Podcast S5E8 | Taking Control: Rupal Patel

TRANSCRIPT

Kimberley Cole 0:01
This is Risky Women Radio – a show to connect, celebrate and champion women in risk, regulation, and compliance. Sharing insight and perspectives from the most influential members of our global Risky women network on the latest developments, we need to think about, the challenges we should all talk more about and the innovation we are most excited about governance, risk, and compliance. Bringing together the hundreds of senior women professionals already connected with a new emerging group of leading women and men. I’m Kimberley Cole, your chief risky woman.

Kimberley Cole 0:24
Welcome to Risky Women Radio. Today’s Risky Woman is Rupal Patel, she made the Women in FinTech Power List 2021. In the senior leaders category, she was also a omen of FinTech Shining Star. And along with that she is the founder of Women in Risk and Control. So Rupal can be described as a senior risk and control and governance leader, an advisor , and a diversity and inclusion champion. She’s influencing the development and implementation of compliant regulatory change strategies from a risk perspective in financial services. She has over 20 years experience with tier one global investment banks in operational risk, compliance and front office controls. And in December 2019, she moved to a pre-seed Fintech startup called Acin, which we’ll hear a little more about during our chat. In 2020, she founded Women In Risk and Control, which is a collaborative industry initiative to positively impact gender diversity in non financial risk management at senior leadership levels. And I’m super excited to hear more about that because obviously, with Risky Women, we love the ecosystem of networks that are being created. So welcome, Rupal.

Rupal Patel 1:38
Thank you, Kimberley, for having me on your show.

Kimberley Cole 1:41
So let’s start by taking us on your sort of career journey. And while you’re doing that, maybe tell us a little about where you’ve ended up at Acin as well.

Rupal Patel 1:51
Sure, you know, career journeys are so interesting to hear. I love hearing about other people’s career journey. So I hope that mine is somewhat inspiring to the listeners as well. But it always makes me think of where do I start on this. And I thought in this session, I probably talk a little bit about that organic movement of moving from one company and one job to another, and how that’s come about through what I’ve thought about more recently as push and pull factors. And I’ll tell you a bit about those pull factors that are pulled me into new career paths, and push factors that have kind of pushed me out of old ones, I guess. And I think for me, when I was thinking about my career journey, I’ve had this question a lot. Normally it’s ranting off, you know, the journey that you’ve been through and the terms you’ve worked at. But as I was thinking about it, I fell in love with this push and pull factor idea. And I thought it might be a better way to get individuals to think about their career journeys as they develop as well.

Kimberley Cole 2:49
I love that. Yeah, that’s a great way of sort of positioning, how you’ve moved. So that’s really interesting.

Rupal Patel 2:55
Yeah, like I started off, you know, like many people do going into university and my parents came from Africa. So they built their own business here, they were pushed out of Uganda in the 70s came over. We’re not hugely educated individuals. And so they always wanted me to study and study hard. And that’s a very Indian thing as well, you know, a lot of Indian families studying is very important for them. So of course, I did the traditional went to university, but I had very little guidance on what to do after that phase, because my parents has set up their own shop, and they did fantastically well, owning a car parts business and really growing that and developing that. But that wasn’t for me. And so I went to university, and I really liked the idea of investment banking, it sounded great, I must say, the lure of the money and the fact that you know, you can build a good career and a good life out of it was part of that decision as well. And I’d seen people who had done well in it, but I didn’t know anyone in that space. So I fell out of university thinking, Where do I go, I tried coding, but I wasn’t very good at that. So I decided not to really pursue that as a career, even though I knew tech was so important and was growing in importance, even back then. And I went and did a master’s in investment banking to understand the lay of the land. To understand a little bit more about what is this whole financial institution business? What is it all about? And I fell out of university and I would say I was pulled into my first role. So a headhunter called me after doing my master’s degree and said, Hey, we’ve got this role at Goldman Sachs. It’s in operations. I’ll be honest, I didn’t really know what the operations part of an organization of the likes of Goldman’s did at the time really, obviously, I knew about m&a. I knew about sales. I knew about trading, but no one really talks about the support functions that support all of those activities. And so I was pulled into that role, and it was my first stint and of course, who’s going to say no to Goldman Sachs. And you know, I loved my time there. And everything that I did that taught me about the backbone of an organization, how it works and how it develops. And from there on in my boss said please join the graduate program, apply for it, I’ll help you. And I said you know what, I’ve kind of made enough money in my first year and I want to go traveling. Whether that was a good choice or not, I don’t know, I gave up a graduate program to go traveling. But it was something that I needed to do for myself and something I’d never do if I didn’t do it at that point in time. So I was fortunate enough to do that and I came back and I thought what do I do now? You know operations was fun, it was good, but it wasn’t where my heart was. So I asked a few friends what they were doing. These new terms were flying around, CESs, credit default swaps, synthetics CDOs. I had no idea what these were and I asked a few friends what they were doing and they talked to me about pricing these securities, they talked to me about doing a P&L on these securities and getting my foot in the door to understand what these were and that enticed me, that was interesting, I thought I could learn and that’s where I started to fall in love with the credit products within financial institutions. I went into a financial looking at P&L. I was then pushed out of that role and pulled into another organization. Started looking at valuing these securities because I really liked them. So I looked at valuing synthetic structured credit securities. I am not a modeller or a quant but I could talk to the quants about it because I was interested in it. Because I could explain what I wanted the model to do but I couldn’t build the models myself. So that was really important and I got to learn a lot from that part of it. I was then pulled from another headhunter into a very different path. So looking at credit rating agencies and I moved to a company called DBRS Dominion Bond Rating Services. They had just set up shop in England at the time. Unfortunately for me, it was a very short stint – it was only 4 months because they closed up shop withi 4 months bcause of the credit crisis. So I was pushed out of that role quite quickly! And I had to find something else! So you know it’s a bit of a roller coaster. I moved into finance doing valuation roles looking at structured product. And then really came the credit crisis and structured products stopped being structured products and we had to go back to the vanilla products. Valuing vanilla products was not so exciting for me anymore and I wanted to do something different. That really led me to looking at projects in the space that I was and looking at the SOX program that we had in place at the time. I started to revamp the whole SOX program taking it from something that really frustrated me, like let’s just tick a box and get this done, to something that was actually useful. I think I was able to do that because of all of the other roles I’d had before because I really understood the processes and how to build a program that could evidence we’ve got the right controls in place and we’re managing risk effectively and still allowing the business to grow. So that’s where I fell in love with I guess and organically moved to op risk. From there I moved from there to a front line role in rates trading and within the front office business of course you get to talk a lot more to the traders and you get to work on conduct and culture and all sorts of interesting ideas and improvements. I then moved over and was pulled out of that organization through another headhunter into another organization into an op risk role and fell in love with that op risk role. We were looking at MIFIDII rolling out regulatory change. And then into e-trading and then of course from there I got pulled into FinTech and FinTech is super exciting. So I can talk to you a little bit about FinTech and my move over from banking which is for 20 years, into FinTech.

