Dyman & Associates Projects

Dyman Associates Risk Management-Reserve Bank Warns Rising House Prices and Investors Could Hurt Economy

The Reserve Bank has warned that soaring housing prices and rapidly growing investor activity could pose risks to the economy.

The RBA said low interest rates, rising house prices and competition among lenders had translated into a strong pick-up in lending to property investors, particularly in Sydney and Melbourne, creating an imbalance.

Households had become increasingly willing to take on risk and debt this year, the RBA said.

It attributed the pick-up in household credit growth to being almost entirely driven by investor housing credit, which was growing at its fastest pace since 2007.

“The composition of housing and mortgage markets is becoming unbalanced,” the RBA said in its biannual financial stability review on Wednesday.

It has begun talks with the Australian Prudential Regulation Authority (Apra) about how to reinforce sound lending practices for property purchases.

Risks to financial institutions would increase if high rates of lending growth persisted or increased.

“The apparent increase in the use of interest-only loans by both owner-occupiers and investors might also be consistent with increasingly speculative motives behind current housing demand,” the RBA said.

“At this stage the main risk from this strong investor activity appears to be that the extra demand may exacerbate the housing price cycle and increase the potential for prices to fall later.”

That could pose risks to the economy if people reacted to declines in their wealth and loan repayment difficulties by cutting back on their spending.

Households that could be most affected were not necessarily the ones taking out loans, it added.

There was also the risk that the increased demand would lead to too much construction and an eventual oversupply of housing, but this was more likely to affect specific local markets, particularly Melbourne.

The RBA said the rise in investor activity had probably priced some potential first-home buyers out of the market.

The willingness of some households to take on more debt, combined with slower wage growth, meant the debt-to-income ratio had picked up a little in the past six months.

“While this ratio is still within its range of the past eight years at around 150%, it is historically high and hence any further increases in household indebtedness would be taking place from an already high base,” it said.

The RBA warned banks to be cautious about their lending practices.

“It is important for macroeconomic and financial stability that banks set their risk appetite and lending standards at least in line with current best practice, and take into account system-wide risks in property markets in their lending decisions,” it said.

In the past year Apra had increased the intensity of supervision around housing market risks facing banks.

It is also working on new guidance for sound risk management practices in mortgage lending.

“The characteristics and risk profile of households investment property exposures warrant close examination given the recent strength of investor demand for housing,” the RBA said.

Dyman Associates Risk Management: Is Your Money Safe?

Is Your Money Safe? Risk Management Blindspots That Cost Investors Dearly

Both retail and institutional investors who have survived one or more economic recessions have learned that they cannot select their money managers solely on a demonstrated stream of at or above benchmark returns and that they need to include the underlying risk of their investment portfolio in the formula that calculates expected future value. However, the risk denominator in portfolio management analytics may be underestimated or misestimated because of the following three industry problems:

1. The traditional view of risk is disaggregated

The traditional view segregates risk into market, credit and operational. In most organizations, both public corporations that issue equity and debt to investors and privately-held asset managers that oversee investors’ money, the various aspects of risk are managed separately.  For example, in some typical organizational structures, the Investment Officer is responsible for market risk; the Treasury Officer or CFO for credit risk and the COO for operational risk.  Each analyzes and synthesizes risk separately and reports his findings to the Board or Management Committee, leaving them baffled to make sense of the holistic picture.  However, risk is not additive or linear and often hot spots in one area may cause undetected issues in other areas.

Market, credit and operational risk were interrelated in one of the most notorious examples of risk mismanagement — AIG’s failure to meet its liquidity obligations which led to $170 billion government bailout.  AIG was heavily involved in writing CDS with its exposure at the height reportedly reaching $440 billion (market risk), which exceeded what the company could pay in claims when the MBS it insured defaulted leading to a liquidity crunch (credit risk).  Additionally, there were signs of inherent operational risks: AIGFP was a minimally regulated and separate hedge fund that leveraged the credit rating of the holding company to place big bets with little reserves. Each one of these issues separately did not pause “crash the car” risk, but in aggregate the market, credit and operational risk factors of AIG could have been lethal to the company and the economy safe for the subsequent government bailout.

