


No, seriously… in my lifetime.



Here are some snippets from my in-box:




]]> 0







]]> 0







]]> 0
Metrics Reporting: Are pretty colors always pretty accurate? Wed, 08 Aug 2012 18:21:42 +0000 I have an odd relationship with management reporting.  I know it’s a necessity and quite often see clear value in what’s packaged for senior management and board review.  But a significant piece of the reporting content comes in the form of metrics and, well, whenever I hear the term it conjures up this ghastly image of good and decent people sinking slowly to their deaths in the quicksand that such efforts often become.









]]> 0
CFPB: Filling the regulatory void left by Sheila Bair Sat, 21 Jul 2012 20:25:31 +0000 I was an unabashed fan of Sheila Bair and made no secret of that fact.  She was a breath of fresh air in a line of work where everything is stale and always at least a little boring.  Not that Martin Gruenberg is any less effective running the FDIC, he’s just a whole lot less interesting to pay attention to.  And in the time since Ms. Bair stepped down I’ve just not been finding much to blog about regarding things the government is doing.







]]> 0










]]> 0
Governance, risk and compliance – related but not the same. Fri, 03 Feb 2012 17:58:28 +0000 I was sitting in a meeting this week listening to a group of very bright people talking about an initiative centered on installing a software solution and I realized something rather disturbing; somewhere along the way in our industry governance, risk and compliance has started melting together and becoming known simply as GRC.  I say “disturbing” for a very simple reason, they’re related but not one and the same.  And so it started me thinking about a wide range of recent conversations I’ve been having lately between services work, software sales and solutions development and there it was right in front of me – most of the people who throw around the term GRC just think of it as a massive catch all for everything even remotely related to any of the three disciplines and not as a rallying point for coordinating their points of intersection.  Uh oh!

Is it possible that this incredibly important and still developing concept known as GRC can be hijacked and used instead to almost marginalize the sum total of all it’s related parts?  Until this week I would never have even thought of something like this as possible but there it was, right in front of me and a bit of a shock.

There are likely two main drivers behind this disturbing trend: GRC software and the overwhelming volume of compliance-based activities.  So many of the GRC solutions currently on the market tend to be rather broad in their scope.  While most of them are oriented towards one particular point within the GRC spectrum they have all expanded to try and touch on as much as they can justify.  So whereas you have a product that may have been designed to manage policy content it now also offers risk assessment, audit and overarching governance features.  But still what it does best is manage policy content.  The license for the product isn’t cheap and senior management has been sold to some degree on the promise of automating much of the required work via this new and costly solution.  Thus we have the first driver behind the blurring of GRC lines: “We paid a lot for it so we better use the heck out of it”.  And so there’s a slow but steady march through the organization looking for things that can be brought into the fold.  However not everything belongs in every GRC solution because as noted previously, each offering no matter how effective tends to favor one specific location within the GRC spectrum.

But even when you have a solution that’s broad enough to accommodate most of what you need to accomplish there’s the other driver coming into play, massive compliance requirements.  I’ve had clients who don’t even care so much about if what they need to do to comply makes sense for them but will do anything to pass an exam.  And so there’s this mad, Lemming-like dash in a single direction to shoehorn everything and anything into this thing called GRC that might even be remotely related.  There’s little thought put into how best to get the work done with the primary concern being “we have to have something to show the examiner”.  The result is a hodgepodge of seemingly related activities being coordinated under a single function or initiative but with almost zero effort made to try and normalize the workload and gain the efficiency’s that GRC promises.  How thoroughly depressing for us practitioners.

And it’s fantasy to think that once things are setup to be done a certain way they’ll ever change.  Unless an examiner or auditor tells you something needs to change everything stays the same.  So a poorly designed GRC function remains poorly designed forever.  And an unnecessary GRC activity continues because no one typically cares if you’re doing too much, only too little.  It’s almost like people just want to stuff everything remotely related to the discipline into the GRC closet and then make sure guests never open that door.

I know we’re still early in the GRC life cycle (Michael Rasmussen recently noted in an article that it’s been ten years since he first conceived of the acronym and concept) but what if this trend isn’t derailed sometime soon?  What if because of the weak economy (I’m being polite, I should swap “weak” for “horrible”) companies continue to just sweep everything under the GRC rug and don’t exploit the benefits of the concept?

