Blogs
July 2022 GRC Recap - What’s Trending in the Governance, Risk, and Compliance Universe?
- GRC
- 01 August 22
6 min read
Introduction
Two things were on the top of our minds the past month: The sweltering heat and rising concerns about a macroeconomic downturn.
Almost all of the Northern Hemisphere experienced record-breaking heat waves this past month. This has not only created a sense of urgency to address climate change, but has also brought the spotlight on environmental, social, and governance (ESG) risk, reporting, and regulations.
US President Biden announced new executive steps to combat climate change but stopped short of issuing the much-called climate emergency declaration. Meanwhile, on the other side of the Atlantic, the UK is exploring a new task force to help investors measure the ‘S’ in ESG.
The interconnectedness and dynamic nature of risk continued to make headlines in July 2022. Gartner flagged the unusually high degree of interrelated risks as it identified concerns of a macroeconomic downturn as the top quarterly emerging risk in Q2 2022.
State-sponsored cyber attacks and key material shortages also made it into the top five. Chris Matlock, vice president with the Gartner Legal, Risk & Compliance practice, writing in the Gartner’s Quarterly Emerging Risks Report, had this to say: “The top five risks reported by respondents were notable both for their interconnectedness and origination outside of the organization.”
A lot more happened in the month of July. Scroll down for a quick glance at the top stories that made it to the headlines in the world of risk, operational resilience, compliance, IT and cyber risk, and ESG.
Trending in Operational Resilience, Business Risk, and Compliance
- The war in Ukraine has triggered a re-evaluation of systemic risks. Robert Muggah, co-founder, SecDev Group and co-founder Igarape Institute, in an article for the World Economic Forum, said. “…systemic risks are proliferating faster than the systems in place to address them” requiring both the private and public sector to adopt measures to reduce risk exposure and cultivate the “mindset, capabilities and partnerships to strengthen risk resilience.”
- The Governmental Accounting Standards Board (GASB), an independent organization that establishes accounting and financial reporting standards for U.S. state and local governments released a proposal that will require governments to disclose information on key risks that could impact the level of services they offer.
- The Allianz Risk Barometer 2022 highlights the most important global business risks for 2022. The top three risks were cyber incidents, business interruptions, and natural catastrophes.
- A new article titled, “Why Front-Line Whistleblowers Are Crucial To Your Organization’s Risk Posture” by Gaurav Kapoor, co-CEO and co-Founder of MetricStream explores the benefits of building a culture of compliance for front-line workers.
- The 2022 State of Risk Oversight by the American Institute of Certified Public Accountants (AICPA) found that more than two-thirds of organizations surveyed “still cannot claim they have complete ERM in place.”
- Deloitte’s 2022 Banking Regulatory Outlook advises banks to maintain focus on the basics including good governance, risk management, internal controls, and financial strength while also getting ready for emerging laws and regulations in the areas of climate, financial inclusion, and digital assets.
- The 13th "Cost of Compliance Report" published annually by Thomson Reuters is now out. The speed and volume of regulatory change and shortages of skilled professionals have been highlighted as the most urgent challenges but on the positive side, most compliance professionals felt that outsourcing, and new technology, especially regulatory technology, will help plug some of the gaps.
- Potential measures that will oversee and strengthen the resilience of services provided by critical third parties (CTPs) to the UK financial sector have been set out by the Bank of England, the Prudential Regulation Authority and Financial Conduct Authority.
- The Hong Kong Monetary Authority has released the seventh Guide of the series that focuses on Third-Party Monitoring and Risk Management (TPRM) and associated Regtech solutions.
- Compliance measures to address sanctions enforcement has become a core priority for the US Department of Justice (DOJ).
Trending in Cyber Risk and Compliance
- A new report titled “Treading Water: The State of Cybersecurity and Third-Party Remote Access Risk” by the Ponemon Institute is out. Top stats to note:
- 54% of organizations have experienced a cyberattack in the past 12 months
- 64% of organizations still rely on manual monitoring procedures, costing an average of seven hours per week to monitor third-party access
- 49% of organizations have experienced third-party attacks in the past 12 months despite being among the 60% who have made changes to their cybersecurity structure
- The National Institute of Standards and Technology (NIST) has updated its cybersecurity guidance for the health care industry.
- A new article by the World Economic Forum (WEF) offers insight into how the cloud has brought a shift in cybersecurity.
