Using IT Governance to Achieve Your Bank’s Business Goals By Mike Gilmore, Chief Compliance Officer, RESULTS Technology Community Banks carry an ongoing burden of compliance for information technology (IT). Examiners expect the bank to undergo annual IT audits, penetration tests, policy reviews, and complete comprehensive technology plans, risk assessments and cybersecurity self-assessments all while trying to do the real work of banking in the community. Why do regulators expect this level of paperwork? What is the purpose of all those self-assessments and evaluations, and who, ultimately, is responsible for getting them done? The answer lies in the realm of IT Governance. In this article, we’ll explore: • What is IT Governance? • Why is it important? • Who is responsible? • How do you implement your own IT Governance Program? IT Governance: What it is — What it isn’t IT Governance is not about the day-to-day management, procurement, installation and running of IT systems. It’s not about keeping the lights on and the wheels turning. Instead, IT Governance can be defined as the processes that ensure the effective, efficient, and safe use of IT to enable an organization to achieve its goals. The key word here is “goals.” Not IT goals, but the business goals of the bank which IT is serving. What are the primary business goals of your community bank? At a high level, almost all have the same goals: to provide quality, competitive, profitable, timely, confidential, (add your own adjective here) banking services to businesses and individuals within your community. A bank’s business goal is not to provide technological services, but to provide banking services. IT’s role is to serve those goals through efficiency, innovation, cost reduction, competitive advantage, security and marketing, to name a few. The purpose of IT Governance is two-fold: 1. Ensure that IT generates business value for the bank; and 2. Ensure that controls are in place to best mitigate the risk posed by technology. Who is Responsible for IT Governance? The easy answer is “everybody”, but the best answer is “whoever sets the business goals for the bank.” Those who set the goals determine the course of governance in all aspects of the business. Ultimately, the Board of Directors has responsibility. The Board sets in place policies, procedures, values, and long-term planning to meet the mission of the organization and the requirements of all stakeholders. Senior Management implements the directives of the Board and makes sure that policies and procedures apply to everyone. Governance is very much a top-down implementation, but ultimately everyone in the organization has responsibilities to see it operate effectively. 8 NEBRASKA INDEPENDENT BANKER
RkJQdWJsaXNoZXIy ODQxMjUw