Introduction: organising the IT function
Michael Yorke
Executive Vice-President, Automation Services, Federal Reserve Bank of New York

Central banks and financial regulatory agencies' public policy mandates impose special demands on the information technology infrastructure which supports them. Security and reliability considerations must be addressed within the context of tight budget constraints. IT managers must lead the adoption of beneficial technologies, while also addressing demands of users. When new projects are planned they must choose whether to "buy or build" and judge whether standard commercial software can be customised cost-effectively. This session examines how one of the world's largest central banks, the Federal Reserve Bank of New York, has approached these trade-offs.

Outsourcing - managing outsourced IT operations
Borislav Todorovic
Head of IT, National Bank of Serbia

One of the key decisions confronting IT managers in the central bank or regulatory environment is the extent to which they can rely on external sources of expertise and technology for the provision and operation of their systems. Outsourcing effectively represents the delegation to an outside body of some services that traditionally may have been provided internally. Clearly the possibility of taking this path requires detailed consideration, particularly in respect of how outsourcing can be managed, and how it can be aligned with core institutional aims. This session examines the implications, costs and benefits of this approach.

Workshop: Using technology effectively in a central bank/regulatory agency context
Roy Laverick
Consultant and former IT audit manager at the Bank of England

This panel discussion/workshop builds on the experiences of participants in their home institutions. Delegates will be expected to give a short account of their institution's use of technology, and the key outstanding issues which they face. Delegates will each introduce themselves, and speak briefly on their main challenges and their experiences in tackling them. Through discussion, delegates will have an opportunity to benefit from each other's expertise and experience.

The role of the IT department
Chris Piper
Head of Information Systems and Technology Division, Bank of England

The role of the IT department Chris Piper, The IT Department stands within the core area of a central bank or regulatory body, and performs a major function as "facilitator" in most of the institution's activities. IT managers must provide appropriate technology to support economic analysis, payment systems and financial market operations. This session examines how these challenges are met at the Bank of England, and how the IT department interacts with and contributes to the Bank's core functions.

Technology and change management
John Mendzela
Mendhurst Associates

Frequently, upgrading information systems is just one part of larger restructuring in an organisation. This complicates the purely technical issues, and underscores the extent to which IT issues are often as much managerial as technological. Drawing on the speakers' experience of managing change at a series of central banks, this session also calls on delegates to contribute and learn from each other's experiences in this area.

Technology for banking supervision
David Parody
Head of Banking Supervision, Gibraltar Financial Services Commission

Financial supervision is one of the most data-intensive functions undertaken by central banks or supervisors in both industrial and developing countries. Often, dozens of technicians are involved. New demands for increased controls over money laundering require increasingly sophisticated manipulation of supervisory data. Once again, IT professionals as well as banking supervisors are under pressure. This session draws on the experience of the Gibraltar Financial Services Commission in developing a leading-edge system to support financial sector supervision.

IT audit
Roy Laverick
consultant and former IT audit manager at the Bank of England

Central banks rely on their internal auditors to provide an assessment for senior managers of the adequacy with which system controls are functioning. To gain the maximum benefit from this process it is essential that the auditors' activities are focused on the most critical areas, and that their findings are presented in a manner that allows shortcomings to be addressed satisfactorily. This session will examine the ways in which these objectives may be realised in the context of complex IT-based operations.

Delivering security
Syndicate group discussion

For central banks and regulatory authorities, control of reputational and operational risks are high priorities. However, security concerns must be addressed within the context of limited budgets and the need for the organisation's day-to-day work to continue as efficiently as possible. Necessarily this involves compromises, forcing IT specialists to deliver an appropriate trade-off between security concerns and other factors. In this session, delegates will split into a number of syndicate groups to explore where and how different organizations have chosen to draw this line.

Formulating IT security policy
Dr James Backhouse
Computer Security Research Centre, London School of Economics

For central banks and market authorities, formulating an effective security policy raises a host of practical and managerial questions: How should the formulation process be driven? To what extent should users and consultants be involved alongside technicians? What are the budgetary implications, and how can the inevitably conflicting needs of security and financial stringency be addressed? In addition this session will consider how the policy can be disseminated to staff at the cutting edge (both technical and non-technical), and how it can subsequently be policed.

Monitoring and maintaining a secure IT environment
Ian Herberston
BACS Payment Services Ltd.

Maintaining security requires much more than the existence of a plan. It must be put into action and monitored. This raises the question of who should be responsible for performing this ongoing role, and what are the essential elements of the function (e.g. a clear security policy, availability of technical staff, acting within an acceptable timescale). If security breaches are detected sanctions must be available, and senior management notified. Finally, there must be mechanisms to ensure that, where security weaknesses are identified, enhancements are made quickly.

Contingency planning
Jim Etherington
Head of Information Systems Directorate, European Central Bank

As operators of national payment systems, and as key players in financial markets, central banks have long understood the need for contingency planning to ensure that critical systems can continue to operate in all conditions. This session examines some of the key elements of a contingency planning strategy, including how to balance the financial cost of contingency provisions and the losses associated with the contingency materialising. Also addressed is the methodology for identifying acceptable system "down time" before alternative provisions must be made available and the methodology for identifying the level of service which is acceptable when a contingency situation arises.

Risk control in payment systems

Around the world, dozens of central banks are undertaking or planning payment systems reform, often with the goal of implementing real-time gross settlement systems. This session examines some of the wider institutional implications of this type of project, looking in detail at new generation systems to support RTGS, the typical life cycle of such a project and the interaction between the IT and more general demands of this type of undertaking.

Testing contingency plans
Speaker to be confirmed

The cornerstone of risk management and effective contingency planning is testing. Only by playing out the scenarios envisaged in risk management planning can IT managers ensure their practicality. However, a balance must be achieved between robust testing of the provisions and minimising the disruption to the organisation. In addition, the dissemination of the contingency plan involves its own risks: making it vital that users understand not only their duties, but the importance of maintaining confidentially.

Problem surgery and course conclusion

A chance for delegates to share views and experiences gained during the four days of the course and learn from each other.