Tarisa Watanagase: Supervisory concerns in an IT environment
Speech by Dr Tarisa Watanagase, Deputy Governor of the Bank of Thailand, at the 2nd SEACEN/
Federal Reserve System Course on Electronic Banking and Technology Risk Supervision, Bangkok,
12 May 2005.
* * *
Financial institutions increasingly rely on technology to do their businesses, as a result, improper
management and operation of IT will bring risks to financial institutions. Also, issues associated with IT
including technological changes, new threats and vulnerabilities will no doubt affect financial
institutions' performance and risk profile. Therefore, it is necessary to integrate IT risks with risk-based
supervision in order to obtain a comprehensive risk profile of a financial institution. Today is a good
opportunity for me to share with you our thoughts and experiences on Supervisory Concerns in an IT
Environment.
1. Overview of current IT environment in the banking sector

The Thai financial institutions have been using IT in their businesses for decades. Initially, IT
was used as a supporting tool for banking operations, helping staff do their work faster, more
conveniently and with less human errors. Then, along with more advanced technology, many
financial institutions now offer their products and services through electronic channels such
as internet banking, mobile banking, ATM, etc. These alternative banking channels provide
customers much easier and more time-saving ways to do their transactions with banks.

In addition to offering alternative banking channels, financial institutions currently also take
advantage of IT to innovate financial products and services. For example, through
system-integrated capability, financial institutions can offer a wider range of services
including bill payment and tax payment. Electronic money (E-money) is a new product that is
now offered by many institutions, both banks and non-banks. All of the aforementioned
products and services delivered with the help of IT and the effort on core-banking system
integration require much more complex technology infrastructure which raises tendency to
the use of IT Outsourcing services from external expertise. As a consequence, financial
institutions can fully focus on core activities and become less concerned with not having a
sophisticated level of IT expertise. However, financial institutions must be aware that risks
from outsourced operations still fall under their responsibility even though they may not
undertake IT operations by themselves.

As the use of IT becomes widespread, it appears that most Thai financial institutions are
adopting international best practices as a framework to create a controlled environment and
manage risks that might occur from IT related operations. As new security threats emerge, it
becomes necessary to have adequate control mechanism to protect banks' information
assets including hardware, software and data.

As we all know, after 9/11, this issue has become a global concern. Most financial
institutions are aware of the need to have Business Continuity Management. The business
continuity plan has to be established on an enterprise-wide basis with a thorough business
impact analysis and risk assessment. It is more than just the recovery of technology; it is the
recovery and continuity of business.

With the widespread use of IT, it is important that the legal framework is in line with the new
environment. Thailand has started to legislate five new Information and Communication
Technology (ICT) Laws to embrace information technology since 1998. They are the
Electronic Transactions Law, Computer Crime Law, Data Protection Law, Electronic Funds
Transfer Law, and the National Information Infrastructure Law. The Cabinet has appointed
the National Electronics and Computer Technology Center (NECTEC) to take charge of the
drafting of these laws. The Electronic Transactions Law was promulgated on April 3, 2002
while the others arc in the process of enactment.
2. E- banking products in Thailand and supervisory concerns
What I would like to do next is to give you some examples of IT-related financial products and services
currently offered in Thailand and the pertinent risk issues that bring up supervisory concerns. Let me
start by briefly showing you our data on e-banking service usage by category.
In the first four rows of the table, the figures show customers' e-banking transactions that have high
transaction volumes but low average values.
In the remaining rows, you will find that the Bank of Thailand is the sole service provider facilitating
wholesale payment transactions between financial institutions and the central bank. Even the number
of transaction is much smaller, the value is certainly much higher. This type of transaction of course
has different risk implications from that with higher transaction volume in smaller amount of money.
Internet banking in Thailand can be classified into two categories, informational and transactional
websites. The informational website provides banking information including products, services,
interest rate, foreign exchange rate, etc. On the other hand, the transactional website is a channel
for customer transactions such as money transfers and bill payments as well as inquiries such as
balance inquiries and statement download.
Since internet is ubiquitous and global in nature, it is an open network accessible from unknown
sources. Messages are routed through unknown locations. Therefore, internet significantly magnifies
the importance of security control and protection against fraud, hacking and other possible
internet security threats. A financial institution needs to have a strong authentication process to
prove the identity of the person who logs onto the service before any transaction is allowed. Since
transaction via internet does not require face-to-face contacts, non-repudiation becomes another
major issue as the ability to prove that a customer did request a transaction on service. As
supervisors, we need to encourage FIs to implement strong security and control measures as well
as provide mechanisms to keep abreast with emerging threats.