2. Regulators are approaching the industry reactively

Significant regulatory tightening ensued after the 2008 mortgage crisis.  According to some critics, regulators may potentially be looking at risk far more reactively by focusing on the problems that have already manifested than proactively identifying new risks that could cause the next business failure. For example, the Financial Stability Oversight Council (FSOC) so far designated three US financial institutions as Systemically Important Financial Institutions (SIFIs) – GE , Prudential  and AIG and imposed on them increased capital requirements. However,  the FSOC does not consider large asset managers to be SIFIs. There is some merit to the logic that asset managers do not require as strong of a balance sheet since they do not own the assets they manage and pass through the downside risk to their investors.  Yet, it could be argued that the asset managers’ aggregate risk and that their investment processes and technology infrastructure pause systemic risk.  For example, over a trillion dollars of passive investments including the iShares brand are managed on Blackrock ’s technology platform Aladdin. It is not hard to foresee the dramatic impact of a major failure of Blackrock’s platform on the US and global economy.

3. Operational risks is not adequately represented

To manage market risk better, most investors are well aware of basic portfolio hygiene principles including the value of diversification, the importance of looking at volatility driven asset correlation, rebalancing, the criticality of subtracting leverage when assessing quality alpha, the value of protecting for inflation through IL bonds or inflation-hedging assets such as real estate. I would argue that operational risk is as big if not a bigger driver of financial loss as market risk. According to Phillipa Girling, a leading expert on operational risk and author: “operational risk in the headlines in the past few years” is hard to ignore: Notorious examples include “egregious fraud (Madoff, Stanford), breathtaking unauthorized trading (Société Générale and UBS), shameless insider trading (Raj Rajaratnam, Nomura, SAC Capital), stunning technological failings (Knight Capital, Nasdaq Facebook IPO, anonymous cyber‐attacks), and heartbreaking external events (hurricanes, tsunamis, earthquakes, terrorist attacks).” (Operational Risk Successful Framework).  Inadequately managed operational risk costs investors, corporations and tax payers billions of dollars:  Madoff’s  pyramid reportedly cost investors $18 billion and the 2008 government bailout cost taxpayers $700 billion. (New York Times Archives)

If the impact of operational risk is undoubtedly large, why do otherwise savvy investors often disaggregate or even completely miss operational risk from the overall expected value analytics of their portfolio and inadvertently accept more risk than they are comfortable with? Part of the problem stems from a lack of a well established methodology to clearly quantify operational risk and integrate it into portfolio management.

Imagine creating a unified industry-sponsored score for operational risk similar to a credit score or  Moody’s  bond ratings, which takes into consideration the fundamental elements of operational risks – people, process, technology, and external events, and quantifies them.  That score would then be clearly available for investors along with the returns and market risk of the portfolio leading to a far more accurate valuation. Significant progress toward accountability and transparency could be made if operational risk were to be demystified.

How can investors make safer investments?

What could investors do in an environment of confusing regulatory requirements and limited transparency around operational risk?  For starters, Investors can raise their awareness and employ alternatives to address the information asymmetry in the following ways:

1. Select asset managers that demonstrate commitment to operational risk management

Certainly some asset managers understand and are willing to invest in operational excellence and risk management.  For example, in the 2014 Review of the Asset Management Industry, the Boston Consulting Group provides an overview of the shadow model where an asset manager can use two counterparties to manage their middle and back office. At Bridgewater Associates, I co-led the implementation of such a model where the firm aimed to create greater transparency, switchability and stay ahead of the regulatory bodies by outsourcing its back and middle office to both BNY Mellon and Northern Trust. FundFire published an article, Bridgewater Divides Industry with Latest Deal, describing the benefits and open questions about the model. It is still early to say whether the industry will embrace this model more broadly. Similarly to gain an operational excellence edge, Citadel and Tudor  invested in a custom-built straight-through processing systems that integrate the trading platforms with the post-trade processes creating greater transparency and reliability. Both are aiming to commercialize their technologies and make these available to smaller money managers who may not be able to afford a large in-house technology development team.

More About the Article

Dyman Associates Risk Management: The Basics of WHS Risk Management

Prior to the modernisation of industry, managers were understandably primarily concerned with performance and cost.

Workplace safety (WHS) unfortunately was often only considered when it affected any goals associated with performance and cost. With the passage of time and gradually increasing awareness of worker rights, employee health, safety and well-being has of course also gained additional attention.

There are various reasons for managing WHS risk. Typically they are summarised into one of four main groups:

- Ethical and moral: accident prevention is undertaken to prevent injury to personnel purely as the result of humane considerations.

- Legal: legislation places a number of duties on various persons and failure to carry out these duties can result in fines and, in extreme cases, imprisonment.