- New research by Trend Micro finds that 54% of global organizations feel their cyber risk assessments are not sophisticated enough.
- The Office of the Superintendent of Financial Institutions (OSFI), Canada, released its final Guideline B-13. The guideline for technology and cyber risk aims to provide specific guidance to enable organizations to balance innovation and risk management.
- New findings from Skybox Security found that the top cybersecurity challenge was the insufficient identification of cyber risks with 40% of CISOs saying that they are not prepared to handle the rapidly evolving cyber threat landscape.
- A new cybersecurity law has come into effect in the state of Virginia. The law requires agencies and local governments to report cybersecurity incidents within 24 hours of detection.
- A recent article in the HIPAA journal outlines the compliance requirements of the draft American Data Privacy and Protection Act (ADPPA). The first draft of the bill was released in early June.
- A joint cybersecurity advisory on North Korean state-sponsored cyber actors use of Maui ransomware has been released by the CISA, FBI and Treasury Department
Trending in ESG
- 27% of Chief Supply Chain Officers have conducted a climate change risk assessment according the 2022 Emerging Priorities in Supply Chain Survey by Gartner. However, only 19% of surveyed companies were found to be using tools and technology to assess climate change risks.
- In a recent Bloomberg article, Morgan Lewis attorneys discuss the importance of the ‘S’ in ESG and what employers need to know about human capital disclosures.
- Only the E matters in ESG and the E should represent ‘emissions’ not ‘environmental’ says a new article published in the Economist.
- The Environmental Risk Outlook 2022 has highlighted the cascading flow of climate risks, especially the importance of assessing the second-order threat of climate risks.
- A new article explores the transatlantic implications for multinational companies that will result from emerging EU ESG requirements
- A new report by Avanade and the European Financial Management Association finds that only 53% of banks will be ready for ESG regulatory reporting.
- Accessing relevant ESG data remains a key challenge facing banks. Read the measures outlined by flow’s Desirée Buchholz.
- The European Central Bank outlines key steps to incorporate climate change into its monetary policy operations. The measures aim to reduce financial risk related to climate change, promote transparency, and facilitate a green transition of the economy.
July 2022 Webinars at @MetricStream
The webinar Managing the Deluge of New Cryptocurrency and Digital Asset Regulatory Change saw thought leaders Jennifer Clarke, Senior Editorial Manager, Regulatory SME, CUBE, Alex Royle Head of Compliance and Regulatory Affairs, EMEA, Galaxy Digital, and MetricStream Product Marketing leaders Loren Johnson and Suneel Sahi discuss the risk and compliance landscape surrounding cryptocurrency and digital assets.
In the webinar Connected, Continuous and Constantly Changing: Tackling the Intersection of Cyber and Third-Party Risks, third-party and cyber risk expert Linda Tuck Chapman and MetricStream Product Marketing leaders Loren Johnson and Patricia McParland participated in an interactive discussion on what’s new, what’s next, and how to thrive in an increasingly complex, connected web of risk.
Get Ready for the GRC Summit
MetricStream’s GRC Summit 2022—much looked forward to by the GRC community as a platform to share insights, exchange best practices, and more importantly to discover what's next in GRC—is back, with an in-person event as we celebrate the 10th year.
Meet us on November 8th and 9th in person at the Royal Garden Hotel in London, UK. Register Now.
Jump to Topic
Related Resources
Blogs
GRC Roundup – June 2022 | What’s New in Governance, Risk, and Compliance?
- GRC
- 01 July 22
6 min read
Introduction
As we enter the second half of 2022, businesses around the world are bracing themselves for a potential economic downturn. The US Federal Reserve announced its biggest interest rate hike in nearly 30 years in a bid to control inflation, and in Europe, many central banks are following suit. Companies and startups are resorting to substantial measures, including workforce reductions. Furthermore, the ongoing geopolitical crisis and supply chain woes are adding to the challenges faced by businesses worldwide. At the same time, regulators continue to increase their focus on areas such as data, privacy, compliance, operational resilience, and business continuity.
Against this backdrop, here’s a quick recap of the latest happenings in the governance, risk, and compliance (GRC) universe in June.
Jump to Topic
In the World of Risk, Regulation, and Resilience
The chairman of the U.S. Senate Banking Committee called upon a leading financial services company to address the weaknesses in its "governance, risk management, and hiring practices."
Regulatory Focus: Operational resilience continues to be a top priority for financial regulatory authorities around the world.
