display-middle-ads-here
My journey with RCSA began almost 30 years ago, in 1996, when I was promoted to create and lead JP Morgan’s Information Technology Risk Management function. I was in the job a week when I was asked to go to a ‘special meeting’.
As we gathered in a large meeting hall at 60 Wall Street – at the time JP Morgan’s global headquarters –the speaker explained that due to JPM and several other large financial institutions’ involvements in the Sumitomo copper trading scandal, we had to improve our internal controls by performing an RCSA for just about every process we had.
For younger readers or the uninitiated, the Sumitomo copper trading scandal involved rogue trader Yasuo Hamanaka, who manipulated global copper markets for a decade.
Using unauthorized trades and price-fixing, Hamanaka caused Sumitomo to lose $2.6 billion. The scandal highlighted inadequate oversight, shook investor confidence, and led to stricter regulations in commodities trading to prevent similar abuses.
Basically, we were told, if it moved or didn’t move at JPM, you had to do an RCSA.
They gave us a simple template and said we had a year to get it done. That was not an option but a mandate.
I had no idea what it was, and when the presenter told us that we would be asking people to volunteer to point out their control weakness and risk, we thought it was like asking inmates if they were interested in running the whole prison.
I hired a few close friends from JPM Audit, and we went out and facilitated about 200+ sessions and educated everyone on what it was and what our expectations were to complete the tasks. It was a grueling process and since we were a major global bank, that meant traveling around the world to get it done.
We finished ahead of schedule and met the company’s expectations. And in truth, we could have stopped there and settled for what had been deemed to be adequate. But JPM’s CIO, Peter Miller, and I thought it could be better.
So, we went about changing the methodology – and in the process of doing that, we created the very first RCSA templates.
Instead of asking people what their risk and controls were, we invited them to consider and reach a verdict on the state of those controls.
Armed with that information, we gathered all the experts from BCP/DR, Information Security, HR, Technology, Operations and Audit and agreed that these were the risk and expected controls that we wanted measured.
As we started rolling out the new methodology in year 2, we designed a system – Horizon – to make it easier to capture the data and present it to management in graphical format.
We introduced special algorithms to weigh risk and controls to get as close to a realistic measurement as we could. Once patented and released more widely, Horizon made completing an RCSA much easier, and gave management a better view of their portfolio of material risk.
Suffice to say, Horizon became an instant internal hit. The internal businesses quickly adopted it and we started helping with the firmwide rollout.
It didn’t take long for then-CEO Sandy Warner to get wind of the RCSA revolution going on inside the business, and about a heartbeat later he suggested we commercialize the Horizon system.
We had no idea how to do that and decided to work with a partner. We chose E&Y to help us and developed a commercial relationship with them. Carmine Di Sibio and Dan Mckinney were my main partners in bringing it to market, and we had many major banks, regulators and government entities as our clients.
We started to evolve the product and methodology to a point that it became a major force in identifying risk and the state of controls. We also added Loss Data Events and Audit Modules to give everything balance and create a ‘triangle’ that leveraged each component to either support or refute RCSA responses.