I’m reminded of the old joke about the immigrant who decides he’s going to use his lumberjack skills in the U.S.A. to make a living and invests his life savings in a chainsaw.  After repeatedly failing to achieve any appreciable gains in his productivity he finally returns to the store to find out what’s wrong with the machine.  Once they pull the ripcord and fire it up he jumps back in surprise asking “what’s that noise”.  I have this image in my head of some internal controls manager managing his/her company’s GRC program ten years from now stumbling across an OCEG document, reading it and jumping back in surprise and exclaiming “what a great idea, why aren’t we doing this sort of thing”.  Don’t laugh, I can all but guarantee it’s going to happen at this rate.

]]> 0
Maintaining compliance is often the Missing Link. Sun, 08 Jan 2012 21:27:47 +0000 I’ve been in the solutions selling business on and off for about a decade but exclusively so over these past four years.  Up until becoming a partner in my current practice I pretty much was always only involved in helping sell the solution and usually implementing it before moving on.  Seldom did I ever have the occasion or opportunity to loop back to the client much beyond the initial six months after getting everything setup to find out how things were going and how well the solution was functioning.

But these past four years has allowed me more than ample opportunity to rectify that heretofore unknown blind-spot in my career.  We don’t just sell a solution, we support it and that involves the establishment and maintenance of what can most aptly be classified as a relationship.  While we have a large number of clients we seldom hear from there are some who call us all of the time.  Often it’s to ask about how best to exploit functionality, sometimes it’s because they forgot how to do something (and we advocate calling to ask rather than reading through the user guides) and on more than one occasion it’s because they have an exam looming large on the horizon and they still haven’t quite finished setting everything up.  It’s the latter that has proven to be a revelation.

The entire reason for purchasing a solution is so that you don’t have to first figure out what needs to be done.  If the solution is designed right there should be a series of relatively basic steps that are clearly outlined and once followed have you up and running.  Instead of wasting precious time and effort getting started you can pretty much start focusing on conducting the related work so that everything is kept current.  That’s not to say that it’s easy, only simple.  And because most compliance-based work is spread out over the course of a full year it should never require herculean efforts to maintain.  Our vendor management solution pretty much requires a few hours of setup time then roughly a few hours per week going forward on average.  And when properly supported it works, it actually works the way it’s intended to.

But here’s the problem: Developing or purchasing the right solution to comply with any regulation or mandate is just the very first part of what’s necessary.  You actually have to properly implement and use that solution.  All too often that part is missed.

It’s not just with my current collection of clients but also with those that I’ve provided consultative support to over the years.  I have one client who has somewhere close to $2M in purchased software sitting locked in a file cabinet having never been implemented due to shifting prioritization by management.  Shocking?  Yes but also frustrating because some of the very problems that software was intended to address still existed.  I have another client I conducted a risk assessment for that had multiple solutions that were near identical to each other but were subsequently replaced by something different because as management changed they wanted only those solutions they already knew.  The result was hundreds of thousands of dollars per year being spent on maintenance costs because they needed to keep the data contained in each solution and there was no straight-forward way of extracting from one and merging with another.

Whatever solution you decide to go with from a simple spreadsheet all the way through to a seven-figure software package it makes little difference if nothing happens beyond setting it up.  Our advice to clients is that when they purchase one of our solutions they can often get a one-year pass with their examiners as long as they can actually display the solution and provide a real and credible plan on how they’re going to be using it.  Typically the examiner will give you points for taking a step in the right direction and will allow you the additional time necessary to get it up and running.  But that’s Year One – Year Two you’d better be able to show progress.

It’s why when I’m engaged with any implementation be it one of our own solutions or when I’m serving in a pure consulting role I often caution that it’s a good first step but only the first of many needed to be successful.  Everyone gets sort of caught up in the potential of the project and starts seeing their better selves once it’s fully implemented.  But I’ve witnessed too many projects where after the initial success fades and resources start getting pulled onto newer initiatives momentum is lost and progress stalls.  I was on one business continuity project where they all but had the plan updated to address an examination finding.  I left right before they submitted the BCP for Board of Director approval and found out a year later that although that part had been properly completed they never actually deployed the plan.  Someone in senior management felt that the plan itself would satisfy the examiners and because of resource constraints decided to delay the implementation and training necessary.  Management gambled and they were tattooed by their examiner the following year.  How frustrating is it to know that the hardest part of the project was already done but not enough so to make the finding go away?  It happens all the time.

