The Furious Five (June 27):Adobe/Meta AI Moves, Netflix's Anti-Sharing Economy, and the Titan Tragedy

Adobe Dominates (link)

Adobe's Financial Triumph Fueled by AI Innovation

Adobe's focus on AI has been credited for the company's recent financial successes. For example, the company is leveraging AI innovations across its product suite, notably Firefly, an AI tool for generating images. This focus on AI has contributed to Adobe's robust financial performance, with the company surpassing Wall Street expectations for the quarter ended June 2, posting revenues of $4.82 billion and adjusted profits of $3.91 per share. Adobe's shares rose over 5% in aftermarket trading following the announcement. This bullish outlook extends to future performance, with Adobe forecasting its current-quarter revenue to be in the range of $4.83 to $4.87 billion, and raising its FY 2023 revenue forecast to between $19.25 billion and $19.35 billion. The company's stock has seen a significant 40% increase since May, driven in part by investor optimism around Adobe's AI strategy. However, some analysts warn of potential overvaluation due to the hype around AI. Despite this, Adobe's management remains optimistic about the future of AI in enhancing their product accessibility and customer productivity. (Source: Reuters, Seeking Alpha)

Outmaneuvering the Competition: Meta’s Open-Source AI Gambit

Tech giant Meta is reportedly planning to offer a commercial license for its forthcoming open-source large language model (LLM), according to an exclusive from The Information. If true, this marks a major shift in approach, as most currently commercially used language models, such as Google's Bard and OpenAI's ChatGPT, are closed-source. This innovative move could potentially lead to broader adoption by companies seeking a more flexible and cost-effective AI solution. However, it's worth noting that this development hasn't been widely reported or confirmed by Meta, so caution is advised until further information is available. (Source: Artisana)

Trustworthy AI: NAIAC's Strategy for Harnessing AI Benefits and Mitigating Risks + NIST AI Risk Framework

The National Artificial Intelligence Advisory Committee (NAIAC) has submitted its inaugural report to the President, outlining strategies for the U.S. government to harness the benefits of AI technology while mitigating its potential risks. The report emphasizes the need for trustworthy AI, new R&D initiatives, international collaboration, and workforce support. Future focus areas for NAIAC include rapidly evolving AI sectors like generative AI. The committee is also set to reassess its working groups to more effectively study the influence of AI on various societal facets such as workforce, equity, and societal norms. Deputy Secretary of Commerce Don Graves highlighted the critical juncture the country is at regarding AI development and the necessity of balancing innovation with risk management. The Biden-Harris administration has emphasized responsible American innovation in AI to safeguard people's rights and safety. The committee's future endeavors will consider mechanisms to keep pace with the swift development and deployment of AI technology. The report also references this AI-Risk framework published by NIST. (Source: NIST)

Netflix Gains On its Anti-Sharing Strategy

Netflix's is benefitting remarkably from the shift towards an 'anti-sharing' economy. During a recent period, the streaming giant experienced a significant surge in new sign-ups, averaging 73,000 daily—a 102 percent increase compared to their previous 60-day average. Remarkably, Netflix added 100,000 subscribers each on May 26th and May 27th. At the same time, Netflix's recent policy change limiting password sharing outside individual households is significantly altering dynamics among families and friends who previously relied on shared subscriptions. While this strategy has boosted the company's sign-ups and revenues, it raises questions about the social and relationship impacts of such business decisions. This shift towards an 'anti-sharing' economy is causing what some users describe as 'breakup talks', disrupting established patterns of digital sharing and challenging relational norms. Although this move is aligned with Netflix's commercial goals, it sparks a discussion about the role companies should play in shaping societal behaviors and norms, highlighting the need for an ESG (Environmental, Social, and Governance) perspective in policy decisions. As we see companies making choices that prioritize economic gain over social dynamics, it's essential to consider the broader implications and the role business should play in fostering or disrupting social connections. (Source: TheVerge, WSJ)

