READER QUESTION
RE: CU Journal's recent report on technologies to monitor employee usage of member data and whether staff are "goofing off" online: Shouldn't our core processors be able to offer this functionality? If not, why not and what do we need?
Eric Panepinto, COO, USERS, Valley Forge, Penn.
Monitoring employee use of member data or other confidential information needs to be a shared responsibility of the credit union and the core processor. Your core processor can provide a variety of system features that can limit employee access to member data, such as partially or fully masking social security numbers, account numbers or debit card numbers when that information isn't required for a particular function or transaction. Your system also should offer flexible system authorization options, enabling you to set limits on who accesses data and what data fields they can view. At USERS, we also employ an encrypted database that makes the core system data unusable if an employee or other person attempts to hack into the database. If you use a third-party call center or similar service, make sure they are capable of limiting their staff's access to your member data, in addition to the ways you are limiting in-house staff's access. On the credit union's side, your responsibility includes ensuring that the hardware your employees use doesn't enable them to save member data onto a CD, USB drive or other media. As far as monitoring whether staff are "goofing off" online, there are many software packages and services available to monitor employee usage of the Internet, including the ability to provide reporting in general or around offenders or your particular Internet policies.
David McConney, EVP/General Manager, Credit Union Core Systems, Harland Financial Solutions, Pleasanton, Calif.
There are a variety of Internet applications that can be installed within your credit union to monitor staff surfing on the web for personal reasons. Restrictions can be defined by the credit union and if an employee ventures to an unauthorized site, the site will be blocked. In addition, there are a variety of content-monitoring software programs to protect confidential member and financial data from being accidentally or maliciously exposed. Both categories of software applications should be driven by IT departments as additions to your core system.
Inherent in many core systems, however, are features that enable the ability to mask NPI (non-public information) data as well as encrypt data to help minimize exposure. Encryption protects data in flight, or data moving from one point to another over a network, and data at rest, which is data stored in a database, file system or other persistent storage location and on media for backup or other transport purposes. These types of features should be offered by your core processor to help minimize risk and exposure of member data.
Chris Barber, SVP/CIO, WesCorp, San Dimas, Calif.
Tracking staff system usage usually means monitoring the usage of web, e-mail, and instant messaging. It could also mean reviewing telephone call logs as well as mobile phone usage. Given that core processors usually create software that run back-office functions, those vendors would not have visibility to the type of data needed to track employee time.
On the other hand, core processors are in a great position to track and audit the use of the data within their processing systems. Assuming that each employee has their own user ID and can be tracked individually, the existing core processing systems should provide detailed audit trails of what data was accessed, when it was accessed, and by whom. It may be as easy as inquiring with them about the type of reporting you are looking for and learning more about existing reporting functionality.
READER QUESTION
We are preparing RFPs for a potential (dreaded) core system conversion in 2008 (first in anyone's memory here). Is it possible to factor in any value in not converting from current processor (but upgrading) to avoid costs, challenges of converting to new processor?
Dan Cheney, CTO, Teres Solutions, Austin
Yes, a case can definitely be made for not converting if you can change the way your organization views the role of its core system. Most credit union core systems tried to be all things to all people-with features ranging from ATM/Debit to loan origination to front office and back office applications, internet banking and everything in between. The truth is this broad approach means the individual features won't meet the needs of everyone. Many core system providers, however, have opened their systems up to integration with third-party, best-in-class applications, such as loan origination systems. If your vendor offers integration, you can turn your existing core system into a transactional engine and integrate it with the best- of-breed applications each line of business requires. This way if there is a problem with a specific application, there's no need to rip out an entire core system. Think of it as minor surgery as opposed to the open heart surgery of a core conversion.
Doug True, President, FORUM Solutions, Indianapolis
Yes, you should factor in a monetary value in not converting from your current processor. This value comes in the form of opportunity costs. Let's face it, a conversion of this magnitude will require a significant amount of resources at your credit union. During the conversion process you will have to suspend or postpone items in your business plan to make the conversion a success. Just as you will factor in benefits derived from the conversion that allow you to implement new initiatives and product lines, you should consider the cost of delaying new business plan initiatives due to the conversion process. Sure, the initiatives might only be delayed for 12 to 24 months, but any delay in today's hyper competitive marketplace has a cost associated with it.
It really boils down to the measurement and comparison of the opportunity costs, conversion costs, and projected gains (potential new offerings and efficiencies) from making a switch. Another perspective you should use is to look at what is causing you the most pain with your current core system. If your pain points are isolated to just a few competencies there may be best-of-breed solutions out there that can complement your existing core system and that would save you going through an expensive conversion. Often times credit unions look for an entirely new core solution when a more prudent and member centric choice would be to improve your offerings in targeted pain point areas.
Chris Barber, WesCorp
The answer would be somewhat specific on a per-institution basis depending on what the core processing system is doing. From a general standpoint, if there are no business metrics or reports being tracked from the current system, that would be the first step in assessing the value of one platform vs. another. In this case, it is about balancing cost savings, business risk (including staff time investment and potential losses if a conversion fails), and business benefit that the new platform offers.
David McConney, Harland Financial Solutions
Every credit union should have a two to three-year plan that clearly defines its goals and direction. As an example, if your credit union is on a merger hunt, then you must factor in the new members and service levels that will come with said merger. If your credit union is looking into commercial services, then the expertise of a commercial banker or its equivalent will be required. If your credit union does not have a good strategic plan that is usually the place to begin before any conversion discussions get to in-depth.
Conversely, the CU should know its core provider's business plan and strategy. What direction is your core processor heading or wants to head? How do they want to be seen in the marketplace? Do they have plans of merging or buying new financial services? Will these services be integrated with the core application? Can you wait for the integration to take place? Does your credit union have a clear understanding of what is inherent in your current core system and are you utilizing all its functionality? When was the last time training on new features took place? When was the last time your credit union attended a client user conference?
All these questions should be factored in prior to considering a core conversion. If your credit union does decide that a conversion is imminent, some points to consider include:
* Ensuring that your credit union has a dedicated person knowledgeable in all aspects of your credit union to manage the conversion.
* Conversions are typically 6-14 months in the planning.
* Third-party integrations and certifications should be looked at.
A conversion is often an excellent opportunity to make changes inside the credit union including areas that have been resistant in the past.
Eric Panepinto, USERS
First, it's important to recognize that a core system conversion doesn't have to be (and shouldn't) be a dreadful experience. Done properly, a system conversion should follow a methodical process, using best practices that help the credit union to accomplish a smooth transition for staff and members. The credit union and processor need to be equal partners in the process, fully invested in the project's success. Your RFP should ask vendors to describe their conversion processes and specific steps they take to ensure success. Having said that, it's entirely possible that there is more value you can derive from your current system. Core systems tend to be very comprehensive in nature, making it tough for any given credit union to keep up with the newest features and enhancements. As your business processes change, as staff turns over, or as new products and services are introduced, you may need to step back and evaluate how you're using the system and whether you're maximizing its capabilities. That's one reason that USERS offers a System Review service, which brings a seasoned consultant from our staff to the client's site for several days to evaluate the credit union's use of the system and recommend ways to better utilize the functionality that's already installed. Many times, credit unions discover that they are in search of capabilities their current system already provides.
Ask The Experts
Readers can leverage the Journal's panel of technology experts by submitting questions to Lisa Freeman at lfreeman
