SINGAPORE – The rise of remote working amid the Covid-19 pandemic has in turn heightened technology-related risks, making it crucial for financial institutions to review their security controls said the Monetary Authority of Singapore (MAS).

Among the recommendations by the MAS Cyber Security Advisory Panel (CSAP) were for financial institutions to review their risk profiles and adequacy of risk mitigating measures, to maintain oversight of third-party vendors and to strengthen governance of the use of open-source software.

These were presented at a meeting with MAS management meeting on Nov 5.

“Singapore’s financial sector has done well so far in its cyber and operational resilience amid the new operating environment created by the pandemic,” said MAS managing director Ravi Menon.

“But as the situation prolongs, that resilience will come under greater stress as cyber attackers look for new vulnerabilities. Financial institutions must remain alert and nimble and strengthen their defences against emerging cyber threats,” he added.

Financial institutions that have adopted remote access technologies have to assess if their cyber risk profiles remain acceptable, and…

Read More…

Given the uncertainties businesses have faced as result of the Covid-19 pandemic, it’s hardly surprising many are looking to improve how they do risk management.

According to Duncan Harwood, managing director of 2020 Risk Management, introducing Monte Carlo simulation one of the best steps a business can take to improve its risk management processes.

Giving a presentation at Risk Awareness Week 2020, he said: “If your organisations is using heat maps and 1-5 scoring matrices to assess risk, then I guarantee there is scope for improvements. Including Monte Carlo simulations in your toolkit would be a quick, simple, cheap way for the risk management function to bring real benefits to the organisation.”

What is Monte Carlo and why should we be using it?

Put simply, Monte Carlo is the name given to a mathematical technique that allows you to replace numbers with ranges and then generates the likelihood of the possible scenarios which might occur.

The software takes different values based on probabilities – each time producing a different result – tens of thousands of times in just a few seconds.

It means you can add uncertainty into your models, spreadsheets and schedules and identify those factors which would have the greatest impact on your business’ success.

Why are heat maps no longer fit for purpose?

Most risk managers are familiar with heat maps and matrices and plenty still use them for risk assessments.

However, according to Harwood, these approaches have significant flaws which make them unsuitable and could even mean that they are dangerous for your organisation.

He explained: “If you are using heat maps, have you ever actually thought about the quality of the information that it tells you? Everything is arbitrary and subjective, there’s no actionable information, and the outputs can’t be used to help inform and improve decision making.

“Organisations don’t set budgets or make decisions on the basis of colours or labels like high or orange, they need information and data.”

Why are people resisting Monte Carlo techniques?

Harwood identified several of the common objections to Monte Carlo simulations and explained why he believes them to be incorrect.

Some examples of the objections include:

• We don’t have the data – Harwood says: There is always enough data available to get value from a Monte Carlo model.
• It’s too advanced for our needs – Harwood says: Monte Carlo can be used with the simplest decisions and spreadsheets – in fact, anywhere there is uncertainty and where people have made assumptions about numbers.
• It doesn’t apply to our industry – Harwood says: Monte Carlo can be used in every industry sector and organisation. It’s not just useful for heavily quantitative sectors such as science economics and financial services.
• Everyone already understands heatmaps – Harwood says: Heat Maps are subjective and so are the messages they communicate. Different people can interpret the results differently and they may only serve to introduce confusion.
• We don’t have the budget – Harwood says: Monte Carlo software is available free so there’s no issue about not having sufficient budget for it. There will be a cost associated with training people in your organisation or hiring external supports to use it however.
• The numbers are all guesses anyway – Harwood says: While it’s true that the usefulness of Monte Carlo will depend upon the quality of the inputs, these can be improved through training people and calibrating them.

He added: ““These often come from auditors, managers and even people calling themselves risk managers. The good news is that none of these arguments are true.

“The only real obstacle to using Monte Carlo is having software available, having people that are able to use it, and those people being able to understand how to build good quality models, interpret the results, and communicate them in an understandable way to other people.”

What sort of insights can Monte Carlo bring?

During his presentation, Harwood ran a Monte Carlo simulation on a company’s projected business plan. The data showed various insights including that likelihood that the company would make a loss in the next year.

He commented: “This is the sort of information which allow boards to make appropriate decisions and allocate resources effectively. If someone told you that there was a one in five chance that you’d make no money next year, how do you think that could change your planning?”

He also used a tornado diagram to demonstrate the positive and negative effects that each item had upon the total profit count. In Harwood’s example it showed that a factory burning down was the single greatest uncertainty, followed by a product recall.

He said: “This information can be used justify decisions which address these events such as upgrading the sprinkler system, where to build a new factory, or whether to increase the level of insurance cover. These measures could all be costed and put through the model leading to better informed decision making and hopefully an improved bottom line.”

What kind of scenario does Monte Carlo suit?

Harwood identified several scenarios in which a Monte Carlo simulation could improve business outcomes.

These included:

• Project management – cost and schedule
• Introducing new projects and strategy
• Setting strategy
• Setting budgets
• Setting targets
• Setting KPIs
• Impacts of uncertain events
• Results of trials
• Changing control measures
• Replacing the need for separate scenarios

He concluded: “The risk team should have the knowledge, skills and competences to influence decision making at the highest levels, but they need to make the board understand what benefits they can bring.