- Financial: the costs of an injury are made up by two parts the direct cost (cost associated with medical treatment, and damage) and the indirect cost (time spent on investigations, lost production retraining).

- General business considerations: these could be considered as financial, but given the difficulty in quantifying them, they are best kept separate. They generally relate to the organisation’s corporate image and reputation. Poor health and safety systems and outcomes affect many stake holders including employees, customers, insurance companies, as well as investors and financiers.

WHS risk management is concerned with providing a structured systematic approach to decision making with respect to WHS issues. The strength of applying a systematic risk management approach to WHS issues is that it combines technical, consultative and managerial approaches into processes that support informed, consistent and defensible decision-making.

The WHS Risk Management Process can be introduced at any time, but good practice dictates the process should be commenced at the earliest possible time. Whether designing a piece of plant or a whole facility, the risk management process of hazard identification, risk assessment, control, and review should be incorporated at the design / planning stage.

WHS Risk Management includes the process concerned with identifying, analysing and responding to WHS risk. The primary objective is to eliminate or minimise the consequences of adverse effects (injury, illness or property damage) on employees or the workplace. This consists of the following major steps also known as the Risk Management Process Model:

- Establish the context: establish the strategic, organisational and risk management context in which the rest of the process will follow.

- Identify risks: identify what, why and how thinks can arise that will be the basis for further analysis.

- Assess risks: determine the existing controls and analyses in terms of consequences and likelihood in the context of those controls. Typically, the analysis should take into account a number of potential consequences and how likely those consequences are to occur.

- Evaluate risks: compare the levels of risk against a pre-established criteria. This allows risks to be ranked so to identify management priorities.

- Treat risk: allow for the development of specific management plans to control the risk by way of elimination or minimisation strategies.

- Monitoring and review.

- Communication and Consultation.

By implementing systematic WHS Risk Management activities, organisations are able to better understand operations and their associated hazards as well as afford greater flexibility with regard to the methods used to control risks and the costs of implementing those controls.

With the increased ability to respond effectively to organisational changes, both internal and external to the organisation, WHS risk management may lead to a myriad of direct benefits including:

- Reducing injury and illness to employees and the community

- Saving money and adding value by more effective allocation of resources

- Improving the quality of information available for making decisions

- Improving the understanding of WHS risks throughout the organization

- Complying with WHS legislation and the ability to better to demonstrate this

- Improving the organization’s image and reputation

- Improving accountability and transparency of decision-making

Possible broader and longer term benefits of an effective OHS risk management program are:

- Effective strategic planning as a result of increased knowledge and understanding of key risk exposures

- Lower workers’ compensation costs because undesirable OHS outcomes are foreseen and addressed

- Improved audit processes

- Better outcomes in terms of the effectiveness, efficiency, and appropriateness of OHS programs, i.e. programs targeting key risk areas

- Improved communication, both within the organization and between the organization and its external stakeholders

WHS Risk Management is a foundation of an organisation and it touches all facets of an organisation’s activities. For this reason, careful planning is required in the development and implantation of a WHS Risk Management program.

Successful WHS risk management requires a sensible and straight forward approach. The purpose of implementation should not only be seen as a compliance requirement but also as a key business tool in adding value to the organisation objectives.

WHS Risk Management should include regular reviews of all WHS aspects of an organisation’s activities. The effectiveness of the WHS Risk Management Process should be monitored and documented in order to ensure that the risk management strategies continue to be relevant to the organisation’s activities that affect WHS.

Dyman Associates Risk Management: Fundamentals of cloud security

For many companies, security is still the greatest barrier to implementing cloud initiatives. But it doesn’t have to be.

Organisational pressure to reduce costs and optimise operations has led many enterprises to investigate cloud computing as a viable alternative to create dynamic, rapidly provisioned resources powering application and storage platforms. Despite potential savings in infrastructure costs and improved business flexibility, security is still the greatest barrier to implementing cloud initiatives for many companies. Information security professionals need to review a staggering array of security considerations when evaluating the risks of cloud computing.

With such a broad scope, how can an organisation adequately assess all relevant risks to ensure that their cloud operations are secure? While traditional security challenges such as loss of data, physical damage to infrastructure, and compliance risk are well known, the manifestation of such threats in a cloud environment can be remarkably different. New technologies, combined with the blurring of boundaries between software-defined and hardware infrastructure in the datacentre, require a different approach.

