7 Key Components of Successful ITM Risk Mitigation

By Lowers & Associates,

ITM Risk Mitigation

Interactive Teller Machines (ITMs) offer new business opportunities to banks, and therefore to CIT carriers. A significant side benefit to the CIT carrier is the chance to take on an even bigger role in cash management in partnerships with banks. But with the larger role comes a larger responsibility to manage the risks that go with a deeper integration into the financial institution.

Here are 7 key components of a program where CIT carriers evaluate risks and then develop and implement procedures to address them.

1. Risk Assessment

The first step in ITM risk mitigation is a risk assessment. CIT carriers need to review the entire process of cash-in-transit from beginning to end to identify the places where losses might occur, estimate a likelihood for each, and determine cost-benefit priorities. Crew and bystander safety will always be of paramount importance, but many characteristics of the routes such as cash transitions, surveillance capabilities, and communication security will be analyzed.

Carriers will be familiar with many of the ITM issues because they have been servicing ATMs, but there will be differences. Evaluated risks can be addressed in a number of ways.

2. Policies and Procedures

The risk mitigation policies a carrier sets up for ATMs may serve as a template for ITM policies, with additional or different elements incorporated as needed. For instance, the over-the-road assessment and policies to manage exposure due to timing and environmental conditions will be a basis for further development for ITMs, if the machines are co-located or if the ITMs replace ATMs.

Policies will cover over-the-road exposures, procedures for handling cash (which is more complex for the ITM), handling multiple machines in a single setting (especially important if several ITMs are serviced in sequence), maintenance issues, vehicle control issues, and reporting or sign-offs. Basic controls like dual control and separation of duties will be included. These policies constitute best practices for the specific carrier to manage cash with security.

3. Internal Audits

The aim of internal audits is to implement a running account of transactions and cash balances at key points in a route to maintain control of the disposition of cash. Audits performed by the carrier may use a variety of methods and they may be scheduled and routine by design, random or intermittent. In all cases, the policy should be communicated to affected staff to set expectations that the audits will occur.

4. External Audits

Audits performed by external agencies give a strong, credible check on internal procedures, adding a strong layer of security. Insurers and other third parties may require these audits as a condition of contract. The value of an external audit is that it can find failures in the system where employees and/or accomplices have intentionally voided internal controls. Random or unannounced audits may be especially effective in detecting fraud early.

5. Personnel Screening and Testing

CIT carrier crews require a special kind of employee. They must be detail oriented, persistently thorough in performing routines, yet able to respond creatively and independently when extreme events occur—they manage risks in real time. Employees like this are rare at any event, but in a tight labor market like today’s, it’s very challenging to find them. Employers need to resist the temptation to loosen background screening and testing criteria, perhaps ramping up the level of effort in recruitment instead.

In addition, an important risk management tool is to interview and/or screen current employees on a regular basis to find changes in life circumstances or attitude that could signal a disaffected employee. Finally, training and testing are essential to help front line people recognize and cope with emergent threats.

6. Access Controls

Access controls including keys, passwords, combinations and alarms should be monitored for operational effectiveness, and changed often enough to reduce the possibility of being defeated. Again, the essential interactive capability of ITMs increases the danger of these controls being breached, so a broader view of “access” is required. Controls based on environmental design or structure are harder to change, but it may be possible to make big risk improvements with relatively small changes.

7. Physical Security

Hardening a target to protect physical security is a classical response to risk, such as in a vault or armored truck. However, it is in the spaces between these hardened targets, where cash is carried that a clever larcenist will look to find weakness. The ITM can exacerbate these weaknesses because of its relatively long service interval, putting a premium on how surveillance, environmental design, and communication can be used to supplement the physical security of the ITM.

For a more comprehensive introduction to managing risk in ITM servicing, download our latest whitepaper on the topic, A CIT Carrier’s Guide to Building Your ITM Program.

