Sanjiv Kumar Tripathy

What’s #BSOD got to do with Corporate India ? Many of #RiskResilience lessons for the #boardofdirectors and #CXOs … Traditional #risk assessments focusing solely on inherent and residual risks are no longer sufficient. Instead, #organisations must integrate a more comprehensive #riskmanagement strategy that includes evaluating secondary and compensating risks, understanding risk velocity, and fostering a proactive risk-aware #culture. Hersh Shah, SIRM & I write on the challenges, and a #Checklist to adopt… https://lnkd.in/duFA5-MM #RiskResilience #BSOD #CyberSecurity #EnterpriseRiskManagement #IndiaInc #DigitalDependence #ERM #CyberThreats #AI #RiskManagement #RiskAwareness #BusinessContinuity #TechInnovation #RiskMitigation #corporategovernance #BWBusinessWorld #Opinion #India IRM India Affiliate

10

#CyberAwarenessMonth - #Day18 The posts from #Day12 to #Day17 provided details and insights about Cyber threats affecting different age groups, top vulnerabilities resulting in such threats and few tips on Cyber measures were covered... Typically, the next thought would be.. What if ... an incident occured, then - what to do and how to report the cyber crime ... and here we go... 1. From Government of India perspective: a. National Cyber Crime Reporting Portal (aka #NCRP)—The portal, https://cybercrime.gov.in, helps log cyber crime incidents of various types. An appropriate category should be selected to ensure the right process flow is initiated. For a list of categories, refer to the #Day3 post. b. #CyberCrimeHelplineNumber - Number #1930 can be used where logging into portal is not feasible and if the incident to reported quickly based on feasibility, magnitude and materiality of impact. c. Walk into the nearest police station or #cybercrimecell. Here, the FIR would need to be formally registered for the process to be started in consultation with the associated authorities. Major cities also have dedicated cyber crime cells that specialize in handling cyber crimes. 2. From Social Media Platforms: a. In case of incidents arising from social media platforms, there is a "Report" feature/function to be used. Once done, the content/account can be taken down by the platform. #DeloitteCyberAwarenessCampaigns, #DeloitteCyber, #CyberSecurityAwarenessMatters

22

An Independent External Monitor (IEM)... Link to this post is https://lnkd.in/dYfeqtiH An Independent External Monitor is a neutral third party appointed to oversee the implementation of an Integrity Pact (IP). * The IEM's role is to Monitor, Investigate, Report, Advise * IEMs are usually retired civil servants, judges, or professionals with high integrity and relevant experience. * The concept of IEMs is primarily used in public procurement to promote transparency, accountability, and fair competition. An Integrity Pact is an agreement between a government or public sector entity and bidders for a contract, wherein all parties commit to refrain from bribery and corrupt practices. The Central Vigilance Commission ( CVC ) site https://lnkd.in/d93sUngf reads as under... In order to ensure transparency, equity and competitiveness in public procurement, the CVC recommends adoption and implementation of the concept of IP by * Government organizations, * Public Sector Enterprises, * Public Sector Banks, * Insurance Companies, * other Financial Institutions and Autonomous Bodies. The IP essentially envisages an agreement between the prospective vendors/bidders and the buyer, committing the persons/officials of both sides, not to resort to any corrupt practices in any aspect/stage of the contract. Integrity Pact is implemented through a panel of Independent External Monitors (IEM), who are nominated by the CVC from amongst the panel maintained by it, and appointed by the respective organization. Several organizations in India have adopted the concept of IEMs... * Bharat Earth Movers Ltd. ( BEML ) * Central Vigilance Commission ( CVC ) lnkd.in/d93sUngf * Department of Animal Husbandry & Dairying * Department of Investment and Public Asset Management (DIPAM) lnkd.in/dz52cvrD * IDBI Bank * Jawaharlal Nehru Port Trust ( JNPT ) * Ministry of External Affairs (MEA) lnkd.in/daQEGbfe * National Fertilizers Ltd. * Oil & Natural Gas Commission ( ONGC ): please see the image accompanying this post * Prasar Bharati lnkd.in/dVkSpUNy * Securities & Exchange Board of India ( SEBI ) Persons worth following in this field... * Ajai Kumar More Reading... * Organisation wise IEMs ( a list in pdf format is at lnkd.in/dWKqxzzH * Roles and Functions of IEMs: Prasar Bharati lnkd.in/dVkSpUNy * Tags hashtag #independentdirectors #externalmonitors #advisors * Independent Director ( ID ) on the Board of a Company lnkd.in/dBHkBsM Please comment below... ( the benefits of commenting are at post: lnkd.in/dCd6yHsU ) ++

