Banks should stop treating controls as an afterthought and instead build them directly into technology architecture from the outset, a senior banking executive argued, warning that future resilience will depend less on monitoring failures and more on desi
Financial institutions should
fundamentally rethink how they design operational controls if they are to keep
pace with increasingly interconnected technology, cyber and operational risks.
Speaking at CeFPro’s 2026 Risk
Americas conference, the Director of Global Technology, Cyber, and Resilience
at a major international bank said that rather than continuing to layer
controls onto processes after systems have been developed, resilience should be
engineered into technology from the very beginning/
This, he argued, would create organizations
that are inherently safer, more adaptable and better equipped to protect
customers.
The senior executive described the
session as the final installment of what he called his operational risk
trilogy. Previous discussions had focused on risk identification, measurement
and monitoring.
This latest presentation shifted
attention toward what he believes will become the defining challenge for the
profession: designing and building controls that genuinely matter.
Drawing on his personal background as
the eldest of nine children, the executive explained that growing up in a large
household shaped his understanding of complex systems long before he entered
financial services.
Small disruptions, he recalled, could
quickly affect everyone in the family, a lesson that continues to influence how
he views operational resilience within large organizations.
"When one thing is off in the
morning, the entire household feels it," he said. "The real question
is, was that system actually set up to actually be resilient, to actually
manage risk in the first place?"
That philosophy, he argued, applies
directly to modern banking. Institutions often ask who failed a control or
neglected a process after an incident occurs. Instead, organizations should
first question whether the underlying system was designed to withstand
disruption.
"The future of risk management
is not just going to be about measuring risk better," the executive said.
"It's not just going to be about monitoring risk faster. I truly believe
it's going to be about building systems that are safer, that are more resilient
and, most importantly, protect the people that actually depend on them."
Central to his argument was a
challenge posed to delegates. If organizations were building their control
environments from scratch today, he asked, would they resemble the frameworks
currently in place?
His view was that many existing
controls remain heavily dependent on manual processes, procedures and
checklists because they are introduced after technology has already been
designed.
Instead, he advocated embedding
controls directly within application architecture, positioning them closer to
where risks actually emerge.
