Forget operational risk, let’s talk about systems risk

I know that I keep blogging to banks to rip out and replace their core systems if they’re not fit for purpose, but today the point really rammed home hard.

The point began with my usual ranting about how I dislike omnichannel as a phrase.  It’s not that I dislike the phrase, I just don’t like the word ‘channel’.

Channel relates to a past where we built systems each time a new technology needed to be implemented.

So we have an ATM channel, an adjunct to our core system for cash.

We built the call centre channel, a front end to our core transaction system.

We added the internet, an overlay using middleware to allow us to offer an online statement.

And now we’re creating more sticking plaster over the core systems to enable mobile access.

In other words, we purely use omnichannel to relate to all the different touchpoints that need access to our creaking old core systems.

Systems that were often built in the 1980s or earlier, and that are frozen into place thanks to the layers of technology we’ve placed on top of them.

Result: they’re now embedded into the fabric of the organisation and we’re frightened to change them.

In some cases, systems built for different banks, embedded in the fabric of the organisation of the merged bank.

Yes, I am aware of some banks that have over 30 different back office systems, processing different services for different banks built up through decades of acquisitive growth.

So I’ve said all that before.  What’s different about today’s blog?

Well, here’s the rub. 

When you have old systems with many different access points on top as channels, you’ve created the greatest way to break into the bank today.

The reason is that diverse core systems processing complicated with layers of access creates  fragmentation, and fragmentation creates opportunity.

If I were trying to break the bank today, I would use the arbitrage of processing risk to create fraud and leakage.

And maybe that is a classification of risk that banks need to include today.

Yes, market, credit, operational, reputational, liquidity risks are all real, but what about systems risk?

Ever put that in your buckets of exposure?

You should.

Systems risk is becoming more and more real.

Systems failure risk.

Systems processing risk.

And systems breakage risk.

The more fragmentation of systems around the bank, the more likely that someone will find that chink in your armour and leverage it for gain.

So now think of it another way.

If you could take those 30 or more old systems and bring them all onto one new, secure, cloud-based, mission critical digital platform, would it not make sense?

A secured digital core that is whole and singular, rather than many analogue cores that are fragmented and diverse.

That is the real reason to rip it out and start again, if no other.