- UK-based financial firms have been given three years to amp up their operational resilience. In a speech, Duncan Mackinnon, Executive Director for Supervisory Risk Specialists at the BoE, provided guidance to firms in meeting operational resilience requirements, including implementing operational resilience policy, scenario testing, building resilience, and embedding operational resilience in the way firms do business.
- HM Treasury announced its plans to mitigate the risks from ‘critical third parties’ to the UK finance sector.
- The Monetary Authority of Singapore (MAS) revised business continuity management guidelines for financial institutions.
- The Hong Kong Monetary Authority published a supervisory policy manual on operational resilience. The Hong Kong Institute for Monetary and Financial Research (HKIMR) released a new Applied Research report, titled “COVID-19 and the Operational Resilience of Hong Kong’s Financial Services Industry: Preliminary considerations from the 2020-2021 experience”.
The State of Risk Management: Industry visionaries and thought leaders published survey reports, providing insights into the current risk landscape and the state of risk management at organizations:
- In its Semiannual Risk Perspective for Spring 2022, the US Office of the Comptroller of the Currency (OCC) highlighted operational, compliance, interest rate, and credit risks among the key risks faced by the federal banking system.
- The Federation of European Risk Management Associations (FERMA) published its European risk manager survey 2022. It said the top business threats this year, including cyber threats, supply chain & disruption failure, geopolitical uncertainties, and uncertain economic growth are linked or amplified by the COVID-19 pandemic and the ongoing geopolitical crisis.
- In PwC’s 2022 Global Risk Survey, 79% of respondents said that keeping up with the pace of digital and other transformations is a major risk management challenge and 65% of respondents admitted to increasing their overall spending on risk management technology.
- Gartner found the rate of compliance reporting to have dropped by 30% compared to pre-pandemic levels. It said that employees now are less likely to observe misconduct and also less likely to report it even when observed.
In the Cyberverse
Cybersecurity firm Proofpoint thwarted a phishing attack trying to exploit the “Follina” vulnerability. In a blog post, Qualys explains the vulnerability in detail.
“The Follina vulnerability’s footprint is significant as it affects ALL Microsoft Office versions – 2013 and above – on ALL currently supported Microsoft Windows operating systems – even the latest: Windows Server 2022!” Qualys noted.
With the escalating number of cyber attacks on organizations, including state-sponsored attacks, the US Cybersecurity & Infrastructure Security Agency (CISA) issued a joint cybersecurity advisory with the National Security Agency (NSA) and the Federal Bureau of Investigation (FBI). The advisory details how People’s Republic of China (PRC) state-sponsored cyber actors are exploiting publicly known vulnerabilities to establish a broad network of compromised infrastructure. CISA also added 36 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.
Gartner listed 8 cybersecurity predictions for 2022-23. The IT research firm believes that 60% of organizations will use cybersecurity risk as a primary determinant when engaging with third parties by 2025.
A new survey from Cloud Security Alliance (CSA) and Google found that cloud adoption improves enterprise risk management and mitigation processes. The CSA said that evaluating cloud and business risk together improves the understanding of IT's impact on an organization’s overall risk maturity, including adopting a shared fate partnership between cloud service providers and customers.
Regulatory Focus: June saw heightened cyber and data-related regulatory activity around the globe:
- The National Institute of Standards and Technology (NIST) is consulting on a new guidance document ‘Using Business Impact Analysis to Inform Risk Prioritization and Response’.
- The California Privacy Protection Agency (CPPA) published the first draft of the California Privacy Rights Act draft regulations.
- UK announced its Data Reform Bill that will “remove the UK GDPR’s prescriptive requirements giving organizations little flexibility about how they manage data risks.” The proposal is expected to deliver around £1 billion in business savings.
- Australian Securities & Investments Commission (ASIC) executive director for markets Greg Yanco called upon listed entities to boost cyber resilience measures.
- The Central Bank of Malaysia published its proposed guidance on assessing key risks and considerations of control measures when financial institutions adopt cloud services.
- In Thailand, the Personal Data Protection Act (PDPA) came into force on June 1, 2022.
In the Era of ESG
FM Global released the online 2022 FM Global Resilience Index, which now includes 15 economic, risk quality, and supply chain measures that offer executives insights into the vulnerabilities of a country’s business environment and, conversely, its resilience.
There’s a growing call for tying leadership compensation to ESG metrics. Sustainalytics said, “Now that companies are integrating material ESG issues into their strategies, it is the logical next step to incentivize executives to improve performance on these issues in a measurable way.”
