Podcast transcript: Digital risk as a source of competitive advantage in financial services (Agents of Change series)

Roger Park

Welcome back to the Agents of Change podcast series. I’m Roger Park, EY Americas Advisory and Financial Services Innovation Leader, and the series host. 

I’m joined today by Amy Brachio, EY Global and Americas Advisory Risk Leader, and Cindy Doe, EY Financial Services Advisory Principal. Both Amy and Cindy focus on digital transformation and risk in their respective roles. Amy and Cindy, why don’t you tell us a little bit about yourselves. 

Amy Brachio

Hi, Roger. This is Amy Brachio. Thank you so much for having me. I get to spend a lot of my time talking to clients across industries about what they’re doing to harness the power of emerging technology to better manage risk and also to think about what are the implications of taking advantage of this great new technology, but also what are the things they need to think about to make sure that they’re able to do it with confidence. 

Cindy Doe

It’s Cindy Doe. Thrilled to be here today in this podcast. Similar to Amy, my background at EY, I came up through the Risk practice focusing on IT, cyber resiliency and privacy. I’m out speaking to clients about what’s happening around digital transformation activity, emerging technologies. How are they dealing with this from a risk management standpoint, from a compliance standpoint? And what kind of questions are they getting from various stakeholders, as well as how are risk management functions thinking about how they transform themselves? So, we’ll talk more about this as we go through, but I’m thrilled to be here.

Park

Thanks Amy, thanks Cindy. I know risk is an important topic for all of our listeners. Technology-driven innovation has transformed the financial services industry. Technologies like advanced analytics and AI, robotic process automation and cloud-driven models have enabled firms to create new products and services, enhance access and experience for customers, and strengthen controls and drive down costs. Digital transformation introduces new risks and potential weaknesses. 

So, Amy, let me start with you. You’ve recently published a few articles on digital risk and spoke about the waves of change that are sweeping the business world and transforming the environment in risk. Can you give us your view on some of these trends?

Brachio

Absolutely. So, when you think about what organizations are facing today, the pace of change has never been faster. Whether it’s geopolitics, changing demographics, industry convergence or emerging technology, our clients just have more coming at them and they need to be thinking differently to make sure that they’re avoiding the downside of what can go wrong at the same time they’re taking advantage of what they need to take advantage of. So, that really means a new way of thinking about risk and really understanding what risks are presented. 

Both the challenges that need to be avoided, so if you’re taking advantage of interacting with your clients and your customers in a different way through digital means, you need to make sure that you’re still compliant with privacy requirements and that you’re thinking about the cybersecurity challenges. But avoiding those things completely may put you in a bad place where you’re not interacting with your customers in the way that they want to be interacted with. It’s really an exciting time. 

Park

Yeah. I think getting that balance right is going to be tricky. How do you take advantage of the new technologies but still make sure that you’re meeting all your obligations and expectations around trust and privacy. 

Brachio

Absolutely.

Park

And, Cindy, in particular, I imagine the financial services industry navigating that whole maze is even more complicated. Can you tell us a little bit about how these trends are impacting financial services?

Doe

Oh, absolutely, Roger, and I would say that a lot of what Amy said holds true for financial services. When I talk to different clients, digital transformation and disruption is either on their doorstep or they can see it on the near horizon. 

As the business changes, risks such as cyber and resiliency are happening at a faster pace or velocity and can change risk positions in a matter of a day. So we are seeing a lot of clients focus on these new types of risks of existing risks in new ways that are emerging, and they’re really focused on that from multiple angles. 

One they’re focused on from a risk management standpoint, how do they make sure they’re bringing the right capabilities into the development and implementation of this technology in the front line? As well as really taking a hard look at the second line of defense or the overall risk organization to say how do we think about using some of these digital technologies in new ways to make our roles more impactful, more efficient and, ultimately, help with that balancing act that Amy talked about between taking advantage, understanding what your risks are of those upside opportunities, as well as protecting the enterprise and managing the downside risks as well? 

Park

Yeah, that’s going to be a tricky question for a lot of our clients. And my next question builds on top of that, and this is for both of you. 

A lot of our clients have really embraced digital transformation and some have progressed faster than others. Some have been a bit more aggressive than others, but there are a handful of individuals I’ve spoken to who think transformation cannot be done in the near term or applied to existing legacy systems, you know, that problem is just too hard. What would you say to those individuals who are resistant to that type of change?

