OCC Steps Up Scrutiny of EUCs at Financial Institutions

A dangerous lack of transparency

While these applications offer great flexibility to end-users, the lack of controls usually found in Corporate IT applications means they lack the transparency and auditability that regulators (and customers and management for that matter) demand in effective risk governance.

When using a spreadsheet, it unclear who changed a formula or cell entry, who reviewed it, and who approved it. At banks, it is not unusual to manage billions of dollars of investments using highly complex spreadsheets. They will feature millions of cells fed from multiple data sources. Manually capturing, approving, and reporting changes to these spreadsheets for risk management and audit purposes is beyond the abilities of end-users, risk managers, and compliance teams.

Policy management, enforcement, and reporting is an extra challenge for compliance teams where staff use EUCs. While the policies around using, updating, and retiring EUC will undoubtedly exist, identifying who is using EUCs and ensuring they are aware of the EUC policy and are applying it is an enormous challenge.

Weighing in on an enormous challenge

Policy management, enforcement, and reporting is an extra challenge for compliance teams where staff use EUCs. While the policies around using, updating, and retiring EUC will undoubtedly exist, identifying who is using EUCs and ensuring they are aware of the EUC policy and are applying it is an enormous challenge.

From my perspective, managing EUCs is not new; we have been involved in projects for over 15 years. All the institutions we engage with understand the need to manage their EUCs. The challenge lies in keeping tabs on where they are used, and working proactively with users to understand the value of the EUCs, and the risks they pose to the business. Then you can work with end-users to manage them properly and ensuring they are ‘in policy.’

Ian Cleaver, VP Professional Services at Mitratech, outlines the approach he recommends to clients when implementing Mitratech’s EUC management solution. “The first step is to identify your most important EUCs, and then to create an inventory of them, so you can proactively monitor them. You can also benefit from using an alerting capability to show when changes are made and where problems of missing data, calculation errors, or other problems that could drive issues for an institution.

“The results of this activity can be integrated into a consolidated Governance, Risk, and Compliance (GRC) framework to provide transparency of the EUC risk to the business,” he explains. “When I used the platform at a global bank, we ensured that the EUC management reports were featured in the monthly Board meeting – very much belt and braces, but it worked. We had no issues.”