Kimberley Cole 8:54
Sure and I mean I love the push and pull concept, that’s very interesting. But also that sort of zigzag and looking at that whole breadth of areas that you can get into those different areas then use the skills that you’ve gained in one and build on them in another. That’s fantastic.

Rupal Patel 9:12
Yeah, I think it actually helps you to do a good job at where you next land if you can take the experience and the learning from a prior role and use that going forward. I think that really helps and elevates your career and sets you apart from just the person who’s theoretically following a manual as it were.

Kimberley Cole 9:30
Yeah and what have been some of those lessons you feel you’ve learnt along the way?

Rupal Patel 9:34
You know I think there’s some really important lessons that I wish I had been talked through and I wish these podcasts existed at the time. I think these are amazing by the way and I think it’s really going to help shape the net generation of leaders in risk and control. I think the most important thing is I never really understood the value of a good network. I understood what people meant by Yeah go our and network, make sure you build your group of individuals that you can look to but there’s very little guidance around how do you build that network? What is a network really. What is a mentor? How do you get a mentor? I think the most important advice I would give is build those networks in all different shapes and forms, so not just within your own team and your own organization, but outside the origanization. We are so fortunate now that we have LinkedIn and we have these podcasts. We have a lot of webinars we are exposed to. All of these individuals on these podcasts and webinars are contacts you can reach out to. I really advise people to start to build their networks from people they’ve heard that have influenced them or that they look up to or that they want to learn from. And always think the door’s open, because if you think the door’s shut you’ve already stopped yourself from asking the question of can you help me or what do you advise. Go out there and be bold and brave and ask those questions because you can build great contacts from going to a conference, going to a webinar and just listen to people. I’ll give you a real life example, just the other day I listened to a webinar from the University of Columbia and the lecturer there was talking about risk and control of course but I am going to go and reach out to them as a result of listening to that webinar because I think what they said was just so interesting and I want to see how we might be able to work together. So that is just a real example of see something, hear it, do something about it don’t just sit and wait for things to come your way.

Kimberley Cole 11:39
I agree and I also think people are more than ready to help generally, if you ask! I also think you’ve always got something to give back, so making sure there’s that two way street. I think always ask because they can only say no so everyone’s just gotta get out there.

Rupal Patel 11:57
And I think just on that point, is give yourself some time. They might not be available for you today but with time they might just reach out to you again. Don’t be disheartened. I think the first time I spoke to you Kimberley was probably over a year ago and then we spoke again very recently but we were always liking and sharing each other’s posts and it didn’t mean that nothing comes after it. It’s a conversation.

Kimberley Cole 12:22
Exactly! Timing is everything I always say! You mentioned a couple of risks there like going off and travelling for a year which I also agree. There are key times when you can do that and it was best to do that and open your mind to so many things. What other risks do you think you’ve taken in your career.

Rupal Patel 12:46
Probably two that are worthwhile sharing. One is really be able to be confident in who you are and believe in yourself. So let me back this up with a little bit of a story or a journey that I went through to give you some context around that. When you see things within your job, your sphere of control, that are not working the way you think they should, or you think there is a better way of doing them, I think you have to be bold enough to call it out and say it how it is! Even if you are talking to people more senior than yourself. So go with the facts, be prepared. Beleive in yourself and take it to the end of that conversation. Don’t just raise the point and then say oh I’ve raised it and I’m done and hope that someone is going to take that on board. Really take that point to the end. I’ll give you an example, when I was working in one of the large organizations I was asked to value certain securities and a huge portfolio of securities. And I was very uncomfortable with valuing them because a) we didn’t have the resources, b) we didn’t have the information we needed to value them and c) the method chosen to value them just didn’t sit right with me. It was far too proxy originated and my thoughts were that you really had to understand the underlying portfolio in-depth to give a true reflection of the value of this product. My superiors really didn’t like that answer. The answer was that it was going to take a long time basically and they wanted it done in a month and it was just impossible for me to do that and justify that value. So I said to them you know this isn’t the way we should be doing it and these are the risks of doing it in this way. Obviously they gave it to somebody else and somebody else picked it up but what I was frustrated with was not believing in myself and not being confident enough to really push that and to get them to see where I was coming from and what the problems were. I really wish I had because if I had we would have saved millions and millions if not billions. Look, believe in yourself, build that network of trusted colleagues that you can go and talk to about these things. I didn’t have that at that point. So I wish I had. So that goes back to that network point we talked about, if you have those trusted colleagues, you can have conversations with, pull them in to help you to pitch what you’re trying to say. So that’s one of the big lessons and the big risks, I guess, that I’ve been through.