“As data drives more decisions, boards and executives will need and expect robust, timely, actionable, information and risk managers will need to be able to do this rather than offering up colourful but ultimately pointless heat maps.”

RISK-ACADEMY offers online courses

+ Buy now

+ Buy now

+ Buy now

Related

Seven local startups are out to change the way business as usual is done.

The companies just graduated from the Tampa Bay Innovation Center’s B2B Tech Accelerator, and showed off their solutions to business problems for a panel of judges at an Innovation Showcase this week.

During the 90-day program, the companies received training and mentoring in customer delivery, investor readiness and leadership.

“Enthusiasm is great in the beginning but you have to show that you’ve got traction and you understand who your market is,” said Ken Evans, managing director of the Tech Accelerator. “That’s where I’ve been adamant about making sure they are out there doing those interviews and hearing no a lot.”

Here’s a look at the accelerator graduates.

• Ceres Engineering LLC, an advanced analytics and decision support solution for the trucking and supply chain industry.

The problem: “Flooding today is one of the largest and most impactful weather events you’ll find. It costs $56 billion a year to U.S. industry. The technology that develops that flood data still is limited to only providing the probability of risk of that flood, rather than detailed…

Read More…

Delta Insurance managing director Ian Pollard says the product has been a long-term project, and is the result of a successful partnership with Prospect.

Read more: Delta launches overseas

“Our relationship with Prospect goes back around five years where we worked with them on our unmanned aerial vehicle (UAV) product, which was the first UAV policy to be launched in the New Zealand marketplace,” Pollard told Insurance Business.

“They were instrumental in helping us get that off the ground, and we got them involved in our personal cyber product around four years ago. They helped put the finishing touches on that from a capacity perspective, so this product is something we’ve worked on for a long time.”

“All of the insurance solutions for cyber globally and in New Zealand are for businesses, and nobody was really addressing the personal or family aspect,” he explained.

“We’ve further refined that product over time, and we’ve developed our partnership with DynaRisk, which is a cyber security provider in the household and personal use space. They offer a range of risk management tools and services, and…

Read More…

SEATTLE, Sept. 16, 2020 /PRNewswire/ — Milliman, Inc., a premier global consulting and actuarial firm, today announced that it has launched its Strategic Cyber Risk Assessment in the Microsoft Azure Marketplace to help organizations better understand, map, and measure their cyber and other operational risks.

The assessment helps companies identify their most critical risks, understand organizational blind spots, and take the first step toward quantifying the financial impact of their cyber vulnerabilities.

“The current economic uncertainty illustrates how important it is to understand the interconnectedness of non-financial risks and how these can rapidly manifest as financial risk,” says Chris Harner, Managing Director of Milliman’s Cyber Risk Solutions group. “Offering our Strategic Cyber Risk Assessment in Microsoft’s Azure Marketplace allows participants to leverage the platform, so as to better identify vulnerabilities and mitigate potential areas of concern.”  

Microsoft’s Azure Marketplace is an online store that provides services and applications for use on Azure. Milliman offers a strategic assessment of an organization’s risk profile. The assessment efficiently…

Read More…

Leaders in African energy risk management united in a webinar on Friday under the theme, ‘Navigating Risk: Increasing Threats in the African Energy Market Under COVID-19’

The ‘Navigating Risk: Increasing Threats in the African Energy Market Under COVID-19’ webinar, hosted by Africa Oil & Power (AfricaOilandPower.

com) and the Africa Energy Chamber, tackled current threats to physical and cyber security of oil and gas assets on Friday; Panelists included Dr.

Sara Vakhshouri, Founder & President of SVB Energy International; Shawn Robert Duthie, Managing Director of Inyani Intelligence; and C.

Derek Campbell, CEO of Energy & Natural Resource Security, Inc.

Leaders in African energy risk management united in a webinar on Friday under the theme, ‘Navigating Risk: Increasing Threats in the African Energy Market Under COVID-19,’ to put forth strategies for mitigating physical, cyber and security risks, with a view toward protecting employees and assets.

From regulatory uncertainty to political unrest to physical and cyber security attacks, the risk of investment in several African countries has been heightened by the onset of COVID-19, not least of which…

Read More…

SANTA FE, N.M.–(BUSINESS WIRE)–The Shared Assessments Program, authorities in risk management, today released results of the Fourth Annual Ponemon Institute’s Third Party Internet of Things (IoT) Risk Management study. This year’s report underscores the acute need for IoT risk management improvement, as most organizations do not know what tracking and safeguards their third parties have in place. New insights in this year’s study crystallize a set of leading practices for reducing IoT-related risks, which represent an important feature of this report.

“While the proliferation and consumerization of embedded technology, including IoT devices, continues to evolve at a rampant pace, new security vulnerabilities and exposures are introduced. This is especially true when the use of IoT devices is extended to third parties, fourth parties, or even more concerning, when it’s unknown where the use of IoT devices are being extended, or those extensions are unmanaged,” observes Rocco Grillo, Managing Director, Global Cyber Risk Services, Alvarez & Marsal.

In “A New Roadmap for Third Party IoT Risk Management – the Critical Need to Elevate Awareness,…

Read More…

]]>