The changing risk scenario’s implications on banks’ three lines of defence

Abstract

Purpose: This study aims to identify how local banks' three lines of defence are adapting to the changing risk environment. It seeks to identify the core emerging risks faced by Maltese banks in comparison to the risks of most concern to euro area banks. It also examines how local credit institutions are developing their three lines of defence framework to mitigate such risks more effectively, and lastly, assesses whether any particular challenges exist that impede Maltese banks' ability to enhance controls. Design: Primary data was obtained by conducting semi-structured interviews with a number of domestic core, non-core, and international credit institutions, as well as a 'Big 4' audit firm. In order to ensure relevant findings and a valid discussion exercise, secondary data was examined prior to designing the structure of the interview. Findings: It was observed that both Maltese credit institutions and euro area banks are significantly concerned about risks related to cybercrime, a low interest rate environment, and reaction to regulation, amongst others. A number of inconsistencies in the nature of risks faced by local credit institutions and euro area banks, however, still exist. Findings also show that the main changes in the risk culture adopted by local banks include the provision of adequate training to first liners, and the enhancement of business relations between personnel in different lines. Lastly, it was observed that some of the main challenges faced by Maltese banks include the availability of adequately skilled personnel, the lack of practicality in certain sophisticated systems of technology, and a risk appetite that only seeks to consolidate. Conclusions: The business of banking is becoming increasingly complex and credit institutions are required to enhance the way their three lines of defence model functions. They are doing so by means of significantly adapting their risk culture with the aim of becoming more agile and responsive to the changing risk environment. Value: This study may serve as an eye-opener to local banks which choose to solely stick to traditional systems of controls. It may also alert practitioners within the local banking industry about emerging risks which they are not particularly familiar with.