Banking's a risky business

After 26 years of work experience, CIO Michael Leung says he still hasn't seen it all. His biggest challenge: post-merger activities and the replacement of the core banking system.
Written by Isabelle Chan, Contributor
Michael Leung, CIO, China Construction Bank (Asia)

CIO 1-on-1 Managing a bank's IT operations is not for the faint-hearted, says Michael Leung, chief information officer (CIO) of China Construction Bank (Asia)--previously known as Bank of America (Asia).

The 26-year industry veteran tells ZDNet Asia in a recent interview that his is a demanding role that is all about managing risks, rather than the technology infrastructure.

Describing banking--with the exception of healthcare--as "the most audited and the most regulated" industry, Leung takes the daily pressures and annual audits in his stride.

He says that surviving as many as six audits a year is part of the job, though it "usually requires a lot of explaining and work".

"Sometimes, we deliberately give them something to write about because they won't stop till they find something," he quips.

Leung, who has held the CIO post since March 2000, says he hasn't seen it all and explains why he's facing his biggest challenge ever.

Q. Why did you choose IT as a career?
Leung: IT was one of the hottest industries at the time when I graduated from university in 1978, and IT professionals during that period enjoyed a double-digit pay rise every year. IT was like a 'hot potato', and everyone wanted to get into the industry. But it's different today.

Michael Leung
Job title
Chief Information Officer, China Contruction Bank (Asia)
Work experience
Leung has over 26 years of international experience in IT, focusing largely in the banking and finance industry. He was appointed senior vice president and CIO of Bank of Amercia (Asia) in March 2000. He manages IT functions that support the banks' retail and commerical businesses, including business systems development, project management as well as production systems support and data center operations.
Before joining Bank of America, he held senior positions at Standard Chartered Bank and Dao Heng Bank (since acquired by DBS Bank). He began his career at Dutch Philips Telecommunications and Data Systems, and later joined IBM, Price Waterhouse Management Consulting Service and Computer Sciences Australia.
Leung is also an active member of several professional bodies including the Hong Kong Computer Society.
About China Construction Bank (Asia)
In August 2006, China Construction Bank signed an agreement to acquire Bank of Amercia (Asia), the wholly-owned subsidiary of Bank of America in Hong Kong, for HK$9.7 billion (US$960.6 million). On Jan. 1, 2007, Bank of America (Asia) was renamed China Construction Bank (Asia).

That's surprising to hear. One would think that with the Googles, eBays and YouTubes, IT today would be one of the hottest career choices.
Today, what are the hottest subjects? It's accounting, it's medicine, and it's law. In IT, you don't get the same social status as, say, a lawyer or a doctor. As for Google and YouTube, well, that's trendy stuff. But, are young people going to university with that in mind? Probably not, at least, not in Hong Kong.

You specialize in IT in the banking and finance industry. Was that accidental or planned?
It was rather accidental, largely because my first employer, Dutch Philips Telecommunications and Data Systems, used to sell banking terminals and systems. I received a scholarship with Philips and studied in Holland. After graduation, Philips hired me, and I ended up in data systems. At that time, Philips focused entirely on banking terminals and its customers were solely banks.

What are some of the unique characteristics or demands of managing IT for a bank compared to other businesses?
Running a bank is about managing risks and that equates to corporate governance. So risk management, in the broadest sense of the word, is very important and related to IT. For IT professionals working in a bank, this is the first thing you need to appreciate.

Managing risk is the No. 1 priority in a bank, and translating that to IT means a heap of things. Corporate governance--control, SOX (Sarbanes-Oxley Act) and Basel II--touches IT and relates to risks. And you certainly need to have a good understanding of the business. Whether it's Internet banking or two-factor authentication, it's all related to IT governance and risk management.

In terms of managing IT, what has the 25 years of industry experience taught you?
Learning, in terms of gaining business, operations and technical knowledge, is a life-time process. Everything, from products and services to regulatory requirements, is changing so rapidly in IT and in the banking industry. Banking is also the most audited and the most heavily regulated in the world. I can't think of any industry that's more regulated.