Kimberley Cole 15:19
Yeah, I was just gonna say, I think that ability of having bring able to back things up, but that speaking truth to power is a really important skill to learn.

Rupal Patel 15:28
Yeah, for sure. I mean, it’s difficult, right? I think, you know, confidence goes with experience as well. So, learn from those mistakes, you might have ups and downs, I certainly did have my share of downs, I would say, but you’ve got to pick yourself up and learn from them and use that information in the next role. The other area of risk, I think, that I have taken personally, in my career is of course, moving out of these giant organizations with huge financial backing with a huge presence in the market and going to a pre-seed company like Acin, which at the time had 20 people you know, no one knows who they are, they practically don’t exist. Because if you say I work for Acin, and everyone’s like, yeah, okay, what like, if you say you work for Morgan, Stanley, Deutsche Bank, JP Morgan, everybody knows, okay, great. There’s a level of status, I guess, associated with working with a big bank that you may like to be accustomed with. Letting go of that and going into the space where no one knows what this is, no one knows really what you’re trying to build, and neither do you. But you’re working on a vision, and you’re trying to build that vision. That is hugely empowering. I mean, I absolutely love the fact that I took that leap of faith, and really grateful to the headhunter who found me to do that. But I think, you know, look, take that risk, and move to a company that you can see yourself in, and that you can align yourself with that vision on. So it’s a hugely risky move. So if you don’t like what that FinTech or that new company is doing, you’re not going to be working to your 100%. But for me, I’ve been able to wear three different hats in the three years that I’ve been there. And even within wearing those specific hats, I’ve always had a varied role. So I’ve never really been in sales, but I’ve been pulled into sales meetings. I’m not a marketer by trade, but I was pulled into the marketing department to rebrand the company to build their actual marketing pitch books, to talk about the lines that they were going to use with customers with prospects to look at product marketing. And those are all things that I never thought that I would do. You know, marketing was a whole different ballgame. But actually, it’s taught me so much. It’s taught me so much that I have taken on to my next role within that group, which is around leading risk intelligence and using data and you know, how do we talk to customers about this? How do we market this? What are the lines that we’re going to use to talk about it? So look moving to a FinTech is risky, for sure. But for me, it’s hugely paid off. And I would say, if you are the kind of character who likes agility, who’s happy to really put in hard work to work like that 110% to not have a script, and be okay with that, to not be defined by a job description, because that job description is probably accurate for 5% of your time. And then you have to be very flexible around it. Because you’re you’re building a business, you’re not just working in a siloed function. So those are the things to kind of bear in mind if you’re going to take those risks.

Kimberley Cole 18:32
I think that’s great advice for our audience. So can you give us sort of a quick view of what Acin actually does? Because it sounds fascinating. And I get that you’ve got this sort of flexibility, but obviously, there’s a vision that you’re aiming for. So tell us about that?

Rupal Patel 18:48
Absolutely. So Acin is really pioneering where operational risk should be. And we’re doing that to build a safer financial services industry as a whole. And so what do we actually do? What we actually do is take risk and control data from organizations from top tier investment banks, asset managers, moving into retail, etc. We take this information, we use AI, and we train our AI. But we also use specialists who’ve worked in investment banking, to connect datasets together, and we anonymize that and send that back out to our clients. So this really allows our customers to understand what are the risks and controls that they need to operate a specific business, for example, to trade credit, to trade equities to trade FX. What are the risks and control that you need front to back throughout the organization so that you can manage this business and have a good framework in place for managing that business? And by allowing customers to see what this benchmark is they’re able to compare themselves to their peers. So they’ve never been able to do that before. The regulator normally comes in knocking on the door and says, Oh, by the way, you know, I’ve seen XYZ, other banks have this, where’s yours, they get their information from seeing other people’s data sets, let’s say, being in a bank as yourself, you’re blind to that information. So what Acin allows is an anonymized view of where you are compared to your peers, where your strengths are, where your weaknesses are, but also, more importantly, how you can elevate yourself to manage your risk most effectively. And we do that through data. So yeah, that’s one part of it. And then I’ll talk to you more later about some of the risk intelligence pieces that we’re building on as well.

Kimberley Cole 20:40
Yeah, love to hear about that. And just on this sort of additional elements of your career…You built or you founded the network, Women in Risk and Control. So tell us a bit about that as well.

