Key risk indicators (KRI) for information technology services are metrics that help banks manage risk in regards to the technology services department, whether the risk is financial, reputational, or compliance. Using KRIs, banks can analyze the risk of any technological decision, as well as the impact of privacy\/security breaches or other IT issues on other bank processes.<\/p>\n
Bank IT departments can use a wide-variety of technology-focused KRIs to build benchmarks that measure the risk of security breaches, system outages, server speed slowdowns, lack of adherence to service level agreements (SLA), and failure to update malware, and many others.<\/p>\n
\u00a0 How Technology Benchmarking Can Help Manage Risk for Banks<\/strong><\/p>\n Technology is a key enabler for banks, but has also become more complex with mobile devices, an increase in the number of applications banks must manage, more sophisticated hackers, and newer technologies such as artificial intelligence (AI) and robotic process automation (RPA). With so many moving parts and advanced technologies, managing risk has become more critical\u2014and even more challenging.<\/p>\n Banks also have to manage the risk of aging legacy systems. Banks often only have time to put out fires\u2014patching holes and addressing compliance shortfalls\u2014rather than upgrading systems to prevent issues from arising. Although those banks that do upgrade their infrastructure still face risks related to these changes.<\/p>\n Most of technology risk management has been reactive, with banks viewing technology risk as a compliance check-the-box activity rather than as a way to add value to the business. Benchmarking key risk indicators for information technology allows banks to take a proactive approach to risk management\u2014minimizing risk and using measurements to make strategic technology decisions such as how much money to invest in IT infrastructure.<\/p>\n Benefits of Benchmarking for Information Technology Departments in Banks <\/strong><\/p>\n Technology benchmarking enables bank IT departments to make better decisions regarding technology. For example, benchmarking can answer questions such as: Is it more cost-effective to retire a legacy system when factoring in support and maintenance costs? How often is IT staff putting out fires versus proactively improving system functionality to meet business requirements? How often are business users unable to get their work done due to system outages? Does the IT organization need to revamp its procedures for emergency change management? Are there security holes that make the bank vulnerable to a cyber-attack?<\/p>\n Benchmarking with key risk indicators for information technology helps to identify potential improvements in both the technology used and the way the IT department is staffed, organized, and managed.<\/p>\n Technology Risk Benchmark Examples for Bank IT Departments<\/strong><\/p>\n Key risk indicators for information technology benchmarks can cover a wide range of technological issues, from maintenance to utilization to system downtime. Here are five technology services KRI benchmarks commonly used by banks.<\/p>\n Technology Key Risk Indicator Benchmark #1: Mean Time Between Failures (MTBF)<\/u><\/p>\n Mean time between failures (MTBF) measures the average number of days a system functions before failing. Failure doesn\u2019t necessarily mean a complete shut-down; a failure can also mean that there is an issue that is causing a slowdown in system performance or when the system isn\u2019t delivering expected results.<\/p>\n To calculate the mean, total the numbers days from system failure, including the time it takes to repair the systems, until the next failure divided by the number of system failures. If the average time between system failures is shorter than acceptable, IT departments can revisit their preventative maintenance schedule, update system documentation, increase employee training, and even look at revamping system design.<\/p>\n Technology Key Risk Indicator Benchmark #2: System Availability (Severity I)<\/u><\/p>\n The holy grail of system availability is the \u201cfive 9s\u201d meaning that a system is operational 99.999% of the time it is scheduled to be available, not including scheduled downtime. Divide the number of minutes the system was online and available to all authorized users by the time the system was scheduled to be available, as a percentage, to calculate system availability.<\/p>\n Every system will have a different system availability goal. A non-critical system that doesn\u2019t directly impact customers such as an internal reporting system likely has a less stringent system availability goal than a mission-critical system like online banking.<\/p>\n Technology Key Risk Indicator Benchmark #3: Percentage of Emergency Changes<\/u><\/p>\n The most common emergency change is having to install a security patch to resolve a major security incident. Since emergency changes\u2014as the name implies\u2014have to be done quickly, there\u2019s less time to test the change before deploying it, which can cause unintended consequences and risks.<\/p>\n To calculate, divide the number of emergency changes by the total number of changes, as a percentage. Obviously, the lower the percentage of emergency changes, the better. After every emergency, IT departments should decide if the change really was an emergency and how to prevent these types of changes from becoming emergencies in the future.<\/p>\n Technology Key Risk Indicator Benchmark #4: IT Security Incidents per IT Security Employee<\/u><\/p>\n One of the greatest technology risks for banks isn\u2019t the technology itself, but human error. Employees losing laptops or mobile phones, employees not reporting security incidents, and even untrained employees are some of the top causes of security events. Having clear security protocols in place and employee training can reduce the number of incidents.<\/p>\n To calculate, divide the number of IT-related security incidents by the number of employees working within the IT security function. These incidents might vary in severity, so be sure to determine the seriousness of each incident and treat it accordingly.<\/p>\n Technology Key Risk Indicator Benchmark #5: Mean Time to Repair <\/u><\/p>\n This benchmark measures the amount of time it takes the IT department to fully fix a system failure\u2014including rolling out the fix to all workstations, devices, and servers\u2014measured from the moment the failure occurs until the repair is complete. To calculate the mean, or average, divide the total number of hours of time it takes to fully fix issues divided by the number of repairs.<\/p>\n If the mean time to repair critical system failures is unacceptably high, likely issues include lack of employee training and response procedures, too few staff, and not fixing the root cause but simply patching the problem.<\/p>\n Final Thoughts <\/strong><\/p>\n Technology allows banks to compete and survive in a saturated field\u2014but it also presents the potential for high-impact risk due to cyber-attacks, system outages, overloaded networks, data loss, compliance penalties, and the data breach risk of running outdated technology. Benchmarking key risk indicators for information technology allows banks to identify and mitigate these risks as well as use technology more strategically to boost the bottom line.<\/p>\n No matter the industry, key risk indicators for information technology can help bolster\u00a0your business. For a full list of KRIs for benchmarking you can download our Technology Services Key Risk Indicator Benchmarking Report<\/a>.<\/em><\/p>\n![\"Guide](\"https:\/\/opsdog.com\/resources\/wp-content\/uploads\/2020\/05\/tech-services-key-risk-indicator-benchmarks-e1589837923447.png\")
<\/a><\/strong><\/p>\n![\"what-is-risk-management-in-information-security\"](\"https:\/\/opsdog.com\/resources\/wp-content\/uploads\/2018\/06\/information-security-and-risk-indicators-guide-1-e1557178149205.png\")
<\/a><\/p>\n![\"ultimate-guide-of-benchmarks-for-banks\"](\"https:\/\/opsdog.com\/resources\/wp-content\/uploads\/2020\/05\/50-credit-metrics-for-banks-e1589837878132.png\")
<\/a><\/p>\n