Governance, risk, and control (GRC) teams within financial institutions are essential in conducting application risk assessments to ensure that potential risk factors are identified, evaluated, and mitigated. This process is crucial for safeguarding organizational assets and maintaining compliance with regulatory requirements.
During the assessment process, GRC teams rely heavily on application owners. However, not all application owners possess a comprehensive understanding of their applications' functionalities, architecture, and potential vulnerabilities. This knowledge is vital for GRC teams to accurately identify and evaluate risk, which is a key element in enabling effective risk mitigation strategies and compliance with regulatory standards.
One significant weakness in this process is insufficient knowledge of applications. Without a thorough understanding of the application's characteristics, potential vulnerabilities may be overlooked, leading to incomplete or incorrect assessments. This can result in increased exposure to risk and hinder compliance with regulatory standards.
An audit performed at a leading financial institution in Europe identified insufficient knowledge of an application as a potential issue. The auditors recommended that the financial institution introduce automation utilizing data points to reduce the dependency on inaccurate risk assessments performed by the application owners.
Organizational Challenges
Dependency on risk assessments conducted by application owners introduced several challenges:
- Subjectivity and bias—Application owners bring their own experiences and perspectives into the risk assessment process, which can lead to subjective interpretations. Personal biases and past experiences influenced how risk was perceived, causing inconsistencies in risk assessments.
- Evolving threat landscape—The rapid evolution of the cyberthreat landscape means new vulnerabilities and attack vectors constantly emerge. Application owners were not always up to date with the latest threats, leading to underestimated or overlooked potential risk.
- Complexity of IT environments—Large organizations often have complex, interconnected IT environments. The sheer volume of systems, applications, and data made it challenging for application owners to comprehensively assess every component’s security, resulting in gaps.
- Data interpretation challenges—Accurate risk assessments require precise data analysis. Application owners need to interpret various data points, such as incident logs, change management, system vulnerabilities, and user behaviors. Misinterpretation of this data led to incorrect conclusions about risk levels.
- Resource limitations—Application owners often face constraints in terms of time, budget, and human resources. These limitations forced them to prioritize certain areas over others, leading to an incomplete assessment of the overall risk landscape.
If left unaddressed, these challenges would have heightened the chance of an inaccurate risk assessment. This put the financial institution at a disadvantage for several reasons.
Weak Asset Risk Portfolio
An inaccurate risk assessment can lead to a misrepresented risk portfolio, where high-risk assets are perceived as low risk and vice versa. This misrepresentation can have serious consequences, as it may result in inadequate risk mitigation measures for critical assets. For example, if a high-risk asset is incorrectly assessed as low risk, it may not receive the necessary security controls, leaving it vulnerable to cyberthreats. Conversely, low-risk assets may receive excessive protection, leading to inefficient use of resources.
Increased Vulnerability
Misjudging the impact levels of confidentiality, integrity, and availability (CIA) can leave critical assets underprotected, increasing the organization's vulnerability to cyberthreats. Confidentiality refers to the protection of sensitive information from unauthorized access; integrity ensures that data is accurate and unaltered; and availability means that systems and data are accessible when needed. Inaccurate assessments of these impact levels can result in insufficient protection measures, making it easier for attackers to compromise critical assets.
Resource Misallocation
Inaccurate assessments can cause resources to be misallocated, with efforts focused on less critical areas while neglecting high-risk assets. This misallocation can lead to inefficiencies and increased exposure to risk. For example, if an organization spends a significant amount of time and resources on securing low-risk assets, it may neglect high-risk assets that require immediate attention. This can result in a false sense of security and leave the organization vulnerable to attacks.
Compliance Risk
Failure to correctly assess risk can result in noncompliance with regulatory requirements, leading to potential legal and financial repercussions. Regulatory bodies often require organizations to conduct accurate risk assessments and implement appropriate controls to protect sensitive information. Inaccurate assessments can lead to noncompliance, resulting in fines, penalties, and damage to the organization's reputation. Additionally, noncompliance can hinder the organization's ability to operate in certain markets or industries, limiting its growth potential.
