Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Henry Umney
EU AI Act Article 26: What Third-Party Risk Management Programs Miss About AI Vendors
How Do AI Tools Enter Without a Vendor Review? AI tools enter an organization through three doors that skip vendor review entirely. Shadow sign-ups happen when an employee subscribes to an AI tool directly. Feature flips happen when an already-approved vendor turns on a new AI capability inside a product you already trust. Business-unit integrations happen when a team connects an AI feature to existing software on its own. Door one, the shadow sign-up, looks exactly like the Samsung story above.
Vendor Risk Management Doesn't Get Its Own Exam Anymore | JD Supra
Vendor risk now surfaces inside lending, payment, and BSA exams for community banks and credit unions, not only the annual TPRM review. Key Takeaways NCUA's 2026 supervisory priorities fold third-party oversight into the lending and payment systems reviews, and cybersecurity now appears only as a footnote instead of its own category. (NCUA, Letter 26-CU-01) The FFIEC retired its Cybersecurity Assessment Tool on August 31, 2025, and pointed institutions toward NIST CSF 2.0 instead.
Vendor Risk Management Doesn’t Get Its Own Exam Anymore
Key Takeaways NCUA’s 2026 supervisory priorities fold third-party oversight into the lending and payment systems reviews, and cybersecurity now appears only as a footnote instead of its own category. (NCUA, Letter 26-CU-01) The FFIEC retired its Cybersecurity Assessment Tool on August 31, 2025, and pointed institutions toward NIST CSF 2.0 instead.
What the First DORA Incident Report Establishes About Concentration Risk in the EU Financial Sector
Twenty-nine percent of major ICT incidents reported across the EU financial sector in 2025 originated from failures at third-party providers: vendors, infrastructure operators, and other financial entities in the supply chain. For TPRM programs operating under DORA, third-party risk concentration is no longer a theoretical concern. The first annual incident data shows it as a structural feature of how the sector is built.
Governing the Invisible: Why Spreadsheets Are Still Models And the Regulatory Stakes Have Never Been Higher
A New Regulatory Era: SR 26-2 vs SS1/23 The period from 2023 to 2026 has produced the most significant regulatory refresh of model risk management standards since SR 11-7 was published in 2011. The UK and the US have both acted — but in fundamentally different directions. Understanding that divergence is now the central challenge of MRM governance for any institution with a cross-border footprint.
[Webinar] 2026 SIG Questionnaire | Master the New Standards - March 5th, 11:00 am - 12:00 pm EST | JD Supra
The release of the 2026 SIG Questionnaire marks a pivotal shift in how organizations evaluate their vendor ecosystems. With 21 risk domains receiving critical updates, this version introduces a rigorous focus on AI Management Systems (AIMS) and enhanced supply chain transparency. Managing these updates manually often leads to fragmented data and assessment fatigue. In this live webinar, our GRC experts analyze the 2026 updates to help you prioritize your assessment strategy.
Third‑Party AI: The Blind Spot in Governance
Ask any board if AI is on the agenda, and the answer is yes. Ask how confident they feel about their vendors’ use of AI, and the answer is less clear. That gap runs through HTF Research’s global study on AI Governance and Third‑Party Risk Management, sponsored by Mitratech. The study surveyed 46 leaders from institutions across banking, asset management, insurance, energy, corporate, and brokerage sectors. AI is spreading across the enterprise. Third‑party AI risk is not.
[Webinar] Strategic AI Governance: Implementing Effective Controls in Financial Services - March 5th, 10:00 am EST | JD Supra
March 5th, 2025 10:00 AM EST As AI continues to transform financial services, organizations must establish strong governance frameworks to manage risks while fostering innovation. AI is transforming every function—Legal, Compliance, Finance, IT, Operations, Third-Party Risk, and beyond. But without AI readiness, governance, and risk management, organizations face compliance gaps, security vulnerabilities, and ethical challenges. How can you integrate AI governance effectively?
