As they navigate the choppy waters of a constantly evolving banking environment, chief audit executives (CAEs) within large financial institutions find themselves at the helm of unique challenges and intricate risks.
Simple proficiency in risk management is no longer sufficient. Understanding the key risks, emerging trends, and transformative technologies that continue to shape the internal audit shoreline going forward into 2025 remains a critical mandate for many financial institutions. CAEs need to know how to stay ahead of these changing trends as they continue to reverberate throughout the broader banking ecosystem.
Emerging Technologies
In recent years, the banking industry has been transformed by the swift pace of technological advancements. While these innovations offer opportunities for efficiency and growth, they also present significant risks and challenges. Below are four technology trends impacting financial institutions:
- Cloud Services – Banks continue to expand their cloud computing services. CAEs must assess the security, privacy, data, and operational needs of the cloud, including establishing cloud services policies, roles, responsibilities, and processes. Internal audit also should assess the cloud’s design and architecture, including its scalability, redundancy, and performance. In addition, the cloud’s security measures should be evaluated to assess encryption protocols, access controls, vulnerability management, and incident response capabilities.
- Artificial Intelligence (AI) – CAEs must establish appropriate guardrails to manage AI, including governance, policies, monitoring, and risk mitigation. AI can be used to automate routine and manual internal audit functions such as reconciliations, compliance checks, and data extraction and provide greater agility to internal audit teams. However, organizations should take action to have an AI model development policy in place to help avoid potential risks.
- Endpoint Security – With the hybrid workplace introducing new and extended cybersecurity risks, CAEs need to perform endpoint security audits to assess vulnerabilities and help ensure appropriate security measures. Internal audit teams should review access controls, user permissions, and encryption settings, as well as perform continuous monitoring.
- Intrusion Detection/Incident Response – As cyberattacks increase in frequency and sophistication, it is critical for internal audit departments to help ensure the effectiveness of the organization’s intrusion detection and incident response. This can be done by assessing the effectiveness of intrusion detection systems, log analysis, and threat intelligence feeds.
Data Management
Effective data management is crucial for CAEs to understand and to help organizations enhance the value of their data assets, mitigate risks, and achieve business objectives. There are three key focus areas that CAEs should consider:
- Data Governance and Policies – CAEs should continue to manage the availability, usability, integrity, and security of data. Proper data governance will help identify and assess data-related risks such as data breaches, compliance violations, and inconsistent data management.
- Data Quality and Controls – CAEs should enforce data entry standards, validation rules, and perform data quality audits. Conducting data quality audits helps organizations detect errors, gain deeper insights, and utilize data to mitigate risks. Data controls also must be put in place so that data meets predefined quality standards.
- Data Operations and Analytics – CAEs must make sure that data is collected, stored, and processed properly. Through identifying patterns and anomalies, predictive analysis, improving benchmarking, and continuous auditing, data analytics can help provide real-time insights into risks.
Privacy Protections
Financial institutions manage large volumes of sensitive information, and security remains the bedrock of data privacy compliance. CAEs must understand the intricacies of different privacy regulations across numerous countries. An accountability framework can help banks design an effective compliance program to protect customer privacy. In addition, this framework will establish risk-based, appropriate, and enforceable actions and controls for teams to implement. Internal audit teams also should consider how to validate that data privacy policies and procedures are designed and operating effectively within the organization.
Key Risk Considerations
Banks operate in a complex environment filled with risks and challenges that significantly influence their operations and strategic decisions. These risks, ranging from economic conditions to regulatory compliance, have a profound impact on banks and the CAEs managing the internal audit function. Four key risks that CAEs must consider are highlighted below:
- Liquidity Risk – CAEs should make sure their organization has strategies, policies, and practices to manage liquidity risk in accordance with the organization’s risk profile and help ensure liquidity. CAEs must install procedures to test liquidity ratios and make sure there is sufficient stress testing. In addition, CAEs can utilize contingency funding plans to assess the completeness, feasibility, and effectiveness of liquidity stress tests.
- Strategic Risk – The connection between bank strategies with long-term market trends and investor expectations is drawing greater attention. CAEs must orchestrate strategic planning and rigorous risk assessment processes to help with compliance assurance, proactive risk management, and organizational and strategic readiness.
- Regulatory and Compliance Risk – The introduction of Fundamental Review of the Trading Book (FRTB) regulations imposing stringent capital requirements and risk management standards will require CAEs to adapt their operations to meet these new regulatory demands and avert potential compliance issues. As such, CAEs must stay agile to adapt to the fast-paced regulatory environment and have structured and sustainable approaches to help document regulatory requirements, understand risks, and improve decision making.
- Credit/Counterparty Risk – CAEs should develop a comprehensive assessment of the organization’s credit and counterparty risk, which encompasses financial metrics as well as qualitative aspects such as operational resilience, legal implications, and risk models. Risk models should utilize credit ratings, exposure limits, collateral, and market conditions to evaluate risks. CAEs also should consider the organization’s risk profile by evaluating a counterparty’s creditworthiness and potential vulnerabilities.
A CAE’s Road Map for Success
Addressing the key risk areas requires a holistic internal audit approach that integrates proactive risk assessment, compliance, and strategic planning. Developing robust policies that effectively identify and manage these risk issues early can help provide enduring best practices over the long term.
Embracing these trends and emerging technologies, while fostering a culture of adaptability and innovation, can help CAEs adeptly navigate an evolving banking horizon with confidence and steer their organizations toward sustainable and responsible growth.
If you have any questions or need assistance, please reach out to a professional at Forvis Mazars.