Implementing an Effective AML Monitoring and Assurance Program

Workshop: Implementing an Effective Monitoring and Assurance Program
1

Outline
Background and History
Frame of Mind
Key Risk Indicators (KRI’s)
Independent Verification and Validation (IV&V)
2

A Word of Caution
Don’t Assume
Healthy skepticism
Murphy’s law
Don’t Expect, until you inspect
Trust, but verify
3

Background and History
Slap it in phase
“Let’s get the regulators off our backs”
First generation systems
Second generation systems
Regulatory focus becoming more sophisticated
Regulators are requiring due diligence on Commercial Off the Shelf Software (COTS)
4

Committee of Sponsoring Organizations of the TreadwayCommission
How Key Risk Indicators can
Sharpen Focus on Emerging Risks
5

Key Risk Indicators (KRI’s)
Many organizations are seeking to develop a process that provides management and the board of directors with rich information
about potential events that may affect the entity, especially top risk exposures,
that they can monitor on an ongoing basis.
While most organizations monitor numerous key performance indicators (KPIs), often those indicators shed insights about risk events that have already affected the organization.
Increasingly, boards and senior executives are looking to develop metrics or indicators
to help to better monitor potential future shifts in risk conditions or new emerging risks
so that management and boards are able to more proactively identify potential impacts on the organization’s portfolio of risks.
Doing so enables management and the board to be in a better position to manage events that may arise in the future on a more timely and strategic basis.
This latter type of metric or indicator is frequently referred to as a key risk indicator (KRI).
6

KPI’s vs. KRI’s
Important to distinguish key performance indicators (KPIs) from key risk indicators (KRIs)
Both management and boards regularly review summary data that include selected KPIs designed to provide a high-level overview of the performance of the organization and its major operating units.
These reports often are focused almost exclusively on the historical performance of the organization and its key units and operations.
For example, reports often highlight monthly, quarterly, and year-to-date sales trends, customer shipments, delinquencies, and other performance data points relevant to the organization.
It is important to recognize that these measures may not provide an adequate “early warning indicator” of a developing risk because they mostly focus on results that have already occurred.
7

Example of KPI’s vs. KRI’s
8

Developing Effective Key Risk Indicators (KRI’s)
A goal of developing an effective set of KRIs is to identify relevant metrics that provide useful insights about potential risks that may have an impact on the achievement of the organization’s objectives.
The selection and design of effective KRIs starts with a firm grasp of organizational objectives and risk-related events that might affect the achievement of those objectives.
Linkage of top risks to core strategies helps pinpoint the most relevant information that might serve as an effective leading indicator of an emerging risk.
9

Linking Objectives, Strategies, and Risks
11

KRIs Facilitate Strategic ProactiveManagement of Emerging Risks
12

Leading Indicators for Risk Events
An effective method for developing KRIs begins:
by analyzing a risk event that has affected the organization in the past (or present) and
then working backwards to pinpoint intermediate and root cause events that led to the ultimate loss or lost opportunity.
The goal is to develop key risk indicators that provide valuable leading indications that risks may be emerging.
The closer the KRI is to the ultimate root cause of the risk event, the more likely the KRI will provide management time to proactively take action to respond to the risk event.
This process can be depicted visually in the following manner:
13

Workshop Exercise
Share with us the KRI’s you have identified or are likely to identify in your institution?
15

Sample Sanctions KRI’s
Transactions filtering: false positive rate of more than 2%
Relationship filtering: false positive rate of more than .02 %
Sanctions database not updated, not fully run
More than 1 miss per year
History of cautionary letters
16

Sample Monitoring KRI’s
Clearing less than 10 alerts per day
Filing rejections from the regulator
Alert Aging/Backlog (filing deadlines/unprocessed alerts)
Procedural violation rates
Failure to identify Trends
Review criteria not maintained
Incomplete Analysis/Research
Failure to provide/maintain summary Reporting
Inadequate Decision Making
Form completion error rates
Narrative completion error rates
Record Keeping requirements not maintained
Staffing experience levels not maintained
Initial and advanced Training requirements not maintained
17

Sources of Information When Developing KRIs
SME’s know stress points
Standardization of definitions/methodology
Quality of data – internal vs external
Industry benchmarking
Importance of independence
18