E-Money, or known otherwise as Multipurpose Stored Value Card, E-Purse, E-Wallet, or Smart
Card has three major characteristics.
1. Pre -paid: Consumer pay money in advance to e-money issuer.
2. Store value: Amounts of advance are stored in electronic media such as plastic card.
3. Multipurpose: Consumer can use money paid in advance to purchase goods and services
from different retailers determined by the e-money issuers
E-money can be categorized into network-based and card-based depending on how the value is
stored.
- Storing value in a network basis requires no physical item to store value but is kept in the
service providers' system.
- Storing value in a card-basis is the use of a plastic card with embedded chip to store
value.
E-money is regarded as non-traditional financial services which lead to new ways of security
and control implementation. Furthermore, it may facilitate money laundering activities. That is
why in Thailand, we prohibited the transfer money among customers without going through service
providers' data system. In addition, the system must be able to trace all activities. A bank should set a
maximum limit of e-money that can be used . And, it can only be issued in Thai Baht currency and
used in Thailand.
IT outsourcing means allowing other service providers to perform on behave of a financial institution
IT functions which are normally done by the institution itself. By the advent of rapid changes in
technology and competition, financial institutions tend to reduce costs and to improve their services by
outsourcing some technology-related functions to third parties both within and across borders. In
Thailand, we see a few distinctive characteristics of IT outsourcing services.
- Full scope of IT operations. This is to outsource the entire IT resources and operations
including location, equipment, hardware, software, staff, facilities, communication and other
necessities to the third-party service providers. By that, financial institutions will not involve in
those operations but rather assign a coordinator to monitor the performance of the provider.
- Selective areas of IT operations. With this, a financial institution may acquire a certain
service of a provider, for example, renting the facility of a service provider to operate its
back-up hardware and software.
Both full and selective scopes of outsourcing can be carried out with a third-party service provider
residing domestically or abroad. This raises supervisory concerns. Since financial institutions' data
including customer and transaction data are processed by other parties, A financial institution must
ensure its data integrity, security and confidentiality to prevent data leakage and mishandling.
Moreover, though operated elsewhere - whether domestically or abroad, system reliability and
availability still fall under the financial institutions' responsibilities. All of these issues can in fact
impact the institution's reputation, image and credibility.
E-banking frauds in Thailand
E-banking, unfortunately, also brings about electronic frauds. There are two major kinds of frauds
thriving in electronic payment environments in Thailand: card-based and networks-based frauds.
Card-based frauds include counterfeited ATM and Credit cards, and Skimming, which involves
copying the magnetic stripe encoding from debit or credit cards to forged cards The network-based
fraud is called "Phishing". This is an identity theft whereby Internet hackers trick some naïve
customers into revealing their sensitive information such as User ID and password through fake email
addresses, through social engineering, or spy ware. The Bank of Thailand has recently issued
notifications to address these issues and encourage financial institutions to raise customer awareness
of such frauds through education.
As stated earlier, financial institutions now take advantage of IT to innovate financial products and
services. Such innovation brings to a financial institution new dimensions to traditional risks,
which include strategic risk, credit risk, market risk, liquidity risk and operational risk. Therefore, the
lack of efficient and appropriate controls may amplify the likelihood of each risk and its impact. Internet
banking, e-money and IT outsourcing are good examples that highlight the importance of IT
supervision. At this point, may I draw your attention to the next topic which is IT risk-based
supervision.
3. IT risk-based supervision
BOT has adopted risk based supervision for the past several years.
Supervision objectives:
The primary objective of BOT supervision is to encourage FIs in Thailand to conduct banking business
in a safe and sound manner and consistent with related laws, rules and regulations. It is also our
duties to ensure that supervisory framework is keeping up with demand from the financial community
as well as with market innovation, international best/ sound practice; finally, to protect customer
rights as well.
IT risk-based supervision helps ensure the safety and soundness as well as legal compliance of a FI.
As already mentioned, IT does not trigger new type of risks but brings in new dimensions to traditional
banking risks. At this point, I would like to first give you the definitions of risks directly associated with
IT. May I begin with strategic risk.
Scope of IT risk-based supervision:
1. Strategic risk
Strategic risk arises from adverse business decisions or improper implementation of those
decisions. Use of technology can create strategic risk when management does not adequately plan
for, manage, and monitor the performance of technology-related products, services, processes, and
delivery channels.
2. Operational risk
Operational risk is the risk in the areas of security, data confidentiality, data and system
integrity, and outsourcing causing problems with product and service delivery. This type of risk
often results from failure to establish adequate security measures, contingency plans, testing, and
auditing standards. Operational risk can increase when a financial institution hires outside service
providers to design products, services, delivery channels, and processes that do not fit with the
financial institution's systems or customer demands. Deficiencies in system design, implementation, or
maintenance of systems or equipment also tamper with data integrity.