AI Governance: The Critical Path to Security, Compliance, and Competitive Advantage
AI is no longer an emerging trend—it’s a full-fledged business necessity. Organizations are integrating artificial intelligence at unprecedented speeds, unlocking new efficiencies and competitive advantages. However, with rapid adoption comes a significant challenge: maintaining control over these powerful technologies. AI governance has become a boardroom priority, from regulatory mandates to cybersecurity concerns.
Navigating AI Risks: Best Practices for Compliance and Security
Law Offices of Gary Martin Hays & Associates, P.C. (470) 294-1674 Law Offices of Mark E. Salomone (857) 444-6468
Internal Controls Grab the Focus in the FRC’s Changes to the UK Corporate Governance Code | JD Supra
Following a 16-week consultation into changes to the UK Corporate Governance Code, the Financial Reporting Council (FRC) published the 2024 UK Corporate Governance Code on the 22 January 2024. The FRC has kept changes to the Code minimal, focusing on those that are necessary to promote smarter regulation. The FRC was conscious that the expectations for effective governance should be targeted and proportionate.
The Financial Reporting Council (FRC) published the 2024 UK Corporate Governance Code on the 22 January 2024 | Get the Insights
Following a 16-week consultation into changes to the UK Corporate Governance Code, the Financial Reporting Council (FRC) published the 2024 UK Corporate Governance Code on the 22 January 2024. The FRC has kept changes to the Code minimal, focusing on those that are necessary to promote smarter regulation. The FRC was conscious that the expectations for effective governance should be targeted and proportionate.
[Webinar] Cyber Maturity | Building a Cyber Security Protection Wall & Boosting Attack Readiness - June 27th, 2:00 pm BST | JD Supra
June 6, 2023 To embed, copy and paste the code into your website or blog: June 27th, 2023 2:00 PM BST Join Industry experts Florian Spindler, Manager at KPMG, Claudia Howe, Executive Director of GRC Solutions at Mitratech, and Henry Umney, Director of GRC Strategy at Mitratech as they explore 2023’s current cyber risk landscape and share their knowledge on how organizations can gain a deeper understanding of their own cyber maturity, as well as learn a systematic and practical approach to...
[Webinar] Expert Perspectives: Implementing DORA, Mastering the Challenges and Opportunities - May 17th, 9:00 am ET | JD Supra
DORA is set to transform how European based Financial Institutions enhance the operational resilience of their critical business processes. With an implementation date of 17th January 2025 the evolving nature of the regulations presents institutions with significant challenges in mastering the details and developing their implementation plans.
[Webinar] Are you Ready? Why Your Board & Stakeholders Are About to Ask You About Your IT Risk Technology - March 14th, 10:00 am CST | JD Supra
The attention on IT Risk and Cybersecurity risk management policies is reaching new heights — again. It doesn’t matter if you’re a large enterprise like Uber or a small / midcap company; there’s one common thread as we start 2023: a renewed (and business-critical) focus on how you manage your IT risk — and your Board is about to start asking questions. What’s the Headline?
CFOs will drive transformation to align EUC models and enterprise systems
Tried and tested controls are proving inadequate Today however, many of the previously accepted tried and tested business controls are failing. The Sarbanes Oxley Act of 2002 (SOX) is a case in point. The Public Company Accounting Oversight Board (PCAOB) is focused on ensuring that spreadsheet controls in accounting and finance processes are followed to eliminate errors and fraud.
GRC 2021 predictions: digitising in a hybrid world
Governance, risk and compliance (GRC) teams started 2020 with a clear picture of what they were going to focus on this year, but the onset of Covid-19 pandemic threw up new GRC challenges, such as around bank staff having to work from home. By Henry Umney, SVP Commercial at Mitratech.
All Regulations Lead to the Senior Manager & Certification
CEOs Need to be Aware Come December 2019, the Financial Conduct Authority (FCA) will extend the Senior Manager & Certification Regime (SMCR) to 47,000 solo-regulated financial institutions. The scope of the SMCR is also expanding to include non-financial conduct. Clearly, these measures are geared towards minimising risk and enhancing the resilience of the financial services sector and indeed of UK Plc.
