Reducing IT Risks in Croatian Banks
In March 2002, the Croatian National Bank (CNB) and the wider public in the country realized how vulnerable commercial banks are to information technology (IT) security flaws: it had just been discovered that the chief foreign exchange trader of the fourth largest commercial bank in Croatia had concealed nearly $100 million in derivative losses over several years. Moreover, the trader was able to hide these losses because he successfully breached the commercial bank’s own internal password security for the IT systems responsible for settling these trades.
 |
Information Technology security expert, Erik Pols, from FSVC advises staff of the Croatian National Bank on how to supervise IT risk in banks
Photo Credit: Financial Services Volunteer Corps |
The security of IT systems is vital for managing operational risks in banks, and with USAID support, the CNB has pioneered the establishment and enforcement of IT security standards in the region. The Financial Services Volunteer Corps (FSVC), funded by USAID, provided training and technical assistance that enabled the CNB to develop a special group of bank examiners who specialize in IT risk supervision. This unit makes sure that banks have the proper mechanisms in place that ensure a secure, stable and reliable IT environment. Bank regulators from the U.S., Holland, and Israel were engaged as volunteers to provide the training the CNB needed. With continuing support from USAID, this unit has significantly improved the quality of their own audits and set standards for external IT auditors that conduct independent annual audits, to improve their performance level as well.
According to Damir Blazekovic, who heads the CNB’s IT Unit, they are motivated to invest more efforts into their daily work with the goal of making the IT security of Croatian banks simply a “state-of-the-art affair.” The Bank has shared its experiences with other central banks in the region, including Albania, Montenegro and, Bosnia and Herzegovina, seeking to curb the threat of fraud, hackers and viruses to their institutions.
Back to Top ^ |
