Risk and Controls Governance PDF

Risk and Controls - 1 Governance Presentation Title | Author | Date Company Confidential © Capgemini 2024. All rights reserved | 1  Streaming Media Company 2 Presentation Title | Author |...

Risk and Controls - 1 Governance Presentation Title | Author | Date Company Confidential © Capgemini 2024. All rights reserved | 1  Streaming Media Company 2 Presentation Title | Author | Date Company Confidential © Capgemini 2024. All rights reserved | 2  3 Agenda 1 Importance of GRC 2 Types of Controls 3 Integration of Risk and Controls 4 Top Trends in GRC 5 Challenges in GRC 6 The COSO 7 Strong Internal Controls Framework 8 Control Trends and 2025 Ahead Presentation Title | Author | Date Company Confidential © Capgemini 2024. All rights reserved | 3  4 The rising importance of GRC “GRC today must look across the risk and regulatory landscape to give boards centralized oversight of the most pressing challenges their organizations face. “ Governance, risk, and compliance (GRC) is an operational strategy that helps organizations align IT activities to business goals, manage risk effectively, and stay in compliance with government and industry regulations. Presentation Title | Author | Date Company Confidential © Capgemini 2024. All rights reserved | 4  5 Risk and Controls A risk is any threat or uncertainty of an organization that could have an outcome that is not what was expected. The outcome could affect the organization negatively and, in some cases, positively. A control is a set of procedures that are put into place to address the risks of an organization. Controls are clearly defined and measurable. They prevent or detect errors by reviewing data ,processes, people, and/or compliance with regulations. Presentation Title | Author | Date Company Confidential © Capgemini 2024. All rights reserved | 5  6 Types of Controls Application Manual Controls Controls IT Dependent Manual IT General Controls Controls Presentation Title | Author | Date Company Confidential © Capgemini 2024. All rights reserved | 6  7 Integration of Risk and Controls Analyses risks and vulnerabilities to determine their severity and the resources they may affect. Prioritizes risks that will cause the most damage and alerts operators to take action. Policies and procedures that ensure management directives are carried out and that actions are taken to address risks. Documents control procedures and monitors their effectiveness to help a business adhere to regulatory compliance obligations Presentation Title | Author | Date Company Confidential © Capgemini 2024. All rights reserved | 7  8 Top Trends in GRC Evolving Regulatory Landscape Keeping a pulse on regulatory updates Importance of Continuous and proactively adapting compliance Monitoring and Adaptation programs will be crucial in ensuring Continuous monitoring and organizational resilience and adaptation are crucial in sustainability. 2024 for GRC. As regulatory landscapes evolve and Cognitive AI and hyper- become more intricate, organizations must establish automation These technologies can robust mechanisms for help streamline risk ongoing monitoring to stay assessment, compliance abreast of changes. management, and cybersecurity posture Data Privacy and Security Professionals must stay Collaboration and Integration abreast of evolving data among GRC Functions protection laws and The integration of governance, risk, and implement stringent security compliance efforts will strengthen protocols to mitigate cyber internal controls and fortify resilience threats and ensure against emerging threats and regulatory regulatory compliance Presentation Title | Author | Date challenges. Company Confidential © Capgemini 2024. All rights reserved | 8  9 Cybersecurity will remain a top priority within GRC strategies-Organizations will increase their investments in technologies to enhance cyber risk management. This includes automated, integrated, and AI-powered solutions for risk, compliance IT, audits, and cloud security. Challenges in GRC- 2024 Cyber regulations are evolving rapidly as the cyber menace becomes more prevalent in today's interconnected world. GRC practices are focussed on complying with new cyber resilience regulatory requirements such as the Digital Operational Resilience Act (DORA) in Europe or the Sounds Practice for Cyber Resilience from the Office of the Comptroller of the Currency (OCC) in the United States. Top Cyber Threats- The rise of ransomware. Network and Application Attacks. Privacy Concerns and Data Breaches. Presentation Title | Author | Date Company Confidential © Capgemini 2024. All rights reserved | 9  10 The COSO Framework Monitoring-At a minimum, Control Environment - The organization's culture, ethical values, monitoring is performed by an and attitude toward risk internal auditor who makes sure that employees are adhering to established internal controls.. Risk Assessment- Organizations commonly adopt risk management plans that help them to COSO Framework identify risks and either reduce or eliminate risks deemed to pose a threat to Information and the organization's well- Communication- Communicat being. ions rules are put in place to make sure that