The Microsoft Worldwide Partner Conference (WPC) will take place this year from July 10-14, 2011 in Los Angeles, California at the Los Angeles Convention Center[i]. WPC is an annual gathering for the Microsoft partner community to meet top Microsoft executives, learn about Microsoft’s roadmap for the upcoming year and see the latest Microsoft product innovations. Since 2003, WPC has served as a major Microsoft support event for thousands of partners from more than 130 countries worldwide, better enabling partners to plan their business strategies for the upcoming year. Microsoft executives who will speak at WPC include Steve Ballmer (CEO), Kevin Turner (COO) and Jon Roskill (corporate VP of the Worldwide Partner Group). Executives from the Microsoft U.S. financial services industry group and other industry groups also will be attending WPC and meeting with partners. The guest speaker on Wednesday, July 13^th, will be Sir Richard Branson, founder and President of Virgin Group.  

It should be noted that WPC is just one of many ways that Microsoft supports its partner ecosystem. With respect to the activities that Microsoft and its strategic partners can jointly undertake to pursue joint business opportunities, these can include a wide variety of joint marketing and sales activities, such as the following:

• Joint presentations at major trade conferences[ii]:
• Joint presentations at Microsoft Technology Centers[iii]
• Joint solution marketing videos[iv]
• Joint webinars[v]
• Jointly written white papers[vi]
• Coordinated booths at trade conferences[vii]
• Microsoft sponsorship of partner events and provision of speakers for partner events[viii]
• Microsoft highlighting of partner solutions in this Microsoft GRC blog and on the Microsoft Financial Services Industry Group website[ix]
• Microsoft participation in partner think tanks[x]

Sometimes the close collaboration between Microsoft and a GRC partner may lead both to decide that an even closer working relationship makes sense. For example, Microsoft recently announced the acquisition of Prodiance, a Gold Certified, industry-managed partner that markets leading Excel spreadsheet and Access database control solutions[xi], with the stated goal of bringing more compliance functionality within Microsoft Office.

·        Prodiance[i]

o   White paper – “Automating Spreadsheet Controls for Solvency II Model Compliance”[ii]

·        Open Text[iii]

o   Book - Tom Jenkins, CEO of Open Text, Managing Content in the Cloud[iv]

·        Harland Financial Solutions[v]

o   White Paper – “Exceptions Management: Front Line Effort For Improved Credit Risk Management”[vi]

·        Accenture[vii]

o   Survey article – “Most European Insurers Say Compliance with Solvency II Will Cost More Than Originally Expected, Accenture Survey Finds”[viii]

·        Hyland Software[ix]

o   White paper on ECM workflow – “Workflow: Real Life ROI”[x]

·        Thomson Reuters[xi]

o   Cost of Compliance Survey 2011[xii]

·        Numerix[xiii]

o   White paper – “Numerix CrossAsset XL and Windows HPC Server 2008 R2: Faster Performance for Valuation and Risk Management in Complex Derivative Portfolios”[xiv]

·        Fiserv[xv]

o   White paper – “Headlights into 2011: U.S. Financial Regulatory Reform A Game Changer for Financial Services”[xvi]

With Microsoft making a big bet on its Azure Cloud based services, the impact and implications for Governance, Risk & Compliance (GRC) space makes for a very interesting case. I will share some interesting industry patterns around GRC on an ongoing basis as i come across them. Today i  start off with - Cloud GRC and Cloud based GRC services.

Cloud GRC - As companies in regulated industries look to adopt Cloud for relevant operating models and workloads, Cloud Governance, risk and compliance (GRC) is a key consideration. Typically firms list security, privacy, reliability, and operational control as key issues. There are baseline expectations that both existing as well as emerging certifications and standard attestations would be applied and stretched to the Cloud such as SAS 70, FISMA, ISO 27001, HIPAA, PCI DSS etc. There are also some evolving standards being worked on at bodies such as the ISO, ENISA etc. Microsoft itself addresses these issues through the coordinated and strategic application of people, processes, technologies, and experience. The result is continuous cloud security advances within the Microsoft cloud environment. For e.g. Windows Azure contains a risk-based program that hunts down and labels security and operational threats. It also keeps a detailed set of security controls updated and maintained at all times. Windows Azure operates a compliance framework that helps ensures organizational controls are designed correctly and operating as they should be.

You can find more information via this link. and whitepaper (Securing Microsoft's Cloud Infrastructure).

Cloud based GRC services - In many industries, regulatory reporting and risk assessment requirements are spread across the value chain or the supply chain. Many of these currently are supported by disparate, inconsistent and exist at country or functional level silos hosted by respective dept., suppliers. In such cases, Cloud based GRC Services lend themselves very well. An integrated Cloud based approach could help enable rapid deployment across the value chain for efficiencies. For e.g. European Environment Agency reporting and tracking is done across 32 member countries on Microsoft Azure.