9

2 Comments

In the ever-evolving landscape of operational risk management, staying updated is key! Recently, the RBI released a significant update on operational risk management and resilience. A webinar by Deepak Sai & Shashank Shekhar from The Digital Fifth provided valuable insights into this guidance note, focusing on governance, risk culture, and adaptability. Keeping pace with these changes is crucial for sharpening our risk management strategies. #OperationalRiskManagement #RiskResilience #RBIGuidance #RiskManagementStrategy

6

3 Comments

It was a pleasure speaking with the students of the Global Risk Management Institute India (GRMI) on 'Navigating Risk in a VUCA World' at their campus in Gurgaon. GRMI is a specialized institute, built with the need for a multi-disciplinary approach in the ever-evolving arena of Risk Management. Risk has moved well beyond the traditional view of financial and regulatory risk and now encompasses reputation risk, geopolitical risk, cybersecurity risk and whole area of strategic risks that could impact long-term competitiveness and sustainability. Stakeholders, including investors, regulators, and customers, are demanding greater transparency and accountability in how organizations manage risks. Overall, risk management has become more integrated, proactive, and technologically driven over the last decade. The GRMI students were sharp, well informed, had a deep sense of curiosity and recognized that their roles will increasingly span across the organization and not remain siloed as a quasi-financial role. Thanks, Subhashis Nath, Jayant Palan, Chetan Mathur, Puneet Malhotra, Madhu Vij, and Sakshi Arora for having me over.

95

1 Comment

#CyberAwarenessMonth - #Day8 Did you know... ??? ... In India, the most common sources of #CyberThreats (per Press Information Bureau) are: 1. Social Media Platforms (using fake profiles), 2. Mobile devices (using SMS and WhatsApp phishing), and 3. E-Commerce (using fake websites and payment frauds). By now, it's clear... #CyberSecurityMatters. Tips on #CyberMeasures relating to #FakeProfiles... a. Check for incomplete or inconsistent details and usernames b. Reverse image search to verify profile pictures. c. Check on friends and followers, profile creation date, etc. d. Leverage verification badges, e.g. X - blue tick, etc. e. Report suspicious accounts on the social platform itself. #DeloitteCyberAwarenessCampaigns, #DeloitteCyber, #CyberSecurityAwarenessMatters

19

People Risk in Operational Risk: The Hidden ThreatWhen we think of operational risk, we often focus on external factors like market volatility, cyber attacks, and supply chain disruptions. However, a significant threat lurks within our own organizations - People Risk.People Risk refers to the potential for human error, misconduct, or inadequacy to disrupt business operations and impact the bottom line. It's a ticking time bomb that can lead to:- Data breaches- Financial losses- Regulatory non-compliance- Reputation damage- Decreased productivityIdentifying People Risk:- Human error: inadequate training, fatigue, or stress- Employee misconduct: fraud, theft, or sabotage- Inadequate staffing: understaffing, skill gaps, or poor performance- Diversity and inclusion issues: discrimination, harassment, or bias- Labor relations: union disputes, strikes, or workforce unrestMitigating People Risk:- Implement robust training and development programs- Conduct regular background checks and screening- Foster a culture of diversity, inclusion, and respect- Establish clear policies and procedures- Encourage open communication and whistleblower protection- Monitor and address employee well-being and engagementDon't underestimate the power of People Risk. By acknowledging and addressing these internal threats, you can fortify your organization's resilience and safeguard its future.Take the first step today and assess your People Risk exposure. Your organization's well-being depends on it. #PeopleRisk #PESTEL #Riskmanagement

