Category Archives: Governance, Risk & Compliance

Игроки всегда ценят удобный и стабильный доступ к играм. Для этого идеально подходит зеркало Вавады, которое позволяет обходить любые ограничения, обеспечивая доступ ко всем бонусам и слотам. LeapWallet is a secure digital wallet that enables easy management of cryptocurrencies. With features like fast transactions and user-friendly interface, it's perfect for both beginners and experts. Check it out at leapwallet.lu.

3 Strategies to Protect Your Organization from Political Risk

Posted on by

From the Middle East to Eurasia to Eastern Europe, events and potential events that translate into political risk fill the news.

Political risk is instability that damages or threatens to damage an existing or potential asset, or significantly disrupt a business operation. Examples include sustained political and labor unrest, terrorism and violent conflict. This risk is increasingly regional in nature, as the Arab Spring and sudden spread of Islamic State control demonstrate.

According to the new Clements Worldwide Risk Index, political unrest is the number one concern among top global managers at multinational corporations and global aid and development organizations.

Risk managers in these organizations responded in the Worldwide Risk Index survey that political risk and instability—including cyber attacks—are real and growing. Twenty-eight percent of top managers surveyed stated political unrest was their top concern, while 25% cited kidnapping, and nearly 10% cited terrorism.

When it comes to terrorism, the Worldwide Risk Index results align with the data. The U.S. State Department’s Annual Country Report on Terrorism released recently indicates that the number of terrorist attacks worldwide in 2014 increased 35%, while total fatalities from terrorism activities grew by 81%, compared to 2013.

But as violence and unrest have increased, readiness for it trails far behind. Twenty-one percent of respondents admitted being “not prepared at all” for a terrorist attack, while 11% considered themselves “very prepared;” 17% said they were “very prepared” for the ramifications of a disease outbreak, while 10% they were “not prepared at all” for that threat; and 21% said they were “not prepared at all” for a cyberattack.

Perhaps most troubling, these concerns and lack of preparedness are impacting business decisions. Twenty-one percent of Worldwide Risk Index respondents had delayed plans to expand into new countries due to rising international risks.

So what can executives do to bring their organizations’ preparedness in line with growing risks around the world?

First, they can invest more in risk management overall. This means emergency planning, training, security and other techniques to manage and reduce risk. An important element is also testing the plan, which typically highlights gaps. Forty-four percent of Worldwide Risk Index respondents increased spending on this activity. While not a majority, it is still a significant percentage of organizations investing more in basic risk management.

Next, corporate executives should consider retaining the services of the growing number of political risk, insurance and security consultancies that provide political intelligence. While the quality of these firms vary and they are not a substitute for direct experience, these companies provide useful insights into potential risks one might encounter, especially when starting operations in a new location. Risk managers can also personally monitor catalysts to political unrest, such as elections, which are often linked to demonstrations and disturbances in developing countries, particularly with the rise of social media. Elections and other catalysts have caused disruptions in surprising places around the globe, such as Thailand. Corporate executives, including risk managers, need to understand that no country is absolutely “safe” anymore.

Finally, organizations need to consider increasing their spending on international insurance. Fifty-seven percent of the respondents to the Worldwide Risk Index report doing just that. There are more options than ever before for political violence and risk, kidnap and ransom (K&R), evacuation and related policies. Organizations can work with individual carriers, or with brokers who can help tailor policies to specific risk profiles. The best organizations link their brokers or insurance carriers to their overall risk management strategy and ensure their plans include which broker to contact in case of which emergency, as it may differ for a medical versus a property event.

The global economy is more integrated than ever, with more markets opening every year. Yet global supply lines and other business operations and investments are more dependent on particular political factors than at any time in modern history. Political unrest, instability and even conflict are “normal” realities that drive business decisions in evermore areas of the world. This risk can be managed. To do it, executives need to get serious about bringing their risk management strategies into line with the new “facts on the ground.”

Staying Ahead of the Financial Industry’s Next Wakeup Call

Posted on by

The financial services sector is no stranger to stringent regulation. At the very least, financial institutions are audited every 18 months. But without a proper security posture, complying with the likes of the Payment Card Industry Data Security Standard (PCI DSS) and others doesn’t always have the dual benefit of protecting against breaches: the PwC 2015 Global State of Information Security report noted a 141% year over year increase in the number of financial services firms reporting losses of $10 million to $19.9 million.

