A version of this article was previously published in May 2018 by Bank Director.

How can financial institutions proactively combat the risks facing the industry today? The 2018 Risk Survey—presented by Bank Director and Moss Adams—compiled the insights of directors, chief executive officers, and senior executives of US banks with more than $250 million in assets.

According to the survey, the worries keeping top executives awake at night align with the key priorities that banks commonly hear from banking regulators: cybersecurity, compliance and strategic risk.

Cybersecurity

Cybersecurity was the biggest concern by far, reported by 84% of respondents.

The survey addressed the confidence that executive and directors have in their institutions’ cybersecurity programs, with an emphasis on staffing and overall effectiveness. Access to the proper talent—in the form of a chief information security officer (CISO) or a strategic partner with the necessary skill set—and associated costs are key to a successful program, and 71% of respondents revealed their bank employs a full-time CISO.

While technical skills are valuable in today’s business environment, financial institutions must overcome their dependence on skilled technicians who don’t necessarily have the ability to strategically look at the changing technological landscape. The CISO should strategically build an appropriate plan by taking a full view of the bank’s technology and strategy. Without this perspective, a bank could provide hackers with an opening to breach the institution, regardless of size or location.

Institutions building the foundation of a robust cybersecurity program should also focus on three key areas:

• Assessment tools. Is the institution leveraging the proper technologies to help maximize the detection and containment of potential issues?
• Risk assessments. Has management identified current risk to the organization and implemented proper mitigation strategies?
• Data classification. Has management identified all critical data and its form and addressed the protection of this data in the risk-assessment process?

Compliance

Compliance was the second biggest area of concern, identified by 49% of respondents. It’s an area that continues to evolve as new regulators have been appointed to head the agencies that regulate the industry, and technological tools—dubbed regtech—have entered the marketplace.

More than half of survey respondents indicated that the introduction of regtech has increased their banks’ compliance budgets, demonstrating that the cost of solutions and staff to evaluate, deploy, and support these efforts in an effective manner is a growing challenge.

Because the volume of available data and the ability to analyze that data continues to grow, respondents may have felt this technology should have effectively decreased the cost of operating a robust compliance program.

Executives looking to decrease costs may want to consider the staffing required to operate a compliance program and whether deploying technology would allow for fewer personnel. When technology is properly used and standards are developed to help guarantee efficient use of it, the dilemma of acquiring technology versus adding staff can often be more easily solved.

Strategic Risk

Strategic risk was the third largest area for concern, identified by 38% of respondents. Many directors and executives are wrestling with what the future holds for their institutions. The debate often boils down to one question: Should they continue to build branches or invest more in technology—either on their own or by partnering with fintech companies? 

Fintech companies are a growing player in lending and payments segments, areas that were historically handled exclusively by traditional institutions. That, coupled with clients who no longer value personal relationships and instead prioritize being able to immediately access services via their devices, increases the pressure to deliver services via technology channels. 

Financial institutions have entered what many would call a perfect storm. Every institution will need to make hard decisions about how to address these issues in a way that facilitates growth.  

We’re Here to Help

For more information about how industry risks could affect you or your bank, contact a Moss Adams professional.