XBRL. The training Workiva provided was excellent and also helped during the transition IDC Financial Insights #FI

8 ESSENTIAL GUIDANCE Risk officers: Prepare for financial authorities stepping up to protect all groups of customers by establishing a dedicated conduct risk framework. Look to next-generation governance, risk, and compliance platforms to provide newfound support. Ensure that overreliance on IT in automating business decisions does not introduce new vulnerabilities and risks, particularly around model governance. Establish compliance strategies, and test increasingly complex product characteristics for compliance with modern ethical requirements. Create model conduct culture, and create incentives for business decisions that protect both customers and businesses. IT: Include all stakeholders (lines of business, executives, and boards) in the development of risk and compliance infrastructures, from the development of data requirements to the production of dashboards and reports. Involvement from these leaders is as important as integration to existing systems. Understand the technologies necessary to implement any given solution. Understand changes to the operational risks associated with a new IT implementation. Is the appropriate governance in place to manage an in-house or external solution? Place particular focus on the user interfaces to any new compliance and reporting system. The best technology will not overcome the reluctance of staff to use it because of overly complex or time-consuming data capture. Likewise, the system will not be leveraged beyond its narrow purpose unless getting timely and accurate information to support new product development, for example is easy. Product/line of business: Ensure that the line of business is involved in the creation of any risk, compliance, and reporting implementation up front. Feedback from the line of business is as much about what it can get from the system as it is about what kind of data it can provide. Business-led analytics will be key to discovering new opportunities in the risk and compliance data. Whether it leads to a change in existing processes or products or to a new product supported by the data, analytics will be the key to opening new avenues of revenue IDC Financial Insights #FI

9 About IDC International Data Corporation (IDC) is the premier global provider of market intelligence, advisory services, and events for the information technology, telecommunications and consumer technology markets. IDC helps IT professionals, business executives, and the investment community make factbased decisions on technology purchases and business strategy. More than 1,100 IDC analysts provide global, regional, and local expertise on technology and industry opportunities and trends in over 110 countries worldwide. For 50 years, IDC has provided strategic insights to help our clients achieve their key business objectives. IDC is a subsidiary of IDG, the world's leading technology media, research, and events company. Global Headquarters 5 Speen Street Framingham, MA USA idc-insights-community.com Copyright Notice Copyright 2015 IDC Financial Insights. Reproduction without written permission is completely forbidden. External Publication of IDC Financial Insights Information and Data: Any IDC Financial Insights information that is to be used in advertising, press releases, or promotional materials requires prior written approval from the appropriate IDC Financial Insights Vice President. A draft of the proposed document should accompany any such request. IDC Financial Insights reserves the right to deny approval of external usage for any reason.