In a new study, Moody’s Analytics found that organizations that develop more responsible ESG practices and focus on mitigating ESG risks experience generate better shareholder returns.
In its tenth SONAR report, Swiss Re explored a new generation of emerging risks resulting from climate change, particularly the thawing of permafrost.
Regulatory Focus: Environmental, social, and governance (ESG) aspects continue to make waves in the regulatory landscape.
- The Basel Committee on Banking Supervision issued principles for the effective management and supervision of climate-related financial risks.
- The US Commodity Futures Trading Commission (CFTC) is seeking public comment on climate-related financial risk to better understand its relevance to the derivatives markets and underlying commodities markets.
- The European Council and Parliament reached a provisional political agreement on the corporate sustainability reporting directive (CSRD).
- In Canada, the Office of the Superintendent of Financial Institutions (OFSI) released guidance on climate risk management.
- The Monetary Authority of Singapore (MAS) published information papers on environmental risk management for banks, insurers, and asset managers.
From the MetricStream Corner
Speaking at a recently held MetricStream webinar, “Utility Data Management and ESG Reporting – The ‘Elephant in the Room’,” Anand Hanchinamani, Senior Director, Audit Product Management, MetricStream, said, “Climate risk is a global problem with a local impact. It can lead to probably hotter working conditions in India or increased tidal flooding in Florida or coastal regions. But, [climate risk] is systemic – one particular problem can lead to a series of supply chain issues or [result in] add-on impacts around the world on different kinds of operations. So, that is why board of directors, investors, customers, and regulators demand accuracy with reporting and responses on ESG-specific issues.”
MetricStream attended the recent Gartner Security and Risk Management Conference and the Marcus Evans' 13th Edition Third Party Risk Management for Financial Institutions Conference. Key themes at both the events included the importance of automation, interconnected risk management, and risk quantification.
MetricStream at Gartner Security and Risk Management Conference (L); MetricStream at Marcus Evans' 13th Edition Third Party Risk Management for Financial Institutions Conference (R)
Jump to Topic
Related Resources
Blogs
Insurance Industry: We Have You Covered
- GRC
- 29 June 22
4 min read
All That Glitters Is Not Gold
The Bank of England on Threadneedle Street London is the eighth oldest bank in the world. Don’t ask me how I know this or to name the other seven, but last week while having dinner with some colleagues overlooking this remarkable building, we were discussing how this bank’s vault stores over 40,000 gold bars.
As conversations go, we moved from topic to topic during our first course. We discussed the state of the world and how central banks are taking an aggressive timeline to tame spiraling inflation rises. We also pondered on the cost-of-living crisis, squeezing oil supplies, plummeting equity prices (at least for the first half of 2022), ongoing geopolitical tensions, and possibly the start of a recession. The dialog gradually morphed into how the bank insures itself against this gold and how resilient the insurance industry is.
Onto the Starter Course: Insurance Is Transforming
Along with having to deal with the post-pandemic effects, the insurance industry is grappling with accelerating regulatory pressures, mounting cyber risks, and increasing climate catastrophes. You can add supply chain disruptions, migrating to the cloud, and a drop in talent retention to the list. Commercial insurance started hundreds of years ago within the shipping industry as a means to protect against looting. Cyber insurance is a more recent development that began around the 1990s and is critical, as today, the most valuable assets are stored in the cloud.
Insurance companies have built and acquired vast customer databases that reside in detached and disconnected systems and human intervention is usually required to locate, gather, and operationalize them. Data and consumer protection will always be driving forces in this industry, with further reliance on digital networks. But what we are witnessing is the revolution of digitalization and how in recent times it has been transformative with technology innovation. This includes intelligent automation, cloud computing, and automated claim processing leading the way in projecting efficiencies across automated workflows. Another name to describe this positive disruption is InsureTech.
Main Course: Business, Cyber, & ESG
We have entered a new era with sensitive information, data breaches, and ransomware dominating the headlines. Cyber risk has more than quadrupled since 2002 and tripled since 2013.
At the end of March 2022, all European Union (EU) institutions and agencies were required to have cyber security frameworks in place for governance, risk management, and controls. And with regulation, it does not stop there as these changes will need to be reflected in business processes.
A common risk language makes it simpler to communicate and report risks. Meanwhile, standardized issue management processes allow stakeholders to identify quickly which issues are associated with which risks.