I understand the pressures in play for most institutions, honestly I do.  Too few resources, too little time and trying to figure out the right balance between running a business and meeting regulatory requirements.  But that doesn’t explain why you’d implement a solution but not maintain it.  And does it ever make business sense to invest in anything but not leverage the benefits associated with that investment?  Besides, who want to be the one standing in front of the CEO explaining that while it’s true that the money was spent to solve the problem the problem still exists?

Seriously, go the distance, finish what was started and then put someone in charge of keeping the thing current.  In the end you’re going to have to anyway so why wait?  Oh, and before you run out and purchase a brand new solution check the file cabinets and make certain you don’t already own one.

]]> 0
Will Hurricane Irene reveal your BCP’s strengths or weaknesses? Sun, 28 Aug 2011 15:17:45 +0000 I’m violating my own standards by using such an easy topic to blog about but it’s too big to ignore.  With the increasing insanity being inspired by 2011′s first true hurricane I’d be remiss if I didn’t at least explore the impact this is going to have on the business community.

I just heard that Mayor Bloomberg is evacuating low-lying areas in New York City and that mass transit will more or less be cut off tomorrow (Saturday) sometime around mid-day.  New York’s Governor Cuomo also discussed the possibility of closing the bridges as well if weather conditions become so severe that using them might be dangerous.  Upon hearing this my first thought was “how the heck are key stakeholders going to get to their disaster sites if they’re called in?”  The obvious answer is that many companies will likely require that the important people go to their DR sites tonight so that they’re already there “just in case”.  How wonderful for these people to have to leave their families in the midst of a potentially epic natural disaster.  I can’t help but wonder how many are willing to comply and how many are going to insist that they can’t make it.  Did any BCP/DR test ever take into consideration the possibility that key stakeholders would simply refuse to show up?

And with the enormous range of Hurricane Irene is it at all possible that certain recovery sites might not be able to provide the proper services, resources and support to meet such a potentially large demand?  I know that they all claim that they’ve factored that in to their models and are able to provide sufficient capacity.  But until they know for sure how do they really know for sure?  Who among us has yet to witness any BCP/DR plan that didn’t start experiencing hiccups and delays during testing?

One element of a BCP that I’m also now wondering about is the day-after scenario.  I’ve reviewed dozens of plans during my career and upon reflection cannot recall any that placed significant attention on what happens after the official disruption is at an end.  I’m looking at pictures of severe flooding from Irene from those places already affected and have to wonder how many business are going to be able to open on Monday despite the fact that the roads are clear and the skies sunny and blue.  In thinking about some of the more common disruptions over the years (e.g. heavy snow, ice, etc.) it was somewhat obvious that once the roads were passable it was safe to head back to the office.  But that may not be the case this time around.  How many plans are designed to accommodate that?  Is someone from facilities charged with the responsibility of conducting a site inspection on Sunday night to see if their buildings are ready to open the next day?

Admittedly I’m picking on the entire concept of a business continuity plan but you can’t blame me, Hurricane Irene is only one reason.  Middle of last week I was in the Northeast and experienced my very first earthquake event.  Now I realize that anyone from California or Japan would chuckle at that statement because what I personally experienced was little more than an overloaded truck driving past me on a pothole-ridden street to those who deal with the phenomenon regularly.  But still, for me it was a big deal.  In the aftermath I asked around to see what happened in other places where the tremors were felt to see if anyone was formally evacuated from their building – no one was.  I expected in the days following to read about how companies had dedicated time and resources to inspect their structures to ensure that everything was as it should be and that there were no signs of damage from the unexpected movements – again, almost nothing to be found.  Well for all those BCP’s that I’ve reviewed where the likely threats were documented and addressed as part of their plan, how many think that maybe they should update their documentation to cover earthquakes?  They can no longer justify leaving it out because it’s not a likely threat, it just happened.  And now that they know it happened once they need to accept that it not only could happen again but likely will. But I’m willing to bet that a year from now I won’t find a single plan that has been modified to include what should happen in the event of an earthquake.