1

🔴TODAY AT 4PM-5:30PM 🔴 Don’t miss the final extended session of the Risk Webinar Series 2024!  🗓 Date: 20th September, Friday 🕓 Time: 4:00 PM - 5:30 PM IST  We’ll cover both sessions in this extended webinar:  Session 5: “Fortifying Digital Frontiers: Risk Management in Cybersecurity and Privacy” Session 6: “Harnessing ESG for Effective Risk Management and Long-Term Growth”🌟 As cyber threats rise and privacy concerns grow, organizations must stay ahead of the curve to protect their digital frontiers. In Session 5, you'll explore how to safeguard your data, mitigate cyber risks, and ensure privacy compliance.  In Session 6, discover how integrating ESG principles can enhance your risk management framework, drive sustainable growth, and build long-term resilience in a rapidly evolving world.  It’s not too late to be part of these impactful sessions! Sharing a brief glimpse of Session 6: “Harnessing ESG for Effective Risk Management and Long-Term Growth” 🔴 WEBINAR LINK: Zoom Meeting: https://lnkd.in/eErRy-Qs  ID: 853 6698 8064; Passcode: 514660 Yukti AroraCA. Jyoti Singh #RiskWebinar2024 #Cybersecurity #PrivacyManagement #ESG #RiskManagement #SustainableGrowth #DigitalSecurity #CyberRisk #DataProtection #LongTermGrowth #PrivacyCompliance #ESGforGrowth #WebinarSeries #CorporateGovernance #Sustainability #BusinessResilience #ExtendedWebinar #RiskMitigation #CyberThreats #PrivacyConcerns #ESGPrinciples #StayAhead #RiskManagementStrategies

11

1 Comment

### Unlock the 5 Key Strategies to Turn Risk into Opportunity ### LAUNCH: EXCITING NEW SERIES (Seriously) - Enterprise Risk Management https://lnkd.in/gGgaWJKB Its not as boring as it sounds, "with conventional methods, comes conventional profits.... get great at identifying not only the Risks BUT the opportunities, get GREAT at ERM" As businesses face increasing competition and disruption, innovation has become a key driver for growth and success. Therefore, enterprise leaders must focus on creating a culture of innovation that encourages creativity and risk-taking. Download a copy of my ERM Playbook: Connect here https://lnkd.in/gYFapHED 2x, 5x or 10x your Profits?  Connect on LinkedIn https://lnkd.in/gg92mFNE Connect for more free material and coaching https://lnkd.in/gYFapHED

1

In a speech to the heads of assurance function of NBFCs, Mr. J Swaminathan, Dy Governor flags four areas for the assurance function to stay focused on: 1.       Cybersecurity and Operational Risks: Implement robust cybersecurity policies and procedures, conduct regular risk assessments and vulnerability scans. Deploy advanced security technology tools such as firewalls, encryption, and intrusion detection systems. He says these are non-negotiable supervisory expectations. Ignore at your peril! 2.       Credit risk from rule-based credit models: If you have an algo based model for lending, keep the rule engines and models calibrated taking into account real time learnings and emerging scenarios. Have these models validated periodically, so that it is relevant and current. Do not leave everything for the machine and models! 3.       Avoid concentration: Flags out retail unsecured lending once again along with top up loans and capital market funding. Risk managers and Boards need to assess whether the risk appetite in these products have crossed boundaries. 4.       Hello Boards!!  i.      Invest in Early Warning Systems, Stress Testing capabilities, Vulnerability Assessments, Monitoring of Cyber Key Risk Indicators, targeted evaluations of compliance with KYC/AML norms and Transaction monitoring capabilities. Compliance is indeed costly but there is no escape! ii.      NBFCs need to strengthen compliance function with more resources. No dual hatting please!  iii.      Open the Boardroom door to heads of assurance functions for direct interactions.  iv.      Don’t swipe out the market with excessive interest rates. Message- You decide the interest rates. We are watching intently! v.      When you design the product, it might tick the box for the legal form, but do not over take substance and spirit of regulations .   Very clear pointers from RBI to NBFCs, as to where the supervisory gaze is focused on now.   https://lnkd.in/dY2QxXQX