Erosion of Trust
Inaccurate risk assessments can erode trust among stakeholders, leading to a lack of confidence in the organization’s risk management practices. Stakeholders, including customers, investors, and partners, rely on accurate risk assessments to make informed decisions. If they perceive that the organization's risk management practices are flawed, it can damage the organization's reputation and relationships. This erosion of trust can have long-term consequences, affecting the organization's ability to attract and retain customers, investors, and partners.
Inaccurate risk assessments can have significant implications for organizations, affecting their ability to protect assets, comply with regulations, and maintain stakeholder trust. Addressing this challenge requires a concerted effort to improve the accuracy of risk assessments through better training, collaboration, and the use of advanced technologies. By doing so, organizations can enhance their risk management practices and better protect their assets, ensuring long-term success and sustainability.
Developing a Solution
Inherent risk assessment is a critical process in evaluating the potential risk associated with an IT asset. It begins with a thorough analysis of the impact on CIA—the three pillars of information security.
The financial institution introduced a CIA prediction model based on “golden source” data points. The model employs an artificial intelligence (AI) algorithm to statistically determine the impact levels for IT applications’ confidentiality, integrity, and availability.
The AI algorithm was chosen for its numerous advantages in multiclass classification problems. A collective learning method, the algorithm utilizes multiple decision trees to improve predictive accuracy. By analyzing vast amounts of data, it can calculate data points and propose accurate impacts and likelihoods on CIA. This approach ensures a more comprehensive and precise risk assessment process.
Additionally, business rules were defined to overwrite model results as needed until the model is fully trained and can consistently determine impact ratings.
Examples of business rules include:
- Regulatory applications—Integrity regulatory impact is set to High
- Recovery time objective of an application—12 hours or less, Availability financial impact is set to High
- Payment applications—Integrity financial impact is set to High
Implementing AI in Risk Assessments
The financial institution successfully implemented AI in its risk assessments by taking several steps:
- Data collection—Gathered comprehensive, high-quality data from various sources, including application logs, network traffic, and security incidents
- Algorithm selection—Chose an appropriate AI algorithm that was well-suited for the organization's specific needs and risk landscape
- Model training—Trained the AI model using historical data to ensure that it can accurately predict risk and impacts
- Continuous monitoring—Regularly updated and refined the AI model to adapt to new threats and changes in the organization's environment
- Integration—Integrated AI-driven risk assessments into the existing GRC framework to enhance overall risk management processes. The prediction model output is fed into risk assessment tools on a timely basis as proposed by the model. Information security officers or application owners have an option to accept or reject the model’s results. If the results are rejected, valid justification must be provided, which is verified by assurance teams to ensure accuracy.
Benefits of AI in Risk Assessment
After implementing AI for its risk assessments, the financial institution calculated that it was saving an average of two hours of time per application. Based on the number of applications, it was determined that approximately 9000 hours—greater than one year’s worth of time—were saved. In addition, the financial institution reaped a number of other benefits after automating its risk assessments with the assistance of AI:
- Enhanced accuracy—AI algorithms can process vast amounts of data quickly and accurately, identifying patterns and correlations that might be missed by human assessors. For example, machine learning (ML) models can analyze historical security incidents and identify common factors that lead to breaches. This helps in predicting future risk with higher precision, ensuring that potential threats are identified and addressed promptly.
- Consistency—Human assessments can vary based on individual knowledge, biases, and interpretations. AI, on the other hand, provides consistent and objective evaluations. By using predefined criteria and algorithms, AI ensures that risk assessments are uniform across the organization. This consistency is crucial for maintaining a standardized approach to risk management and compliance.