The IT exposure usually does not limit to just these two risk types. Improper IT management and
operation can lead to compliance risk and reputational risk.
3. Compliance risk
Compliance risk is arises from violations of, or non-conformance with, laws, rules, regulations,
or ethical standards. Some new technologies raise unexpected compliance issues. For example,
transactions conducted through the internet can also raise questions regarding jurisdictional authority
over those transactions. Cross border activities raise a number of concerns to supervisors on how to
supervise banking businesses with no physical presence in the country, and also how to effectively
manage risks involved in cross-border transactions.
4. Reputational risk
Reputational risk arises whenever technology-based banking products, services, delivery
channels, or processes generate adverse public opinion. For example, breaches of security and
disruptions to the system's availability can damage financial institutions' reputation. Also, system
disruptions or doubts about the integrity of the system or data could result in a loss of confidence in
electronic delivery channels as a whole, and can potentially affect other e-banking providers.
IT risk-based supervision focuses on strategic and operational risks.
Strategic risk
Supervisory objective
In strategic risk supervision, supervisors have to ensure that Financial institutions have
efficiently managed their IT resources and are prepared for the future development of core
businesses.
Supervisory areas
Therefore, to achieve such objective, supervisors will assess risks that may arise in the following
areas.
Policy perspectives
Since enterprise activities require information from IT to meet business objectives, effective IT
strategic planning is mandatory. The strategic plan refers to how to utilize IT in an organization. IT
must be aligned with and enable the enterprise to take full advantage of its information, thereby
maximizing benefits, capitalizing on opportunities and gaining a competitive advantage. As such, IT
policy, plan and procedure are the concentrated areas for supervisors to examine. We anticipate a
financial institution's policy to cover all necessary areas pertaining to IT activities including contingency
plan, security, and out/in-sourcing. In addition, the policy should cover new product issuance such as
internet banking and e-money. The process of formulating, implementing and maintaining of such
policies should be considered. A continuous risk assessment and monitoring should also be part of an
area of examination.
Management support and oversight
It is ultimately a responsibility of a financial institution's board and management to extend governance
to IT and provide the leadership, organizational structures and processes to direct and control the
enterprise. Management must monitor to ensure that IT resources are properly managed to promote
business objectives.
IT governance
During the last few years, financial institutions have increasingly invested in technology infrastructure
to improve their internal processes and servicing capabilities. Investment in technology infrastructure
normally involves huge amount of funds and other resources. Technology also carries risks, which can
adversely affect financial institutions if not properly managed. Financial institutions need to understand
the strategic importance of IT, manage IT to effectively deliver value to business, and mitigate risks
arisen from the use of IT.
IT governance focuses on how financial institutions make the best use of their invested technologies. It
is a high-level IT control framework related to the formulation of IT strategies, the management of IT
processes to deliver value, the performance measurement, and the management of IT-related risks.
We believe that effective IT governance process will enable financial institutions to effectively utilize
their technologies to meet business' expectations and to add value to their business. In that way, IT
will truly help the organizations to improve competitive advantage, customer satisfaction, cost
efficiency, and ability to grow and innovate the business. Eventually, it will help financial institutions to
realize better return on investment in technology infrastructure.
Independent audit and review
A financial institution is required to have IT independent audit and review all IT related areas to ensure
that the board and management emphasize IT as a key business driver. IT controls are evaluated and
those having a material impact on financial processes are specially focused. The assessment of these
controls should be conducted on a regular basis. In Thailand, we require financial institutions to
perform IT audit at least once a year. In addition, we also require an independent assessment of
internet security.
Now, let's turn to operational risk.
Operational risk
Supervisory objective
In operational risk supervision, supervisors have to ensure that financial institutions have
adequate security measures, data integrity process and contingency plans in place.
Supervisory areas
The focal point when we evaluate operational risk regarding IT is to ensure a financial institution
establish adequate control mechanisms in IT process and procedure. The control can be done either
technically or manually, or both. Segregation of duties is an example of manual control which should
be maintained especially for critical functions or processes to prevent fraud. Additionally, controls
should be embedded in the system to ensure integrity of input, processing and output. Adequate
physical and logical access controls are important since they can protect data, system and resources
from unauthorized persons. Finally, a financial institution should provide alternative resources for
backup and recovery, and ensure that they can be available during an event of a disruption. All of
these matters are about security and confidentiality, integrity and availability which will be
elaborated more in the next slide.
