On this episode of our Risk & Accounting Advisory podcast, we are discussing “responsible innovation” — new and expanded or modified products and services — as part of the Risk in Review series.
This series is meant to provide informative content in a 5-queston format. Our guest, Mike Dempsey, Senior Manager, in the Risk & Accounting Advisory group unpacks what responsible innovation means for your organization. Regulators are focusing on responsible innovation and wanting to ensure adequate feasibility, due diligence and approvals before introducing a new or expanded activity.
We also cover the latest Office of Comptroller and Currency bulletin on the guiding principles, as well as regulatory considerations, benefits for businesses and finally, outlining how companies can effectively and sustainably develop a risk assessment framework, which includes responsible innovation criteria.
If you would like to learn more about the impact of new and modified or expanded products and services on your company’s risk profile and key messages and tips, please reach out to our speakers or visit cbh.com/risk.
View All Risk & Cybersecurity Podcasts
HOST: Hello and welcome to Cherry Bekaert's Risk and Accounting Advisory podcast. My name is Neil, firm leader of the Risk Advisory practice at Cherry Bekaert.
HOST: Today we will cover new, expanded, or modified products and services—otherwise known as responsible innovation—and what responsible innovation means for your organization.
HOST: Joining me today is Mike Dempsey, Cherry Bekaert's Financial Services Advisory leader.
MIKE DEMPSEY: Thanks. Happy to be here. I have spent a lot of time on this topic as an industry practitioner, regulator, Federal Reserve team leader, and consultant assisting large, mid-sized, and small financial services firms with innovation and change management.
MIKE DEMPSEY: I also consulted with the Office of the Comptroller of the Currency on a regulatory bulletin for this topic more than five years ago.
HOST: In your words, what does the term responsible innovation mean?
MIKE DEMPSEY: Responsible innovation is a term that has taken on new meaning as the financial services industry has transformed in recent years. Increasing adoption of digital technology solutions and digital assets by banking customers can provide flexibility and accessibility, but they can also bring emerging and elevated risks to the project sponsors offering these products and services.
MIKE DEMPSEY: You need to perform a thorough feasibility, due diligence, and risk assessment process before going live with a new product or service. You should also perform a post-implementation review to ensure the conditions of approval remain valid.
MIKE DEMPSEY: The Office of the Comptroller of the Currency (OCC) defines responsible innovation as the use of new or improved financial products, services, or processes to meet the evolving needs of consumers, businesses, and communities in a manner consistent with sound risk management principles and aligned with the bank's overall strategy.
MIKE DEMPSEY: The bulletin I consulted on is OCC 2017-43. It provides guiding principles for ensuring all new, expanded, or modified products and services are developed and approved in accordance with sound principles and risk management practices.
MIKE DEMPSEY: A robust risk assessment process should always be used to evaluate new and existing products, services, and strategies that can alter the risk profile of your institution. Conducting a detailed risk assessment early in the planning process allows leadership to fully vet and consider associated risks, as well as the controls and monitoring tools needed to mitigate them.
HOST: You mentioned consulting on that bulletin more than five years ago. Why is there increased regulatory focus on responsible innovation now?
MIKE DEMPSEY: Regulators have started focusing on four components in examinations of responsible innovation to promote effective, principles-based oversight. First is adequate feasibility, due diligence, and documented approvals before introducing a new activity.
MIKE DEMPSEY: Second is policies and procedures to properly identify, measure, monitor, report, and control risks. Committee governance is the third component, such as having a New and Emerging Products Committee.
MIKE DEMPSEY: Fourth is effective change management for new activities or affected processes and technologies, including having a project management office to manage change. Ongoing performance monitoring and review—key risk indicators, reporting, and board reporting—are also critical. Regulators will be looking at these areas in their examinations over the next year or two.
HOST: What are the benefits our clients get from transforming and uplifting their innovation capabilities?
MIKE DEMPSEY: Responsible innovation provides a risk-based approach, transparency, flexibility, and cultural buy-in among key stakeholders. It helps build a strong culture for initiative adoption.
MIKE DEMPSEY: Clients can also benefit from a common taxonomy and common risk language that is understandable by a broad audience, including leadership, end users, and stakeholders. That enables consistent communication and reporting of risks and metrics across an organization, between affiliates, with customers, and to the public.
MIKE DEMPSEY: The framework can be scaled and right-sized to an organization's size and complexity while remaining aligned with broader strategy and processes. Responsible innovation should treat risk assessments as living documents, revised and updated as technology understanding and trustworthiness evolve.
MIKE DEMPSEY: The primary objective is to achieve guiding principles of fairness, accountability, and transparency; identify high, medium, and low risks; measure the effectiveness of controls; and identify pain points with recommendations for improvement.
HOST: Can you provide guidance to help listeners ensure more effective and sustainable product development, and touch on the risk assessment framework you mentioned?
MIKE DEMPSEY: Responsible innovation requires management and the board to fully understand and assess the impact of new, modified, or expanded products and services on the organization's risk profile. Some key messages and tips:
MIKE DEMPSEY: Involve risk management earlier—get your second line involved in the product development process to avoid being a back-end check.
MIKE DEMPSEY: Train stakeholders on the value proposition of a disciplined, rigorous framework for assessing products and services. Culture is key, starting with tone at the top.
MIKE DEMPSEY: Expand your risk categories in the risk assessment process. Broaden the span of risks included in due diligence to cover conflicts of interest, conduct risk, credit risk, market risk, third-party risk, business continuity planning, model risk, and others. Don't limit it to operational risk.
MIKE DEMPSEY: Identify and escalate risks and issues. Project sponsors and risk managers should monitor and coordinate implementation with the business units (first line) to ensure all relevant issues are addressed and information is distributed to support functions such as IT, operations, accounting, and finance.
MIKE DEMPSEY: Ensure accountability. All stakeholders should know core values, expectations, and consequences for failing to uphold policies. Failure to comply with policies and procedures should result in disciplinary action when appropriate.
MIKE DEMPSEY: Provide effective challenge. Reviews and assessments of a new product or service should consider a broad range of views with open discussion and constructive challenge. Initiatives should be fully vetted to determine inherent and residual risk, ensure mitigating controls are appropriate, and confirm the business sponsor understands the risk profile.
MIKE DEMPSEY: Post-implementation reviews (PIRs) are an effective mechanism to ensure assumptions, parameters, and conditions remain valid once the business is implemented. Conduct checks at intervals such as six to nine months after launch.
HOST: Can you tie this back to the solution offerings our team brings to market and how we can help clients start their journey up the maturity curve?
MIKE DEMPSEY: Our Risk Advisory team can assist with a customized innovation framework and diagnostic toolkit. We can provide a comprehensive set of responsible innovation program attributes, including policies, procedures, due diligence, risk assessment templates, and tools to facilitate assessments of your program.
MIKE DEMPSEY: We can help you assess maturity, plot comparisons between your current and target state, and provide benchmarking analysis against peer leading practices across the industry.
HOST: This was a concise episode but packed with valuable information. For more information on responsible innovation and how your business can begin its journey to developing a framework as Mike described, visit cb.com/risk.
HOST: If you enjoyed today's podcast, check out other Risk and Accounting Advisory podcast episodes at cb.com/slp/podcast. Please like, share, and subscribe to our podcast series.
HOST: Thank you once again for listening.