As a heavily regulated industry, insurance companies are now grappling with the interconnectedness and multifaceted ESG challenges that need urgent attention to identify, collate, and report the correct data through an ESG framework. Outsourcing has become an established way of working for (re)insurance leading to third-party risk management (TPRM) gaining an increasingly important part of your risk profile. The ESG objectives and mission need to be clearly demonstrated. The purpose and ethos of a company are up there with profitability.
Insurers have embraced cloud technology. As well as allowing organizations to be more agile, the cloud is an ideal platform for data storage across the systems as it is secure, scalable, and reliable.
Dessert: MetricStream Brings the Next Generation of ConnectedGRC System for Insurers
At MetricStream, we have been working alongside insurance giants for years. Our solution is built to identify, manage, collate and operationalize risks across the enterprise.
Whether it is internal audit, enterprise/operational risk management, third-party risk, incident management, compliance and policy management, cyber and IT risk, or ESG, at MetricStream, we have you covered with:
- Real-time aggregated view of risks and compliance status
- Quantifiable risks to prioritize risk treatment plans and investments
- Advanced AI-enabled automation and continuous monitoring capabilities
- Federated data model to bind together your core GRC libraries
- Secure private cloud architecture
Read the case studies from the insurance industry:
A Fortune 1000 Insurance Company Moves Up the GRC
Major Insurance Firm Engages All Lines of the Business in GRC
The dinner conversation then moved to digital assets, stable coins, and NFTs. At that point, I knew it was time to leave.
If you want to know more about how we can help your insurance company effectively manage and mitigate multi-dimensional risks, reach out to me at ssahhi@metricstream.com
You can also request a personalized demo of our product.
Stay up-to-date with the trending discussions and insights in the risk community. Subscribe to the Instagram of Risk Blog Series authored by Suneel Sahi, VP, Product Marketing at MetricStream.
Check out Suneel’s other ‘Instagram of Risk’ ’blogs:
Be Resilient, I Whispered to My Car
If You Think Compliance is Expensive, Then Try Non-Compliance
An Ounce of Prevention is Worth a Pound of Cure
Don’t Aim To Be Perfect, Aim To Be Anti-Fragile
Jump to Topic
Related Resources
Blogs
May 2022 in GRC: The Latest from the GRC Universe
- GRC
- 01 June 22
6 min read
Introduction
Organizations today need to keep a close eye on the constantly changing Governance, Risk Management and Compliance (GRC) landscape. Newer and diverse risks, including increasing cyber risk, pandemic-related regulatory and policy changes, and risks associated with climate change now present a very real challenge that organizations need to prepare for.
Stay prepared for what’s next in GRC with our monthly round-up of the trending news and insights that you can use.
Building Resilience Remains Top Priority while Compliance Function Takes Center Stage
As the risk landscape expands, strengthening business resilience with enterprise and operational risk management remains a top priority for organizations. At the same time, regulatory requirements by governments and regulatory bodies has left organizations to deal with multiple layers of complex change, often happening simultaneously. This makes the compliance function an important priority for organizations of all sizes.
Here’s what has been spotted on the risk and compliance radar this month.
- As per a background document issued by the UK government alongside the Queen’s Speech there are plans for new direct legislation for tech providers.
- Three consultation papers titled "Outsourcing and third-party risk management" pertinent to Financial Market Infrastructures (FMIs) were published by the Bank of England.
- The American Institute of Certified Public Accountants (AICPA) Auditing Standards Board has voted to approve three new quality management standards. The standards will help improve the risk assessment procedure and audit quality.
- Canada’s federal financial institutions regulator, the Office of the Superintendent of Financial Institutions (OSFI), has released Draft Guideline B-10: Third-Party Risk Management. This establishes OSFI’s third-party risk management expectations for federally regulated financial institutions in Canada (FRFIs) and also sets down industry best practices.
- The Prudential Regulation Authority, UK, has formulated next steps for firms establishing their operational resilience roadmap in preparation for the March 2025 deadline.
- The fifth edition of the Regulatory Initiatives Grid, which sets out the planned regulatory initiatives for the upcoming months, has been published. This helps firms in the financial services industry and other stakeholders plan for operational impact due to the initiatives and the timing of the initiatives.