KRI Communication and Reporting
Three major stakeholders:
Role of the Board
Role of Enterprise Risk Management (ERM)
Role of Risk Owners
Collaboration
Frequency of reporting (real-time vs. monthly)
Level of reporting detail (high level vs. detailed)
Dashboards – Status System – Color/Direction (e.g. RAG, Trend Arrows)
20

Sample Status/Trend Dashboard
21

Sample Status/Trend Dashboard
22

IV&V Background and History
Increasing program failure rates and system complexity pressure to reduce IT spending
A significant challenge to manage enterprise risk with a reduced budget
No technical, managerial and financial independence to oversee all phases of a program
No identification and resolution of weaknesses, gaps and defects early in the program lifecycle (when they are less costly to resolve).
How are programmatic and technical risks best identified and mitigated?
Loss of reputation, increased scrutiny, inability to achieve objectives and lack of end user satisfaction
23

What is Independent Verification and Validation (IV&V)?
Can you afford not to know?
Do you have confidence that your IT programs will meet all requirements?
Will your IT programs be deployed on time?
Will your IT programs be within budget?
Are you able to effectively manage and mitigate program risk to ensure successful solution delivery?
Independent Verification and Validation (IV&V) can:
Can mitigate program risk
reduce time and cost overruns
Meet enterprise objectives
Deliver value
24

Effective risk mitigation strategy that can increase the probability of producing a quality product, on time and within budget.
Enables informed decision making based conduct assessments to identify the value and risks in your IT investments.
Implements Software Verification and Validation
Unbiased assessment of what is and is not working on your program
Best if implemented at the start of a program (the earlier the better) when risks can be mitigated through corrective actions that reduce the impact to cost and performance.
25

Can take place at any time during the lifecycle of a program—during the selection of the technical solution and/ or the systems integrator, upon program initiation and planning, or at any other time
Maintaining technical, managerial, and financial independence from the system developer
Significantly increases the opportunity for a successful result and/or product.
Early detection of issues, gaps, weaknesses and defects results in reduced schedule slippage, less remedial effort and lower overall cost.
26

Independent Verification and Validation (IV&V)Process
Standardized methodology
Testing against the expected:
Vendor Specification
Legislation Regulation and Guidance
Industry Standards
Best Practices
KRI’s
Effective Enterprise-wide IV&V is “best practice” in solution delivery
Supports the goal of optimal IT investment outcomes, with minimized risk
Industry research confirms the many benefits of independent verification and validation
27

IV&V Benefits
Increased visibility at the enterprise and/or program/project levels
Early identification and mitigation of problems
Elimination or reduction of unexpected cost overruns
A more efficient and consistent development process
Streamlined lifecycle processes
An accelerated implementation schedule and a lower total cost of ownership
A high-performance final system/ product that meets and satisfies user needs
28

IV&V Benefits
Financial Value: Establishing an enterprise level IV&V program that provides findings and recommendations throughout the product lifecycle from acquisition through development and into operations and maintenance (O&M) can significantly reduce total lifecycle costs. Early corrective action that prevents problems in testing or production contributes to lower overall cost.
Correcting defects in the requirements phase can be up to 100+ times less expensive than correcting these defects during the operations phase.
29

IV&V Benefits
Operational Value: Utilizing the IEEE 1012-2004 Standard for Software Verification and Validation enhances an organization’s ability to effectively manage risk and deliver high quality products and services at lower cost.
Developing/building the right product/service that satisfies the envisioned purpose reduces risk and cost by reducing defect rates and rework.
30

IV&V Benefits
Performance Value: IV&V monitoring promotes program and project team adherence to quality best practices and industry standards, which improves the capabilities of the organization as a whole.
IV&V promotes compliance with project performance, schedule, and budget requirements.
31

How does IV&V work?
Program performance is assessed against the intended future state, evaluating requirements, design, development, testing and operations.
Determines how will the new system affect the whole organization so that you have the tools to deliver stakeholder alignment, project success, and satisfied users.
Map processes according to best practices
One can also validate the implementation process
What should the selected solution implementer be doing to achieve desired outcomes?
“Industrialize” testing and on-going quality assurance
32

