Posts Tagged ‘Risk management’

Cyber Security, Cyber Governance, and Cyber Insurance

Posted by Paul Ferrillo, Weil, Gotshal & Manges LLP, on Thursday November 13, 2014 at 9:07 am
  • Print
  • email
  • Twitter
Editor’s Note: Paul A. Ferrillo is counsel at Weil, Gotshal & Manges LLP specializing in complex securities and business litigation. This post is based on an article authored by Mr. Ferrillo and Christine Marciano, President of Cyber Data Risk Managers.

JP Morgan Chase. Community Health Systems. The Home Depot. Kmart. There has been no shortage of data breaches in recent weeks—with new developments on an almost daily basis. The age of cyber hactivisim, cyber extortion, and cyber terrorism is here, and it is not going away any time soon.

Data security issues are no longer just an IT Department concern. Indeed, they have become a matter of corporate survival, and therefore companies should incorporate them into enterprise risk management and insurance risk transfer mechanisms, just as they regularly insure other hazards of doing business. As the number of data breaches has increased, the demand for cyber insurance has likewise dramatically increased more than that for any other insurance product in recent years. Every board of directors should be questioning its officers and management as to “whether or not its company should be purchasing cyber insurance to mitigate its cyber risk.” If management answers, “Oh, it costs too much,” or “Oh, it will never pay off,” second opinions should be obtained. Rapidly. Because neither answer is correct.

…continue reading: Cyber Security, Cyber Governance, and Cyber Insurance

The Risky Business of Cybersecurity

Posted by David A. Katz, Wachtell, Lipton, Rosen & Katz, on Wednesday November 5, 2014 at 9:02 am
  • Print
  • email
  • Twitter
Editor’s Note: David A. Katz is a partner at Wachtell, Lipton, Rosen & Katz specializing in the areas of mergers and acquisitions and complex securities transactions. The following post is based on an article by Mr. Katz and Laura A. McIntosh that first appeared in the New York Law Journal; the full article, including footnotes, is available here.

The national and economic security of the United States depends on the reliable functioning of critical infrastructure. Cybersecurity threats exploit the increased complexity and connectivity of critical infrastructure systems, placing the Nation’s security, economy, and public safety and health at risk. Similar to financial and reputational risk, cybersecurity risk affects a company’s bottom line. It can drive up costs and impact revenue. It can harm an organization’s ability to innovate and to gain and maintain customers.

—National Institute for Standards and Technology, Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0

In today’s technology driven environment, public companies must constantly confront the challenge of cybersecurity, in its complex, varied, and ever-adapting forms. Cybersecurity breaches regularly fill the headlines, the costs of cybercrime are skyrocketing, and the repercussions of corporate cyber-attacks are felt all the way from chief executives to retail customers. President Barack Obama has stated that “the private sector and the government can, and should, work together to meet this shared challenge,” while FBI Director Robert S. Mueller has described “the critical role the private sector must play in cyber security.” As companies become increasingly dependent on networked technology, and as an expanding number of people conduct transactions and other activities online, cybersecurity will continue to grow in importance for the business community, for the global economy, and for society at large.

…continue reading: The Risky Business of Cybersecurity

2014 Annual Corporate Directors Survey

Editor’s Note: Mary Ann Cloyd is leader of the Center for Board Governance at PricewaterhouseCoopers LLP. The following post is based on the executive summary of PwC’s Annual Corporate Directors Survey; the complete publication is available here.

Over the last several years, we’ve observed certain trends that are shaping corporate governance and which we believe will impact the board of the future. We structured our 2014 Annual Corporate Directors Survey to get directors’ views on these trends and other topics including:

…continue reading: 2014 Annual Corporate Directors Survey

Governance, Risk Management, and Risk-Taking in Banks

Posted by René Stulz, Ohio State University Fisher College of Business, on Wednesday October 8, 2014 at 9:00 am
  • Print
  • email
  • Twitter
Editor’s Note: René Stulz is Professor of Finance at Ohio State University.

