In Practice August 1, 2019

Cybersecurity Is About Protecting Clients—and Your Practice

One element of the cybersecurity discussion that is often overlooked is that the biggest threat to many advisory firms is not actually to client accounts but instead to the advisory brand.

Reported by

In recent months, Advisor Group has added significant cybersecurity expertise to its senior management team. The new hires include Jason Lish, who has for about four months now served in the position of chief security, privacy, and data officer for Advisor Group’s Advisor Solutions team.

His role involves collaborating with advisers and executives from across the four individual firms that comprise Advisor Group—FSC Securities Corporation, Royal Alliance Associates, SagePoint Financial and Woodbury Financial Services. In a recent conversation with PLANADVISER, Lish pointed to his extensive cybersecurity background protecting organizations such as Alight Solutions, Charles Schwab and Honeywell, as the main reasons he was able to get this newly minted and exciting position.

Want the latest retirement plan adviser news and insights? Sign up for PLANADVISER newsletters.

“Four months in, I’ve now had sufficient time to understand the business and to start to make an impact,” he says. “From a priority perspective, so far there are two general areas where our firms are focused. First is on strengthening the overall security program at the home office by putting in place risk-based methodologies and enhanced capabilities that I’ve seen work in larger institutions I’ve been involved with.”

Lish says the Advisor Group firms—like others in the advisory industry—have a good cybersecurity foundation, “but in this space there are always ways to continue to harden the environment and put layered security measures in place.” At Advisor Group, he explains, the next step forward in cybersecurity is being referred to as the “CyberGuard” program.

The CyberGuard Program includes such features as comprehensive cybersecurity insurance, privacy/data breach insurance protection and coverage for breach response costs, regulatory liability and business disruption; discounted access to a cloud-based data backup solution that gives advisers secure, encrypted access to files from laptops, smartphones and other devices; and access to a security auditing and monitoring platform that continually monitors advisers’ systems to identify potential security gaps.

“The program also includes providing trusted login enforcement, login reporting and remediation support,” Lish says. “We now offer enhanced email and file storage capabilities with strong authentication and security monitoring features.”

Lish’s comments about improving advisory firm cybersecurity echo those made recently by Bart McDonough, CEO and Founder of Agio, which he describes as a “hybrid managed IT and cybersecurity services provider specializing in the financial services, health care and payments industries.”

“In today’s evolving cybersecurity environment, our clients come to us for two main reasons, which do overlap,” McDonough says. “First, they want help with their technical cybersecurity capabilities across the board. They have both generic and specific concerns about potential points of exposure for their organization.”

The second reason clients come to Agio is to get help meeting third-party cybersecurity standards, such as those put in place by regulators, particularly the Securities and Exchange Commission via its Office of Compliance Inspections and Examinations (OCIE), or private parties that review and approve cybersecurity.

For context, during recent examinations, OCIE staff identified common security risks associated with the storage of electronic customer records and information by broker/dealers and investment advisers in various network storage solutions, including those leveraging cloud-based storage. These risks are outlined in a Risk Alert published recently by the OCIE. Summarizing the matter, the Risk Alert states that, while the majority of these cloud-based network storage solutions offer encryption, password protection, and other security features designed to prevent unauthorized access, examiners observed that firms did not always use the available security features.

“There has been a lack of understanding of what the different threat vectors are and what advisers’ evolving obligations are from a regulatory perspective,” Lish reflects.

He warns that independent advisers are actually becoming a preferred target of hackers and bad digital actors in the financial services realm. For this reason alone it has become essential that the leadership of advisory firms make cybersecurity a top personal and organizational priority. 

“This is based on the fact that your larger institutions, the big banks for example, have been at this cybersecurity game for quite some time,” Lish explains. “They have been working for many years to harden their environment, and so this has actually led attackers to move away from these targets and to go to less sophisticated environments that have not as yet had to develop the knowledge or expertise to put the necessary defensive capabilities in place. If you look at an RIA that is operating wholly on their own, they may not even know where to start with cybersecurity.”

