Tarisa Watanagase: Mitigating fraud risk in financial institutions Keynote address by Dr Tarisa Watanagase, Governor of the Bank of Thailand, at the seminar on “Mitigating Fraud Risk in Financial Institutions”, Bangkok, 29 April 2008. * * * Khun Kaisri, Distinguished Guests, It is my great pleasure to join you at this seminar on “Mitigating Fraud Risk in Financial Institutions”, hosted by KPMG Thailand. I would also like to thank the host for giving me this important opportunity to share the views of the Bank of Thailand on this topic. The globalization of the financial services industry, the increased sophistication and complexity of financial institutions and their services, and the ongoing advancement of technology continue to introduce new risks and opportunities for fraud. The pace and complexity of these advances have vastly accelerated beyond the risk associated with traditional credit and market risk activities. One of those emerging risks in financial institutions is fraud risk, which needs to be effectively controlled through effective governance and sound operational risk management processes. Fraud risk in financial institutions has increased as perpetrators use advanced innovation and technology to identify and exploit weaknesses in banks’ IT systems, databases, and delivery channels, including ATMs and the Internet. Financial institutions must take care to ensure that system security measures are effective as a means to combat fraud. Fraud can occur in a variety of ways: the inappropriate actions of a rogue employee can cause huge losses; hackers can access a bank’s mainframe or databases, which in the past few years, has resulted in increasing losses due to the theft of confidential customers’ information. Depositors affected by ATM or Internet banking fraud also continue to increase. Although fraud is impossible to fully prevent, financial institutions can reduce the probability of fraud occurrence and minimize losses with stronger oversight and tighter controls. This leads me to the Bank of Thailand’s views on the critical elements for fraud prevention. There are three critical elements that all institutions must possess to most effectively combat fraud: Strong corporate governance, up to date systems and processes, and effective internal controls and risk management. The first and most important element is strong corporate governance. Today, more than ever, boards of directors and senior management must provide close monitoring and oversight as the business activities of their institutions are increasingly complex and as the level of sophistication of their customers continues to increase. In almost every case where fraud has resulted in huge losses, ineffective corporate governance was identified as one of the primary causes. Boards and top management must set the “tone at the top” by creating an organizational culture that places high priority on risk management, compliance with policies and regulations, and high standards of ethical behavior at every level. This is done through ensuring that comprehensive policies, procedures, limits and controls are in place for all activities and ensuring that expectations for compliance are fully communicated throughout the organization. Secondly, financial institutions’ IT systems and operational risk management processes must be up to date to reduce the risk of fraud due to system breakdowns, hackers, and processing errors. As you all are probably aware, customer information theft is rapidly increasing around the world. Technology is one area where perpetrators can often get ahead of under-prepared institutions, gaining access to databases and mainframe systems, and accessing sensitive information including confidential customer data. Key preventive measures include ensuring that IT systems and software are updated frequently to defend against hacking attempts, viruses, and other breaches. Robust system controls that carefully grant and monitor system access are equally important. Sound operational risk management goes beyond technological controls. Financial institutions should have well defined policies, procedures, and limits related to all transaction processing. In particular, those units responsible for executing cash or other transactions on behalf of their companies must ensure that controls include a segregation of duties that allows for an appropriate check and balance process. The lack of segregation of duties is usually a driving factor in fraud from trading activities. In both the Barings episode in the 1990’s and the most recent losses at Société Générale, fraudulent transactions occurred as the traders found a way to control the execution and reconciliation of their trades. That leads to the third and final critical element of fraud avoidance: sound risk management and internal controls. Financial institutions must be able to effectively identify and assess risk across their entire organization and ensure that process are in place to ensure compliance with internal policies and limits, laws, and regulations. In addition to the systems controls and the segregation of duties I have already mentioned, financial institutions need to have effective physical control of assets, clearly defined authorization limits and exception processes, and comprehensive risk management reporting to management and the board of directors. After management and the board of directors, the institutions’ internal audit and compliance units should be the first line of defense in preventing and identifying fraud. Those are the key responsibilities for institutions in the fight against fraud; however, one of the Bank of Thailand’s key mandates is to ensure the safety and soundness of the financial system. An essential part of this is to make certain that each financial institution has an effective risk management system in place to identify, measure, monitor, and control the risks to which the institution is exposed. To assist financial institutions in their efforts, the Bank of Thailand has provided sound-practice guidelines to local banking industry in a number of important areas such as corporate governance expectations, operational risk management, operational loss event collection, and security of electronic financial services. We will continue to provide guidance to assist our institutions. In addition, through the supervisory process, we will continue to look for weaknesses in our supervised institutions that expose them to potential fraud. While the Bank of Thailand is here to support institutions in this manner, please keep in mind that the primary responsibility for fraud prevention remains with the board of directors and management. I would be remiss in not addressing the upcoming launch of the revised Basel Capital Accord. Basel II, as it is more commonly known, establishes expectations for financial institutions’ risk management processes. In addition to requiring an explicit calculation of capital requirements for credit and operational risk, Basel II requires institutions to have robust consolidated risk management processes. Institutions are expected to ensure that they have adequate capital for all other risks as well. Through the supervisory process, regulators may also require additional capital for institutions whose risk management processes are not fully compliant. Institutions can best address the expectations of Basel II by maintaining or establishing sound risk management processes. In Thailand, the implementation of Basel II will start at the end of this year, and the preparation for its implementation is progressing on schedule. As our institutions complete the implementation of Basel II, I firmly believe that we will see a commensurate improvement in the quality of risk management among our banks, particularly in the operational risk area. To conclude, I would like to reiterate the importance of preventive measures to combat fraud, and I applaud your efforts in holding a conference on this topic as it shows that you place a high degree of importance in this area. While no institution can ever be expected to be completely fraud proof, institutions maintaining key elements I discussed will have taken a big step towards fraud mitigation and avoidance. I wish you great success for this seminar. I hope you accomplish your objectives and I know you will all take a lot of valuable information from this timely and meaningful event. Thank you again for inviting me to join you today and thank you very much for your attention.