Independent Banker - July 2023 - 53

to systems. Processes also need to
be digitalized and updated as part
of the transformation, says Marcia
Malzahn, president and founder of
management consultancy Malzahn
Strategic in Maple Grove, Minn.
She advises that a good starting
point is to make a list of all the
processes under each department
of the bank. Then, prioritize the
list of processes by how critical the
process is to the operations of the
bank and the extent to which the
process involves sensitive employee
or customer data. Finally, community
banks can determine if they can
outsource the digitalization or if they
have the resources to do it internally,
she says.
To illustrate, Malzahn offers a
simplified example of how this
digitalization assessment could be
accomplished within a community
bank's human resources department.
First, the community bank needs
to understand where employee
records are held, which could be
in a centralized location within its
network, in the cloud or on paper in
a file cabinet. Then the bank needs
to determine who has access to those
records and whether they could be
easily recoverable after a disaster.
Based on the answers to these
questions and other strategic
considerations, the community
bank could decide to outsource its
human resources department so
its HR director can focus on talent
acquisition, development and
retention strategies. Alternatively,
the community bank could simply
create an internal network folder
with the appropriate authority
levels and scan all the documents
in a structured filing system. The
community bank would also need to
establish an electronic process to use
going forward to ensure all employee
documents are kept electronically,
from application to onboarding to
termination, Malzahn says.
" When times are tougher and
the uncertainty is greater, we
need to ask questions with
qualitative responses that
won't show up in the ratios. "
-MATT PIENIAZEK, DARLING CONSULTING
RISK
THIRD-PARTY RISK MANAGEMENT
IS TIME-CONSUMING.
It's not unusual today for community
banks to outsource services. But
staying on top of vendor partners
requires significant work with respect
to planning, initial due diligence,
negotiating and ongoing monitoring.
SOLUTION
When thinking about third-party
risk, it's important for community
banks to evaluate various levels of
risk. Vetting the provider itself is
only the first step. Understanding the
risks a bank faces from that vendor's
partners is also critical.
Be assured that regulators are
looking carefully at this type of risk,
especially with technology and fintech
providers, says Dennis Hild, principal
at Crowe LLP, a public accounting,
consulting and technology firm in
Chicago. That's why it's so important
to understand more granularly what
could happen to a bank's systems if a
vendor has a breach.
" You're not going to prevent every
breach, but you want to make sure
that you can get your systems up and
running pretty quickly, " Hild says.
independentbanker.org // 53
http://www.independentbanker.org
Independent Banker - July 2023

Table of Contents for the Digital Edition of Independent Banker - July 2023
