Frank Hayes at Computerworld wrote an interesting article about Société Générale. He talked about how ultimately, management could be blamed for this meltdown. Frank brought up good points about how IT builds the controls for systems, but those controls are only as good management allows them to be. As he said, IT folks take it personally when someone games the system. We try to plug the holes as quickly as possible. It’s a point of pride to us.
In IT, we think of implementing controls as our job, whether they’re for financial traders or Sarbanes-Oxley or HIPAA or anything else. We spec out the software, we secure the systems, we manage the operations. And we tear our hair out when someone steals a password or exploits a security hole. We take it seriously. We take it personally.
And the people we’re working for? They don’t. At least, some of them don’t.
We don’t make the financial and Sarb-Ox and HIPAA rules. They’ve been handed to us to implement. We’ve done that. And the same management that dictated the what and how of those controls is, in too many organizations, fully prepared to sabotage them.
Systems are composed of technology and users. We’ve always assumed that if management told us to build a system, we’d manage the technology and they’d manage the users.
Now, I’m sure that there are plenty of people that feel this couldn’t possibly happen to them. Well, I’m willing to bet that this is already happening, but on a smaller scale. Given the big push of sales and goals at financial institutions today, I think there is already an environment that can encourage abuse. How do you think we all got into this sub-prime lending mess? You can even look at something as simple as deposit account goals.
GonzoBanker talked about Account Retention late last year. In this article, according to their survey, out of 64 new deposit accounts, 55 were closed for a net of 9. How do you lose 55 quality accounts in a month when you opened 64? I can tell you that here, there would be some fired branch managers. If managers here lose more than 20%, there is a private meeting called. I don’t want to think about 86%.
In the instances that I’ve heard of this happening, it’s because people are gaming the system. Done just to meet their goal or collect a commission check. The only way this continues to happen is if upper management turns a blind eye to this. The back office people can only do so much. Management has to step in and decide to turn things around. As Frank said, IT can manage the system, management HAS to manage the users.