Cloud as an enabler to develop and run applications with unbounded scalability and ease-of-use, lends itself very well to GRC due to rapidly changing regulations. Common GRC related activities such as stress testing, inspection, audit neccessiate temporary periodic spikes in need for collaborative workspace, computing needs and business records archiving. Currently the response to this is ad-hoc and puts a lot of pressure on the organization to manage this need. A Cloud based computing cycle, inspection, audit workspace, archiving workspace could very well fit here to manage the peak loads. For e.g. Risk specialist firm RiskMetrics, a division of MSCI, offers Monte Carlo Risk simulations from Azure to its customers during peak loads. I have blogged about this case earlier.

With such a Cloud based flexible platform, one can easily scale up or down to meet the demands of risk management and regulatory reporting. With the pay-for-use business model, one does not waste money on services one will not use 90% of the time.

Stay tuned as I cover more specifics on industry adoption in my following blogs.

Do you see similar patterns ?

Early this month FinArch, a key Microsoft Risk solutions global alliance partner, announced that one of the world’s largest bank has selected its Financial Studio as its global solution for liquidity risk calculation and reporting. FinArch had successfully implemented the solution in London during 2010 for the bank’s European operation. Financial Studio is a comprehensive integrated Risk and Finance solution based on a single version of the truth in data terms, i.e. a common core Financial Data Architecture. Based on the Finance Resource Planning (FRP) concept, the solution provides complete functionality for the management of the entire accounting chain, enterprise risk management function and internal and external reporting obligations.

It’s yet another example of a mission critical Risk data model and business application being deployed on Microsoft SQL Server & platform. The need for real-time risk modeling,high performance computing, RAROC models will only increase in the coming months for the industry.

The FinArch solution provides the bank with a common Microsoft based data model & architecture in which to store, manage and enrich data from all parts of the business. The solution offers a powerful simulation engine for the expected slew of mandatory stress testing prescribed by multiple regulators. It also provides capabilities beyond regulatory compliance. It is also unique in the sense that it integrates Risk and Finance world genuinely providing risk, finance, accounting and reporting functionality in 1 single unified platform.

The core capabilities being:

• Cash Flow analysis 
• Valuations
• Gap Analysis
• Concentration Risk
• Stress Testing simulations
• Basel III convergence – counter cyclicality, leverage ratio, liquidity risk

Congratulations to the FinArch team for achieving this significant milestone, amongst many others. I look forward to sharing many other success stories in the area of Risk and compliance.

Source: Based on FinArch Press Release, March 2011

Today, I will provide more details on the survey findings. This survey polled respondents across financial industry, as well as the broader sector to have a more balanced view of the results. Out of a total of 1,662 global respondents, 1,398 (84%) were from financial institutions and 264 (16%) from non-financial institutions. Here are some key results:

• The top five financial risk management future trends are:  1. Liquidity Risk Buffers, 2. Enterprise Risk Management, 3. Stress Testing, 4. Managing Systemic Risk, and 5. Banking Book Credit Risk Models.
• The top five non-financial risk management future trends were: 1. Enterprise Risk Management, 2. Operational Risk, 3. Cash Flow at Risk (CFAR), 4. Productivity & Efficiency in Risk, and 5. Technology Risk.
• Risk Management/Compliance trends foreseen in the next two to three years include: 1. More visualization of analysis, 2. Collaboration as a key pillar, and 3. Broader and wider access to business insights and analytics, i.e. risk management for everybody.
• Risk management and compliance functions will rely much more on: 1. Automating work flows and processes, 2. Self serve – providing powerful analytics to end users, and 3. Unlocking business data/insights.
• Top skills which risk managers of the future need to focus on include: Deeper business knowledge was ranked the top skill; Quantitative skills (math, statistics) and Communication skills ranked second and third respectively.
• Risk managers today spend on average 62% of their time on tactical tasks (e.g. data collection),and only 36% on strategic/analytical activities. The percentage of firms taking a more strategic and longer term view of risk management practices will rise.
• The percentage of operational costs needed for an effective risk management program: 27% felt 2-5% of the operational costs was adequate; 25% voted for 5-7% of the operational costs and 24% voted for a much larger share of 7-10% of the operational costs.
• Future decisions on risk management technology investments will be based on: 1. Efficiency - Integrated offerings which help bring efficiency to work flows and processes, 2. Self-service – The right information, at the right time in the right format for end users, and 3. Productivity – Saving valuable hours for employees in everyday risk management tasks. Interestingly, cost came out as the lowest factor.

Do you agree /disagree with your peers in the risk industry? I welcome your thoughts.

