Compliance April 30, 2015

Three Steps to Address Cyber Attacks

The cybersecurity of registered investment advisers (RIAs) is an important issue, says the Securities and Exchange Commission (SEC) in a guidance update.
Reported by

Adviser use of technology to conduct business activities is on the rise, and so is the need to protect confidential and sensitive information from third parties, including information about clients, the SEC says. Underscoring the need for firms to review their cyber-security measures: a number of recent high-profile cyber-attacks on firms, from JP Morgan to the health insurer Anthem.

In February, the SEC determined that few written policies and procedures directly address how firms determine whether they are responsible for client losses associated with cyber-incidents. Lack of a specific process can prove problematic for advisers and broker/dealers accused of leaving client data or funds exposed to cyber-risks. The 2015 exam priorities, though streamlined from the previous year, will still focus on cybersecurity compliance and controls.

Want the latest retirement plan adviser news and insights? Sign up for PLANADVISER newsletters.

Advisers should consider several measures when addressing cybersecurity risk. The guidance update from the SEC’s Investment Management unit offers three steps for addressing cybersecurity.

First, conduct a periodic assessment of the nature, sensitivity and location of information that the firm collects, processes and stores, and its technology systems. Assess internal and external cybersecurity threats to and vulnerabilities of the firms information and technology systems. Diagnose the effectiveness of the governance structure for the management of cybersecurity risk. An effective assessment would help identify potential cybersecurity threats and vulnerabilities to better prioritize and mitigate risk.

Questions to ask:

  • What are the security controls and processes currently in place?
  • What would the impact be, should the information or technology systems become compromised?  

Next, create a strategy to prevent, detect and respond to cybersecurity threats. Firms might want to consider implementing tiered access to sensitive information and network resources, network segregation, and system hardening; and using data encryption. To guard against the loss or exfiltration of sensitive data, consider restricting the use of removable storage media and deploying software that monitors technology systems for unauthorized intrusions, the loss or exfiltration of sensitive data, or other unusual events. Develop an incident response plan. Routine testing of strategies could also enhance the effectiveness of any strategy.

Questions to ask:

  • Who has access to various systems and data?
  • Should the firm adopt user credentials, authentication and authorization methods?
  • Is there a firewall or are there perimeter defenses in place?
  • What is the process for data backup and retrieval?

Finally, implement the strategy with written policies, procedures and training to provide guidance to officers and employees. Detail applicable threats and describe the measures that will prevent, detect and respond to such threats.

Questions to ask:

  • Does the firm want to educate investors and clients about how to reduce their exposure to cyber security threats?
  • Does the staff understand the policies and procedures to help monitor compliance?

The Investment Management Division recommends that advisers identify their compliance obligations under the federal securities laws and take them into account when assessing how they can prevent, detect and respond to cyber attacks. Advisers can also mitigate exposure to any compliance risk associated with cyber threats through compliance policies and procedures that are reasonably designed to prevent violations of the federal securities laws.

More information about the guidance update is on the SEC’s website.

Data & Research April 30, 2015

More DBs Looking for Custom Solutions from OCIO Providers

The need for greater capabilities and more competition will likely shake up the market for outsourced chief investment officer (OCIO) services, according to the latest research from global analytics firm Cerulli Associates.
Reported by

Smaller pension plans, nonprofit educational endowments, and charitable foundations frequently outsource the oversight of investment policy development, asset allocation, investment manager selection, and other noninvestment functions to an outside entity, Cerulli notes in the second quarter issue of “The Cerulli Edge – Institutional Edition.”

Managers, investment consultants, and dedicated OCIO providers responding to a recent Cerulli survey expect outsourced assets (client assets in which they have some discretion) to expand 33.6% on average in the next three years (or a median growth rate of 22.5%). Many outsourced advisers tell Cerulli a number of factors are driving more institutional clients to embrace an outsourced solution.

For more stories like this, sign up for the PLANADVISERdash daily newsletter.

According to the survey, 69% of respondents cite a lack of internal resources as the top reason their clients engaged an OCIO. Outside of the larger pension plans and endowments with internal staff and investment resources, many institutions cannot retain the personnel or afford the technological expertise to respond to the global financial markets’ speed and complexity.

Nearly two-thirds (63%) of Cerulli survey respondents report their clients’ desire to transfer more responsibilities to another entity. While it is extremely rare for an institution to completely cede fiduciary duty, an increasing number of boards feel overwhelmed by their oversight responsibilities. Some say they don’t have the time to properly administer plans, they lack the knowledge to address complex investment issues, they are being pulled away from the original mission of the institution, or some combination of these concerns.

For these reasons, many OCIO firms tell Cerulli they see signs of OCIO moving “up-market,” to larger institutions in corporate defined benefit (DB) and non-profit segments, such as endowments and foundations. Traditionally, smaller institutions (those with less than $100 million in assets) sought outsourced services, and this is still largely the case, according to Cerulli survey data. However, approximately 5% of managers report corporate DB and non-profit mandates (4.6% and 6.1%, respectively) in accounts between $500 million and $1 billion, a fairly large size for an OCIO account, Cerulli notes.

According to the report, as boards seek to place more discretion and responsibility with an outsourced provider, they expect OCIO managers to bring additional capabilities and resources to the table. With more boards embracing objectives-based measures of success (e.g., returns above a foundation’s minimum level of spending), there is greater demand for OCIO managers with multi-asset-class capabilities, a demonstrated record of successful asset allocation, and the ability to deliver a total portfolio approach customized to the institution’s objectives. Multi-asset-class capabilities require significant investment resources and experience, including investment platforms able to offer alternative investments, according to Cerulli.

Another trend moving OCIO up market is the demand for outsourced liability-driven investing (LDI) services from corporate DB plans. With many corporate plans derisking and attempting to better match assets and liabilities that are unique to each plan, plan sponsors seek OCIO managers with specific skills, Cerulli says. These competencies include long-duration fixed-income expertise, quantitative skills to accurately assess plan liabilities and construct derisking glidepaths, and management of derivatives overlay strategies to more accurately hedge liabilities.

Many institutions employing an OCIO today have maintained a relationship with that provider for five, 10, or more years. Cerulli says some institutions are re-evaluating their relationships and seeking more customized and comprehensive services—all at lower fees.

Information about how to purchase the Cerulli report is here.

«