Overview

Spreadsheets and other end-user computing applications (EUCs) pose an enormous risk to companies that rely heavily on them to perform their reporting and other functions. The combination of a lack of controls, inadequate training and human error with which EUCs are often managed has led to many multi-billion Euro mistakes affecting insurers, banks and even the government. Actuarial teams are particularly at risk given the highly complex and often poorly documented spreadsheet models they use daily.

Management, regulators, and shareholders around the world are starting to take notice of the risks posed by EUCs and it is becoming ever more critical for insurers to ensure that they have a solid and comprehensive EUC management framework in place.

German-based insurers and their subsidiaries, for example, are now required to comply with a set of regulations collectively known as VAIT, which specifies the minimum requirements under supervisory law on the system of governance of insurance undertakings as well as the requirements with respect to the management processes and measures for IT security, IT risks, and IT processes.

EUC Management Framework benefits include:

1. The reduction of errors in results reporting
2. Improved risk management, from audit reports
3. to data privacy breaches
4. Significant time saving and increased efficiency
5. Smoother role transitions within companies

Approach

Effective EUC management programmes consist of elements of governance, people, process, and technology. MBE and Apparity customised these elements to meet the specific needs of the customer.

Governance: Develop and define an EUC policy, assessment criteria to classify EUC risk, and controls based on risk classification.

People: Identify key stakeholders, assign roles and responsibilities, conduct training, establish a steering committee, and encourage a culture of spreadsheet best practice and EUC risk awareness.

Process: Develop an EUC operating model, identify procedures required to create a sustainable EUC programme, and create supporting processes to help ensure VAIT and EUC policy compliance.

Technology: Implement and configure full Apparity product suite, aligning to client’s policy andrequirements; automate processes identified in the EUC operating model.

Key milestones achieved when implementing an EUC programme:

Results

Within ten months, MBE Consulting and Apparity helped the client build and operationalise a sustainable EUC programme.

Conclusion

In addition to satisfying internal and external policy and regulation, MBE Consulting and Apparity helped implement an EUC programme that will reduce:

• Errors in preparation of financial statement and management reporting
• Effort to remediate errors in EUCs
• Regulatory and compliance penalties
• Losses and reputational damage due to errors

Contact us to find out how we can help ensure you are VAIT compliant with our proven EUC management solution.

The post VAIT: Managing spreadsheet risk by constructing an EUC framework appeared first on MBE.

This is especially relevant to the insurance sector. The financial security of millions of policyholders depends on the rigour with which models are managed. A manual, ad hoc approach is simply not good enough anymore, and it seems that the authorities agree.

What is VAIT & Who Does it Apply To?

In 2018, Germany’s Federal Financial Supervisory Authority, BaFin, issued the Versicherungsaufsichtliche Anforderungen an die IT, or VAIT, requirements. VAIT sets out requirements relating to information security and information technology for the insurance industry.

VAIT applies to all undertakings subject to supervision in accordance with section 1(1) of the German Insurance Supervision Act, Versicherungsaufsichtsgesetz (VAG). It also applies to any insurance group with undertakings in other EU or European Economic Area states for which BaFin is the group supervisor.

EUC-Specific Requirements

VAIT includes dedicated requirements for end user computing (EUC) applications. Points 14, 15, 18 and 42 to 57 of the VAIT regulations are specified as applying to EUC applications. At a high level, these requirements may be grouped into four categories:

1. Inventory
   The ability to create and maintain a risk-based inventory of EUC applications.
2. Version Control
   The ability to enforce and monitor varying levels of change/ release (version) control based on the risk classification of the EUC application.
3. Change Management
   The ability to monitor EUC applications to identify unauthorized changes and facilitate approval workflows.
4. Access Control
   The ability to control and limit access to critical EUC applications and those which contain confidential or personally identifiable information (PII).

How Apparity Helps

MBE’s EUC software partner is Apparity. Our combined VAIT Compliance solution is designed to manage and control EUC applications within highly regulated industries, especially banking, insurance and the utility sector. Apparity’s standard functionality allows insurance companies to automate and evidence all of the EUC-specific requirements of VAIT.

Inventory

• Discovery Module
  Automatically create and maintain an inventory of EUC files, including key file details.
• Structural Complexity Algorithm
  Determine the complexity of each identified file using custom evaluation parameters.
• Registration
  Qualitative assessment of file impact to capture relevant data from file owners. Enables a risk-based inventory based on both complexity and impact.
• Connection Explorer
  Visually chart connections between discovered files. Provides a clearer understanding of upstream & downstream dependencies.

Version Control

• Versioning
  Automatically capture and track all file copies while allowing user comments to enable collaboration and audit trails.
• Version History
  View, export, and restore a file to a previous version or copy of a file.
• Zero Loss Fingerprinting
  Monitored files are always tracked, regardless of file save location or how it is named. Ensures there are never ‘lost copies’ of a file.

Change Management

• Change Logs
  Real-time and in-session view of all critical changes made to a file. Filtering and sorting helps identify potential mistakes or unauthorized changes.
• Noise Filtering
  Users only see critical changes that are relevant to them configured against company EUC policy.
• Automated Review and Approval Workflow
  Ensures critical changes are properly signed off with included audit trails.

Access Control

• File Access & Modification Reports
  Track and log all users who update critical files.
• Unexpected Change Warnings
  Flag any changes made by non-Apparity users who might be outside the controls framework.
• Apparity checks & monitors against all Existing Access Control frameworks. Ensures access will never be granted to a file unless the user has access to the original file location.
• Automated PII identification
  Allows teams to understand which files have sensitive data that should not be accessible to broader audiences.

For further information on how MBE can support you with your EUC requirements please get in touch. Additional information on the Apparity solution and how it helps with VAIT compliance can be found here.

The post VAIT: Germany’s Insurance IT Regulation appeared first on MBE.