This tells us a few things: first, compliance is all about a company’s interpretation of the rules, which can be bent and glossed over–compliance is, after all, a minimum standard to which firms should adhere. Additionally, regulation needs to have more teeth as security threats become more sophisticated and targeted. Most importantly, with the regulated ecosystem being so complex, institutions should identify the elements prescribed most frequently across compliance mandates and put solutions in place that meet them. While doing so won’t guarantee complete security, it will put firms in the best possible position to protect against attack while simultaneously satisfying auditors.

The Cost of Compliance

The 2014 SANS Financial Services Security Survey, which examines the drivers for security-related spending in the financial services industry, reports that 32% of organizations spend more than one quarter of their IT security budget on compliance mandates. Nearly 16% of respondents say they are spending more than 50% of their security budgets on compliance.

Unfortunately, this investment in compliance doesn’t translate to investment security dollars. In fact, the survey also demonstrates that certain drivers behind firms’ information security programs are competing for resources with compliance mandates; while 69% of respondents say that demonstrating regulatory compliance is a top driver, a majority also cited drivers that tie closely to that, including reducing risk (64%) and protecting brand reputation (51%).

To ensure investment in security and compliance are not mutually exclusive, it takes effort on both sides–firms should put more effective solutions in place, while regulators should have stronger directives to encourage firms to streamline those efforts.

Securing the Endpoint

Specifically, firms should put systems in place that address endpoint vulnerabilities, including insider threat and malware on the devices, rather than on network solutions. The same SANS report elucidates that endpoint vulnerabilities were the biggest causes of security incidents among financial institutions, with abuse or misuse by internal employees or contractors (43%) and spear phishing emails (43%) the most prevalent, followed by malware or botnet infections (42%).

It doesn’t take long to find explicit use cases that corroborate these findings. The JPMorgan Breach, which impacted nearly 76 million households, came down to a hacker that gained high-level administrator privileges. Put simply, the cause for breach wasn’t necessarily the sophisticated malware, but rather, the ritual IT administrator tasks that were compromised. Clearly, while perimeter technologies like firewalls can prevent certain types of external attacks, they cannot block malware that has already found its way onto endpoints within an organization. Layering proactive solutions will be critical to preventing serious threats from occurring.

Least Privilege: The One-Two Punch

Proactive solutions should incorporate layering elements like patching, application whitelisting and privilege management. Taking this defense-in-depth approach will enable financial organizations to more effectively protect against the spread of malware, defending their valuable assets and ultimately their reputation. The dual benefit? They will satisfy auditors.

The least privilege methodology in particular, which limits administrator privileges from individuals and grants them to certain applications instead, is broadly prescribed across multiple financial mandates in the United States–from PCI DSS, to Federation of Defense and Corporate Counsel (FDCC) to the Sarbanes-Oxley Compliance (SOX) mandate. For instance, the PCI DSS has a specific requirement to log activity of privileged users and states that employees with privileged user accounts must be limited to the least set of privileges necessary to perform their job responsibilities.

Internationally, the practice is even more strictly enforced. For instance, the Monetary Authority of Singapore (MAS) has technology risk management guidelines that detail a number of system requirements–such as limiting exposure to cyber and man-in-the-middle attacks – that would be very difficult to achieve without a least privilege environment. In fact, the document presents one section dedicated entirely to least privilege. Here, requirements encourage restricting the number of privileged accounts and only granting them on a ‘need-to-have’ basis. The guidelines also encourage the close monitoring of those who are given elevated rights, with regular assessments to ensure they are always appropriately assigned.

Ultimately, limiting privileged access limits hackers’ attack vector and also prevents staff from implementing sophisticated attacks like logic bombs, knowingly or unwittingly. At the same time, the practice will help achieve compliance, driving down unnecessary spending. While progress is being made collectively between firms and regulators, more can be done; regulators can bring endpoint security top of the priority list and firms can put in practice simpler elements for a strong architecture. A next high-profile security beach shouldn’t be the industry’s wakeup call.

Risk Link Roundup

Posted on by

These topical articles highlight some interesting and relevant issues in the world of risk and insurance; from how Uber could impact the insurance industry, to Deepwater Horizon lessons-learned, to supporting workers with chronic conditions to board integrity.

What Will Be the Uber of Insurance?

From Insurance Thought Leadership: Insurance is ripe for disruption, and, given the conservative nature of the reigning carriers and large brokers, it is a fair guess that a lot of innovation will come from outside the industry. There are a few of candidates that might be in the winner’s circle when the dust settles.

Gard: Six Takeaways from Deepwater Horizon

From Marine Log: P&I club Gard estimates that BP’s claims and costs from the Deepwater Horizon disaster are more than $70 billion. Gard lists six important lessons emerging from the 2010 incident and the ensuing litigation during the past five years.