Brachio

Thanks, Roger. I’ll get us started. Our clients need to understand that there is a real sense of urgency out there. If you look at different studies, it shows that the average life-span of an organization on the Fortune 500 will be cut in a third by the time we get to say 2027, and could be down as low as about 12 years, which means that transforming the organization is not just a nice to have, but a need to have, or the organization risks no longer being in business. 

The companies out there need to view transformation as really part of their lifeline and their ability to extend the life-span of the organization. I think with that type of mindset, it leads to different decision-making and a different sense of urgency or imperative around the need for digital transformation. 

My favorite example is how we consume media. If you think about it, not that long ago we rented our movies from the local Blockbuster. You know, Netflix came in and really changed how we all consume media, not only for Blockbuster, but now it’s all through streaming. And we continue to see those changes. 

Park

I mean, there’s definitely risks involved with digital transformation. But there’s also risks as you’ve pointed out of not being, not transforming and not keeping up.

Doe

So, Roger, from the financial services standpoint, I would say the thing that we’re having many conversations with customers about is their end customer. What are they expecting? You know, there continues to be proliferation of FinTech organizations that are coming in offering very targeted services that five, six, seven years ago didn’t necessarily exist as competition. 

So, part of what we’re thinking about in this whole digital transformation journey, which risk is part of, is what does the customer expect? Which ties back a little bit to what Amy was talking about, which is what’s the journey around trust? If you’re having to deal with things like cyber resiliency, privacy, compliance requirements, risk requirements, how do you juggle all those things through the lens of a client? So, as we think about these emerging technologies and these types of transformational efforts, it’s really important that firms think about what is the changing client dynamic? What are the changing expectations? And what steps can they take? It doesn’t mean that you necessarily have to implement a full blockchain solution with AI in every part of your business. But there are steps that you can take to start to think about that transformation from the angle of your customer and what steps are going to have the most impact. 

We spend a lot of time talking to customers about customer journeys. So, how do you create that lifelong relationship with a customer? And how do you make sure you’ve got the right level of risk, cyber, privacy, resiliency capabilities, compliance capabilities into those models that you’re really delivering something that the customer is going to find value in? 

It’s going to be a trusted solution, and it’s going to end up creating a competitive differential for you in the marketplace. So, those are the things I would say from a risk standpoint, we are seeing clients look at technologies including robotics. In some cases, some of our clients are looking at AI, machine learning. They’re looking at solutions in other technologies, particularly cloud is a topic that comes up just about every week. But they’re looking at these things in ways that help drive efficiency, as well as potentially help them be more efficient in risk management processes.

Park

I think that’s a super important point, Cindy. From the inside, it may seem like an obsession with risk or cyber or resiliency. But from the perspective of the customers, it’s really about do they trust the companies that they’re working with protect their data and provide them a reliable, trustworthy service in an era where the customer expectations are so high that’s going to be the competitive differentiator, as you said. 

OK, so my next question is going to be a little different. It’s going to be about talent. When we talk about change, obviously, we can’t ignore the people aspect, and today the nature of work has changed significantly due to everything we just discussed — digitization, data-driven activities, AI, robotics, automation, etc. What, then, does the risk function look like? Have the skill sets of the CRO and the risk team, are they changing?

Brachio

Great. That’s an excellent question. Yeah, the risk profession of the future is going to be critically important to the overall success of the organization. Part of that is going to come with mindset. This move from really a focus on risk avoidance to optimizing the risks that the organization takes.

It’s also going to be critically important that the risk professional of the future have a seat at the table with the C-suite, with the leaders of transformation, bringing that mindset to deliver value and trust throughout the organization. Risk professionals are going to need to evolve and make sure they are embracing emerging technology and understanding big data. 

Like Cindy talked about, artificial intelligence, robotics and process automation to really be able to disrupt how risk functions operate today. Most importantly, is the ability to be nimble, to be agile, to be intellectually curious and to have the stamina to keep up with the pace of change that we’re all seeing will all be vital on the softer skill side.

Park

That’s great, Amy. I think some really important points there around risk professionals also having to embrace digital transformation and also having to look forward to how they can transform their function to keep pace with the changing pace of their organization. 

Cindy, a question specific to financial services. It’s one of the industries that we operate in that’s heavily regulated as some others. What role do you think regulation is going to play in this?

Doe

Let’s start back to the customer. Customer expectations are high. Availability of systems when I need them, whether that’s at 2:00 in the morning or 2:00 in the afternoon, the ability to transact accurately, reliably and in a real-time manner continue to be things that customers are focused on. And many times, customer expectations can tie into what regulators are focused on. Regulators are clearly looking at everything that’s happening, right? They’re engaging in conversations with multiple clients and understanding what’s happening from an emerging technologies standpoint. 