Titan Disaster: A Governance, Risk, Compliance Tragedy

OceanGate's Titan submersible incident has starkly underscored the importance of rigorous internal controls, adherence to governance risk, and compliance for businesses. Despite the repeated warnings about Titan's safety by a prominent deep sea exploration expert, the company's CEO, Stockton Rush, overlooked these critical insights in his pursuit of innovation and market dominance. The tragic consequences were not only fatal to him and four other passengers but also posed severe risks to the broader industry. Critics argue that these calamities were preventable had OceanGate prioritized safety certification and independent validation before operating commercially. Rush's dismissal of such safety precautions—viewing them as barriers to innovation—reflects a dangerous misapprehension that can jeopardize both human life and the reputation of an industry. In the wake of this tragedy, the importance of sound internal controls, risk management, and compliance with accepted standards is clearer than ever. (source: BBC)

Author: Malik Datardina, CPA, CA, CISA. Malik works at Auvenir as a GRC Strategist that is working to transform the engagement experience for accounting firms and their clients. The opinions expressed here do not necessarily represent UWCISA, UW, Auvenir (or its affiliates), CPA Canada or anyone else. This post was written with the assistance of an AI language model. The model provided suggestions and completions to help me write, but the final content and opinions are my own. 

Should drone inventors have thought about this risk?

Came across this article on Wall Street Journal about how the wedge-tailed eagles have turned out to be the drones worst nightmare. Here are some videos that illustrate the problem:

Being someone who works on innovation as the GRC Strategist - risk is something that I think about daily. Of course, you need need to be prudent and make sure that you've documented. All the known risks and have a plan and how to mitigate them.  For example, you should patch your software when the vendor tells you there is an issue.

But how could drone inventors possibly think about the risk formula about the impact and likelihood of eagles tearing up your drone?

It's a good illustration of how innovation requires taking risks of which you will only encounter when actually deploying innovation into the real world. They're just some things that literally will fall out of the sky that you didn't think of and a workaround will need to be designed after the fact.

Author: Malik Datardina, CPA, CA, CISA. Malik works at Auvenir as a GRC Strategist that is working to transform the engagement experience for accounting firms and their clients. The opinions expressed here do not necessarily represent UWCISA, UW, Auvenir (or its affiliates), CPA Canada or anyone else

BNY Mellon Software Glitch: Time to make SysTrust mandatory?

As was widely reported in the business press, BNY Mellon experienced a technical glitch that affected its ability to price mutual funds accurately. Based on the press release from one of the affected funds, the problems started on Monday August 24th, where one of BNY Mellon's system "InvestOne" managed by SunGard was pricing about 800 mutual funds inaccurately.

So what was the cause of this fiasco?

According to CNN, "BNY Mellon outage occurred after a SunGard accounting system it uses became "corrupted" following an upgrade. A back-up also failed."

Normally, this type of thing will force the party experiencing the breach intense scrutiny over what went wrong. However, as I went through the timeline posted by the company, I found (reading between the lines) that they did a number of things right, such as:

• Incident Management Communication Plan: One of the aspects of incident management is communicating to the public and making them aware of the issue. As it can be seen, the company posted details on estimates as to when the system would be ready as well as what was the source of the delay when they didn't meet their estimated deadline. 
• Contingency planning: BNY Mellon was able to get the Net Asset Values (NAVs) "using a secondary and more manual process" to the clients without the production system. According to WSJ, this involved "mobilizing more than 100 accountants to manually calculate the values of thousands of fund securities". The secondary procedure was not perfect as small differences were noted between the fund and, as reported the WSJ, this could expose the bank to "potential liability from the resolution of trades that may have been made during the pricing fog".  
• Effective Service Level Agreement (SLA) with SunGard: Based on the close coordination with SunGard, it appears that they were able to get SunGard to eventually rebuild the system "from scratch". 