Lish adds that one element of this discussion that is often overlooked is that the biggest threat to many advisory firms is not actually to client accounts but instead to the adviser’s brand.

“Independent advisers are often operating in small, trust-based, tight-knit communities, and in that way it can be very hard to recover the brand reputation after a cyber incident,” Lish says. “Not to mention the security capabilities are coming up more and more in the request for proposals process. The cybersecurity questions are actually being formalized. To that point, we’re working to develop better ways to articulate what security is and what we are doing to achieve it.”

The Markets July 31, 2019

A New Investing Approach for Public and Church Pension Plans

River and Mercantile suggests that they use equity derivatives to provide contractual exposure to the equity market, but in a way where risk can be managed.

Reported by

In a new paper, “Pension Investing: An Alternative Strategy for Public and Church Defined Benefit Plans,” River and Mercantile Managing Director Tom Cassara lays out the case for a new way for these types of pension plans to invest, similar to an approach that the consultancy suggests for corporate pension plans.

Cassara says he has served church pension plans for many years, but since joining River and Mercantile a year ago, he has become more conversant in the use of equity derivatives. Generally, church and public pension plans and the consultants who serve these plans are not familiar with the use of these types of instruments.

This inspired Cassara to develop a new investing approach for these types of plans consisting of an underlying fixed income investment strategy comprised of high-grade, longer-term securities that deliver higher yields, paired with equity derivatives that provide contractual exposure to the equity markets, but in a way where risk can be managed. The primary goal of this approach is to provide insurance protection against market downturns in exchange for giving up some of the upside when market returns are good.

Non-Employee Retirement Income Security Act (ERISA) church pension plans and public pension plans are managed differently than corporate pension plans that fall under ERISA, Cassara tells PLANADVISER. “Non-ERISA church plans are backed by the church organization, and the public plans are backed by the entity they serve, so they have a little more financial freedom,” he says. “ERISA mandates a certain funding ratio, whereas these plans have more freedom on their minimum funding to support future benefit payments. The rules regarding them tend to be a little more forgiving on minimum funding status, so they tend to be a little less funded than their corporate counterparts.”

How church and public pension plans typically invest is in a well-diversified portfolio with the objective of maximizing returns and minimizing risk through a myriad of investment styles, Cassara says. Their emphasis is more on returns than on liabilities, he explains, and they do invest in the private markets, including equity, debt and hedge funds.

“We tend to be more comfortable with an investment strategy where we hit more single than doubles [in terms of returns on the upside], in trying to avoid falling backwards into what I call a ‘death spiral,’” Cassara says. “The portfolio we have put forth is one where we have invested in high-quality fixed income vehicles, typically bonds issued by investment-grade corporations, public entities and governments, that are longer-dated and produce higher yields. That would provide a good amount of cash flow and a reasonable rate of return.

“On top of that, we would reach out to the futures market to gain equity exposure–not to ride the market’s fluctuations but to create a collar,” Cassara continues. “Each collar would be unique for each organization and designed differently.” One could provide insurance protection against a 10% decline in the equity markets, for instance, he says.

To pay for that premium, River and Mercantile proposes selling off some of the securities delivering upside.

The goals is to help church and public pension plans “be more confident about where their returns will be and to try to advance the funded status of their plans in a more measured way, with limits put in place to protect the plans from any of the downs the economy could bring,” Cassara says.

River and Mercantile has just completed its back testing on this approach and is only just now starting to discuss it with these types of pension plans, he says.

As he writes in his paper, “A vast number of pension plans rely on diversified portfolios dominated by global equity allocations and a significant percentage of alternative investments (hedge funds, private equity, private debt)—yet funding ratios have remained stagnant even in the face of the longest equity bull market in history. We believe that an investment strategy which encompasses more predictable returns and increases protection against shocks to its funded ratio via a recession or economic downturn is most prudent for plans to consider on behalf of their participants.”

Never miss a story — sign up for PLANADVISER newsletters to keep up on the latest retirement plan adviser news.

«