If you look across the globe, including the US, you are seeing regulators engage in various sandboxes which really create an opportunity for all parties to learn more about the evolving technologies and their use cases and the new types of products that customers are expecting and really understand them better in what I would call kind of a controlled manner so that they can all kind of experiment, understand what this means and evaluate what these capabilities do from a risk perspective. 

So, we are definitely seeing an active level of interest and engagement if you look kind of across the board with various regulators that our clients interact with. 

Park

It’s good to hear that the regulators are also engaging and enabling. Maybe experimentation is not the right word, but the test-and-learn model for these new and emerging technologies.

Doe

Yes. Test and learn would be a good way to put it.

Park

Amy, what are some practical steps that financial institutions can take as they try to turn digital risk into a source of competitive advantage?

Brachio

I want to focus on the people aspect that we already touched on earlier. Essentially, the risk function needs to disrupt itself. It needs to change from being a defensive tool into becoming a core component of strategic development, helping the organization find ways to both maintain existing product lines and invest appropriately in the new and what’s coming next. 

This means the risk professional of the future needs to embrace this duality, which can be a challenge. But she needs to be able to look at the past, understand it and learn from it. But also needs to use a broader network of intelligence from across the organizational ecosystem to react to these shifting risks as they emerge in real time. And that is a change from how risk functions are run today. But, I think an exciting one and one that will add tremendous value to the organization as a whole. 

Park

I think as a risk professional, I think it could be exciting to move into this new type of role and this new dynamic. 

So, what I’m hearing is as financial firms make the transition to digital and continue to innovate at scale, a strong risk management function is going to be a differentiator because that will give those companies the confidence to move forward responsibly and quickly. It makes sense. It’s clearly important to involve the risk teams up front and integrate them in with those responsible for digital transformation. Cindy, do you have any thoughts on that?

Doe

There’s a few things I would add or weigh in in terms of that question, Roger. I do think that a number of financial services firms are embracing this change and they really look at change as part of their DNA and are really focused on how do they take advantage of this, going back to how do they meet the changing customer expectations. I really think about what they do to meet those. 

From a risk standpoint, there are probably three foundational components to consider that I would have clients think about. One is get the risk teams, the risk capabilities in your organizations plugged into the design and experience thinking efforts that our clients are doing to build new platforms, new products, new services into the marketplace. Bringing that risk compliance, security, privacy, resilience lens into the equation will create, I believe, a difference-changing product into the market. 

Two, as Amy mentioned, talent is going to be important. Really thinking about what are those additional talents, both from soft skills as well as technical skills, that will be needed. 

And then, lastly, adaptiveness. I think agile methodologies, being adaptive, being flexible and agile in how we’re attacking the problem sets will be super important for clients. What works today we may have to adjust in a month or two based off what’s happening to the market, based on customer reactions. How do we pivot in real time to try to take advantage of those market opportunities, but also make sure we’re protecting any sort of risks to the organization? 

Park

Thanks, Cindy. I think that’s a great checklist for our listeners to go through as they think about how they can evolve their risk function. 

So, what’s the one thing you’d want audiences to remember after listening to this podcast? Cindy, you first.

Doe

Oh, thank you. To me, the changing dynamic is around trust. The definition of trust is changing, and I think things such as embedding of risk, compliance, security, privacy, resiliency capabilities into these new business models will be a competitive advantage for customers that embrace this and do this right. So, to me, it’s all about trust and that’s going to be critical in winning in the game.

Park

That’s great advice. Amy, your thoughts.

Brachio

Yeah, I completely agree with Cindy. And maybe what I’ll add to that is that the biggest risk may be the action that you don’t take. And, so when we think about the companies that will really thrive in this Transformative Age, it’s those that have the information that they need to make really good decisions. Then you think about the challenges out there. 

We have so much data available. But how good is it? How quickly do you have access to it? And, so, our companies need to ensure that they’re focused on having the best, most insightful data available in order to make decisions in the amount of time that they need to make them.

Park

That’s definitely going to get our audience thinking. Thanks, Amy. Thanks, Cindy. So, now we pivot to the section on personal perspective. So, Amy, maybe you first. What’s the one thing that you both challenge yourself to do every day?

Brachio

So, I really challenge myself to be present in whatever activity I’m undertaking and I think that one of the challenges that we all face with living in this digital age is that things are coming at us from every direction, right? Text messages, WhatsApp, emails. Everywhere you turn, you’ve got things coming at you. 

