BNY Mellon Software Glitch: Cost of IT Control Failure

In the previous post on the BNY Mellon's technology woes, we explored what the company did right as well as the overall need for independent evaluation of the technology that runs the Information Age. In this post, we explore the costs and consequences of the breach.

One of the challenges for putting in controls around information integrity is that it is a hard sell: what's really the value of accurate information? This is in contrast to something like information security where it is also hard sell, but much easier. The reason? When an information security breach occurs, it is largely to access something of value that can be monetized. The Poneman Institute puts this cost at approximately $174 per record.

Consequently, it is easier for someone to go to the CEO/CFO and explain how tightening controls around information security will protect the company's bottom line. Furthermore, information security breaches are something that has entered the mass consciousness within the business community: SunGard was quick to reassure everyone that the issue affecting BNY Mellon's accounting software was NOT attributable to "any external or unauthorised systems access".

When making the business case for controls over information, it can be challenging to show how the control will lead to savings in terms of "decision failure", i.e. the cost of making the wrong decision due to unreliable information. Let's face it: most companies are willing take big risks on their information by continuing to rely on spreadsheets that have an error rate of 88%. Furthermore, as highlighted by this Protiviti study, internal auditors understand the information integrity challenges but are not getting the funding to tackle them.

So the incident at BNY Mellon is rare occurrence where something that is mis-priced can actually lead to costs. As noted in the Wall Street Journal:

"A software glitch this week at fund administrator Bank of New York Mellon Corp. caused difficulties in pricing many mutual funds and exchange-traded funds, prompting some fund sponsors to publish lists of funds whose stated asset values were erroneous.

What can you do if one of your funds is on the list, meaning you may have overpaid for shares?

Reach out to your fund company and ask for a refund. They don’t have to give you one but firms may do so because of their often long-term relationships—ones they want to keep—with investors, analysts said."

The other costs include:

• Direct costs: As noted in the WSJ, "BNY Mellon was working on a separate contingency plan, mobilizing more than 100 accountants to manually calculate the values of thousands of fund securities". The company also required SunGard to come in and work at their premises to fix the issue. If the company had to pay extra for this work to be completed, it would add up quickly. 
• Loss of business due to damaged reputation: Experiencing these types of issues exposes the company to the loss of business due to their reputation being damaged. 
• Regulatory scrutiny: Yes, BNY Mellon is under regulatory review. As noted in the Boston Globe and Yahoo Finance, BNY Mellon's technical problems have attracted regulatory scrutiny of Massachusetts's Secretary of State William F. Galvin who has sent letters of inquiry to  the company to investigate what happened. Regarding the incident he said: "In the warp-speed of trading these days computer problems can happen...But the fallout that seems only to affect large financial institutions can hit the average investor looking at his and her retirement money". 

Of course we won't know the full cost until, the regulatory probe finishes and the publish their findings or the cost was material and this shows up in the financial statements. Regardless, organizations should be proactive in ensuring that sufficient technology controls are in place and that these types of risk are controlled. 

"Images can't be verified": The limits of social media?

In previous posts, I have illustrated how information integrity concepts, and assurance more broadly, have played a role in media reporting. In the post, I noted the following as way way to act as a check on the media:

"Another probably more plausible approach is to leverage crowd sourcing and organize it to enable people comment or blow the whistle on information that is produced in a manner that is inaccurate, incomplete or invalid. The Guardian actually did this for the MPs expenses: they built an app that allowed ordinary users to analyze MPs expenses (if interested check out the Google Docs Spreadsheet with this info). As noted in the article, there was another attempt to build such an app (see here for the alternative). This is both good and bad. It's good in the sense that no one organization has the ability to monopolize such initiatives. However, it is bad in the sense that the efforts of the crowd are effectively divided. Regardless, it does illustrate that the potential for "crowd sourced audits"."

However, the events in Egypt, Syria, and the coverage of  the Occupy Wallstreet Movement, illustrate the limits of social media on its ability to act as a check as a means to counter "official sources".  As noted in the following excerpt in the WSJ, there is a significant discrepancy in the death toll in the recent events in Egypt:

"The Associated Press cited the Ministry of Health as saying 525 people were killed across the country, with 3,717 injured. Interior Minister Mohammed Ibrahim said 43 policemen died in the assault, the Associated Press reported.

The Brotherhood placed the number of fatalities far higher—saying 2,200 people had been killed and more than 10,000 wounded."

To put the number of dead into perspective, the number killed (if the Brotherhood numbers are accurate) is the same scale as the number that died in September 11, 2001, which was 2,977.

What is interesting is that the Egyptian military actually targeted camera men to prevent images of the massacre from leaking out. For example, Mick Deane, a cameraman from Sky News was shot and killed by the Egyptian army. Also, as you can see in the video below, Ahmed Asem  (an Egyptian photojournalist) was killed while filming the Egyptian army kills others:


In Syria, even after horrifying images of chemical attacks were available from YouTube (no link was provided due to the gruesome nature of the attacks; however they can easily be found by putting "Syria Chemical Attacks" in YouTube), the mainstream continues to refer to them as "alleged".