Security and confidentiality
Supervisory objective
An objective of IT supervision in security and confidentiality areas is to ensure of IT activities
being conducted in a secure and control environment and of data confidentiality and integrity
by laws, rules and regulations.
Supervisory areas
To achieve such objectives, the following points should be addressed by supervisors.
Physical security: It is about control for environmental exposures due primarily to mother-nature
events such as lightning, storms, flood and etc. Others may be caused by human acts such as
terrorist, fire, electronic shock and equipment failure. The result of such conditions can damage
computer system, equipment and facilities which in turn cause an interruption. Another type of physical
security is physical access controls which aim to prevent unauthorized access to computer system,
equipment and facilities as well as data. Examples of this type of controls are electronic door locks,
biometric door lock, video camera, etc.
Logical security: It is data, system and network access control. Lack of adequate logical security
may be prone to technical exposure to unauthorized implementation or modification of data and
program at either the network, platform, database or application level. A classic example of this type of
controls is the use of user ID and password.
Supervisor should be able to analyze and evaluate the effectiveness of both physical and logical
access control in accomplishing financial institution's information security objectives.
Integrity
Supervisory objective
An objective of IT supervision in an integrity area is to ensure reliability and completeness of
system functionality in order to verify that data is processed in an accurate and timely manner.
Supervisory areas
Therefore, supervisors need to review and assess whether financial institutions have sound
application control in place. In this regard, they should have control built in the procedure and
programmed in the system to ensure the integrity of input, process and output. In a large financial
institution using various applications, a sample of applications including core banking applications and
management information system (MIS) would be examined for control adequacy. Data and system
integrity can reflect the effectiveness of system development, acquisition and change control
procedure. Therefore, it is necessary to cover those areas in the scope of supervision.
Availability
Supervisory objective
An objective of IT supervision in an availability area is to ensure financial institutions' readiness
for being able to run business without interruption during an occurrence of disruption.
Supervisory areas
In this regard, supervisor must review and assess the scope of business continuity plan which
should be established in an enterprise-wide basis. Also, the best way to determine how well the plan
works or which portions of the plan need improvement is through testing. We encourage financial
institutions to test the disaster recovery plan at least once a year. Finally, financial institutions should
have a procedure in place to update the plan regularly.
4. IT examination and risk assessment
Objective
The objective of IT examination and risk assessment is to assess a financial institution's IT
management and operation to ensure accuracy and reliability of information system as well as
its alignment with the financial institution's business objectives which can eventually bring in
the safety and soundness.
IT examination process
There are three main steps to be taken when performing IT examination.
1. Pre -examination
This step is the process of gathering the information about the financial institution on which we will
conduct examination. The information including business nature, objective, policy, plan, IT
infrastructure and organization chart can be obtained from previous examination reports, internal
database and external sources. At this step, IT examiners will coordinate with Onsite examiners
to share information and identify areas of concerns. With all of the gathered information, examiners
can preliminarily assess IT role in supporting FI business and prepare scope of examination.
2. Onsite examination
The next step is to conduct onsite examination at a financial institution. Normally, IT and Financial or
Safety and Soundness examinations are performed concurrently where their examination results are
integrated together for an overall risk assessment. At this stage, examiners gather information through
a variety of examination techniques such as interview, observation, review of documents to summarize
the findings.
3. Post examination
After the findings, examiners will assess the risks of those findings and report on significant issues.
The risks regarding IT are assessed and assigned to IT risk rating which is divided into three
levels, high, medium, low with respect to the probability of occurrence and the degree of
impact to a financial institution. For significantly high risk issues which indicate serious
control weaknesses which then need an immediate correction, we could enforce the FI to take
corrective action within a predetermined period of time. And, it is our duty to monitor
compliance with such an enforcement action. This is a process of follow-up
The risk assessment is performed not only when conducting IT examination but also when
considering new products and services' applications. Currently, the products and services that
need BOT's IT risk assessment prior to approval are internet banking and e-money.
IT Risk Assessment Factors, at a minimum, include:
Security: The financial institutions have to prove that they have adequate security measures in place
to ensure that information is protected against harm from threats leading to different types of
vulnerabilities such as loss, inaccessibility, alteration or wrongful disclosure.
Risk management: Risks of new products and services must be thoroughly considered by the
financial institution. There should be a policy and procedure in place to manage the risks.
Internal control: The financial institutions should set up preventive, detective and corrective control
mechanisms that may be built in the operating procedure or programmed in the system involving new
product and service delivery.
Contingency plan: The financial institutions should formulate the contingency plan to carry on the
business under unexpected events.