And, so, what I really challenge myself to do is to focus on being present with my family, with my friends, and in whatever meeting or activity I’m involved in at work to make sure I’m getting the most out of it and giving the most in those interactions.

Doe

So, for me, Roger, I think the one thing that I try to do every day is do something that makes me a little bit uncomfortable. Whether that is doing something personally, like, for example, exercising every day, or whether it’s something where I’m going out and talking to a client about something new or reading something that I wouldn’t normally read. But something that takes me outside of my comfort zone. 

Park

That’s great, that’s awesome. I’m going to take both things as advice as well. So, quick-fire Q&A. For our listeners, which book would you recommend on digital risk or innovation?

Brachio

So, this is Amy. I’m not going to answer your question specifically, but sort of carrying on with this, you know, we have so much information coming at us that we really have to be disciplined in how we manage our time. And with everything that’s facing us, I think that’s more important today than it has been in the past. 

So, the book that I like is called 17 Minutes, which really helps you take a look at how you use your time, how you reserve time to think and allowing you to be present. Because I think that’s what’s going to allow us to be able to tackle all the issues coming at us.

Doe

That’s great advice. Roger, from my standpoint, it’s not necessarily a book, but I love to read the Harvard Business Review. There are so many great articles in there that talk about digital transformation, that talk about the emerging technologies, that talk about the people implications, the organizational implications and where things are going. 

So, that’s one of my favorite reads and it’s easy for me to put into my suitcase or I can read it on my phone and it’s very easy for me to digest stuff pretty quickly.

Park

Yeah, I’m a huge fan of the Harvard Business Review as well. Cindy, you mentioned earlier a report that we had done. If our audience wants to get to that report, what’s the easiest way for them to link to it.

Doe

Oh, sure. So, the podcast audience can read more of the things that we talked about today in our paper called Moving from Analog to Digital, a new Paradigm for Risk Management, which they can Google, or you can visit ey.com/risktransformation.

Park

Thanks, Cindy. Which headline might we read in The Wall Street Journal on this date in 10 years?

Brachio

You ask hard questions, Roger. So, I’ll take a stab at this one. I think that what we’ll be reading about or maybe what I hope we’ll be reading about in 10 years is that a company that we’ve never heard of today has solved curing cancer.

Doe

Oh, that’s a good one.

Park

That’s a good one.

Doe

I can’t top that one. So, I guess the thing I would love to see is see somebody who’s come up through the ranks in information security and cybersecurity running a major financial services institution.

Park

That would be a great headline. What skill should our listeners teach their kids?

Doe

I’ll start with this one. I would say, it’s exactly what Amy was talking about earlier, being focused and being in the moment. As a mother of three kids ranging from the age of 15 to 21, it is a constant battle to get them focused away from their electronic media and to get them focused in the moment. 

I do think things like being off at school and in class helps engage them, but it is a struggle to try to make sure you stay focused because there are so many things that our kids have access to that we never even dreamt about when we were younger. And I think it’s really about practicing that capability to be disconnected, even if it’s only for a few hours, just to have that focus. I think that’s super important. And to learn how to balance those things in your life.

Brachio

So, like Cindy, I’m a mom and I have two teenage girls. What we talk about at home is that in the future it’s not going to be enough to be good at one thing. So, it’s really going to be about being able to connect the dots. 

So, one of my daughters is looking at chemistry and public policy because she thinks it’s an interesting nexus between science and public policy. And the other daughter wants to be into being a therapist, but also looking at business so that she can really have the skills needed to run the business. And I think it’s going to have to be that type of thinking, because if you’re good at only one thing, it can probably be automated. 

Park

That’s a great point. I can certainly use a business therapist, too. I’m sure we all could. There are days where we could all use a business therapist. That’s a great career choice. 

Doe

That’s true.

Park

So, I’m sure our audience is going to want to reach out to both of you. What’s the best way for them to get in contact?

Doe

For me, Roger, it’s going to be through my LinkedIn account, Cynthia Doe, EY.

Brachio

Same here. Amy Brachio on LinkedIn.

Park

Great. Amy, Cindy, thank you so much for joining me on my podcast today. I think you gave our audience a lot to think about and a lot of good information, and I’m sure they’re going to be reaching out to you on LinkedIn.

Doe

Thank you, Roger. It was great to be here.

Brachio

Thanks, Roger. This was a really interesting conversation.

Park

So, listeners, as you know, you can make suggestions on topics, guests or questions on Twitter using #agentsofchange. And thanks for your time. The next podcast will be in three or four weeks.