Strategic Risk
Strategic risk is a function of the compatibility between the bank’s strategic goals, its business strategies, the resources used to meet strategic goals, and the quality of implementation. Resources necessary to carry out business strategies include both those that are tangible and those that are intangible. Strategic risk incorporates management’s analyses of external factors that affect the strategic direction of the bank. Anticipating change, both externally and internally, are essential to managing this risk. Strategic risk arises from adverse business decisions or improper implementations of business decisions.
Addressing specific risk tolerances from a strategic focus aids in controlling this risk. The Board of Directors and management provide direction and guidance regarding merger and acquisition plans, marketing initiatives, initiation of diversity in product elements, technology changes, and other related strategic moves. Controlling this risk is necessary for the continuity of operations and protection of resources, depositors, customers, and shareholders. It also assists in maximizing the return on shareholder investment without sacrificing quality or reputation.
Information Technology Risk
Information Technology (IT) governance is the responsibility of the Board of Directors. The core elements of IT governance encompass value, risk, and controls. Management has appointed the Operations and IT Officer the responsibility for overall management of Information Technology risk. IT risk focuses on information and information systems, especially the most critical and vital information assets. Without reliable and properly secured information systems, business operations could be severely disrupted. Likewise, the preservation and enhancement of the Company’s reputation is directly linked to the way in which both information and information systems are managed. Maintaining an adequate level of security is one of several important aspects of managing IT risk.
The Information Systems (IS) Steering Committee serves as an advisory group providing assistance and guidance to management regarding customer information security, information systems planning, systems management organization, systems performance, business continuity, information security, system related expenditures, vendor management, and related policies and procedures. The IS Steering Committee is chaired by the Operations and IT Officer and meets on a monthly basis. Committee members are Executive Management representatives, the Operations and IT Officer, the Information Security Officer, the IT Manager, the Compliance Manager, the Chief Lending Officer and the Risk Manager. Formal meeting minutes serve to document decisions and recommendations by the IS Steering Committee. Meeting minutes are reported to the Management Committee and the Board ERM Committee.
An annual Information Technology Audit, which is facilitated by the Internal Audit Department, is conducted via a co-sourcing agreement with a third party auditor. The objective of the IT audit is to evaluate the effectiveness and efficiency of operations, test the reliability of data and IT controls, and ensure compliance with applicable laws, regulations, guidance, and industry best practices. The audit scope addresses IT Governance, IT Management, IT Operations, and IT Security. The following systems and applications were evaluated based on operational criticality and security risks: Network Resources, Core Data Processing, Internet Banking (Business and Retail), ATM and Debit Cards, Credit Cards, Wire Transfer, ACH Processing, Report and Document Storage, Commercial and Consumer Lending, Mortgage Lending, Custom Report Writing, Accounting, and Payroll.
Testing of the internal network environment and external network perimeter are included in the Results of the IT Audit and are reviewed with the IS Steering Committee and Management. For any exceptions identified, a responsible party is assigned and action plans are developed to address corrective measures. The final results of the IT Audit are reviewed with the Board Audit Committee. The status of unresolved audit issues along with their priority ratings is reported to both Management and the Board Audit Committee at each meeting.
Financial Reporting Internal Controls. Sarbanes-Oxley introduced broad and challenging financial management and disclosure regulations. Non-compliance with Sarbanes-Oxley regulations has serious consequences. As an accelerated SEC filer, the requirements of section 404 of the Sarbanes-Oxley Act are applicable to the Company. Section 404 requires companies to maintain internal controls and procedures for financial
22