I’m just thinking that regulators and auditors need to stop rewarding those they’re responsible for monitoring for simply having a plan in place.  At some point they’ll need to shift their focus from simply checking off that a plan exists and start digging into it a bit more.  The same degree of scrutiny that emerged in 2009 because of the “Great Swine Flu” threat and making sure that BCP’s had a thorough pandemic response component now needs to become standard fare for the overall plan.  Companies need to conduct more than tacit testing exercises and really start thinking things through.  Between companies having antiquated and irrelevant plans, to those who have partially baked plans and worse yet, those who don’t even have one in place it’s time to do something about it.

The worst time to discover that you need a viable plan and don’t have one is, well, when you actually need it.  If enduring both an epic hurricane and your first earthquake don’t inspire you to action nothing will.

]]> 0
Vendor management: What’s missing in this big picture? Sun, 17 Jul 2011 22:01:18 +0000 I do a whole lot of work with vendor management, a fact which most of my regular readers are quite aware of.  And while I typically recoil when somebody else says of themselves what I’m about to say, I’m going to say it anyway; I’m really something of an expert on the discipline, particularly as it relates to financial institutions.  I designed my very first vendor management program nearly eight years ago (very manual, very spreadsheet oriented) and have progressed with it to the point where my practice now supports well over one hundred institutions who are all users of our automated VM solution.  So as you can imagine I put a lot of time and effort into thinking about how to go about identifying and assessing vendors.

Two separate but (very much) related events occurred recently regarding vendor management that sort of has me scratching my heads and so I wanted to share.

First, while conducting some research on FFIEC guidance surrounding vendor management for a client I realized that simply as a force of habit I knew which InfoBase documents to access.  There’s one that covers 3rd party service providers and another that’s specific to outsourced relationships.  Together they combine to provide solid content on the details related to vendor management.  But here’s what I noticed for the first time ever; nowhere on the FFIEC site or in its documentation is anything ever directly referred to as vendor management.  Examiners are constantly hammering away at our clients for more and more information regarding their vendor relationships, comments are routinely found on reports addressing the same.  And yet nowhere in their core guidance documentation is anything specifically referenced as vendor management?  Why is that?

Second, back in May our practice participated in a bankers conference in New York and presented on the subject of vendor management.  When the audience was asked “Who’s happy with the guidance you get from your examiners, raise your hand?” nobody raised a hand… nobody.  Now to be fair, we didn’t ask how many in the audience ever thought to even ask their examiner for direction which is an other issue altogether.  But out of roughly fifty people in attendance no one, not a single soul felt that their examiner was helping them figure out vendor management.

So what exactly is a financial institution to do?  You’re not getting specific direction from the examiners themselves and the one source for guidance you’re encouraged to rely upon doesn’t even define it in such a way that you know for sure what to look at.  Seriously, it can be remarkably maddening when you get right to it.

And to make things all the more confusing, when you start researching vendor management on the Internet you find that the discipline mushrooms quickly into focuses on procurement, financial accounting and contract management and so you can’t even find a simple or straightforward concept to use as a guide to either build or enhance your current vendor management program.  Or at least that’s what you wind up concluding at the end of the day.   But really in the end what your examiners are going to hold you accountable for are only those things that you’re required to do.  Within the vendor management space that boils down to GLBA and what’s required in order to comply with it.  To some that might seem overly simplistic but it’s not, it’s the right answer and the correct strategy.

But here’s the kicker: Since I first started working within the banking sector and helping institutions comply with GLBA I’m amazed by how pitiful few people even know what they’re expected to do.  I think the regulation is fairly straightforward (and always have) but when our practice engages current or potential clients that’s not always the case.  And so if you don’t understand what compliance looks like how do you add another layer (in this case vendor management) and align it so that it matches up on the key points?

It sure would help though if the people who are responsible for making sure you’re doing what you’re supposed to be doing actually pointed you in the right direction.

]]> 0