Rupal Patel 20:53
Absolutely, Women and Risk and Control was founded in 2020, we started having the conversations just before COVID. Around, how do we see a better representation of senior women in panels, talking about risk and control. I’ve had a career in investment banking, where I had seen some extremely great females. And when I moved across the Acin, we looked at doing panels, and we looked at building a community. But what we found was that there wasn’t the right representation of senior female leaders being represented. And we started to discuss the idea of a network that could really elevate individuals to get to their career successes, so that they could reach the pinnacle of their careers based on and empowered by a community that would really support them. And I think this came from two things. One, it came from our CMO at the time in Europe, who’s absolutely fantastic. Who really said to me, you should think about setting up a network and building a community. To which I said, there’s so many women’s communities, what am I going to do, you know, I don’t want to just do another one. And when you started looking at it, we thought, my career experience had not always been so great with many women helping me along my career. So I must say, you know, you will come across people who help you, and you may also come across people who don’t help you. That’s just the way it is. But that’s not the way that it has to be. And so that’s what I really thought about when I started to set this up. And I paid the idea back with a lady called Sally Clark, who really knows the risk and control space extremely well. But is hugely talented as well. And she’s on boards. She’s a non Executive Director, she’s been a managing director at some of these larger organizations. So she really knows the importance of building that community as well. And really, Women in Risk and Control grew from that conversation of Is there enough interest that we think we’re going to be able to gather? And is there a niche, and we thought, yes, there is. I love risk and control, I could talk about it forever, I think people need to have that community. And I’d love to be part of helping to build that collaborative industry initiative that can help with gender diversity, and get people to those senior leadership levels, if that’s what they choose to do. So we started Women in Risk and Control, organically. But what we did is we built a leadership team. So we now have a leadership team of about 15 individuals. These individuals work at the likes of the London Stock Exchange, Morgan Stanley, JP Morgan, Deutsche Bank, and the idea of building that leadership team was around who else cares about this topic and wants to help other people to grow, and who can help me to develop this as well. So these are individuals who help to lead the initiative and to grow the initiative. And what we have done is we’ve come up with three key objectives that we wanted to achieve. And that is to nurture that cross firm network of individuals and talent, it is to build that community to enable career progression and to empower. And thirdly, it was around providing and facilitating meaningful mentoring opportunities. So I’ll go into that a little bit. But what we’ve built so far is a number of webinars where individuals can go and learn about the topics around risk and control, but also wider aspects of growing your career. Managing difficult teams, for example, to group mentoring, and we talked a lot about mentoring. And mentoring is very difficult because it’s a very personal relationship that needs to be built for it to be successful. So we came up with the idea of group mentoring, which is really where an expert talks about a specific area or sector of risk and control that they are very good at and that they want to share their knowledge and experience with and they do so in a semi cloased group of individuals who want to know more about that, and from there, if that relationship sparks, and people want to take that relationship further and go on to individual mentoring, they can do so. But we offer that group mentoring and bring that together.

Kimberley Cole 25:14
That’s great. That’s a really good idea group mentoring. I think it also sort of takes the pressure off the mentees that there’s a whole group of them who can all ask questions, and they can all learn.

Rupal Patel 25:24
Yeah, I think, you know, often, like, especially when you start your career, you want to ask certain questions, but you’re afraid to or you don’t know how to put it out there. And I think, you know, the more people that you see who have the desire to learn something about a topic, the easier is for you to start asking questions. And we try and do it with faces on cameras on so that we could see each other and build that relationship. So I think that will really help individuals as well. And we’ve done about 10 of them so far. And I’m hoping we can do at least one a month.

Kimberley Cole 25:55
Excellent. So you’ve done a lot of very interesting things. And if you weren’t doing what you’re doing today, what would be your dream career?

Rupal Patel 26:04
I’ve always thought about this, you know, I think let’s go back to when I was 17. Very young. I always loved the idea of hospitality and hotels, and restaurants. And I think that came from and this will give away some of my age, the media around Paris Hilton at the time. So I really started looking at the Hilton group and got fascinated with it. Oh my gosh, how did they build this chain of hotels around the world that are amazing hotels, you know, everyone goes to them. And I fell in love with the idea of hospitality actually. And before I went to university, whilst I was picking my courses, obviously business, finance, etc, were on the list. But a left field idea was going on a course around hospitality. And so I went to see a university that specialized in this it was in Wales, actually, I ended up in Cardiff University doing accounting and management, far, far less glamorous than I think hospitality. But I went to see this university, which talked about hospitality. And one of the things they said you had to do as a course on cooking. And cooking isn’t my skill set. And I didn’t really enjoy it, I love eating like cooking, I just kind of wasn’t. So I think, unfortunately, for me, that was the death of hospitality and hotels, although I will say, look, I’m still hugely fascinated with that world. And you know, risk and control exists everywhere. And I do see that maybe at some point in my career, I can move across into risk and control in hospitality.

Kimberley Cole 27:37
Excellent combined both passions. Let’s move on to sort of your area of expertise around operational risks. So I guess, lay the sort of lay of the land for us, give us the overview of operational risk.

