How Can Identity and Access Management Enhance Treasury Operations?
While the responsibilities of the corporate treasury department have grown through the years, adoption of the technologies that provide proper oversight, checks and balances have not necessarily kept up with the times. Corporate assets are regularly a target for theft from hackers and can just as likely be targeted by employees. In addition, internal threats don’t need to be maliciously motivated to cause irreparable damage to a company.
Finally, add to the mix the growing list of compliance regulations being introduced by government legislation and a corporate treasurer can potentially be at risk for criminal prosecution for misdeeds that occur on their watch. How can identity and access management (IAM) solutions be used to mitigate these risks?
At the most basic level, to protect corporate assets and the corporate treasury department, their applications must be protected – and that’s precisely what an IAM system is designed to do. There is always people churn within a company as well as within departments themselves: people are hired, fired, retire and transferred on a daily basis. What happens to the user accounts that are created within the applications for these individuals during these events and, equally important, why were accounts created for these people in the first place?
When we look at an IAM solution we focus in on the user provisioning and enterprise role management capabilities to address these sorts of risks. An organisation needs to define specific business roles as well as associated access rights to applications based on the requirements necessary for individuals to effectively do their jobs. Once these roles are defined, the user provisioning system can create and revoke the necessary access to the applications as changes happen within the organisation. An organisation no longer has to be concerned with an employee, contractor, or partner that has transferred out of a department or departed the organisation entirely, still having access to applications. After implementing a role management and user provisioning system, people will be able to see the number of rogue and orphaned accounts that existed across the multitude of applications.
After it has been ensured that only those individuals that need access to the applications have them, how is the challenge of people abusing their access privileges addressed? A robust access management solution is designed to handle these tasks. Based on your business policies, it is possible to define and enforce when and from where individuals can access applications. Furthermore, these systems are smart enough to halt user actions that are recognised as suspicious. And since certain business roles within an organisation do allow and require individuals to perform transactions which can have a material affect on the organisation, it is imperative for the system to absolutely validate that the user is actually who they claim to be, before granting access to the applications in the first place.
Also, it is important to acknowledge that your workforce might need to access applications that are owned by partner or other third-party organisations. Likewise, an organisation might want to grant their business partners access to some of their applications. Identity federation technology securely allows for these types of business transactions. Using identity federation technology, a corporate treasurer can log into their desktop once and have access to financial applications within their organisation and also have access to their account balance and transactional data at the various banks and other financial institutions they do business with. And finally, the system itself needs to be flexible enough to work within the scope of real-world practices. For example, what happens when an employee needs to take a vacation? A business cannot shut down when employees take a temporary leave, so it is important that individuals are able to delegate to other individuals their responsibilities and access rights to applications, based on business policies, in their absence.
How do corporates audit themselves and attest to the fact that all applications are protected as they have defined them to be? A robust audit, compliance and attestation framework is the final piece to the puzzle. A good system is designed to allow for the segregation of duties such that individuals are not granted a toxic combination of responsibilities within or across applications – a person that is able to create a vendor in an application should not also have the ability to draft a payment to that vendor. A good IAM system should be able to quickly look back at any point in time and report on who had access to what, when, from where and why. The system should be able to generate reports and workflows so that the people responsible for this oversight can attest to the fact that the correct checks and balances are in place, and if the checks and balances no longer meet the business practices, they can immediately implement a change.
Of course, any good IAM solution should easily integrate with an organisation’s existing applications and infrastructure. It needs to be built upon open standards to permit the greatest range of interoperability and should be recognised in the industry as a leading solution of its kind. With such a system being the guardian of all these critical applications, the solution needs to be highly available and scalable. Keep in mind that this is not an all or nothing proposition either – start small. Focus on your critical business processes and the people assigned to carry out those tasks, and then use the technology to get the associated applications under management.
While an IAM project might be initiated to address security and compliance concerns, corporate treasury departments should see other benefits more in line with their primary corporate charter – cash and asset management. Automating manual processes, such as user account creation and granting access privileges based on roles, frees IT specialists to concentrate on other tasks and, in many cases, allows organisations to be more efficient. Another commonly cited savings area comes from providing employees with the ability to securely reset their own passwords – when this task is the responsibility of a help desk, it is widely agreed to cost around US$10-50 per password reset. Multiply this by numerous resets per employee on an annual basis and across an organisation with thousands of employees and contingent workers and we can calculate that this is an area ripe for savings.
Finally, a security breach can have the unintended consequence of a loss in consumer confidence, which can quickly lead to a decline in revenue and market capitalisation. Every organisation will have their own drivers for undertaking an IAM project, but it is important to recognise that you can build a business case for adopting a solution around security, compliance and cost savings.