ATM Risk Management and Controls - EuroJournals

165 European Journal of Economics, Finance and Administrative Sciences - Issue 21 (2010)
Management Risk Analysis
Management risk analysis identifies the nature of risk involved in detail. This evaluation helps the
financial institution to decide whether it is necessary to have controls to overcome losses which may
arise from various risks associated with the ATMs. A plan is normally formulated as to how these
ATM risks are going to be identified, what methods are going to be used to overcome these
risks/threats, and, if a fraud or a misuse should occur, how much loss is expected and how Bank is
going to recover.
This is the highest risk category that requires the strongest controls since online transactions are
often irrevocable once executed. The bank’s internet systems may be exposed to internal or external
attacks if controls are inadequate. A heightened element of risk is that attacks against internet systems
do not require physical presence at the site being attacked. At times, it is not even clear or detectable as
to when and how attacks are launched from multiple locations in different countries
In view of the proliferation and diversity of cyber attacks, banks should implement two-factor
authentication at login for all types of internet banking systems and for authorising transactions. The
principal objectives of two-factor authentication are to protect the confidentiality of customer account
data and transaction details as well as enhance confidence in internet banking by combating phishing,
key logging, spyware, malware, middleman attacks and other internet-based scams and malevolent
exploits targeted at banks and their customers.
Two factor authentications for system login and transaction authorisation can be based on any
two of the following factors:
• What you know (eg. Personnel Identification Number)
• What you have (eg. One Time Password token)
• Who you are (eg. Biometrics) comprises methods for uniquely recognizing humans
based upon one or more intrinsic physical traits
Risk analysis provides the financial institution with variable information as to how much
investment it should make to enhance the security and controls of its ATM installation.
The EDP Audit Control and Security Newsletter (March 1991) indicated that risk analysis involves 4
steps.
• Reviewing the existing ATM centre environment
• Identifying the critical information processing of ATM applications
• Estimating the value of the ATM assets used by these application that must be
protected
• Quantifying the estimated loss associated with the occurrence of a fraudulent misuse
of cards of unauthorised withdrawals etc.
Reviewing the Existing Operation of the ATM Installation
It is essential that management identify all the various hazards to which ATM centre is exposed,
including natural disasters or otherwise. The management normally identifies the controls that are in
operation that are to reduce the possible impact of these risks/threats. Controls of all kinds which are
applicable to the Automated Teller Machine must be identified.
Even though the existing ATM controls may appear to be in operation, the management must
make sure that maintenance is preformed to ensure that the controls will be effective in the event of a
fraud or misuse. John Page and Paul Hooper (1987) indicated that compliance testing is used to
determine the following:
• To determine whether the necessary controls are in place.
• To provide reasonable assurance that the controls are functioning properly
• To document when, how, and by whom, the controls are preformed.
The management may recommend that some of these controls be changed, implement or
modified in ways that minimize the relevant risks and the exposure associated with them.