With respect to the Occupy Movement, almost 8,000 people have been arrested. However, the mainstream media does not cover this and so a major crackdown on a significant social movement is effectively invisible to the mainstream society.

So what does this have to do with information integrity?

I have been fascinated with the portability of information integrity concepts to any information system, including the mass media system. For example, if one reads Manufacturing Consent, it is essentially a book that evaluates how the media is able to apply concepts, such as decision-usefulness, completeness, validity, etc to the way information is published or broadcast.

And this is the link to the social media.

One may think that with official media being unable to compete with social media, that the it will be replaced by social media. However, this is only from a business perspective. the real question is whether social media does actually alter the ability of the mass media to set the parameters of debate. In other words, can you or I can get on a blog expose the truth about something and create change society, based on the blog post?

As illustrated by the examples above, when the official media does not actually corroborate the social media, it effectively prevents social media from having an impact on society. I had mentioned in this in one of my earlier posts, the official media is still seen as a source of trust and verification, whereas social media is not. This ultimately prevents social media from ever truly supplanting old media, as people in a society ultimate rely on collective institutions to bind them together in a cohesive. So despite social media giving people the ability to contribute to the landscape ideas, it has not fundamentally altered the essence of power structures in society.

In other words, the "information system" that is within the society still remains where it always has.  And when the citizenry make decisions about societal matters, they ultimate rely on this information system for their opinions and beliefs, simply because the other sources can be doctored and faked, i.e. there are no official "information integrity" controls around social media. Consequently,  countries - be they dictatorial or democratic - can crackdown on their citizens and social media will not "materially" affect society's opinions or belief about the plight about that group or their cause.

Auditing the Media: Was CNET's CES coverage complete?

As noted in the Tech News Today (TNT) report on Friday, CNET's parent CBS banned its staff from awarding Dish's "Hopper" an award as part of their reporting the Consumer Electronics Show that just wrapped up last week. As reported by CNN, the bottom of CNET's 'Best of 2013' page notes the following:

"The Dish Hopper with Sling was removed from consideration due to active litigation involving our parent company CBS Corp. We will no longer be reviewing products manufactured by companies with which we are in litigation with respect to such products."

Some may point to this as a legal risk management move: CBS had to stop CNET from awarding this to Dish to avoid it being used against them in court. However,  Ayaz Akhtar, a non-practicing lawyer and host of TNT, noted in his commentary on the issue that CNET awarding a prize would have little impact on the course of litigation  (but listen to the show for the proper context and for how he worded this. He's careful to avoid any misrepresentation and it's not an exact quote).

The real issue, in my humble opinion, is to looking at whether media be relied on to report on issues objectively. One could say that due to the lack of independence of CNET on the matter, makes their reporting of CES lack objectivity. This is the standard of care that a financial auditor is held to when auditing a company. For example, auditors are prevented from holding stock in companies that they audit. Should the media be held to the same standard?


For me this incident illustrates how the concepts of financial information integrity are portable to other arenas, such as understanding news coverage. Financial information produced by companies listed on stock exchanges is subjected intense scrutiny and regulation. Accountants/auditors were required to develop a framework to analyze how financial information can be provided to investors in a reliable that enables them to make effective investment allocation decisions. This financial “information production” process is essentially similar to the “information production” process produced by the media: data is gathered, summarized and presented to the user/reader to make a decision. The latter is the key difference. For example, if someone is going to rely on CNET's CES coverage to understand the best products out there, then they could make an erroneous decision because CNET did not cover dish's product.

The following is a list of audit objectives (i.e. completeness, accuracy, etc) that financial information must meet in order to reliable for decision making purposes.

• Completeness – is the information presented completed, i.e. everything that is out there is included in the medium
• Accuracy – is the information congruent with the original event
• Timely – was the information reported in a timely manner, to be useful to the user
• Validity – does the information faithfully represent the underlying reality that is presented

Another important concept, especially to media coverage, is the one  of "presentation & disclosure – is the presentation of the information impartial. In financial statements, companies may engage in transactions to alter the presentation of items, e.g. bury accounts payable into accounts receivable so the user won't be able to accurately assess the ratio of current assets to current liabilities. Media has a greater ability to do this. And I don't mean to pick on the CNET people because they at least tried to inform the reader about their bias, but the statement they mentioned is at the bottom and not at the top. That is, some readers may miss it.

Overall, it's hard to say whether that the coverage lacked integrity and more specifically was "incomplete". On the one hand, one could argue their analysis was in complete because they excluded Dish's product. However, they did provide full disclosure although it is buried at the bottom. But one can easily search for Dish's product on the Internet and see what other reviewers are saying (e.g. such as PCMag's review). But it does illustrate that media consumers need to be aware of such risks and do their best to understand where corporate conflicts exist and how such coverage can be biased.