Banking is also the most audited and the most heavily regulated in the world. I can't think of any industry that's more regulated.

How can undergraduates who are hoping to join the IT industry better prepare themselves for the job?
They should ready themslves with a strong foundation in IT knowledge and skills, then choose an industry to work in, for example banking, and build their business acumen quickly. Both communication and people skills are also key.

If I'm hiring a programmer, I would expect the candidate to have a good understanding of the technology, such as the hardcore technical aspects of data modeling or Java programming. But then he should also build specific knowledge of the industry he is working in, such as risk management, if he's in banking.

What are the three attributes you look for in a new hire?
As mentioned above, the first is technical knowledge, the second is a good understanding of the business, and the third is soft skills.

Is it better for a fresh IT graduate to start work in the vendor environment like IBM or Microsoft, or join the IT department of, say, China Construction Bank (Asia)?
The first half of my own career was with vendors, service providers and consulting firms. These companies are like the Shaolin Temple where you are taught a lot of kung-fu (Chinese martial arts) and get the opportunity to be in a lot of real 'fights' in the frontline. I personally think that a tech vendor can offer a very good training environment for young graduates. On the other hand, in a business like a bank, you get to work on more specific business units or areas, and that's where you would probably be able to drill down a lot more into each area. So, perhaps, it's about breadth versus depth.

I have been on both sides of the fence. I worked more than 14 years in the vendor and service provider environment. That was good training ground for a young graduate. You are sent for many courses as a consultant, have the opportunity to attend courses and training, and you learn a lot in the vendor environment. You win bids and tenders for customer deals. I enjoyed it, and I am grateful and lucky to have had that experience during the first part of my career. And then when you join an organization like a bank, you develop different skills. For example, I'm running the IT functions of a bank now, and have to do several things that I would not have an opportunity to if I remained a consultant. So, I encourage young graduates to start their careers by joining vendors and consulting businesses first.

How can IT professionals, who are already in the industry, stay employable?
They should keep abreast of IT development, become more business savvy, and move up the value chain as far and as fast as they can. These days, you see more people asking about business concepts and strategic thinking. I think overall, it's becoming harder for die-hard techies to find a job these days. I believe that to be more employable, you need good business appreciation, accounting skills as well as industry knowledge that will give you an edge. Remember to add value, ask yourself what you bring to the business or the job.

What keeps you attracted to your job?
Both banking and IT are highly competitive, rapidly changing and expanding industries. In my case, I have total responsibility of IT, reporting directly to the CEO of the bank. It's exciting, fulfilling and rewarding. I can't think of another industry that's more competitive. Maybe telecommunications, but banking will not be any less. There's always something new in IT banking, so that's exciting.

What keeps you awake at night?
Following the recent merger with China Construction Bank, we are now confronted with a huge post-merger integration or reconstruction challenge. Honestly, in the past 26 years of my career, I have never been in such a situation. Again, it's exciting but at the same time terrifying. Bank of America (Asia) is becoming a subsidiary of China Contruction Bank, and we're integrating both operations. We're in the middle of it now--a lot is happening and one of the mega projects is the replacement of the core banking system. That's like replacing your heart. It's exciting and yet scary. Things can go wrong, so it's almost like a career-termination project. If the surgery goes well, then good, the patient lives; if not, the patient dies. Since the beginning of my career, this is the first time that so much is ahead of me.

What would be your biggest nightmare?
Any one of the five or six IT audits that we conduct each year comes out with unexpected, unfavorable, or perhaps untrue, findings. It usually requires a lot of explaining and work to address such findings. Auditors will look around, ask questions. Two or three weeks later, they come up with a report, and depending on the style and attitude of the auditors, they may find something in the tiniest or darkest corner. Well, that's what they're paid to do; this is part of the job. Sometimes, we deliberately give them something to write about.

What's on your agenda this year?
As mentioned above, the "post-merger" activities occupy the front page of all our plans this year. The agenda is full of projects related to the merger.

Editorial standards