• A. M. Best announces it will not permit its ratings of insurance companies to be cited in registration statements and related prospectuses, since that could expose A.M. Best to “expert” liability as a result of the Dodd-Frank legislation[i]
• Citigroup and other banking institutions reportedly begin the process of spinning off their hedge fund and private equity lines of business[ii]
• The U.S. Securities and Exchange Commission adopts a final rule “Proxy Disclosure Enhancements” pursuant to authority granted in the Dodd-Frank legislation[iii]
• CalPERS establishes its Diverse Director Database to support nominations of directors by institutional shareholders pursuant to the new SEC proxy access rules[iv]
• The SEC seeks comments on other regulatory initiatives undertaken as a result of the Dodd-Frank legislation[v]
• Companies begin planning for compliance with the “say on pay” requirements for shareholder meetings held on or after January 21, 2011 and Towers Watson surveys 251 large and mid-sized companies on their preparations[vi]
• The FDIC, OCC and FRB issued a joint advance notice of proposed rulemaking (“ANPR”) regarding alternatives to the use of credit ratings in the agencies’ risk-based capital rules for banking organizations[vii]
• The U.S. Office of the Comptroller of the Currency (OCC) and other U.S. banking agencies express support for the September 12, 2010 Basel III agreement as being in harmony with the goal of the Dodd-Frank legislation to establish “more stringent prudential standards, including higher capital and liquidity requirements for large, interconnected financial institutions.”[viii]
• The FDIC hosts a roundtable to discuss implementation of the new resolution authority granted to the FDIC under Dodd-Frank[ix]
• Personnel at the U.S. Treasury Department work to establish the Bureau of Consumer Financial Protection and rumors surface that President Obama may make an interim appointment of Harvard Law Professor Elizabeth Warren as its first director[x]

Having personally led the PRMIA initiative in a pro-bono capacity, this survey was about defining the future vision, blueprint and game changers for next-generation risk management practices. The idea being to uniquely capture the broader pulse of the risk profession beyond regulations, which included future vision, game changers, productivity, and a generational shift in talent pool and technology. The survey responses clearly confirm the global demand for easy-to-use automation and analytics, and validate the focus on solutions that automate and simplify governance, compliance and risk management. 

As per responses, a sign of the enhanced work pressures and real-time turnaround is being reflected in a consistent focus on productivity and efficiency in Risk and Compliance functions across many areas to save valuable time and effort. Responses also indicated a shared vision towards enhanced productivity and efficiency in future risk and compliance workflows. There is a clear sense of pain around being asked to “do more with less.” Most respondents expressed a future vision where they are able to spend more time on strategic and proactive risk mitigation activities, rather than on time consuming tactical tasks like data aggregation.

On technology front - ease of use, flexibility, self-serve and integration with current environment were key expectations, along with the need for enhanced decision support, predictive analytics and high performance computing in the processes. Also implicit was the role of technology enablers to enhance productivity and efficiency in the workplace. Tools like risk computing via cloud start to become real.  

On potential game changers, being an open ended question, there was a predictably a wide range of response. The top “categories” of game changers were new regulatory concepts, risk approach and next generation risk computing. Whilst I will cover the detailed results in next few blogs, some of the key areas covered in the benchmark survey are: 

-       Vision and pulse of the profession

-       Empowerment and culture

-       Generational shift in the risk talent pool & skills 

-       Future trends in Risk and Compliance

-       Future vision of a Risk and Compliance workplace

-       Budgets, Investment Expectations

-       Technology predictions

-       Game changers

The survey is available for download by PRMIA members from http://www.prmia.org/

You can also request a copy via this blog. I certainly look forward to your comments & feedback.

It has been reported that the SEC estimates that 33% of public companies have at least one institutional shareholder owning at least 3% of their securities for at least three years[ii]. Examples of such major shareholders would include CalPERS and other large pension funds.  Although large hedge often hold positions of 3% of greater in public companies, only a subset of these same hedge funds hold their 3% equity positions for at least three years.

Under the new SEC final rule, management is not required to include shareholder nominees for more than 25% of the total board seats. If multiple shareholders nominate directors for more than 25% of the board seats, the largest shareholders will take precedence over the smaller shareholders, irrespective of which shareholder nomination was received first by management. Under New York Stock Exchange Rule 452, brokers are no longer permitted to vote the shares they hold on behalf of customers, unless the beneficial owners of the shares direct them as to how to vote the shares. Since brokers in the past typically voted shares in favor of the management’s slate of directors, this new SEC final rule, when combined with NYSE Rule 452, may now have a significant impact on the composition of boards of public companies with large institutional investor shareholders.  In light of the new SEC final rule on proxy access, some companies may attempt to enact procedural barriers to thwart large institutional shareholders from replacing management-nominated directors. In a recent article, J.W. Verret of the George Mason University School of Law explored some of the legal defenses public companies might attempt.[iii]

These new developments may mean that boards of directors of some public companies over the next few years will include a significant number of independent directors nominated by large institutional investors unhappy with the way the current management is running the companies.  From an information technology point of view, this may result in the independent directors requesting the board have its own IT infrastructure in the “cloud” that would not be subject to operational oversight and control by management. Boards of directors have relatively simple record-keeping requirements. For example, boards must maintain records of whistleblower complaints made to the board under the Sarbanes-Oxley Act and vendors already exist to provide record-keeping extranets specifically for boards of directors[iv]. The primary IT requirements of boards tend to be in the areas of business intelligence, communication and collaboration and document production and review. These requirements could easily be satisfied with through a cloud environment, such as the Microsoft Business Productivity Online Suite (BPOS)[v].