Other trending risk and compliance topics include, the publishing of the 2022 Interos Annual Global Supply Chain Report, which highlighted that only one-tenth of the survey respondents monitor supplier risks on a continual basis and the PwC Global Risk Survey, where 65% of survey respondents are increasing their overall spending on risk management technology.
Mitigating Cyber Risk Increases in Importance
With cyber actors continually improving the level of sophistication of cyber attacks, cyber-risk mitigation is now the top priority for organizations, governments, and regulatory authorities. In the month of May 2022:
- Cybersecurity authorities of the United States, Canada, New Zealand, the Netherlands, and the United Kingdom coauthored a joint Cybersecurity Advisory titled “Weak Security Controls and Practices Routinely Exploited for Initial Access.” The advisory will help organizations identify commonly exploited controls and practices. It includes cyber risk best practices to mitigate the issues.
- The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Federal Bureau of Investigation (FBI), in partnership with cyber agencies from the UK, Australia, Canada, and New Zealand, released an advisory titled “Protecting Against Cyber Threats to Managed Service Providers and their Customers” in response to the increase in malicious cyber activity targeting MSPs.
- In response to the Presidential executive order in the US, the National Institute of Standards and Technology’s (NIST) has revised its publication, titled “Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.” The revised publication provides greater guidance on identifying, assessing, and responding to cyber risks throughout the supply chain.
- In what has been lauded as one of the world’s first, the European Council and European Parliament signed a provisional agreement for the establishment of the EU Digital Services Act (DSA), which is designed to build cyber resilience by following the principle that what is illegal offline must also be illegal online.
- The European Council and the European Parliament will replace the current NIS (Network and Information Security) directive with NIS2. NIS2 is set to enable both the private and public sector build cyber resilience and incident response capabilities.
- The European Council and the European Parliament have reached a provisional agreement on the Digital Operational Resilience Act (DORA). The act will help enterprises build cyber resilience and prevent and mitigate cyber threats.
In other IT risk and cyber risk news, Rob Joyce, the head of cybersecurity at the U.S. National Security Agency, is “still very worried” about the escalated cyber risk arising from the Russian-Ukraine war. For CISOs, this translates to continuing to track the conflict and putting measures in place to mitigate any direct attacks and cyberattack spillovers. The judgement by the Federal Court of Australia in the Australian Securities and Investments Commission v RI Advice Group Pty Ltd, has now made it clear that the failure to manage cyber risk is a breach of financial services obligations. This has led to the Australian Securities and Investments Commission (ASIC) publishing a guidance note on the critical cyber risk measures that AFSL holders are now expected to have in place.
Climate-Related Risks, Sustainability, and Greenwashing Make ESG Headlines
The importance of assessing risks from climate change, environment, and social equity continues to create a lot of conversation. The top highlights include:
- The European Financial Reporting Advisory Group (EFRAG) has published the first draft of its sustainability standards for public consultation. The final standards are scheduled to be sent to the European Union's executive European Commission by November 2022 for adoption. This will be a significant as business will be required to disclose information on how ESG risks impact their business and their externalities.
- The climate-related risks of 12,000 supplier sites has been studied in a joint project by supply-chain-mapping company Resilinc and the University of Maryland’s Supply Chain Management Center and Earth Systems Science Interdisciplinary Center. The study reported that 93% of the supplier sites in China and Taiwan were experiencing increases in climate variability.
- The Taskforce on Nature-related Financial Disclosures (TNFD), which consists of corporates, financial institutions and service providers backed by the UN, released a prototype framework, which closely mirrors TCFD. This aims to help public and private companies with assessing and communicating the financial risks of nature loss.
- A new report by the Financial Stability Board (FSB) has been published. This aims to assist supervisory and regulatory authorities as they devise approaches to monitor, manage and mitigate risks arising from climate change.
To be noted is the new survey report by Deloitte, which reports findings on how climate, sustainability, and social equity are now important considerations when it comes to shaping infrastructure plans. Also, various global regulators are aiming to bring new reforms to tackle greenwashing and promote greater transparency in environmental, social, and governance investments.
Thrive on Risk with MetricStream
MetricStream empowers organizations to drive a connected GRC program. Leverage ConnectedGRC, and our BusinessGRC, CyberGRC, and ESGRC product lines, to better identify, assess, manage, and mitigate strategic risks, operational and enterprise risks, IT and cyber risks, third-party risks, compliance risks, and ESG risks.
Interested to learn more? Request a demo now.