Rupal Patel 27:51
For sure. So operational risk. Look, I fell in love with that when I started to look at stocks, programs, and then finance, operational risks, just to lay it down is really the risk of loss from flawed or failed people, processes, systems, or external events. It’s the classic description, really, what does that mean? Think about it people, processes, systems, external events, basically covers everything, something can go wrong in any part of your business that will involve those four elements. And operational risk is trying to manage the risk that these areas are managed effectively, so that you can still generate revenue, but so that your risk is controlled. So the areas of expertise within this space are very broad that I have been doing, I think this will give you an idea of just the breadth of how big operational risk really is. And I’ll take it in the sense of the people processes systems and external events. So from a people perspective, operational risk really talks to the human risks, behavioral risk, talent, culture, conduct. Those are elements that some people see that fit in the non financial risk management space which is all encompassing and includes operational risk. But for me, when I look at an operational risk incident, let me give you a specific example. I was working in the reach trading business within a large investment bank. And my role there was to build the right first line framework for risk management. One of the things that was so key at the time that I was working there was around conduct and conflicts of interest. And this was obviously after the financial crisis when the FCA came out with their five conduct rules for senior managers and for the rest of the organization and global regulations, you know, followed around that space. Identifying conflicts of interest log it’s a really challenging space because you start thinking about okay, so what is a conflict of interest? How are people involved in a conflict of interest and what do they need to be able to know how do they know to be able to conduct themselves. So we worked on a conflicts of interest log that we developed, we listed out those conflicts of interest with the top traders in that business at the time. And we looked at what are the controls that we can set up around managing these conflicts of interest, but still allowing the business to generate revenue in a controlled manner. That’s the conduct side conflict side, the people side. Processes if I move to processes, I talked about SOX, I talked about finance. So what got me into operational risk and got me loving operational risk was a organic movement of roles, which I talked about a little bit in the beginning. But what I was asked to do was to take a program, which was the SOX program, and just to run it, and that SOX program, let me tell you, it was a series of questions that were asked to senior individuals within the global valuations group. And each individual would answer around 20 to 50 questions on a scale of one to five. Now think about the subjectivity of a scale of one to five, first of all, think about the different individuals and then think about their understanding of each of those 50 questions and whether that’s the same or not. So we did this assessment. And this was meant to be the SOX certification that everyone within finance within that specific group knew what they were doing, were abiding by the rules and regulations. It really bothered me that this was just an amalgamation of one to five cobbled together with at the end of the day, averaged as a score. It didn’t really mean anything. It didn’t help the business, really. But it allowed the business to tick a box that I needed to change. So I built a whole new SOX program, which really focused on how do firms value securities? And I was able to do that, because I worked in valuing securities. And so we came up with the steps to value securities and what are the controls around those steps? For example, you need the right population first of all, to feed into your systems, you can’t miss trades out every single trade needs to have a valuation or needs to have a reserve. Then how are you going to value it? What are the models that you’re using to value it? What are the assumptions that you’re making? What are the reserves that you’re going to take, what’s the methodology, and so forth. So that’s a kind of overview of transformation and process that I’ve been involved with. REG change is another one referred to, I built a nine step process for translating regulatory change for understanding risk, documenting it through controls, tying it into assurance activity from first line and second line. And then there’s systems of course, and that comes to what are the systems that we’re going to put in place to manage risk, effectively. And of course, Acin plays a part in that. And then there’s the external environment. And this is the really interesting bit that more so as I’ve grown in my career, has kept me interested in operational risk, I think operational risk is impacted by external influences. So the biggest ones, of course, that all of us will know about is Brexit, the 2008 financial crisis, COVID, the supply chain impacts of COVID. Everything happening now with the geopolitical arena that we all live in. Those are all impacting the operational risk environment of every single organization in the world right now. And the fact that operational risk changes so quickly, but also is so matrixed is just so interesting. And that has really allowed me to build my career. So those are some of the areas that I’ve been involved with and have expertise in.

Kimberley Cole 33:38
That’s really interesting. And I do think the other thing that’s quite interesting is, obviously, you’re trying to anticipate a whole lot of different factors that could come into play. So potentially, when you’re doing risk well, and certainly operational risk well, you’re mitigating a lot of the things going wrong. So it’s kind of a interesting thing, like, how do you know that you were successful? Well, nothing went wrong. You’ve given some good examples there of when you’re really trying to anticipate what’s happening. But I do think it’s kind of often challenging to identify when you have done things well, in that space.

Rupal Patel 34:19
Yeah, I think you’re 100% correct there. Operational Risk doesn’t get kudos for getting things right, because it’s not visible. We are not a revenue generating part of an organization. So you can’t just say I’ve made 100 million, here you go. What you can say is I tried to prevent a loss or I tried to prevent things from going wrong. They’re all qualitative, subjective forms of justifying operational risks existence. And so it is difficult because it’s not a quantitative discipline. And it’s hard to identify exactly what you said when you’ve done it well. But if we think about it, What happens when you don’t do it well? I think trying to explain to organizations in the right context. So let’s just take something that I’ve been working on a lot recently is obviously, everyone’s heard about all the fines to do with unauthorized communication, OK, let’s take, like 10 steps back before this really came out into the market. Everyone was involved with a clean desk policy, you often saw when he walked around the trading floor, no mobile phones on the trading floor. Everyone thought these were tiny little pieces of op risk, trying to exert their influence on the organization, trying to do the right thing, but really didn’t associate much value to those. If we take that whole point of having a clean desk, ie making sure important information is kept hidden, is kept in authorized ways. You take the idea of no mobile phones on the trading floor, that means you can’t send information to people who shouldn’t have it. And then you think about what’s happened in the past year, with the fines on unauthorized communication, you can quickly see why op risk is so important. But you’ve got to be able to relay that story, culture, conduct being built in for people to understand why that control is there. What’s the point of having that no mobile phones on the trading floor? Seeing that there alone is not enough to explain to non risk professionals and to the rest of the organization, why it’s important. So for me, I think op risk is like the heartbeat of an organization. And it really is that lifeblood. But it goes across many stripes of risk, especially in today’s environment where risk is just so commingled, and all of this, and organization works with people. So conduct culture, behavior is just so important without getting people to understand why you’re doing things, you’re on a losing path.