Staff development: The financial institutions should establish a staff development plan to enhance
personnel capabilities to conduct new product and service operations.
Last topic of presentation is new challenges for BOT supervision and ways to overcome.
5. New challenges for BOT's IT supervision and ways to overcome
(1) While the financial industry is moving fast with innovations and new developments,
supervision needs to ensure the stability of the financial system. Supervisors need to
encourage financial institutions to operate their businesses in a safe and sound manner as
new delivery channels or services could exacerbate some of the same risks inherent in
traditional banking.
However, the prudential regulatory framework has to be congruent to the evolution of the
e-banking business. Therefore, we need to strike a balance between the need to maintain
the stability of the financial system and to foster developments, competition, and a
level playing field.
There are ways to overcome this challenge.
- Regulators need to keep up with the development of the market while being proactive in
formulating the regulatory framework. In the case of Thailand, BOT takes an active role in
meeting regularly with financial institutions and IT companies to exchange views and
experiences on the development of the businesses and IT environment.
- In the process of drafting policies, we often seek out the view from our fellow regulators
to ensure that our policy are in line with market and international practices, as well as to
help us anticipate problems that may arise in implementation.
- The final drafts of policies are sent out for comments from key stakeholders in and outside
the Bank of Thailand, especially the industry, to ensure that the policies are practical and not
posing any undue burden on financial institutions.
- We also make sure that revision of regulations and guidelines is conducted regularly to
ensure that e-banking policies are keeping with demand from the financial community as well
as with market innovation and international best practices.
- To maintain proactive supervision, the IT risk-based supervision is conducted
continuously, updating each of bank's IT risk profile on a regular basis and performed
overall assessment in certain areas. In case of getting a report of any incidents, we have to
thoroughly analyze the impact on the financial institution system and consumer. And, to
prevent recurrence of such incidents, we may urgently issue notification to financial
institutions to provide preventive, detective and corrective control measures in self
and customer protections.
(2) With the rapid development in technology, in the near future, apart from the known internet
banking, we will see more of the "non-traditional" banking products. The providers of these
services will not only be limited to banks, but also non-banks. Of course, the extent to which
a non-bank provider can offer these new products and services depends on the rules and
regulations of each country. To promote a fair competition between service providers that
are banks and non-banks is a challenge for the authorities.
BOT is in course of shifting from supervision by institutional basis to transactional
basis which will enable us to overcome such a challenge.
(3) After the financial crisis, the need for strengthening supervision of financial institutions has
been stressed as a major priority to BOT. The monitoring of financial institution systems
becomes both more critical and more challenging for supervisors. The "Core Principles for
Effective Banking Supervision" have become the most important global standard for
prudential regulation and supervision. They are developed by the Basel Committee on
Banking Supervision in cooperation with supervisors from noiQ-10 countries, providing the
international financial community with a benchmark against which the effectiveness of bank
supervisory regimes can be assessed. IT supervision is also included in the Core Principles
such as CP9 (MIS), CP 11 (Information System to comply with Country Risk and Transfer
Risk), CP13 (Contingency Plan, MIS, Business Resumption Plan) and CP21 (verification of
information from bank records by on-site examination and/ or external audits). Therefore,
How to achieve full compliance with the Core Principles becomes another challenge
for BOT supervision.
The BOT, with the assistance of the IMF and the World Bank, has finished our
self-assessment of our compliance with the Principles. Weaknesses in the existing system of
supervision and regulation have been identified, and will form a basis for future remedial
measures.
The other two challenges involve the creation of internal expertise for IT supervision in order
to be more responsive with technological evolution.
The first is to enhance supervisors' technical know-how. The way to overcome this
challenge is to provide regular training to supervisors. Some in-depth technological
knowledge is necessary. The supervisors should be given tools to keep up with new
technology, vulnerability, threats and other forces. Research and development for IT
supervisors should be considered.
Another challenge is to formulate policy with flexibility, forward-looking and reflecting
changing business nature. One way to overcome this challenge is to broaden the view
and knowledge of supervisors which can be accomplished by all aforementioned matters.
6. Conclusion
In conclusion, technology is still changing and financial institutions tend to depend more on it. BOT
has no intention to interfere with financial institutions' innovation; however, while technology is
becoming more and more complex, so are the threats. A financial institution needs to have active IT
management to provide secure and reliable services to customer. Supervisors need to keep updates
with those new issues. In addition, it's not only a supervisor's job to maintain the stability of banking
industry but also banker's. Both sides should put efforts together to create a safe and sound
environment and should always recognize the significance and effects of technology towards the
banking industry. So, working in a proactive and more collaborative manner is the solution for
today's supervisors'.