The increasing complexity of the cybersecurity threat to the fund industry has given rise to a new venture from global governance providers Carne Group and CalQRisk, a developer of enterprise-wide risk management technology solutions.
John Skelly (pictured), principal at Carne Group and Neil Clifford, head of risk at Carne Group, explain that their aim is to provide fund directors with a comprehensive and holistic assessment of cybersecurity and financial crime risks for the fund entity and its delegates.
Ten year old Carne Group has corporate governance offices in the Cayman Islands, Dublin, Luxembourg and Jersey and fund product centres in London, the US and Switzerland.
Skelly says: “Regulators around the world are increasingly focusing on cyber security risk. The key challenge for fund structures is that ultimately they are relying on the services of the administrator, investment manager, fund boards and management companies involved, so sensitive information is being shared across multiple entities and it is key for fund boards to try and understand where the risks are and assess if sufficiently strong controls are in place. ”
Threats can come in the form of fraud, theft of money, hacks – as was seen in the recent Ashley Madison case – leaked information about log-ins and portals, and come through many touch points and risk areas.
Skelly says: “If sensitive board documents and/or confidential investor information were stolen and made available on the internet it would be highly damaging reputationally for boards and fund promoters. And if client monies were stolen then that would disastrous.”
“You can never completely eliminate the chances of something happening so it is really about trying to minimise the risk of it happening to the lowest possible level, by making sure there are robust and strong policies and procedures, controls and systems in place to minimise the risk,” says Clifford.
“It’s one challenge doing it for a single entity, but the challenge is so much greater when you consider a regulated fund model where you rely heavily on service providers to make up the structure. With multiple service providers, each with different policies and controls in place, the challenge is trying to be consistent in performing an assessment across the entire fund structure. Without a highly systematic approach, such an assessment is going to become clouded with lots of qualitative and subjective information”
Skelly says: “Our solution provides boards with a singular, holistic view of the cyber security risks that exists across the entire fund structure and ranks those risks in order of seriousness. This makes it easier for boards to action service providers to ensure that the key risks are given top priority.
“Our system doesn’t just provide a snapshot view of Cyber security risks at a single point in time. After the initial assessment is complete, it continues to provide real time updates as actions are taken to address risks. This means boards always get an up to date picture and can easily track progress over time. That’s pretty powerful functionality,” says Clifford.
Fees for the new service are set on an initial assessment fee basis plus on going fees with updates. The process is based on the ISO 31000 Risk Management standard and ISO 27001/2 Information Security and Technology standards. It includes access to a real-time register, evidencing the controls in place at the fund and within each delegate, as well as recommended additional mitigation options.
Skelly says: “We are targeting all fund boards and investment managers in a bid to protect funds and funds’ investors.”
