To those of you who have known me for many years, you will realize that this post is not intended to be a ego-centric or promotional note….That’s just know how I roll. In my opinion, competition is healthy and necessary in EVERY business.
So why the disclaimer? Well, I am getting more and more concerned that some of my good friends in the banking arena are making decisions in the compliance area, SOLELY based on cost. We are seeing a growing number of Banks make critical security and compliance decisions based on “getting it done” cheaper. I KNOW most Banks are struggling to show an increased ROI and ROE which may be down from the last few years. Many of these Banks have compensation plans that tie directly to profitability and some executives have seen their personal bonuses reduced CONSIDERABLY. I understand the pain, but I also understand the potential of these cost reduction pressures getting in the way of making critical decisions.
It’s my opinion that making ANY decision based on the cost alone can have devastating reputational consequences. It does not matter what area of compliance you are considering, if you are looking at cost alone, it’s only a matter of time before SOMEONE gets compromised. Audit and compliance happen to be areas where a vendor can put a nice proposal together that “says” you are covering ALL the areas, but none of them go into detail as to the actual due diligence that’s to be performed. Frankly, in the technology area, most banks don’t have the expertise to understand the difference.
Here at The Garland Group, we have discussed SEVERAL times coming up with a “lite” version of our Technology audit— but we always come back to one thing. Would you be OK with a “lite” version of the audit if you had the primary responsibility to make the right decision as a member of the Board. Just ask yourself: What is taking the cheap route going to “cost” me in reputational risk, security, and more?
Thanks for letting me get that off my chest, and thanks for reading this.