That being said, there is always room for improvement. When I was reflecting on this, I speculated that this was another case of inadequate testing of the system upgrade. However, according to SunGard, this was not the case. As they noted on their website:

"The issue appears to have been caused by an unforeseen complication resulting from an operating system change performed by SunGard on Saturday, August 22nd. This maintenance was successfully performed in a test environment, per our standard operating procedure, and then replicated in SunGard’s U.S. production environment for BNY Mellon. This change had also been previously implemented, without any issues, in other InvestOne environments. Unfortunately, in the process of applying this change to the SunGard production environment of InvestOne supporting BNY Mellon’s U.S. fund accounting clients, that environment became corrupted. Additionally, the back-up environment hosted by SunGard, supporting BNY Mellon’s U.S. fund accounting clients, was concurrently corrupted, thus impeding automatic failover. Because of the unusual nature of the event, we are confident this was an isolated incident due to the physical/logical system environment and not an application issue with InvestOne itself."

Given my background as a CA, CPA and CISA, I have always thought it is an odd contradiction that we expect infrastructure (road, dams, bridges, etc.) to be certified by engineers to be in working order (key word is expect, as John Oliver notes in the video below, this is not exactly up to snuff!), but do not have the same expectations for the technology that runs the Information Age.

And that's where I have always proposed that it is necessary to have a framework like SysTrust (now SOC2 and SOC3) in place that requires companies to ensure that their systems are reliable: secure, available, and able to process information without messing it up.

Based on the experience between SunGard and BNY Mellon, I think it actually proves the case. Although companies, like SunGard, likely have such controls in place it is beneficial to others to have a second set of eyes on those controls, ensuring that they are in place, are designed effectively and are operating effectively. The reason is that with such mandatory audits in place, it will allow for the circulation of best practices through such audits. This occurs in the financial auditing world through "management letter points".

One other area that we should explore is the total impact of this error, as it will give insights into the "total impact of failed IT controls". This will be the topic of the next blogpost.

Can Inadequate Disaster Recovery Planning be worse than locusts?

Why are US farmers facing a disaster?

Is it due to locusts? No.

It's due to inadequate IT disaster recovery planning.

As reported in the Wall Street Journal, the US Immigration Department is unable to issue visas to temporary workers due to a system failure. Specifically:

"“The system that helps perform necessary security checks has suffered hardware failure,” said Niles Cole, a State Department spokesman. “Until it is repaired, no visas can be issued.” He said technicians are working around the clock to resolve the issue but couldn’t offer a timeline for when the system would be back in action.

Specifically, a central database isn't receiving biometric information from U.S. consulates world-wide, he said. Biometric data, including fingerprints, are used for security screening of applicants."

And the losses are mounting daily. Over 200 workers are sitting at the Mexican-US border waiting to be processed by system so they can get into the US and help harvest the crops. The article reported that farmers are losing between $500,000 to $1,000,000 per day because the fruits are spoiling.

Reading this article I had the following questions

Why isn't there a hot site? 
Given the importance of the technology, why don't they have the ability to swap to a new piece of hardware instantaneously?

Was the security information backed up and why is there no manual work around? 
If it's digital information, why isn't there a manual work around to transmit the information and circumvent the faulty hardware? The data could be manually uploaded to the central database.

Was a proper risk assessment done? When a disaster recovery plan (DRP) is created for a system, the organization must determine the Recovery Time Objective (RTO) that determines how quickly a system will be stored after failure. Google, for example, has an RTO of zero. To determine what the RTO is there needs to be an assessment of the impact of such a failure. In this case when setting the RTO did the risk management professional include the fact that this system was critical in supporting the visa program H2-A for temporary farm workers? It should be noted that the US farmers association had paid into this program and now they are suffering losses of over $500,000. This will also reduce the amount of tourist visas issued potentially resulting in lost tourist dollars to the US.

The lesson we can learn from this is to ensure that we understand what business processes a system supports and understand the impact to those business processes should the system go down.