One of the first steps towards securing enterprise cloud is to review and update existing IT polices to clearly define guidelines to which all cloud-based operations must adhere. Such policies implement formal controls designed to protect data, infrastructure, and clients from attack, and enable regulatory compliance. Government bodies such as NIST, the US Department of Commerce, and the Australian Government Department of Finance and Deregulation (PDF) have produced cloud computing security documents that outline comprehensive policies for their departments, which can be a useful starting point for implementing a corporate policy.

It is important to recognise that cloud security policies should provide protection regardless of delivery model. Whether building private, public, or hybrid cloud environments within the enterprise, cloud security is the joint responsibility of your organisation and any cloud service providers you engage with. When conducting due diligence on third-party cloud service providers, carefully review the published security policies of the vendor and ensure that they align with your own corporate policies.

A fundamental security concept employed in many cloud installations is known as the defence-in-depth strategy. This involves using layers of security technologies and business practices to protect data and infrastructure against threats in multiple ways. In the event of a security failure at one level, this approach provides a certain level of redundancy and containment to create a durable security net or grid. Security is more effective when layered at each level of the cloud stack.

When implementing a cloud defence-in-depth strategy, there are several security layers that may be considered. The first and most widely known protection mechanism is data encryption. With appropriate encryption mechanisms, data stored in the cloud can be protected even if access is gained by malicious or unauthorised personnel. A second layer of defence is context-based access control, a type of security policy that filters access to cloud data or resources based on a combination of identity, location, and time. Yet another popular security layer in cloud-based systems is application auditing. This process logs all user activity within an enterprise application and helps information security personnel detect unusual patterns of activity that might indicate a security breach. Finally, it is critical to ensure that all appropriate security policies are enforced as data is transferred between applications or across systems within a cloud environment.

Unfortunately, there is no one-size-fits-all solution for cloud security that can protect all of your IT assets. Nor is it wise to adopt a closed-perimeter approach. Organisations can no longer rely on firewalls as a single point of control, and security practices must expand beyond the datacentre to include key control points for endpoints accessing the cloud and edge systems. When incorporating third-party public and hybrid cloud solutions in your enterprise IT strategy, you cannot assume that the security policies of these service providers meet the standards and levels of compliance required. Make sure you spell out and can verify what you require and what is delivered. Read More

Dyman Associates Risk Management: 10 lessons learned from major retailers' cyber breaches

There has been extensive adverse publicity surrounding what has become the largest data breach in the retail industry, affecting Target and two other U.S. retailers. In November-December 2013, cyber thieves executed a well-planned intrusion into Target’s computer network and the point-of-sale terminals at its 1,800 stores around the holiday season and successfully obtained not only 40 million customers’ credit and debit card information, but also non-card customer personal data for as many as 70 million customers. In addition, 1.1 million payment cards from Neiman Marcus and 3 million cards used at Michaels were reportedly exposed.

The respected Ponemon Institute announced this June it believes that hackers have exposed the personal information of 110 million Americans—roughly half of the nation’s adults—in the last 12 months alone, and this number reflects the impact of major retailer breaches and others in different governmental or business sectors, but does not include hacks revealed in July-August 2014.

As we speak, there are news reports about the discovery of large quantities of personal information (including user names and passwords) mined from many websites by a Russian-based hacker group and new malware threats focused at retailers. According to a report released by the U.S. Department of Homeland Security, technology that is widely used to allow employees to work from home or permit IT and administrative personnel to remotely maintain systems is being exploited by hackers to deploy point-of-sale (PoS) malware that is designed to steal credit card data. This threat is being called “Backoff Malware”.

Homeland Security estimates it has been around since October 2013 with a very low antivirus detection rate at the time it was discovered, meaning that even systems with fully updated and patched antivirus software would not be able to identify Backoff as malicious malware.

Snapshot of Target

Target announced at the end of February 2014 that the company’s profit fell by 40% in the fourth quarter of 2013. The company reported $61 million pretax expenses related to the breach, but expected $44 million in cyber insurance payments against this figure. These expenses were incurred for legal costs, breach notification, forensics, and PR/crisis management to date. However, the worst financial costs are yet to come. A senior Gartner analyst estimated that the total exposure to Target could be $450–$500M, which considers lawsuits, regulatory investigations, breach response, fines and assessments, loss of revenue and security upgrades.

Both the cyber insurance and directors & officers insurance programs at Target are involved, since Target announced significant revenue/profit shortfalls caused by brand damage/customer fallout and costs to improve IT security. At least two derivative shareholder actions have been filed, which have triggered Target’s D&O insurance.