Kimberley Cole 36:54
Yeah. So tell us then what’s Acin doing to really tackle operational risk differently? Tell us what’s going on there. Because I think that’s very interesting.

Rupal Patel 37:06
Acin is a hugely interesting organization, we are pioneering a data led approach, firstly. So talking about moving it from that qualitative discipline that we said, to something that can be data led, be more quantitative, that can really be used so that people can analyze data and use that analytics to then form opinion on. So I’m not saying you know, we’re going to take away the qualitative side of op risk, that’s not going to happen. But what we can do is do a much better job of taking all of the data, structuring that data, and allowing organizations to have a data led approach to managing operational risks. So ACIN’s ability to take other people’s datasets together to anonymize that data, and provide institutions with that overview of how are they operating compared to their peers, gives them a competitive advantage. Because it allows them to then see, what do I need to change? What are my peers doing, they are not giving us information that no one else knows about everyone knows risks and controls that operate, how you then implement those risks and controls, and how you form your organization around it is going to be the competitive advantage. But we are giving organizations that data to allow them to retain their own competitive advantage and to also to learn from each other. So by continuously sharing that data set, we see new controls coming on, we see new risks arising, our tool allows organizations to dynamically manage risk through horizon scanning. We can talk about that more later, if you wish to also, but horizon scanning and dynamic risk management is a huge part of our offering as well. So you know, just getting the benchmark is a first step.

Kimberley Cole 38:50
Yeah, I was gonna say, what are those kinds of key areas of focus that should be on the agenda, and especially now you’ve got this sort of data landscape that you can use to inform that? What are those areas?

Rupal Patel 39:03
I think look, op risk has grown and matured over like, I don’t know, since the financial crisis, it’s really developed. And it’s developed organically because of how organizations have approached it, but also how they’ve been pushed into doing things from the regulatory perspective. And often what has happened is it’s been an amalgamation of data, and knowledge, but it’s been built up over time, and not necessarily in a structured manner. Now, the industry is a little bit more mature, we have a lot of knowledge, experience, we have massive data behind it. Now is the time that I think people need to look at standards. So I’m not saying they never looked at standards before all organizations will have their standards around how they write a control how they put in place a risk framework. But from my experience, what I saw is that these standards were often different in different parts of an organization in different functions. So to give you an idea, you know, front office might write their controls in a very detailed manner, operations might write their controls at a very high level. So they’re still following the standard of documenting it in a specific way. But they’re just writing it very differently. So now, I think is the time of really using standards and Acin helps to build those standards, well, to give you a framework for building those standards. So I think with that, you can start to build data analytics. Without that everyone’s starting on a different footing. And you can’t compare. Within large organizations, you’ve got to be able to have different views, you’ve got to have your business view, your regional view, your legal entity view, your global view, your cross business view, all of those pieces of data need to be able to be combined. So you’re comparing apples to apples and not apples to pears, so that you’ve got that aggregate risk. So that’s the structure and the standards.

Kimberley Cole 40:55
And you mentioned horizon scanning as well. So tell us more about that.

Rupal Patel 40:59
So horizon scanning, that’s super key. So I think, you know, we talked a little bit about what’s happening in the geopolitical arena, what’s happening around external events. And just knowing from the past two years, just how commingled everything is, horizon scanning is all of that. It’s looking at what is happening in my world around me, what a news feed saying, what are the regulator’s doing, what regulatory changes are coming? What are the consultations out there? How am I going to get these news feeds and pace? And what am I going to do with them? So horizon scanning is looking at the environment around you to find out what are the alerts that will trigger you to conduct some kind of analysis of your environment, to see whether or not you’re able to cope with that risk or that threat. And from there, what you can build is risk scenarios. And risk scenarios are plausible events that you think can happen in the near future, or in a longer period of time, if that’s your horizon that you’re looking at, and trying to really see what are the risks and controls associated with that? And what are the threats that can cause that scenario to happen. So that’s a very quick and board overview of horizon scanning and a little bit about risk scenarios as well.

Kimberley Cole 42:17
Very, very interesting. So when you’re thinking about sort of who’s doing it well, or who’s kind of leading the way and what the impact has been, who do you think of when you’re thinking about that?