47

2 Comments

The DSB consultation on proposed amendments to the DSB Main Terms, Subscription Forms and Policies (collectively the DSB Agreement) is open. The DSB proposed amendments relate to both the UPI and OTC ISIN Services and are a result of: ▪ Ensuring compliance with the Digital Operational Resilience Act (DORA) in the European Union (which applies from 17 January 2025) ▪ Updating terms that were specific to the previous invoicing period (2023-2024) ▪ Consideration of feedback from users over the last 12 months and editorial corrections   Please submit feedback to [email protected] by 5pm UTC on Friday 30 August 2024. Following consideration of the industry feedback received, the revised DSB Agreement will be published on 25 September 2024 and will become effective on 1 January 2025.   Read more here: https://lnkd.in/d6C9t2g6

4

Unlock the secrets of top-performing organizations with Flevy's exclusive frameworks and best practice documents. 💡 Today's Featured Best Practice: ISO/IEC 270012022 (ISMS) Awareness Training (78-slide PPT) -- https://lnkd.in/eFvqK85E Crafted by an ex-ISO Management System Lead Auditor with a wealth of experience at industry leaders like Microsoft and IBM, this presentation is your key to raising awareness of ISO/IEC 27001 and fortifying information security. What benefits it provides: ✅ Provides a framework for designing, managing and improving your organization's information security management system. ✅ Provides a tool for creating awareness of the latest ISO/IEC 27001:2022 standard. ✅ Provides guidelines and practical tips for handling an audit session. Ransomware attacks have become a global menace, with devastating effects on both organizations and their customers. According to the Allianz Risk Barometer, ransomware is the top cyber exposure concern for organizations in 2022. Businesses, especially those holding sensitive and valuable information, must provide appropriate protection to avoid operational, financial, and legal consequences, including business failure. However, most organizations struggle to identify all the risks they face and manage them in a cost-effective and sustainable manner. To address this challenge, the internationally recognized standard for Information Security Management Systems (ISMS), ISO/IEC 27001:2022, provides a systematic approach to managing sensitive information to ensure its security. This new standard replaces the old ISO/IEC 27001:2013 and offers a robust framework that can be adapted to all types and sizes of organizations. Organizations with significant information security risks are increasingly implementing an ISMS that complies with ISO/IEC 27001. By applying a risk management process, the ISMS standard preserves the confidentiality, integrity, and availability of information while giving confidence to interested parties that risks are adequately managed. 🗎 Full details and download here: https://lnkd.in/eFvqK85E #bestpractice #iso27001 #iec27001 #management #strategy #consulting #leadership

1

🔍 Fraud Detection: Time to Get Proactive Fraud is a significant challenge, affecting companies globally and in India. The Occupational Fraud 2024 report shows that companies lose about 5% of their annual revenues to fraud annually, amounting to trillions globally. In India, the impact is similarly severe. Asset misappropriation is the most common fraud globally, occurring in 89% of cases with a median loss of $120,000. However, financial statement fraud, though rarer (5%), results in much larger median losses of $766,000. In India, corruption is involved in 74% of cases, with vendor collusion and asset misappropriation also prevalent. The median loss from fraud in India is $100,000, underscoring the need for early detection. While whistleblower tips account for 43% of global fraud detections, proactive data monitoring uncovers fraud 50% faster and with 50% lower losses, demonstrating the need for better approaches. At Protiviti India Member Firm, we’re using External Intelligence Analytics to detect early warning signs across the ecosystem—risks like employee moonlighting, vendor collusion, parallel businesses, and favoritism in awarding contracts. Additionally, we leverage image and video analytics to identify fraud like invoice tampering and duplicate submissions, helping companies detect fraud at scale, reducing both detection time and losses. #FraudPrevention #DataAnalytics #ExternalIntelligence #ProactiveRiskManagement #IndiaFraudTrends #GlobalFraudTrends