Risk-averse firms could suffer from fear of disruptive tech
Contemplating the concept of digital transformation can be an agonising feat for CIOs. Whilst it’s not a new concept, many companies maintain manual or outdated processes despite widespread innovation offering faster, more cost efficient and secure ways of doing business. Moving away from legacy architectures, on-premises systems and waterfall development can be a daunting process for any business, but they need to recognise the benefits digital transformation has to offer.
Revolutionising finance practises with machine learning
Breakthroughs in the application of complex calculations to large volumes of data have enabled machine-learning methodologies to revolutionise business processes in nearly every industry. Some of the more recognised examples of machine-learning applications include personalised Netflix recommendations and related product modules from online retailers such as Amazon and Nordstrom.
Financial Services Sector Set to Face Further Regulation in
This is according to Henry Umney, CEO of ClusterSeven, as he offers his views on the regulatory and risk management trends in the banking and financial services industry for 2019. Brexit will confound banks in 2019, whatever the outcome The UK’s departure from the EU at the end of March will continue to have a significant impact on the banking, insurance and asset management sectors throughout 2019, almost regardless of the nature of the final departure.
Don’t Let Spreadsheet Risk Derail Your RegTech Investment
Given the long list of regulations that organisations need to comply with – CECL, IFRS9, MiFID II, SOX, CCPA, BCBS 239, SR 11-7, Solvency II, GDPR, CCPA, among others – investment by organisations in Regulatory Technology (RegTech) is estimated to grow by a whopping 45% annually on average over the next five years. This represents a six-fold increase by 2023.
Managing Corporate Spreadsheet Risks
by Henry Umney | November 1, 2018 at 6:01 am Alongside corporate IT systems, companies and employees often make extensive use of spreadsheets to implement, augment and enhance business processes. While the vast majority of these spreadsheets are only valuable to the specific user, others contain critical data, such as pricing information, foreign exchange information, technical specifications, and business and financial models that are central to the business.
Understanding spreadsheet risk to make Excel safe for financial closure
Time and again, the legitimacy and value of the spreadsheet to business, and in particular to the finance department is questioned, given the numerous times spreadsheet errors have caused significant issue for organisations. But the reality is that for all its shortcomings, this humble tool remains essential for core business processes and remains pervasive in many businesses. It’s not hard to see why.
The comeback of SOX: Are businesses ready for the challenges?
The comeback of SOX: Are businesses ready for the challenges? The Sarbanes-Oxley Act of 2002 (SOX) has been in place for many years, and US-listed companies are well-practiced in complying with it. Indeed, they are so well practiced, in the years following its introduction, the cost and effort of complying has declined significantly, as SOX has become ‘business as usual’. However, in recent years, and contrary to expectations, the cost and effort of SOX compliance has started to increase again.
Financial reporting: Why CFOs are feeling the pressure
Financial reporting: Why CFOs are feeling the pressure Finance departments have now faced budget cuts and staff reductions for over a decade. This has taken a serious toll on them, especially due to the ever-growing pressure of regulation, compliance and financial reporting. Forced to make cost cutting a priority, CFOs have had little choice but to compromise on their strategic priorities such as bolstering their financial analytics, modelling and reporting capabilities.
Data chaos caused by the domino effect of unmanaged spreadsheets
In this increasingly data-driven business environment, organisations are beginning to understand the need and value of quality data. Whilst most enterprises have clearly mapped out and documented the data flows in and out of the numerous corporate business systems they deploy, many still have no visibility of the data flows from these systems in and out of spreadsheets. The resulting data chaos threatens the integrity of many business-critical processes.
The elephant in the room: End-user computing risk is undervalued and undetected - Risk.net
THE PANEL Henry Umney, vice president of sales, ClusterSeven Smita Baliga, director, PwC Sam Lee, head of operational risk, EMEA, Sumitomo Banking Corporation Peyman Mestchian, managing partner, Chartis Research Moderator: Joel Clark, consulting editor, Risk.net The pivotal role that end-user developed applications play within the financial industry is clear to all.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Henry
Contact Henry, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack