Beyond traditional Risk Management practices: iute’s proactive approach

Amidst the complexity of today’s economic landscape, risk management has become a major concern for businesses around the world. In an interview with the representative of the fintech iute company, the Director of the Risk Department Alma Hasanaj, we delve into the essence of the philosophy of risk management, revealing the strategies and knowledge that promote trust in clients.

Question: According to iute, what are the most important points of danger in today’s economic situation?

A.H.: Our risk management is very comprehensive and we try to proactively cover all risks and risk factors. If we see ourselves as part of a large financial group that operates throughout Europe then it certainly puts us in front of additional risks. But if I point out specifically, it is definitely the risks related to business continuity, cyber security, ESG related risks (environmental, social and governance risks) and risks caused by macroeconomic turbulences (decline in economic growth, increase in unemployment). , inflation, decline in solvency, etc.).

Q: How much does what’s going on in the world affect iute? Do you yourself see an increase in the probability and impact of certain risks?

A.H.: Since iute Group is an international company and iute in Albania is a part of it, everything that happens in the world obviously directly affects us and our customers. In the current situation, people are more cautious when making decisions, employment opportunities are decreasing, inflation continues to rise, cyber attacks are increasing and all this creates risks and forces us to be ready to respond adequately to what is it happens In my opinion, these are some areas of risk where much more attention should be paid compared to before, working in parallel to ensure business continuity just in case.

Q: Broadly describe what modern risk management is?

A.H.: Traditional risk management focuses a lot on risks and consequences, while IT focuses more on what causes risks, that is, on risk drivers. Also, traditional risk management focuses on residual risk, while we focus on evaluating controls. Simply put, we focus on the factors that create risks and how to positively influence these factors. Another important aspect of modern risk management is of course the fact that risk management is part of daily and strategic decisions. And last but not least, incident management – without it, we don’t have an assessment of the events that actually happen and affect us every day, and therefore, without incident management we cannot effectively manage risks.

Q: You say that risk management should be part of decision-making – how do you achieve this, because in reality it seems a bit difficult to do?

A.H.: Very good question! Let’s just say that changing the mindset is one of the biggest challenges. If there is a culture of risk management and governance in the company, many processes and controls will start to work themselves. For this to happen, many initiatives must be taken, many trainings must be done, there must be a lot of talk about risk management and thus it reaches all structures and all personnel. Very good tools of influence, or awareness of the materialization of risks, is the incident log, which creates a panorama where risks materialize and have a cost. It is said that “money talks” and when all levels of management see how much money can be lost from incidents, they will start to act.

Q: If we go into a little more detail, how does iute manage its most important risks?

A.H.: Above all, it is necessary to agree on the principle of how responsibility for risk management is divided. The general reasoning is that the head of the risk department is responsible for the company’s risks, but in reality this is not the case. At iute, we have managed for each manager to take full responsibility for risk management, in his area of coverage. The second is the environment where risks are managed: in general, the main tool is Excel. At iute we have a digital solution and a special space where risk management takes place. We have built a system that describes risks, risk factors, controls, assessment results, financial impacts, etc. Within this space, we have incorporated the incident log, the internal audit findings log, the control log, the improvement plan log, the notification system, etc. The system is comprehensive and in it we support holistic risk management. And what is most important – risk management should be continuous and not a one-time project or an activity that we do only because an external party asks for it. Systematic risk management brings many benefits to the company.

Q: What do you recommend to others about risk management?

A.H.: Risk management is often mentioned in the internal policies of companies as one of the mandatory work tools of managers at any level, but unfortunately, these policies are not always put to work in their favor. For those companies for which risk management is mandatory, I recommend being proactive and creating effective risk management tools. I can say from my experience that companies will have real benefits.