53

Operational Quality, Governance & Controls - Time to scale up first line of defence In today’s world of #NBFCs, the greatest threats to business existence lie with regulatory impact in case of any unfavorable observations or significant oversight. This makes the margin of error extremely narrow. To safeguard the organization, it's important to strengthen our first line of defence i.e. operations governance and controls. Why this first line of defence is vital, see the thoughts shared by vivek malviya, Head - Operations Governance & Controls, Credit Saison India:   1. Regulatory #Compliance and #Risk Management ✅ Enhanced Regulatory Scrutiny: The #RBI's increased focus on NBFCs requires stringent adherence to regulatory requirements. A strong first line of defence ensures compliance, reducing the risk of penalties. ✅Proactive Risk Management: Operational managers can identify and mitigate risks early, preventing potential issues from escalating. 2. Financial Stability and Integrity ✅Maintaining Financial Health: High standards of #financialintegrity are essential. Robust operational #governance ensures accurate financial reporting and transparency, crucial for stability. ✅Asset Quality Monitoring: Cautious oversight of loan performance and timely interventions help manage asset quality that aligns with the RBI’s emphasis on reducing NPAs. 3. Customer Trust and Market Confidence ✅Building Customer Confidence: With the RBI's scrutiny, customers value regulatory compliance. Strong governance and controls enhance trust by ensuring legal compliance and high service standards. ✅Safeguarding Data Privacy: In an era where data security is primary, active first-line defenses protect customer data, complying with RBI guidelines on privacy and cybersecurity. 4. Operational Efficiency and Resilience ✅Process Optimization and Efficiency: Enhanced governance leads to better process optimization, reducing inefficiencies and operational risks. ✅Resilience and Crisis Management: Strong first-line defenses ensure resilience and effective crisis management, including contingency planning and stress testing. 5. Accountability and Transparency ✅Clear Accountability Structures: Establishing clear roles and responsibilities ensures everyone understands their role in risk management and compliance. ✅Enhanced Transparency: Good governance promotes transparency, building trust with regulators and ensuring accurate information during reviews and audits. 6. Strategic Advantage ✅Competitive Edge: NBFCs with superior governance and operational controls are better equipped to adapt to regulatory changes and capitalize on them for strategic benefits. ✅Innovation and Adaptation: Robust governance frameworks enable NBFCs to innovate and adapt more efficiently, ensuring they stay competitive while meeting regulatory requirements. The first line of defence and strong operational governance are indispensable. Hyperion Advisors Pvt. Ltd. Deepu Bansal Vidhi Jain Subhichha Surana

34

Risk Management and Enterprise Risk Management #risk #riskmanagement #risks #GRC #governance #compliance #COSO #isoiec27005 #iso31000 #ERM #enterprise https://lnkd.in/d-XR7jeE

3

As India’s #DigitalEconomy continues to flourish, the role of #CyberInsurance will become increasingly pivotal in safeguarding the growth and prosperity of #SMEs. By embracing this proactive approach to #RiskManagement, Indian SMEs can fortify their digital defenses & enhance #BusinessContinuity. By collaborating with #TechnologyProviders and industry experts, #InsuranceProviders can develop specialized coverage options and #RiskMitigation strategies tailored to the cyber-physical domain. This proactive approach will ensure that SMEs can confidently embrace these technologies while maintaining robust #CyberResilience. #SMEcommunities #SmallMediumEnterprises

5

Enterprise-Wide Risk Assessment (#EWRA) helps to identify and evaluate the #FinancialCrime risk your business is exposed to and determine the mitigation measures required. But this risk is not a static parameter. It keeps evolving with changing business operations, customer base, regulatory amendments, etc. So, do not fall for considering EWRA as a one-time exercise. It is an ongoing process that can assist you in tracking your business’s dynamic risk profile, allowing businesses to keep pace with emerging risks and deploy advanced #AML controls to manage these newer risks. #businessriskassessemnt #antimoneylaundering #AMLCFT #antifinancialcrime #AMLSingapore #riskbasedapproach

16