Rupal Patel 42:29
We’re fortunate at Acin of course to talk to some of the leading investment banks and understand their processes and what they’re doing. And many of them are already doing a lot of what I talk about here, when it comes to horizon scanning, they are looking at their horizon, they are trying to predict what is the next event that can occur in my organization, they are trying to tackle training and culture. But I think some of the places where they fall behind are getting the connectivity across the organization, and really connecting it to risk and control. And that’s what we do at Acin. We connect it to the risk and control. So let me give you an example. FINRA, I think it was in August or September, they announced that they had a consultation paper on trace reporting timelines coming down from 15 minutes to one minute. That’s huge, right? That’s super fast. For asset backed securities for structured securities. What does this require? So this really requires, so this is part of the horizon scanning a) you know that it’s a consultation, it’s out there, FINRA in that document highlighted that around 80 to 90%, I can’t remember the exact figure, of firms already report within a minute. So if you’re a smaller player in the market, think about this, if 90% already doing it, you’re probably one of the ones who aren’t doing it. If you’re the smaller player, if 90% of the big players are doing it, it’s likely this rule is gonna go into effect. So what are you going to do to prepare yourself? And how you going to do that? When it comes to this, this isn’t just about putting that report to the regulator. It’s about looking at your whole tech stack. It’s looking at the upstream controls that you have in place. What’s the booking model that you have in place for these products? How does it flow downstream? How does the report get generated? And what is the tech stack that I need to build to get that out the door within a minute? And that’s where horizon scanning needs to go to so that initial Oh, yeah, okay I’ve seen XYZ consultation in the market. That’s not just horizon scanning, that’s just knowing that it’s out there. That’s the tip of the iceberg, digging into it and saying how does it impact my risk and control environment. That’s the exciting piece. That’s where we can really start to prevent and start to show where operational risk can get you.

Kimberley Cole 44:39
That’s really interesting. And so obviously, that excites you, or the other developments that you’re seeing in the industry that also are exciting you?

Rupal Patel 44:47
I’m really excited by the fact that banks are really taking on to technology to fintechs. They always have but they’ve tried to do it on their own. So in a lot of cases they build their own In house tech teams trying to build fast and agile solutions to the products that their own organization wanted, their own people wanted it. But they were never fast enough to do it. Because it wasn’t their game, it wasn’t their business model do it. And the fact that a lot of these large players, including the consultants are like I’ve got FinTech labs, and are adopting fintechs. I think that’s hugely exciting and promising, of course, for Acin but promising more for the wider FinTech arena. And for the wider op risk industry as well, the use of AI and technology, I think, operational risk is going to be huge. Back in the day, a number of my colleagues worked on looking at what are the behaviors that can cause something to happen, or can cause someone to do something that’s not in line with the way we want risk to be managed within this organization. That is very hard to look at one singular control and say that it is the cause of XY and Z. But using behavioral tools using AI, putting controls together to say, hold on a trader logged in late, they’ve got odd patterns of behavior, they’re putting on high risk trades when they shouldn’t be they’ve never done this like before. And they’re talking to people they don’t normally talk to. We’ve seen changes in their method of communications, and how they are describing what they’re doing. That’s all behavioral. So I’m really interested in actually how this behavioral risk which is coming about is going to be incorporated with op risk, and really what elevate op risk. And then lastly, I think the role of a CRO. CROs before focused a lot on market risk alone and credit risk. I think op risk is a huge part of their role now. And I’m quite interested just to see where the CRO role will really go and what that will really mold itself into.

Kimberley Cole 46:50
I think that’s a very interesting discussion. And actually, that’s come up on several of the podcasts is, you know, what is required now, in that role, and how broad it’s becoming. So that’s super interesting. And I love your thoughts around how technology and artificial intelligence are all coming into play, and of course, data. So very interesting. And thanks for sharing your insights and expertise on operational risk. Now one of my favorite sections of the podcast Rants and Revelations, so your revelation, what’s something that you’ve learned recently, that really blew you away?

Rupal Patel 47:27
I think working in this industry, you see fines coming all the time. It doesn’t sound nice to say it like that. But the reality is that fines are quite common. I think what really blew me away recently, and this is probably because I’ve been working on this space. And doing a specific article on this as well, is the 2 billion in fines in unauthorized communication from two regulators, I should say, from the CFTC. And the SEC. And the reason this really blows me away is not because the 2 billion number is big, but it’s because it’s the same issue that they find at every single bank floor at the same time. And I’ve never seen that, before, they’ve taken that same issue, and they find everyone at the same time, because all of these banks are doing it wrong. And that just made me wonder like, I would have really liked to think that someone had got it right, that someone wouldn’t have been fined that amount and would have been fined much less. There were degrees in some of the banks to how much they got fined. But on the whole, they all got fined about the same. Which really makes you think, how did all of these really smart people get it wrong? How did we all just get it wrong? And it’s not the first time that the regulator had said, watch out for unauthorized comms. So it’s really surprised me that like everyone who’s got it wrong, and obviously it has not been able to provide enough evidence to the regulator to make them back down because they’ve had to pay up the fine.

Kimberley Cole 48:54
Interesting. So what’s your rant then? What’s the thing that you would prioritize to change?

Rupal Patel 49:02
Cooking! I hate cooking!

Kimberley Cole 49:06
Well, I guess you’ve got all those delivery options. Now you never have to cook.

Rupal Patel 49:11
Exactly perfect. But I guess on a more professional note, look, you know, this whole ticking the box exercise, it really bothers me. I hate to there is just no point in wasting resources on ticking a box to prove to the regulator you’re doing something. And one of the ones if I can be specific that really frustrates me is because I’ve been through this process and many banks and talk to many people about it is the whole RCSA process. It takes forever to do uses so many resources. And what frustrates me the most is I don’t know if anyone can really say what is the value that they actually got from the end of this exercise. Other than being able to say we did this exercise. Did it actually help you to manage or mitigate your risks better? I don’t know if, hand on heart, anyone can actually say that given the resources, like there is a better way to do this. And I think one of those ways is that dynamic RCSA look and using data and using technology. But that’s one of my rants, right? How do we make this process better? I’m not saying it’s not a good process. It’s worthwhile doing, but just the way we do it, I just think it’s such a waste of really smart people.

