Without major investment in ageing bank IT systems the banking industry could be vulnerable to cyber-attacks and operational breakdown according to bank auditors. The report Audit Insights: Banking, issued today by ICAEW, highlights that banks have under-invested in renewing core systems and no UK bank of any scale that has been in business for many years has an integrated or fully modernised IT system.
The Audit Insights:
Banking report, launched by ICAEW’s Financial Services Faculty at its Banking Conference on 18 October gives collective insights from bank auditors on a wide range of risks facing the banking sector, bringing these issues into the public domain. It not only addresses the requirement for banks to make major investment in IT, but also challenges them to think differently about how their business is run, how staff are motivated and about the banks control and governance systems. The four flags identified are the need for major IT investment, for cultural and behavioural change, for banks to review their business models to respond to the post crisis regulatory landscape and the challenge of compatibility and consistency of performance reporting.
Iain Coke, Head of Financial Services at ICAEW:
Bank core IT systems are an ageing patchwork of different systems, held together by complex interfaces. They generally work but are increasingly fragile, inflexible and in need of replacement. Replacing them will not be easy and will create the risk of system failures which could disrupt the payments system. No-one knows how much a full system upgrade will cost as major IT projects are notoriously hard to budget for. However, it is likely to cost the largest banks several billion pounds.
Kari Hale, chairman of the ICAEW Bank Auditors’ Working Party and Bank Audit Partner at Deloitte commented:
Banks face a number of evergreen risks that don’t change much over time. In the run-up to the financial crisis too much belief was placed in advances in risk management, and too many people forgot that the fundamentals had not really changed at all. It is important that, in the future, people do not once again fall into the trap of believing that things are different this time
The report also highlighted the inconsistency of banks’ internal models, “Bank capital ratios are a cornerstone of the regulatory system and are increasingly used by analysts to compare banks’ comparative riskiness.” Said Kari, “The larger and more complex banks typically use internal models to calculate their capital ratios, but the operation of these models is subject neither to regular inspection by regulators nor to audit. Recent work by regulators has highlighted inconsistencies between banks internal models. Given their importance, the reliability of these internal models is a major issue that needs to be addressed.”
Banks currently face pressure from all sides to change their culture, become more financially secure and invest for the future while facing escalating regulatory penalties. Our report highlights the major issues that banks and their boards are working hard to address, but where there are no easy answers. Addressing them will require long term thinking at a time when there are many short term pressures affecting banks, including regulatory pressures to make them more stable and secure.