Case study:

The organization I have selected is a mid-sized financial institution that operates locally. It provides financial services to its customers and the public and uses information technology to conduct practically all its business. All banking operations depend on the core banking system and other specialized software for its various functions. An IT shutdown without a plan in place would render the bank almost entirely non-functional.

Some of the risks identified based on how the bank functions and conducts business are as follows:

1. Loss of revenue - the bank will be unable to carry out its core functions, thus losing revenue for the outage period.
2. Other financial losses, including recovery costs.
3. Loss of customer trust and confidence - clients have entrusted their funds to the bank for safekeeping. Because of the IT shutdown, digital channels will be unavailable, the bank will be unable to verify account balances, and customers will be denied access to their funds even over the counter for fear of overpayment.
4. Brand reputation - Any issues involving a financial institution will receive wide publicity due to the nature of its business. According to Phelps (2018), "It is a great thing for a business to be known for reliability in spite of a serious outage" (p. 220). Any other type of publicity could result in serious reputational damage.
5. Compliance, regulatory, and legal issues - Financial institutions are highly regulated, and not having a business continuity plan which would allow clients to access their funds leaves the bank open to legal, compliance, and regulatory issues.
6. Customers moving to the competition - Customers may take the opportunity to move their business elsewhere, given the negative experience.
7. Missed business opportunities - Clients with time-sensitive transactions may resort to using substitutes. One example is using a money transfer service such as MoneyGram or Western Union instead of a bank wire transfer. Or potential customers who were contemplating doing business with the bank may decide against it.
8. Longer recovery time - Bank officials will be left scrambling to try to put things in place, which would take much longer and be less efficient than if there was an established plan to follow.
9. Possibility of a run on the bank - When customers realize there are issues with their banking institution, they might all rush to withdraw their funds, as was the case with Silicon Valley Bank and Signature Bank earlier this year, causing both banks to fail (American Deposit Management Co, 2023, May 3).

While all the risks are detrimental to the business, the risk of compliance, regulatory and legal issues can do the most damage and is the most significant, in my view. This risk has the potential of fines, charges, and other punitive measures, which can severely impact the bank's profitability, potentially leading to bankruptcy. Bank officials can be held personally responsible for failure to ensure compliance (Rothrock et al., 2018). Additionally, some regulatory measures can see regulators shut down the bank due to non-compliance, especially if this is not the first infraction. This was the case when the Eastern Caribbean Central Bank placed a bank into receivership and liquidation this year for non-compliance with regulations, one of which included ineffective risk management systems (Eastern Caribbean Central Bank, 2023, May 26).

Question:

• Ask a clarifying question about your colleague's selected organization and/or its use of information technology.
• Suggest one or more additional risks beyond the ones your colleague identified.
• Offer an alternate viewpoint on your colleague's selection of the most significant risk to their selected organization. Provide a rationale for why you think another risk might be more significant.
• Provide references.