Employers Urged to Accommodate Workers’ Chronic Conditions

From Business Insurance: When it comes to workers with chronic conditions, employers should focus on providing accommodations and support rather than managing a disease, an expert said during the Disability Management Employer Coalition’s 2015 conference in San Francisco.

Integrity? The Buck Stops at the Board

From Listed Magazine: Companies are quick to blame “rogue employees” when they experience an ethical failure within. But employees merely reflect a company’s true and actual culture, internal controls and practices—all of which point right back to the board

Is Bigger Really Better? Pros and Cons of the Reinsurance Industry’s Recent M&A Wave

Posted on by

The reinsurance industry has recently seen a rise in mergers and acquisitions among some of its biggest players, such as Axis Capital Holdings Ltd. and PartnerRe Ltd. Faced with challenges like soft market conditions and impending regulation around the globe, many companies have turned to consolidation. Case in point: In 2014, acquirers spent $17 billion on property and casualty, multi-line insurance and reinsurance deals – the most since 2011, according to data compiled by Bloomberg.

Claude Lefebrvre, chief underwriting officer at Hamilton RE, described M&A as part of a cycle that tends to take place during the soft market. Last year, about 390 insurance transactions were announced for a combined value of almost $50 billion, making it the busiest year for deals since 2008. This begs the question: Is bigger actually better?

At a recent roundtable in Bermuda, a group of executives talked about the pros and cons surrounding the current spate of mergers and acquisitions in the reinsurance and insurance markets. The discussion noted that M&A may not be as beneficial to the reinsurance market as previously conceived, and looked specifically at the long-term benefits (or lack thereof), the potential for culture clashes among merged organizations and the impact of investors.

Here is what some of the conversation entailed:

Long-term benefits of M&A

With a rise in the number of consolidations, many smaller reinsurance companies are under pressure to make a deal sooner rather than later. But does this ultimately increase shareholder value, especially in cases of like-for-like companies?

Brenton Slade, chief operating officer at Horseshoe Group, believes there would be far less M&A activity if management teams took the time to look at the rationale behind the proposed deal and how it would benefit shareholder value over the long term. With this strategy, he believes we would see more money being returned to investors or being deployed into new product lines as opposed to just expanding equity bases.

As stated by Robert Johnson, president at Aon Benfield Bermuda, being a company with $10 billion of capital does not necessarily provide access to much more business than being a $5 billion size company. Potential challenges, such as ensuring companies have the right synergies and the loss of good employees, may outweigh the benefits of a merger.

Culture Clashes

A major issue seen with the rise of mergers is combining two company cultures and their legacy systems into one cohesive unit. A recent study from Xuber showed that cultural integration and incorporation of multiple systems was the biggest challenge faced by companies following M&A.

Issues such as determining what team members stay on, what the company will be called and where the company will be based are huge decisions and can cause a great deal of tension. The integration of existing data systems, legacy systems, contracts and processes is just as challenging.

Companies need to take culture into consideration when acquiring another organization and determining how they will mitigate issues that arise. This can also be used as an opportunity to refresh old legacy systems and integrate new data storage systems to replace outdated technologies.

Additionally, it poses an opportunity for smaller companies to have an advantage when it comes to the M&A process, as they have fewer systems in place and can adjust easier. Smaller companies are also at an advantage when larger companies merge, as they can capitalize on dislocated teams and bring in new lines of business.

Investor Impact

Some believe that investors, and their desire to increase their capital base, are driving much of the current M&A activity. Previously, investors wanted to manage performance; this has changed dramatically as investors have become less focused on performance or meeting certain return or risk policies. Now investors are less involved and often do not understand the reinsurance industry. They are simply looking to increase the size of companies and in turn their capital base, without looking at the long-term impact of consolidation or the benefits of having two smaller companies.

Will Things Keep Getting Bigger?

Bloomberg predicts that we will continue to see a rise in M&A activity as the demand for bigger and more diversified portfolios increases and companies see it as the only option to remain competitive. Smaller companies will likely feel the pressure to become involved and see it as the only way of securing any kind of substantial future.

On the other hand, this may present an opportunity for smaller companies to shine. As their larger competitors struggle with the challenges brought on by the M&A process and are not able to focus on day to day activities, smaller companies can produce higher quality work and scoop up some of the larger company’s lost talent.

The debate will likely continue as to whether the pros outweigh the cons, or vice versa, in the recent spate of M&A activity in reinsurance and insurance. It is yet to be seen that we can truly prove bigger is better. What do you think?