lecture 3 - fintech risk Flashcards
what is information?
data that have been processed in such a way as to be meaningful to person receiving it
information - especially financial - is critical for effective risk mgment.
what is an information system?
combination of people, processes and tech to collect data, analyse it into useful information and communicate it to mgment for planning/decision making/control
what are the characteristics of good information?
ACCURATE:
Accurate
Complete
Cost-beneficial
User targeted
Relevant
Authoritative
Timely
Easy to use
what are some common IT risks?
human error
technical error
natural disasters (disruption of processing)
deliberate sabotage
industrial action
cyber breaches – are these insurable??
non-compliance with legislation
what does an IT control framework include?
systems development (systems development life cycle processes)
general controls (access controls, contingency planning)
application controls (input, process, output controls)
what are the control objectives for an IT system?
governance framework for IT
ensures organisational objectives/regulatory requirements are met
how can you balance IT risk and control investments?
ensuring sufficient IT investment has been made, defining high level control objectives for each IT process, linking control objectives to IT processes (performance indicators), providing auditing guidelines for control objectives.
what is the SDLC?
systems development life cycle:
- initiation and planning
- requirements anaylsis
- design
- build
- test
- implementation
- operations and maintenance
what are the common risks associated with IT systems?
unauthorised changes made to a business critical system
poor quality system introduced (poor info quality)
lack of flexibility to cope with future changes
loss of confidence by management
increased risk of fraud and data protection breaches
excessive cost
what macro level factors should be considered in IT system selection?
needs
strategic fit
personnel involvement
financing
what micro-level factors should be considered when selecting an IT system?
cost
adaptability
training
vendor reliability
what general controls can be implemented for fintech risk and what is their purpose?
designed to ensure completeness and effectiveness of organisations overall environment, include both hardware and software.
categories:
personnel controls - recruit honest staff etc.,
access controls - passwords,
contingency controls - back-up procedures. contains: responsibility schedule, priorities, backup procedures, standby arrangements, public relations protocol, risk assessment.
equipment controls - physical controls
what are some risks and controls with information networks?
risk of hacking
control = data encryption
risk of viruses
control = virus protection
risk of malicious tampering of info
control = firewalls
what are application controls and what are the three categories?
are specific to parts on any system running on an IT network. categorised into:
input controls
process controls
output controls
what is fintech?
fintech and insurtech relates to modern IT innovations (disruptive tech) in financial services