both internal and external communications adhere Control Activities-They are to legal requirements.. essentially internal controls that are put into place to make sure that business processes are performed. Presentation Title | Author | Date Company Confidential © Capgemini 2024. All rights reserved | 10  11 Strong Internal Controls Framework Several historical incidents highlight the catastrophic impact of failed internal controls in the banking sector. These incidents demonstrate how inadequate risk management, lack of oversight, and poor governance can lead to significant financial losses and damage to reputations. Risk Management: Robust internal controls could have enhanced risk management practices, ensuring better monitoring and mitigation of risks Diversification: Internal controls could have enforced more diversified investment portfolios and customer bases, reducing vulnerability to sector-specific downturns. Governance: Strong internal controls could have ensured better governance and oversight, preventing unsustainable practices and financial mismanagement. Presentation Title | Author | Date Company Confidential © Capgemini 2024. All rights reserved | 11  12 Case Studies 1 Citibank and the $900 million “biggest blunders in banking history” 2 OCC Fines JP Morgan Chase $250 Million 3 Internal Control Failures Cost MetLife $10 million Presentation Title | Author | Date Company Confidential © Capgemini 2024. All rights reserved | 12  Control Trends : 13 Preparing for the Future  Intensified Focus on Regulatory Compliance  Automation and AI Continue to Revolutionize Internal Controls  Escalating Fraud Risks: A Growing Concern  ESG Reporting and Internal Controls In 2025, AI and automation will be key drivers of success in internal controls. Teams that embrace these technologies will significantly reduce errors, improve compliance, and increase their ability to detect and mitigate risks early. Presentation Title | Author | Date Company Confidential © Capgemini 2024. All rights reserved | 13  14 Internal Control Review: A detailed description of how the board has assessed a the effectiveness of internal controls annually. 2025: The Year of Regulatory Effectiveness Declaration: A formal Shift Starting January 1, 2025, the declaration on the overall effectiveness of UKCGC mandates that annual b the company's material internal controls, reports include: encompassing financial, operational, reporting, and compliance aspects Material Control Failures: A disclosure of c any significant control failures, remedial actions taken, and progress on previously Note: To fulfill these requirements, companies will likely rely more heavily on external assurance reported issues. from their accountants and advisors. Robust internal procedures for collecting, escalating, and Presentation Title | Author | Date Company Confidential © Capgemini 2024. All rights reserved | 14 monitoring control issues will be crucial  15 The regulatory focus on AI and cybersecurity will remain intense in the 1 USA. Banks need to be ready to show that they have strong risk management and 2025: The Year compliance practices in place. of Regulatory Companies will be held to high Shift expectations to enhance risk controls in 2 areas of risk such as cyber security, information protection, AI, and financial crime. Looking ahead, we expect the key regulatory themes in 2025 to focus on 3 areas like regulatory divergence, AI, cybersecurity, fraud, fairness, and operational resilience. Presentation Title | Author | Date Company Confidential © Capgemini 2024. All rights reserved | 15  16 Presentation Title | Author | Date Company Confidential © Capgemini 2024. All rights reserved | 16 About Capgemini As the digital innovation, design and transformation brand of the Capgemini Group, Capgemini Invent enables CxOs to envision and shape the future of their businesses. Located in over 30 studios and more than 60 offices around the world, it comprises a 12,500+ strong team of strategists, data scientists, product and experience designers, brand experts and technologists who develop new digital services, products, experiences and business models for sustainable growth. Capgemini Invent is an integral part of Capgemini, a global business and technology transformation partner, helping organizations to accelerate their dual transition to a digital and sustainable world, while creating tangible impact for enterprises and society. It is a responsible and diverse group of 340,000 team members in more than 50 countries. With its strong over 55-year heritage, Capgemini is trusted by its clients to unlock the value of technology to address the entire breadth of their business needs. It delivers end-to-end services and solutions leveraging strengths from strategy and design to engineering, all fueled by its market leading capabilities in AI, cloud and data, combined with its deep industry expertise and partner ecosystem. The Group reported 2023 global Get the future you want | www.capgemini.com revenues of €22.5 billion. This presentation contains information that may be privileged or confidential and is the property of the Capgemini Group. Copyright © 2024 Capgemini. All rights reserved.