, on internal data. both should be characterized by frequent and candid conversations between bank leadership and the leadership of the examination team. both should help bank leadership to understand what is considered sound practice. both consultants and supervisors must at some level analyze the tangible results of the management processes, be that loan quality or some other measure of corporate performance. finally, to be successful both consulting and examination must be carried out with the minimum of on - site disruption after careful off - site planning. sharing knowledge among examiners another similarity between consultants and examiners is that there is much practical experience gained by the professionals that must be shared with their co - workers or team members or even more broadly among the community of professionals. for the community of supervisors, these insights are the results of many years of first - hand experience with banks. consultants have developed the fancy phrase of “ knowledge management ” for the process of building individual insights, sharing them with others, and finally applying the collective knowledge through an individual professional working with a client. the challenge, of course, is how to complete this cycle of “ build - share - apply ” when the community spans several thousand people, across multiple locations and, possibly, multiple agencies. this gathering is an example of one possible solution to this challenge. technology, through group software and the creation of more common, interagency tools, might prove to be another solution. i shall return to the need for broadly shared common technology platforms. distinctions between consultants and supervisors now let me turn to the numerous differences between consultants and supervisors. in adding value to the banking industry, supervisors have a major advantage over consultants in that we have the standing and authority to influence actions industry - wide. that ability to influence state or national policies is an important aspect of our work and one that helps to motivate and retain our key people. this fact ties directly to the sound practice papers we provide. as supervisors, we need to share what we learn to help the industry manage and control its risk. to develop industry guidance, we do well in looking to leaders within the industry, and to institutions that know their business best. the knowledge we gain from our associations with so many banks also accommodates the development of new regulatory paradigms. the recently adopted rule for market risk that is based on the internal models of banks is a good example. without the in - depth access to virtually all of the world ’ s leading trading banks and to their experiences and observations, supervisors collectively could not have developed their own understanding

management programs. later this afternoon, you will hear more on this from our panel of it examiners on these resources, recent observations from the field, and risks associated with ai. ransomware attacks continue to target individuals, businesses, and governments across the country and often result in significant financial and operational harm. combating ransomware requires that an organization make investments in people, 1 / 2 bis - central bankers'speeches processes, and technology. often, these attacks are successful because wellintentioned staff have their guard down, or they are not effectively trained to identify and respond to a potential incident. employees can be your greatest strength, but also your weakest link when it comes to protecting digital assets. that's why it is critical that cyberprograms are built upon a solid foundation that includes training staff to quickly respond to suspicious activity. this reinforces the importance of a skeptical approach in helping to safeguard information. today and tomorrow, federal reserve staff, law enforcement, and industry stakeholders will share their perspectives on ransomware incidents, including restoration of key payments - related functions, cyberinsurance, payments - related risks, and financial considerations during an incident. finally, a cybersecurity program would not be complete without a comprehensive testing and exercise plan. by incorporating regular testing, a bank can identify strengths and weaknesses in their current strategies. they can then leverage this information to enhance resiliency, resulting in a higher level of preparedness when an incident occurs. tabletop exercises like the one facilitated tomorrow with ibm are an excellent way to test a cyberdefense strategy against multiple scenarios, including those involving a third party and payment systems. in closing, outreach events like this workshop, the february 2024 ask the feda® session with the cybersecurity and infrastructure security agency, and our recent virtual " office hours " on the 2023 third - party risk management guidance enable us to connect and share resources. these opportunities help us to better support industry management of cybersecurity and other operational risks. i would like to thank the federal reserve banks of chicago, kansas city, and st. louis for organizing this event, and i hope you enjoy the workshop. 1 the views expressed here are my own and are not necessarily those of my colleagues on the federal reserve board or the federal open market committee. 2 / 2 bis - central bankers'speeches