Enterprise Risk Management - Financial Services Industry Spotlight

Five Questions Financial Services Leaders Should Ask About Enterprise Risks

Today’s financial services organizations operate in a technologically interconnected environment that leaves them exposed on every front. As the service offerings expand, organizations may struggle with new technology and regulations while planning for emerging risks such as blockchain and bitcoin, quantum computing, and smart contracts. Leaders have to be forward thinking while monitoring the ground in front of them.

Some organizations may manage enterprise risks in isolation — a compliance report here, a heat map there — treating risk management as a periodic exercise rather than an operating discipline. That approach is no longer sufficient. A strong enterprise risk management (ERM) strategy connects risk directly to performance, giving leaders the coordinated visibility and accountability needed to protect operations and make faster decisions under pressure.

The following questions and answers shed new light on ERM and how an ERM assessment can help financial services leaders reduce risk and operational disruption.

What Are the Most Significant Enterprise Risks Facing Financial Services Today?

• Regulatory uncertainty is a top risk for financial services organizations as digital asset regulations, tax requirements, and reporting obligations continue to evolve. Leaders facing compliance challenges may also feel their organizations are operating in a framework with no set rules from both tax and regulatory perspective.
• Cybersecurity threats remain a high-level concern. Financial institutions typically are prime targets for cyberattacks and data breaches that disrupt operations and financial reporting, as well as damaging organizational reputation and stakeholder trust.
• Market volatility — often caused by factors like fluctuations in digital asset markets, changing interest rates, and continued economic uncertainty — has a significant impact on strategic planning, liquidity, and profitability for financial services organizations.
• Third-party ecosystem dependencies heighten counterparty risks because of the industry’s reliance on networks of large exchanges, platforms, and custodians. In risk, security, or compliance discussions, the term matters because problems in that wider ecosystem can affect an organization’s operations even if the issue is not with a direct vendor.
• Weak governance and resource limitations clash with the institutionalization rapidly occurring in the finance industry. Organizations without strong governance structures, mature controls, and robust ERM strategies may not have the security controls and knowledgeable staff needed to catch both slow-moving threats and risks that require immediate attention.
• Quantum computers, which process data differently than regular computers, have the potential to access encrypted, sensitive records like those held and safeguarded by financial institutions.
• Natural disasters can destroy a facility and compromise sensitive data, making a strong crisis management plan necessary to minimize operational disruptions.

How Have Top Risks Changed in Recent Years, and What New Risks Are Emerging?

• Decentralized finance (DeFi) has altered the core infrastructure of financial institutions, surfacing both new opportunities and risks. The increased use of blockchain and smart contracts requires proactive ERM and strong internal controls.
• Institutional adoption of blockchain and bitcoin is increasing — along with investor and stakeholder expectations for more comprehensive security controls and stronger governance.
• Crisis management plans have become more crucial for avoiding major operational disruptions during disaster events.
• Quantum computing use has escalated tremendously, giving bad actors tools that may not have reached their full potential yet and that financial services leaders are not prepared to defend against.
• AI innovations are providing new capabilities for both organizations and cyber criminals, while reshaping risk profiles to include new governance concerns, fraud, cybersecurity, and data management challenge.
• Data centers now present a greater burden for many organizations. In addition to the cost of building and equipping the data center, financial services organizations must also address new cyber risks to ensure both data privacy and disaster recovery.

Where Do Financial Services Organizations Most Commonly Struggle With ERM?

• Rapid growth and expanding resources can create complexity that makes it harder for leadership to maintain visibility into risks across the business. Without a coordinated ERM approach, risks may become fragmented across multiple functions.
• Controls and governance may not have been considered a priority. Digital asset organizations may focused first on survival and growth, leaving governance, controls, and risk management practices as secondary priorities. As the industry matures, stronger checks and balances are becoming increasingly important.
• The financial impact of crypto mining, data centers, equipment failures, outages, and disruptions can be significant, especially when ERM has been neglected.
• Organizations may fail to develop proper disaster recovery plans, which is especially risky when failing to recognize risks associated with areas prone to natural disasters.
• Leaders may concentrate attention on a single risk while overlooking other threats that could affect operations, compliance, or business strategy.
• Fast-growing digital asset companies may have high employee turnover that results in the loss of important tax, finance, and governance knowledge. It’s crucial to document and retain processes and other data to avoid compliance and operational challenges.
• Leaders may fail to document institutional knowledge — particularly about the finance, tax, and accounting functions — when employees leave the organization.

How Can Financial Services Leaders Better Connect Risk Management to Operational Performance and Strategy?

Contact BDO today to learn more about our Enterprise Risk Management services and how we can help your organization build resilience for the future.