EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.
How EY can help
-
Unlock the advantages of the digital era to harness innovation, drive operational efficiencies and grow your business.
Read more
Transformation – enhancing the control environment and reducing costs
The COO, partnering with the CRO, therefore faces a delicate balancing act – peel back layers of duplicate controls to improve the customer and colleague experience, reduce costs and help simplify the bank, while still keeping the bank safe and resilient.
Any COO, and other control owners, looking to tackle the control estate, must look through several interconnected lenses - customer, operations, operational efficiency and risk and resiliency to name just a few. Nowhere is this challenge more critical than in transformation.
As banks continue to undertake significant, ongoing transformation, there is a material opportunity to enhance and innovate across the end-to-end control estate. This can be done in parallel to understanding and appropriately mitigating delivered risk. This involves validating the need for existing controls, enhancing those that remain and ensuring any new controls are optimal through maximising automation.
We see this opportunity not fully leveraged by many banks, and indeed broader financial institutions. Often control owners and related stakeholders are not appropriately engaged early enough in the change delivery lifecycle for transformation initiatives. Failure to consider control at the outset means banks lose the opportunity to include the optimal control model in the design process. Instead, the consequence is that further down the track only a narrower, and therefore more challenging to justify, business case for control optimization is available. We see controls typically only being considered as the design phase closes, at times bringing incomplete control coverage.
Two-thirds (67%) of senior executives have experienced at least one underperforming transformation in the past five years. Recent EY research identified a lack of commitment to customer centricity as a key factor. Control optimization can make a significant impact here, e.g., by analyzing the point at which customers typically drop out of a product application process, banks can potentially streamline controls while seizing broader opportunities to optimize the customer experience.
What banks can do
We frequently see the business case for elimination of duplicate controls not given enough attention, especially considering the potential size of benefits. There is greater opportunity to deploy technology, such as data mining and natural language processing (NLP), to accelerate the creation of a robust business case through more quickly identifying duplicate and potentially duplicate controls. Machine learning can also be leveraged to learn from root cause analysis data and augment the construction of evolved risk and control taxonomies.
Working in partnership with global banking clients; we have seen the impact. This includes rationalization of 20% of one bank’s entire control population and an effectiveness review of over 2,000 controls by a handful of individuals in a matter of weeks. While there is no silver bullet that works for every bank, there are some key principles that should help guide banks’ thinking ahead:
- Assessing all controls in a bank is almost impossible given the sheer volume. They cover every single process journey, and customer interaction, typically running to the tens of thousands in large global banks. Taking a coherent view across the first and second line of defence is very difficult. The key is for banks to break it down into manageable chunks and prioritise efforts through designing and leveraging clearly defined prioritization logic. This considers factors such as materiality of the end-to-end value stream, business risk, the number of control instances and the extent to which controls are clustered around specific processes.
- Banks should challenge themselves as to whether the way in which they control in today’s operating model is future proofed. Given the rapid rollout of AI and other transformative technologies, ignoring future trends could see controls rapidly outdated. This will be true in a diverse range of priorities, including managing cyber risk, the number one concern of banks’ CROs, and achieving success in a bank’s sustainability strategy.
- The rise of hybrid working and digitisation since the pandemic means banks now have access to much more data; across their clients, counterparties and employees. That means they have an enhanced ability to take a data led approach when defining and automating their evolved control suite.
Chris Richardson, Financial Services Risk Management, Ernst & Young LLP has co-authored this article.