Steve Katz on Basel II: You Can Bank on It

To loan or not to loan. Evaluating risk is a natural preoccupation with the banking industry, so it’s not surprising that it is working on risk measurements that will have effects beyond the financial services industry. In January 2001, the Basel Committee on Banking Supervision issued a proposal for a New Basel Capital Accord that, once finalized, will give banks a methodology to evaluate risk. The New Basel Capital Accord (also referred to as Basel II) sets minimum capital requirements, refines an institution’s internal assessment process and will mandate disclosure processes to encourage safe banking practices. We spoke with Steve Katz, the former chief information security and privacy officer for Merrill Lynch and founder and president of consultancy Security Risk Solutions, for some insight on how the accord will affect corporate security organizations.

Steve Katz: The New Basel Accord will apply directly to U.S. regulated banks. It will require banks to set aside capital reserves to offset operational risks, which include information and physical security, HR security and business continuity planning. Banks will need a set of metrics to look at the components of their operation and the risks they have to manage. Some portion of that risk will be offset by transferring it to insurance companies, which will want to ensure they accept the metrics as well. What is interesting is that institutions and large insurance companies will probably use the same metrics as a basis for offering cyberinsurance to non-[Basel II] regulated companies. There are only three things you can do to risk: You can correct it, you can accept it, or you can accept some portion of it and transfer the rest. Insurance companies are nobody’s fools. They want to limit exposure and will require companies to have effective risk management programs and to document them.

Absolutely. You’ll see more of a risk management view across the entire spectrum. It has to be a risk management issue not a security issue. You’ll also see operational risk management committees set up on the boards of directors similar to audit committees. They’ll make sure that there is a [a risk management] program in place.

The accord will be finalized in 2004 or 2005. You’ll see regulators draft guidance documents and submit them for comment. CSOs should look at a couple of things: The Enron Act [a.k.a. The Sarbanes-Oxley Act of 2002], which requires the chairman of the board to sign off on [financial statements]. CSOs should also consider the implications of having the chairman and the CEO sign off on the operational risks. The CEO is signing off on technical risks, and from a security perspective, many CSOs are being required to do the same. In looking at the responsibility for both cyber- and physical security, the ball is very much in the CSO’s court