OFR_2016_Financial-Stability-Report

Figure 42. Banks that Include an Operational Risk
or Cybersecurity Scenario in Dodd-Frank Act Stress
Tests (number )
Use of operational risk and cybersecurity scenarios is
growing
35
30
25
20
15
10
5
0
Banks with an operational or cybersecurity risk
scenario
Banks without an operational or cybersecurity risk
scenario
2013 2014 2015
Note: Based on mid-cycle Dodd-Frank Act stress tests.
Source: OFR analysis
Figure 43. Mentions of “Cyber” in Large U.S.
Financial Firms’ Form 10-Ks (number)
Cyber risk is rising for systemically important U.S. financial
firms and government-sponsored enterprises
250
200
150
100
50
0
2013 2014 2015
Financial Firms Increasingly See
Cybersecurity Incidents as a Key Risk
The threat of cyber incidents is widely recognized. Twothirds
of global regulators and market experts surveyed
in 2015 ranked the threat as a top financial stability
risk. It placed second among all potential threats in
the survey (see Worner, 2015). Similarly, half of bank
chief risk officers and board members responding to a
2016 survey placed cybersecurity risk among the top
issues requiring their attention (EY and IIF, 2016).
Increasingly, banks voluntarily include cyber risks and
operational risks in the scenarios they submit to regulators
as part of stress testing. Banks prepare these scenarios
as part of mid-cycle stress tests required under
the Dodd-Frank Act (see Figure 42).
A number of U.S. financial firms reported cybersecurity
as a key risk in 2015 10-K filings reviewed by
the OFR. The analysis covered U.S. global systemically
important banks, global systemically important
insurers, central counterparties, and government-sponsored
enterprises. Cybersecurity references in 2015
Form 10-Ks were nearly double those in 2013 10-Ks
(see Figure 43). These filings typically note that cyber
incidents can come from a variety of bad actors,
including organized crime, foreign governments, and
insiders. They also note that cybersecurity incidents can
arise when clients, third-party service providers, retail
partners, or counterparties are targeted. Incidents can
spread cyber risks to business partners of the firm.
Financial firms are integrating cybersecurity preparedness
into their risk management. They are investing
in information security to address cybersecurity risks.
About 40 percent of financial services firms in North
America with more than $1 billion in revenue budgeted
$10 million or more for information security, according
to a 2016 survey (see PricewaterhouseCoopers, 2016).
That is more than most other industries (see Figure 44).
Note: Form 10-Ks for firms in the sample grew on average 2.5
percent in page count from 2013 to 2015.
Sources: Securities and Exchange Commission Form 10-K, OFR
analysis
42 2016 | OFR Financial Stability Report