Bandid Nijathaworn: Meeting security and risk challenges in the finance and infrastructure sectors Opening address by Dr Bandid Nijathaworn, Deputy Governor of the Bank of Thailand, at the seminar on “Meeting Security and Risk Challenges in the Finance and Infrastructure Sectors”, Bangkok, 11 February 2008. * * * Distinguished guests Ladies and gentlemen, It is a great pleasure to be here this morning, to give this opening remark for the seminar on “Meeting Security and Risk Challenges in the Finance and Infrastructure Sectors”. And those of you who come from abroad to join the seminar, let me also welcome you to Bangkok. Today, risk management and security concern are important management issues for all businesses, as companies increasingly operate in an evolving global environment of rapid technological change and innovation. Great advance in information technology has brought about radical changes in the way modern businesses are conducted and managed, and in the way new products and delivery channels are created. Yet while these changes have imparted important benefits to businesses in terms of profitability and efficiency, they also pose greater challenge in terms of the risk exposure and the management of risks. In this regard, I think financial services and banking is of no exception. It is one industry that continues to face this important challenge. Banking business, basically, is about risk-taking, managing risk and profiting from risk. The growing sophistication and complexity of financial activities, brought on by financial innovation and globalisation, have made risk management a key and important task for all banks. In particular, the integrity of real-time information on changing prices, valuation of financial position, and warning on breaches of internal control is most critical now for bank’s top management in taking timely and prudent decision. The recent episode in the global financial market has demonstrated again the costly implication of weaknesses in this area. For these reasons, information technology and its management has become a key part in business strategy as it can provide lever to create competitive edge and innovate business model, especially for providing customer reach in a cost-effective manner. But on top of this, pressure from competition and the need to cut costs also have forced banks to rethink their business models and strategies, leading to fundamental changes in the business process that include the proliferation of outsourcing, electronic banking, and the use of the internet. Again, while these developments are positive, they also expose banks to a different aspect of risk management, for example how to manage and control outsourced activities. Such an environment, if not properly managed, can lead to greater technological and security risk, as well as to malicious activities. For central banks, one of our key mandates is to ensure financial system stability. A key part of this is to make certain that banks and financial markets perform their functions efficiently, and that their business poses no systemic threat to the financial sector and the economy. Hence, for a long time now, the main focus of bank regulation and supervision have been to ensure that banks manage their exposure to risk effectively. These include exposure to credit risk, market risk, liquidity risk, and operational risk. Much progress has been made in honing the approach for a more accurate assessment and a more effective management of risk, culminating in the Basle II, which is a global standard for bank’s risk management. But, in spite of what has been achieved, mishaps can and do happen. From time to time, we still read about banks suffering large losses that originate from the under-management of these risks. More often than not, the losses are linked to a breach of internal controls or systems that have been put in place to rein in excessive risk-taking in the first place. Ladies and gentlemen. On the security risk aspect, the growth of electronic banking and real-time funds transfer have made the challenge of risk management even greater, as the nature of security risk to banks has shifted considerably. Clearly, the main concern now is not so much about ensuring property security or preventing theft of physical assets, but about ensuring information security and preventing identity theft. The concern is not so much about control over access to restricted areas and cash vault, but about ensuring proper authorized access to the IT systems and the electronic funds transfer network. And the issue is not so much about keeping bank premises open after a major disaster, but about ensuring that all key banking operations and network continue to function uninterrupted under a proper business continuity plan. These are aspects of modern security risks to banks. They are part of the broader operational risks, which have received greater attention as the business of banking moves further and further away from face-to-face transactions. In Thailand, to address this challenge, we as bank supervisors, have over the past years provided best-practice guidance to the local banking industry in a number of important areas, including loss data collection, business continuity management and plan, IT security, outsourcing, and IT disaster recovery. In addition, Basel II will, for the first time, impose an explicit capital charge on banks for operational risks, on top of the traditional credit and market risks. Implementation of Basel II in Thailand will begin at the end of this year, and the preparation for its implementation is progressing on schedule. I am confident that with the implementation of Basel II, the quality of risk management by banks in Thailand, especially with respect to operational risks, will improve further. I have taken a lot of your time in this opening remark. But the topic of today’s seminar is important. So, without further ado, may I declare the seminar open and wish you all a successful deliberation over the next two days. Thank you again for the invitation, and thank you for your attention.