Report on NAB holds lessons for all IT shops
The Australian Prudential Regulation Authority (APRA) issued a damning report into the systemic failures that allowed four currency traders to lose more than AU$350 million of shareholders' funds.
These breakdowns of process and procedure may extend, according to the report, to the information technology systems used to facilitate currency option transactions.
APRA said that the integrity of the Horizon system -- which "facilitates all front-to-back-office functionality and provides information used to calculate balance movements in the general ledger" -- could not be ascertained due to failures in the supply of important documentation.
"...the NAB has not provided documentation regarding the extent of user acceptance testing undertaken upon the implementation of the Horizon system and upgrades to the pricing models used for the Horizon system," APRA said.
"This is despite the procedural requirement for the technology team to document and approve all testing, log all requests for, and actual changes to, the Horizon system". APRA goes on to say the issue had already been raised by KPMG earlier this year.
APRA hardly exonerates the technology team from other potential failures of process, noting merely that its investigation did not review other issues surrounding information technology systems within the NAB's trading operations. It did recommend, however, that a timeframe for system developments provided to APRA as part of an on-site review last year be revisited.
"In light of the issues raised in this report, NAB should reassess whether the timeframe for implementation of system upgrades, including development of better system interfaces, should be accelerated." APRA states.
The regulator also said it required the NAB to "undertake an internal review of the processes followed in the development, implementation and upgrades of the Horizon system and, in particular, identify any non-compliance with NAB policies on user acceptance testing and system change control processes".
The tech issues identified by APRA are discussed across only two pages of an 87-page document exposing a raft of organisational problems that have already cost the NAB's chief executive officer and chairman their jobs. Nonetheless, they are a potent reminder of the importance of information technology systems and associated business processes to large organisations in particular. Failures in these areas can contribute to or hide weaknesses within the organisation that can then be exploited by the unscrupulous or incompetent. Australia's largest companies should immediately take the opportunity to review their systems and processes across all areas, including information technology.