One might be tempted to conclude that good risk management in banks reduces the exposure to danger. However, such a view of risk management ignores that banks cannot succeed without taking risks that are ex ante profitable. Consequently, taking actions that reduce risk can be costly for shareholders when lower risk means avoiding valuable investments and activities that have higher risk. Therefore, from the perspective of shareholders, better risk management cannot mean risk management that is more effective at reducing risk in general since reducing risk in general would mean not taking valuable projects. If good risk management does not mean low risk, then what does it mean? How is it implemented? What are its limitations? What can be done to make it more effective? In my article, Governance, Risk Management, and Risk-Taking in Banks, which was recently made publicly available on SSRN, I provide a framework to understand the role, the organization, and the limitations of risk management in banks when it is designed from the perspective of increasing the value of the bank for its shareholders and review the existing literature.

…continue reading: Governance, Risk Management, and Risk-Taking in Banks

Risk Governance: Banks Back to School

Posted by Kobi Kastiel, Co-editor, HLS Forum on Corporate Governance and Financial Regulation, on Sunday September 14, 2014 at 9:00 am
  • Print
  • email
  • Twitter
Editor’s Note: The following post comes to us from Dan Ryan, Leader of the Financial Services Advisory Practice at PricewaterhouseCoopers LLP, and is based on a PwC publication.

On September 2, 2014, the Office of the Comptroller of the Currency (“OCC”) finalized its risk governance framework for large banks and thrifts (“Guidelines”) that was proposed in January 2014. [1] The Guidelines formalize the heightened risk management standards that the OCC has been communicating through the supervisory process for several years, but do so somewhat more flexibly than the January proposal (“proposal”) did. Although many firms have been working to enhance their risk management programs to meet the proposal and supervisory communications, most still have work to do in order to meet the Guidelines’ requirements.

The Guidelines maintain the proposal’s emphasis on risk governance at the bank level to ensure safety and soundness, and affords the OCC greater flexibility (prescribed under regulations) to take enforcement actions in response to a bank’s compliance failure. The responsibility to oversee risk management remains with the Board of Directors which retains its ultimate risk governance oversight role; however, the Guidelines clarify that the Board need not take on responsibility for day-to-day managerial duties as the proposal had suggested.

…continue reading: Risk Governance: Banks Back to School

Cyber Security and Cyber Governance: Federal Regulation and Oversight—Today and Tomorrow

Posted by Paul Ferrillo, Weil, Gotshal & Manges LLP, on Wednesday September 10, 2014 at 9:00 am
  • Print
  • email
  • Twitter
Editor’s Note: Paul A. Ferrillo is counsel at Weil, Gotshal & Manges LLP specializing in complex securities and business litigation. This post is based on an article authored by Mr. Ferrillo and David J. Schwartz.

In our June 4, 2014 article on cyber security and cyber governance [1] we noted that for many reasons, boards of directors and executives of U.S. companies needed to reexamine how they protect (and respond to the successful hacking of) their most critical intellectual property and customer information. One of the reasons was that all signs out of Washington, D.C. pointed towards increasing federal regulation and oversight of cyber security for public and private companies, and particularly for those in the financial services sector. Further, we foresaw not only heightened scrutiny from regulators, but increasing class action litigation, with plaintiffs accusing boards and management of not taking the appropriate steps to protect company and client data. Our predictions were correct on all fronts.

…continue reading: Cyber Security and Cyber Governance: Federal Regulation and Oversight—Today and Tomorrow

Understanding and Implementing the NIST Cybersecurity Framework

Posted by Yaron Nili, Co-editor, HLS Forum on Corporate Governance and Financial Regulation, on Monday August 25, 2014 at 9:03 am
  • Print
  • email
  • Twitter
Editor’s Note: The following post comes to us from Paul A. Ferrillo, counsel at Weil, Gotshal & Manges LLP specializing in complex securities and business litigation, and is based on an article authored by Mr. Ferrillo and Tom Conkle.

Why the Cybersecurity Framework was created and why it is so important

Despite the fact that companies are continuing to increase spending on cybersecurity initiatives, data breaches continue to occur. According to The Wall Street Journal, “Global cybersecurity spending by critical infrastructure industries was expected to hit $46 billion in 2013, up 10% from a year earlier according to Allied Business Intelligence Inc.” [1] Despite the boost in security spending, vulnerabilities, threats against these vulnerabilities, data breaches and destruction persist. To combat these issues, the President on February 12, 2013 issued Executive Order (EO) 13636, “Improving Critical Infrastructure Cybersecurity.” [2] The EO directed NIST, in cooperation with the private sector, to develop and issue a voluntary, risk-based Cybersecurity Framework that would provide U.S. critical infrastructure organizations with a set of industry standards and best practices to help manage cybersecurity risks.

