Newsletter, October 2009 - IDRBT

Fast Forward
October 2009
IT Risk Management
Having logged into Basel II already, banks are only too aware that pervasive IT constitutes 70% of their
Operational Risk. In other words, 7% of the additional capital they have to provide (with an alpha of 10%)
for operational risk will be to cover their IT risks. These IT risks can be more effectively managed with an
organizational mechanism, with board level commitment, which makes use of sound policies, for each and
every aspect of IT deployment, usage and control, backed up by international standards and best practices.
These policies get translated into procedures at the top management level and these procedures get split
into detailed practices (and guidelines) for the grass root functionaries to religiously follow.
A functional, supportive organisational structure is a sine qua non for the successful implementation of the
policies and satisfactory achievement of the objectives. Banks need to have an effective IT Risk
Management in place. In fact, it is time for the banks to take stock of the policies in place, the level of
commitment, understanding and implementation, and put in place the required organisational structures
to support and achieve the desired results.
IT Resource Management
IT Resources can be broadly classified into five major categories: Data, Applications, Technology,
Facilities and People. Acquiring, maintaining, using, leveraging, protecting and ultimately ensuring that all
these resources are put to effective and proper use to achieve the corporate business objectives will demand
enormous clarity, time, attention and commitment from bank managements and the involvement of the
rank and file.
Each of these resources should have clearly defined owners, mandated access and usage control matrices,
backup and recovery norms and accepted/acceptable standards of performance and reliability to make
them serve the purpose for which they exist. Banks have to gear themselves up in this regard for getting the
best out of their IT.
NEW DIRECTIONS : A High-powered committee under the Chairmanship of
Dr. C. Rangarajan reviews the Institute's activities to redefine the role of IDRBT
2