Jump to Topic
Related Resources
Blogs
Test Automation at MetricStream - Efficient, Scalable, and Fast
- GRC
- 28 April 22
4 min read
Introduction
“Winners don’t do different things. Winners do things differently” is a popular quote that perfectly demonstrates MetricStream’s test automation strategy.
Today, test automation is increasingly being preferred over manual testing since it increases efficiency in the software development process while enabling more robust products to be built. Additional benefits include higher test coverage, faster feedback cycle, improved accuracy, elimination of human error, with business advantages of reduced expenses and faster time to market.
However, the general trend being applied for test automation in the industry comes with its own set of challenges. This is where MetricStream has followed a different approach—one that is more efficient, scalable, and fast.
This blog examines the problems associated with the traditional approach followed by the industry and dives deep into MetricStream’s unique approach and the advantages it brings.
Why the Traditional Approach to Test Automation Does Not Work?
The general approach in IT industry is to have test automation led by the QA team. In the QA team one/multiple QA engineers write and maintain the automation script. However, this approach comes with several challenges including:
- The automation effort gets compromised and takes a lower priority. QA teams are required to focus on automation along with the testing. If there are delays in the deliverables or more bugs identified during testing, it takes multiple iterations for the QA team to test and certify the feature.
- A lot of effort is required for the maintenance of the script when there are changes in the features. This is because QA teams usually write automation scripts for each UI screen (form/report) and also tend to write multiple scripts for each use case within the same screen.
- The automation needs to be updated and maintained along with the features. This leads to QA teams to investing more effort in scripting/coding instead of their core competency. i.e. coming up with various scenarios in the testing of a feature.
- Standardization of the common libraries and programming techniques become difficult. The challenge is amplified when many teams are writing code for their specific Platform / Product feature.
- Short deadlines for configuration and UAT cannot be met. The teams implementing the product have very short deadlines for configuration and UAT. QA teams will not be able to plan for a separate automation cycle due to the short timelines.
Automation at MetricStream- A Unique and Efficient Approach with AutoMetric
The automation approach followed at MetricStream efficiently addresses all of the above problems. By developing an inhouse tool/product AutoMetric, MetricStream ensures the test automation needs of the entire organization are catered to. At MetricStream, a separate team of highly skilled developers build the tool and support QA teams to run/adopt the automation. This allows QA teams to focus more on test scenarios than worrying about writing automation tests.
Here’s a quick glimpse into automation at MetricStream:
- MetricStream Products are built on top of the MetricStream Platform using AppStudio, a Rapid Application Development (RAD) IDE.
- AppStudio allows the creation of various objects like Forms, Reports, Charts etc., in a standard fashion.
- Details about object fields, their rendering order, and type of the fields are stored in the platform as metadata during the design of various objects.
- The automation tool, AutoMetric, generates a “testdata” sheet for each object (Form/Report etc,) based on the metadata stored. This is a blank data sheet with only metadata information about the objects. The tool uses Page Object Model (POM) design pattern.
- QA team populates the “testdata” sheet by providing the test data associated with an object.
- QA team also populates the “testdata” sheet with predefined keywords for operations to be performed (click, set, verify).
- AutoMetric picks the “testdata” sheet as input, validates the associated data, generates the automation steps, runs the automation tests, and publishes the report.
Why the MetricStream Test Automation Approach is Better?
MetricStream’s test automation approach is better than the traditional approach for multiple reasons. Listed below are a few benefits:
- Reduced time in running System Integration tests: Using the tool has helped achieve a 500% improvement in execution time of System Integration tests, as compared to the traditional approach.
- Increased ROI: The AutoMetric tool is built with a holistic approach that caters to the automation needs of both the Product Development and Implementation teams. This essentially translates into automation being achieved with lesser effort as compared to the traditional approach, providing a far better ROI.
- More reliable automation runs: Since the tool is developed using a Page Object model, the code is modularized and more maintainable. Hence the automation runs are more reliable.
- Ability for QA teams to focus on core competencies: QA teams can focus more on exploring test scenarios instead of worrying about writing automation scripts and maintenance of those scripts.
MetricStream AutoMetric: Powering What’s Next in GRC
Test automation enables not just the saving of time and money but more importantly the delivering of higher quality products. At MetricStream, our unique and efficient approach to test automation ensures robust BusinessGRC, CyberGRC, and ESGRC products that empower your organization to effectively address and stay ahead of evolving business and market needs.
