Control: enhance three lines of defense
Global Banking Outlook 2017
Enhance three lines of defense
Banks have meaningfully improved their risk management processes since the financial crisis, but there is more work to do.
As regulators approach the end of prudential regulatory policy-setting and begin to increase scrutiny around consumer protection, banks must remain focused on implementing regulatory change.
Despite aspirations to shift strategic efforts to an agenda focused on optimization and growth, compliance will continue to be the primary priority of banks around the world. Now is not the time to be complacent about their progress.
The control agenda: an action plan
Actions for the next 12 months:
- Increase first-line accountability and change culture and incentives: realign control functions and embed a risk management and control mindset across the organization.
- Clarify responsibilities across lines of defense: there is no industry standard as to which controls should sit in the first or second line; clear delineation eliminates confusion.
- Adopt firm-wide processes and tools: effective implementation of risk appetite frameworks will play a crucial role in properly reinforcing the three-lines-of-defense approach.
- Improve balance sheet management: legal entity and jurisdiction will become important dimensions.
Actions for the next 36 months:
- Tighten ecosystem management: take steps to ensure that counterparties are held to the same standards as their own employees when outsourcing tasks.
- Enhance crisis management capabilities: have an effective toolkit, contingency action plan and clear communication protocols that can be deployed in a timely and effective manner.
- Invest in data and analytics and optimize risk management: invest in legacy data and technology architecture to pre-emptively detect potential breaches of controls and limits (e.g., trade surveillance).
- Search for the blueprint for strategic success: apply a stable, sustainable business model appropriate for the demanding and ever-changing regulatory environment.