Kimberley Cole 50:18
And can you just expand on that acronym RCSA?

Rupal Patel 50:22
Sorry, RCSA, risk and control self assessments. So these are assessments that firms do annually, semi annually, they take more than a month to put together, in some cases they may take up to three months, and they’re meant to assess the risk and control environment of your organization. But it means you have to pull data from all parts of the organization, and then summarize it, and the manner in which it’s done, and the way in which it’s done, it’s done as a process and following a procedure versus actually delivering value in in my opinion.

Kimberley Cole 50:57
Okay, so now we’re on to our Rapid Fire Round. So it’s one word answers to these key questions. Why governance risk and control or operational risk should be top of the agenda.

Rupal Patel 51:09
It’s the lifeblood of the organization. So for me, it’s the lifeblood. Yes, it manages the organizational health, keeps it afloat. And it’s super imperative for all organizations to get right.

Kimberley Cole 51:22
Okay, so your one word is lifeblood. Okay, one word for most important focus for the future.

Rupal Patel 51:29
Oh, gosh, one word. I’ve got two, horizon scanning, because I’ve said it so much. It’s horizon scanning. Can we make it one?

Kimberley Cole 51:36
I’ll let you have two! Are you optimistic, pessimistic or neutral in your outlook for the year ahead?

Rupal Patel 51:42
Optimistic, always a glass half full kind of person. Cautiously optimistic, but I’m only allowed to use one word so optimistic.

Kimberley Cole 51:50
Exactly. What word represents success for you?

Rupal Patel 51:54
Accomplishment, I think accomplishment being satisfied that you’ve done something to your best ability. That you are, where you want to be, and that you’re going places.

Kimberley Cole 52:03
And the top skill needed for risk professional of the future?

Rupal Patel 52:07
Oh, my God top skill. One thing?

Kimberley Cole 52:10
Yeah.

Rupal Patel 52:11
One thing? I think there’s obviously many, but I need to say one, okay, because you asked one, I think you have to be able to understand an organization. And you’re like an octopus having your tentacles across an organization. And I still remember that from ​Lauren Reider at Morgan Stanley so kudos to her for telling me that piece there. But in op risk, you really need to understand the whole organization because the people processes systems, external events. So you need to have your tentacles and your fingers in many pies. And for that, you need communication and relationship building skills at the utmost best, so that you’re able to understand so that you’re able to communicate. And then underneath that comes all the other pieces around understanding the data, being thick skin being resilient, I’d say having the agility to move with the times. But if you don’t have the relationship building, if you don’t have the communication skills, you’re not going to know what’s going on to be able to do your horizon scanning. So for me, that’s super important.

Kimberley Cole 53:12
Excellent. All right. So we’re gonna wrap up now with our Risky Women Recommendations. So if you can give us your view of what’s a book that we should be reading, something worth watching?

Rupal Patel 53:24
Sure. I mean, like, I’m not an avid reader first of all. So I will probably talk a little bit more about documentaries that I’ve seen, I guess, I love this Seaspiracy. Absolutely amazing documentary. It might put you off eating fish, be warned. Definitely an eye opening documentary. I absolutely loved it. And then I have seen a couple of Netflix or Rakutan, I don’t know what it was. But there’s one that’s new around Elvis and how Elvis’s manager… don’t want to give the story away. But watch it. It’s about Elvis, and how he got to where he got to and what happened in his career. I think that’s super, super important and interesting. David Attenborough, I love him all his documentaries. And then of course, on a work front, I’ve got a couple of books that I’m reading, How to Win Friends and Influence People. Patrick Lencioni’s The Advantage. I think it’s why organizational health trumps everything else or something like that. Those are great, great books.

Kimberley Cole 54:17
Excellent. All right. That’s terrific. And then what’s your favorite podcast?

Rupal Patel 54:22
Well, I’ve just recently learned about Risky Women. So that’s going to be top of my list and added my favorites. But like The Diary of a CEO by Steven Bartlett, absolutely phenomenal. Everyone who I’ve listened to on there has a story. And I think they are all very honest stories. The one from the Coinbase founder, Brian Armstrong, super interesting about how he got to where he got to the trials and tribulations he went through, but also what he’s like as a character. And then the one from the Monzo co founder, Tom Blomfield. That was super interesting in terms of just his own mindset and where he was. What I like about The Diary of a CEO by Steven Bartlett as it goes into some of the deep dark side of people’s careers, which we don’t often like talking about. And I think that’s really encouraging to see people come out of that, and how they’ve come out of that. So I would recommend some of those.

Kimberley Cole 55:15
Excellent. Well, we love a good podcast here at Risky Women Radio, so The Diary of a CEO sounds very interesting. So that’s it. And thank you so much. I loved hearing all of your thoughts around op risk and learning about Acin. And hearing your wonderful Push Me Pull You career. So thanks for joining us Rupal.

Rupal Patel 55:37
Well, thank you so much for having me. I look forward to working with you guys a lot more as well.

Kimberley Cole 55:41
Absolutely. And we look forward to being interconnected with Women in Risk and Control as well. So one big happy, connected family. Thanks for joining us.

Rupal Patel 55:52
Thank you.

Kimberley Cole 55:55
Thank you for listening to this episode of Risky Women Radio, be part of the ongoing conversation and learn more about our events and other programs at riskywomen.org