  Category: Risk Management
  Comments: Comments Off on 7 Key Components of Successful ITM Risk Mitigation

4 Step Approach to Building Your Business Continuity Plan

By Lowers & Associates,

To stay prepared, organizations must expect the unexpected. Business Continuity Planning (BCP) addresses the need to have contingency plans in place to deal with potential threats that can turn an organization on its head. Continuity planning is a necessary part of coming out on top in the face of the most challenging circumstances such as a natural disaster, a significant market crash, or a serious hit to a company’s brand or reputation.

As a risk manager, CEO, or any party responsible for the long-term success of an organization, you need to have a plan in place to clearly outline what you would do if the worst were to happen tomorrow. Here are four phases to putting your BCP in place.

1. Business Impact Analysis (BIA)

The first step to building your company’s BCP is to consider the potential impact of each type of disaster or risk event that your company may face. For example, a company in the finance industry may consider the role of the stock market, data breaches, or the possibility of a fraud scandal. The BIA helps you discern which processes are the most critical to recover or initiate in a state of a disaster and assigns a monetary value to the protection of assets involved in specific business processes.

Key goals of the BIA should include:

  1. Identifying the impact of uncontrolled events
  2. Prioritizing critical functions
  3. Establishing maximum tolerable outages

2. Risk Assessment

Upon identifying the impact of the risks facing various functions across your business, the next step is to determine the potential magnitude of these risks. This is a critical assessment to perform, as it helps establish which risks should be most emphasized in the BCP. Priorities can be established by looking at which risks are most likely to occur to determine the breadth of coverage for your company’s BCP. To do this, you can run a gap analysis to compare your company’s current contingency plans against that of the proposed risks to identify any holes you need to fill. With knowledge of these gaps, you can analyze various threats to identify their respective impact.

To aid in this process, it is helpful to work from a list of potential emergencies or viable threats as well as the likelihood and impact of such events such as to personnel, assets, or monetary impact. These can help formulate different scenarios to plan for, such as natural disasters or terrorist threats, as well as minor events such a power outage.

A best-practice risk assessment report should cover the following:

  • Summary of Business Operations
  • Risk & Vulnerability Analysis
  • Critical Support Infrastructure
  • Physical Environment
  • Recovery Time Objectives
  • Business Recovery Strategies & Priorities

3. Business Continuity Plan Preparation

During this step, the BCP is developed, taking into account the likelihood, magnitude, and potential impact of the risks that were identified in the previous step. The BCP preparation stage will take it a step further by documenting strategies and procedures to maintain, recover, and resume critical business functions as quickly as possible. Part of this preparation will entail a list of procedures to address priorities for critical and non-critical functions, services, and processes.

The BCP should include:

  • Business Operations
  • BCP Organization
  • Plan Activation & Operation
  • Preparation & Readiness Checklists
  • Emergency Operations
  • Facility Restoration & Relocation
  • Emergency Communications
  • Emergency Forms & Terms
  • Incident-Specific Response Checklists

4. Business Continuity Plan Testing and Table Top Exercises

Once a plan is established, it’s time to put it to the test with table top exercises. During this final step, key staff members and management will come together to simulate their response to various emergency situations that were identified as likely risks. Using the procedures outline in the BCP, these exercises will identify gaps in the plans to improve them in a controlled setting. This process can also help establish the different roles and responsibilities across team members.

When it comes to risk mitigation, hope for the best but plan for the worst. Take your risk planning to the next level by getting started with your Business Continuity Plan. Talk to a risk mitigation expert today.

  Category: Risk Management
  Comments: Comments Off on 4 Step Approach to Building Your Business Continuity Plan

Early Identification: Key to Effective Risk Management

By Lowers & Associates,

Risk practitioners tend to categorize risks based on the level of knowledge about the occurrence (known or unknown) and the level of knowledge about the impact (known or unknown).[1]  Known risks can be prioritized by level of impact and likelihood of occurrence and a plan forms accordingly. … Continue reading

  Category: Risk Management
  Comments: Comments Off on Early Identification: Key to Effective Risk Management