Jump to Topic
Related Resources
Blogs
Be Resilient, I Whispered to My Car
- GRC
- 05 April 22
4 min read
Where There is no Resilience, There are no Results
It’s that time again. I have to give my car in for service and I am adamant that it will be a routine check. There is nothing wrong. The engine roars, there are no warning lights, and the effortless drive in recent times has been particularly smooth.
Still, in the back of my mind, I have this niggling thought that they will find something that needs changing, replacing, or updating.
I know I should not be thinking like this, after all, it’s for my benefit. A car has many parts that need to work in tandem. If there is no battery, your car will not start, if there is no alternator your battery won’t charge, and if there is no petrol, you are not going anywhere. The resilience of a car which comprises of 30,000 parts – is incredible!
Now here is the dichotomy. Similar to cars, organizations need to demonstrate resilience, and work in tandem with other departments, technology, and processes to ensure their critical business operations continue when faced with adverse risk events.
In a recent webinar, I interviewed an ex-Chief Risk Officer and our SVP of Product to decode ‘resilience’ and ‘cyber’. Two pressing words that are shaping boardroom discussions and encouraging regulators to act fast.
Watch the Webinar: Strengthening Resilience with Effective Cyber and Enterprise Risk Management in 2022
Some of the questions that I posed to my panelists include:
- How should organizations manage cyber risk in line with their Enterprise Risk Management?
- What is the difference between Operational Risk and Operational Resilience?
- What is the impact of cyber risk on an organization’s resilience?
- What is the importance of real-time intelligence to be agile?
- How do you use technology to build resilience?
Operational resilience is a firm’s ability to prevent, detect, respond to, recover, and learn from operational disruptions that may impact the delivery of important business functions and services.
Organizations need to think beyond traditional risk management programs and start focusing on strengthening operational resilience. This requires a better understanding of the overall risk profile and appetite through risk quantification, the agility to quickly adapt to the evolving risk landscape, and the ability to minimize the impact of any risk event, recover quickly, and ensure continued business operations in the aftermath of the event.
In the UK, the Financial Conduct Authority, Bank of England, and Prudential Financial Authority are working toward this and implementing regulations and guidelines. In the EU, draft legislation Digital Operational Resilience Act (DORA) has been published, and in Germany, the IDW PS 340 n.F. has been revised.
In the U.S, the Federal Bank regulatory agencies released a paper outlining sound practices for large banks to help them enhance operational resilience and several main financial authorities in the APAC region are stepping up their resilience practices.
How MetricStream Operational Resilience Benefits You?
MetricStream has a clear solution to help you build Operational Resilience, enabling you to:
- View and manage interconnected risks across the organization with a single view of all critical processes and associated key risks
- Leverage proactive risk management with forward-looking risk visibility using predictive risk metrics and indicators that help anticipate and prevent adverse risk incidents
- Stay ahead of threats and vulnerabilities with early warning notifications and proactive remediation mechanisms
- Manage business disruptions and ensure continuity of operations with an accurate picture of third parties and their risk impact on the business
- Support agility and risk-based decision-making by leveraging a single view of the top risks faced by the organization across the first and second lines of defense, through the use of real-time actionable insights.
- Reduce losses and be prepared for adverse risk events through proactive control structures and analytics, and be able to take mitigating actions on failed controls
- Strengthen confidence with regulators and executive management by establishing a strong risk data governance and issue reporting framework with clear lines of accountability
MetricStream’s ConnectedGRC is designed to help you improve resilience and agility through an integrated approach to compliance and risk management that enables you better define, manage, and channel risk to your advantage. Our CyberGRC product line proactively and intelligently manages cyber risk by enabling users to view and aggregate cyber risk data from across the enterprise, including third and fourth-party vendors. Organizations are empowered to build cyber resilience by using the actionable business intelligence to make data-driven decisions.
You can learn more or book a demo here.
In my next blog, I will be discussing ESG and what this means to risk owners and governance structures—which makes me think, for my next service should I be driving an electric car?
Stay safe.
This blog is part of the Instagram of Risk Blog Series, authored by Suneel Sahi, VP, Product Marketing at MetricStream, which captures discussions and insights trending in the risk community.
Check out Suneel’s other ‘Instagram of Risk’ ’blogs:
If You Think Compliance is Expensive, Then Try Non-Compliance
An Ounce of Prevention is Worth a Pound of Cure
Don’t Aim To Be Perfect, Aim To Be Anti-Fragile
Jump to Topic