- Efficiency—AI can perform risk assessments much faster than manual evaluations. Traditional risk assessments can be time-consuming, requiring extensive data collection and analysis. AI algorithms can automate these processes, quickly analyzing large datasets and generating risk reports in a fraction of the time. This efficiency allows the financial institution to respond more swiftly to emerging threats and make informed decisions faster.
- Reduced dependency—Relying on application owners for risk assessments can be problematic if they lack the necessary knowledge or expertise. AI reduces this dependency by providing a data-driven approach to risk assessment. By leveraging AI, the financial institution can ensure that risk evaluations are based on comprehensive data analysis rather than individual knowledge, reducing the risk of inaccurate assessments.
- Predictive capabilities—ML algorithms can predict potential risk based on historical data. By analyzing past incidents and trends, AI models can identify patterns that indicate future vulnerabilities. This predictive capability allows the financial institution to proactively address risk before it materializes, enhancing overall security posture. •
- Scalability—AI can handle large volumes of data and assess multiple assets simultaneously, making it suitable for organizations of all sizes. Whether it is a small business or a large enterprise, AI can scale to meet the financial institution’s needs. This scalability ensures that risk assessments are comprehensive and cover all critical assets, providing a holistic view of the financial institution’s risk landscape.
By leveraging these benefits, the financial institution significantly improved the accuracy, consistency, and efficiency of its risk assessments, ultimately enhancing its ability to protect against cyberthreats and maintain compliance with regulatory standards.
Business Outcomes
The benefits introduced by integrating AI into risk assessment resulted in tangible positive business outcomes for the financial institution.
Improved Compliance Tracking
One of the most significant positive outcomes of integrating automated compliance tracking into GRC processes is the accuracy and reliability of compliance data. The golden source captures accurate compliance data from the outset, ensuring that any updates or changes in application security controls are automatically reflected in risk assessments. For example, if a new security control is implemented, the system will update the compliance status and adjust risk assessments accordingly. This real-time updating mechanism ensures that the financial institution is always working with the most current information, reducing the risk of compliance gaps and ensuring that all regulatory requirements are met.
Streamlined Risk Management
Automated integration of compliance data into risk assessments significantly speeds up the risk management process. When a new application is onboarded, the system quickly absorbs the relevant compliance information and updates the risk profile. This enables faster decision making and response, as the risk management team can immediately assess the new application's risk level and take appropriate action. This streamlined process reduces the time and effort required for manual data entry and analysis, allowing the financial institution to respond more swiftly to potential risk.
Consistent Risk Evaluation
ML algorithms provide a consistent method for evaluating risk factors across different applications and environments. By standardizing the evaluation process, the financial institution can ensure that risk assessments are comparable and reliable. This consistency improves the overall reliability of the risk management framework, as it eliminates the variability that can arise from manual assessments. With consistent risk evaluation, the financial institution can better identify trends and patterns, leading to more informed decision making and improved risk mitigation strategies.
Efficient Resource Utilization
Automating risk assessments and compliance tracking allows the financial institution to make better use of its resources. By reducing the time spent on manual data collection and analysis, resources can be redirected toward more strategic tasks. For example, security teams can focus on addressing high-priority risk rather than spending time on routine assessments. This efficient resource utilization not only improves the effectiveness of the risk management process but also allows the financial institution to allocate its resources more effectively, ensuring that it is addressing the most critical risk first.
Conclusion
The significant benefits of integrating automated compliance data into GRC processes are illustrated by improved compliance tracking, streamlined risk management, consistent risk evaluation, and efficient resource utilization. By leveraging technology to enhance these aspects of risk management, the financial institution achieved better compliance, faster response times, more reliable assessments, and more efficient use of resources. These improvements ultimately contribute to a stronger risk management framework and better protection of organizational assets.
Rajendra Jakku
Is a highly experienced information security specialist with more than 24 years of expertise in managing and protecting enterprise information systems. Currently he manages an identity access information security control testing team, focusing on strengthening the control environment.