More than 100 lawsuits are pending against Target at this time, with many consumer class actions and some actions filed by individual financial institutions, claiming for costs of cancelling and reissuing compromised cards, absorbing fraudulent charges made on the cards, and the loss of anticipated fee income from the holiday season. There has been activity to consolidate these lawsuits into three groups of plaintiffs to facilitate the legal process.

Allegations surround Target giving network access to a third-party vendor, a small HVAC company with weak security, which allowed the attackers to gain a foothold on Target’s network. From that point of entry, the attackers allegedly moved to the most sensitive areas of Target’s network storing customer information. Malware installed at POS terminals utilized so-called “RAM scraping,” and the attack apparently proceeded despite apparent warning signals.

Target staff had urged the company to review the security of its payment system months prior to the breach, according to American Banker and Wall Street Journal reports. Some financial institution plaintiffs are alleging that as early as 2007, Target was warned by a data security expert about the possibility of a data breach in its point-of-sale system. Banks claim that a layered security system would have made the hackers’ task more challenging—Brian Krebs, a noted security analyst, describes a “POS kill chain” for more effective layered security posture.

Dyman Associates Risk Management : So You Think You Have a Point of Sale Terminal Problem?

If your company has a Point of Sale (POS) terminal anywhere in its infrastructure, you are no doubt aware from the active media coverage that malware attacks have been plaguing POS systems across the country.

Just within the past week, the New York Times has reported that:

• Companies are often slow to disclose breaches, often because of the time involved in immediately-required investigations;
• Congress is beginning to make inquiries of data breach victim companies; and
• Even those companies who have conducted cybersecurity risk assessments still get attacked, often during the course of implementing new solutions to mitigate potential problems and protect their customers’ payment cards or other personal information.
• Former employees can be a source of information to the media about your efforts to investigate and secure your POS systems.

No Quick Fix

Even the best intentions, most competent efforts and unlimited budgets cannot fix a problem such as this overnight.  These fixes take time, and have become an unavoidable symptom of having POS terminals.

What should your company do?

(1) Launch a cybersecurity risk assessment, if you have not yet done so.

(2) Protect your risk calculations by engaging outside counsel and qualified cybersecurity experts to provide legal risk advice protected by the attorney-client privilege.  Keep C-suite executives and Boards of Directors informed.  The outside counsel, together with experts, should:

educate and advise directors and executives on legal and business risks associated with your company’s particular threats and vulnerabilities;

• engage a qualified, experienced external cybersecurity team to review technical infrastructure and identify vulnerabilities stratified and prioritized by risk, likelihood of being exploited, and costs and time involved in remedying each one;
• review  operational procedures across a multi-disciplinary team in your company, which are often overlooked and can have the greatest impact on the overall health of your risk profile;
• help identify the most sensitive categories of information in your organization and develop data governance procedures tailored to your organization to add yet another layer of protection for your most sensitive assets;
• regularly remind your team members, including from your third-party vendors engaged by counsel, about privilege and confidentiality obligations.

(3) Treat cybersecurity risk assessments and remediation efforts as an iterative process.  Constantly review your multi-disciplinary team’s recommendations as they change week by week or day by day.  Re-evaluate the spend allocated based on updated information about your risk landscape as the investigation and assessment progresses.

(4) Stay informed about updated regulatory requirements and case law on cybersecurity and privacy.  Ensure stakeholders understand these updates and charge them with implementing appropriate changes in their domains.

(5) Recognize that there is no such thing as perfect security, but that there is a tipping point over which your company will move outside the category of high-risk operations and into a safe zone.

(6) Allocate the necessary resources to get the job done – and done well.  If your company goes an extra mile in building security policies, procedures and technology that are better than industry standard, you can use your low risk profile as a market differentiator.  In addition to reducing litigation and reputational risks, validated strong security will increase customer confidence and loyalty.

(7) Review your insurance policies for adequate coverage to address interim risks.  While reputational risk cannot be insured against, insurance can be very valuable in the event of a breach.

In the retail industry in particular, the widespread compromises in Point of Sale Terminals resulting in staggering amounts of payment card theft is a hallmark of 2014.   A decrease in brand reputation alone is too high a cost to ignore.   If your company is – very understandably – not equipped to tackle the daunting task of finding and prioritizing vulnerabilities and choosing the best cybersecurity governance and technical plans, find someone who is.