How does IV&V work?
Independent review of the work streams of your program’s contractors using best-in-class tools and methods for validating project plans, schedules, and performance
Conduct complete and consistent assessments of an IT implementation without bias or prejudice.
Establish a center of excellence for managing testing beyond the ad hoc delivery method
Provides a strategy that typically increases quality and reduces cost over the long term
Supports enterprise transformation
Validate the data management strategy, verify actual data migration prior to go-live milestones
Review the strategy for retiring legacy systems
33

Practical Questions
Application (IT systems) transparency to the business users:
Do the business users have a complete/sufficient understanding of the current technology and how to assess if it is leveraged effectively?
Do the business users understand what data is covered or not covered under specific conditions?
Do they understand how complex monitoring algorithms work and the options for adjusting them?
Justify scenario parameter settings (thresholds and scoring):
Are each of the parameters and settings for the monitoring algorithms configured according to AML risks?
Correlate transaction monitoring scenarios to AML risks. This is a measurement of how effective and efficient the monitoring system is at “covering” the transactional activity using a risk based approach.
For example: A specific scenario that generates the majority of alerts against low risk activity (customers or transactions) may be considered less effective or to generate a high level of false positives.
34

Practical Questions
Does IT have sufficient change controls and/or continuous controls monitoring?:
Is there a process in place to ensure all expected transactional, customer, and referential data is delivered and received by the compliance systems?
What happens when the Bank’s source system introduces a new transaction type code or changes critical data elements?
Will the new transactions be appropriately monitored or ignored by the downstream compliance systems.
Are there data integrity or quality issues that have a negative impact on the effectiveness of the compliance applications?
35

Strategic, Technical, and Operational Questions
Will the system contribute to a true transformation of the entity or business unit?
Are the right people in the organization involved in the program—to the right degree and at the right time?
Are timely decisions being made at the right level?
Are we using the right management approach for staffing, processes, performance measurement and metrics?
Do we understand the level of risk and response required at each program milestone?
Do we have a clear understanding of the overall health of the program?
36

Strategic, Technical, and Operational Questions
Is the system complete, compliant, consistent, documented, usable, and technically sound?
Are key processes being followed and are program documents and deliverables of sufficient detail and quality?
What is the system’s impact on the organization’s processes, performance targets and metrics? Are these being adequately addressed?
Is sufficient training in place to facilitate user acceptance of the new system/capabilities?
Is the systems integrator adhering to the leading practices you need for your program and utilizing mature lifecycle processes?
Will the solution be sustainable at a reasonable cost?
37

IV&V Review Areas
CDD/KYC onboarding and profiles
Relationship Monitoring
Transaction Monitoring –rules, alerts, trigger time frame
Risk Rating
Sanctions
Data mapping, file reconciliation
Information and Transaction Flow
Data quality/data integrity
Internal and regulatory guidelines
Industry standards
Best practices
Consistent with Risk Assessment
38

Examples of Monitoring Issues
Secondary users not scanned
Customer risk rating does not drive engine
Poor geographical risk modeling
High risk wire payments are not detected
Watch list quality
Payments not being scanned
Rules not correctly running in engine
Under utilization of the system
Defective look up tables
39

Examples of Sanctions Issues
Lack of file reconciliation
False positives
Heavy hitters
Analysis of Misses/External Reports of Misses
Threshold sensitivity
Potential hits
Wire payments message types
Field mapping
40

Overcoming the Business Objection
Opening a can of worms
Cost justification
Pay now or pay later
Ticking time bomb
Obstruction of the business
Can you afford not to know?
Regulatory saavy
My Strategic Partner’s Motto - ImpactAML – “Let us catch it before the regulators do!”
41

Taking Compliance to the Next Level
General level of compliance is one thing
Culture of compliance should be the goal
2nd generation application of technology
Make sure you get it right
A truly effective compliance program is key!
42

Thank you!
43
Ken Bryant
Bryant & Associates
This presentation can be viewed at:
www.amlcft.com
Referenced documents can be viewed on our website “Library” page

http://amlcft.com	3440
http://translate.googleusercontent.com	5
http://webcache.googleusercontent.com	2
http://amlcft.com HTTP	1

Implementing an Effective AML Monitoring and Assurance Program

by Ken Bryant on Oct 04, 2011

Accessibility

Categories

Tags

Upload Details

Usage Rights

4 Embeds 3,448

Statistics

Implementing an Effective AML Monitoring and Assurance Program — Presentation Transcript