…continue reading: Understanding and Implementing the NIST Cybersecurity Framework

Ten Key Points from the SEC’s Final Money Market Rule

Posted by Yaron Nili, Co-editor, HLS Forum on Corporate Governance and Financial Regulation, on Monday August 11, 2014 at 9:13 am
  • Print
  • email
  • Twitter
Editor’s Note: The following post comes to us from Dan Ryan, Leader of the Financial Services Advisory Practice at PricewaterhouseCoopers LLP, and is based on a PwC publication.

After six years of debate over the risks and operations of money market funds (MMFs)—and events such as the fall of Lehman Brothers, breaking the buck at the Reserve Primary Fund, rancor between financial regulators, and hundreds of industry comment letters—the SEC finally adopted MMF reform on July 23rd. The final rule will fundamentally alter certain aspects of MMF operations and accounting, and the way these funds are viewed by investors.

…continue reading: Ten Key Points from the SEC’s Final Money Market Rule

Cloud Cyber Security: What Every Director Needs to Know

Posted by Yaron Nili, Co-editor, HLS Forum on Corporate Governance and Financial Regulation, on Wednesday August 6, 2014 at 9:00 am
  • Print
  • email
  • Twitter
Editor’s Note: The following post comes to us from Paul A. Ferrillo, counsel at Weil, Gotshal & Manges LLP specializing in complex securities and business litigation, and is based on an article authored by Mr. Ferrillo and Dave Burg and Aaron Philipp, both of PricewaterhouseCoopers LLP.

There are four competing business propositions affecting most American businesses today. Think of them as four freight trains on different tracks headed for a four-way stop signal at fiber optic speed.

First, with a significant potential for cost savings, American business has adopted cloud computing as an efficient and effective way to manage countless bytes of data from remote locations at costs that would be unheard of if they were forced to store their data on hard servers. According to one report, “In September 2013, International Data Corporation predicted that, between 2013 and 2017, spending on pubic IT cloud computing will experience a compound annual growth of 23.5%.” [1] Another report noted, “By 2014, cloud computing is expected to become a $150 billion industry. And for good reason—whether users are on a desktop computer or mobile device, the cloud provides instant access to data anytime, anywhere there is an Internet connection.” [2]

…continue reading: Cloud Cyber Security: What Every Director Needs to Know

Boards of Directors, Corporate Governance and Cyber-Risks: Sharpening the Focus

Posted by Luis A. Aguilar, Commissioner, U.S. Securities and Exchange Commission, on Tuesday June 17, 2014 at 9:06 am
  • Print
  • email
  • Twitter
Editor’s Note: Luis A. Aguilar is a Commissioner at the U.S. Securities and Exchange Commission. This post is based on Commissioner Aguilar’s remarks at the recent “Cyber Risks and the Boardroom” Conference; the full text, including footnotes, is available here. The views expressed in the post are those of Commissioner Aguilar and do not necessarily reflect those of the Securities and Exchange Commission, the other Commissioners, or the Staff.

I am pleased to be here and to have the opportunity to speak about cyber-risks and the boardroom, a topic that is both timely and extremely important. Over just a relatively short period of time, cybersecurity has become a top concern of American companies, financial institutions, law enforcement, and many regulators. I suspect that not too long ago, we would have been hard-pressed to find many individuals who had even heard of cybersecurity, let alone known what it meant. Yet, in the past few years, there can be no doubt that the focus on this issue has dramatically increased.

…continue reading: Boards of Directors, Corporate Governance and Cyber-Risks: Sharpening the Focus

Next Page »
 
  •  » A "Web Winner" by The Philadelphia Inquirer
  •  » A "Top Blog" by LexisNexis
  •  » A "10 out of 10" by the American Association of Law Librarians Blog
  •  » A source for "insight into the latest developments" by Directorship Magazine