Lean at banco BV boosts efficiency with security
By applying lean concepts to agility, banco BV achieved significant reductions in the lead time of its Access Management and EHT (Ethical Hacking Tests) deliveries without compromising what matters most to financial institutions: information security.
It is very common to hear that banking environments tend to be inefficient and often outdated. Considering that this type of environment deals with capital goods and is extremely regulated, it is not hard to see why: when we deal with this kind of asset, increasing efficiency at the expense of risk is not an option; risk can never increase and must always be the focal point of any institution in the field. The secret lies in finding ways to increase efficiency without compromising information security.
Banco BV has been working with agile squads for some time, but the application of lean concepts in the company needed to be expanded; it also needed to cover the corporate service areas, that is, those that provide services to these squads. Communication was often poor, and the areas involved worked in a very disconnected way, without a unified view of how the flow worked from beginning to end.
The area identified as responsible for the biggest bottlenecks in the flow was Information Security, more specifically the functions of Access Management, responsible for granting access to professionals who were being hired and needed to start their jobs as quickly as possible and EHT (Ethical Hacking Test), responsible for identifying vulnerabilities in the features delivered by the squads by applying a range of tests before release to production, a crucial function for ensuring that customer information is not compromised and that the risk of intrusions or data leaks is mitigated.
Given the need to increase agility in delivering features for the Digital Bank segment, focused on checking accounts for individuals, the execution time of Access Management and EHT requests represented both an opportunity and a need that had to be addressed as quickly as possible.
With this criterion in mind, lean efforts were directed at these areas, using the digital bank as the pilot customer.
The problem was a two-way street: on the one hand, the squads did not understand how the EHT flow related to their own process and saw this final stage as an obstacle to delivering value; on the other, the EHT sector needed to ensure that the squads' deliveries were secure, and for that there was a minimum time to be considered, which often, so as not to delay deliveries, generated additional work (overtime) for its employees.
The voice of the customer
The lean philosophy places great emphasis on always looking from the customer's perspective. In this case, we are talking about a corporate service, in which the customer is internal but, in turn, produces value for the external customer. In BV's case, it was necessary to involve the squads and the corporate areas in the meetings to ensure alignment around the flow and the business requirements.
Day-to-day life in a banking environment is very demanding, especially when it comes to launching a new product or service. Therefore, securing the involvement and dedication of employees from the areas involved to take part in the process is an effort that requires leadership's involvement and sponsorship in prioritizing efforts.
At the beginning of the work, the meetings were exhausting and full of conflict, with the areas pointing to culprits rather than problems. As the flow became clearer and data was brought in, the areas became more involved in the meetings and began to understand each one's role in the flow, the needs of the areas involved and the impact each stage had on the final delivery. The participation and involvement of the customer area made the process more robust and reinforced once again the importance of listening to the customer.
The four principles of being simple
As discussions among those involved in the flow deepened, the problems began to be revealed: lack of clarity in the information passed from one area to another, which worked in isolated silos; low visibility of the end-to-end process; rework resulting from a lack of acceptance criteria in deliveries from one area to another; and the absence of a management model that made an end-to-end view of the flow possible.
To solve the problems identified, the BV team used well-established lean tools (such as the A3 to implement the PDCA cycle, root cause analysis, the five whys and 5W2H to execute the action plan), seeking to develop the four principles of being simple in a banking environment, which is by nature quite complex.
But what about risk in a simple lean environment?
The actions implemented by the bank certainly had a positive impact on both the internal and the external customer, with the responsiveness of access management services increasing dramatically. But how was the question of information security handled? Did the increase in efficiency compromise security and increase risk?
In fact, while executing and measuring the results of the actions, the team always kept a close eye on this factor, which, as already noted, must always be the focus of any banking institution.
What we saw was that implementing lean in operations was not only safe in terms of not increasing risk or compromising information, but also managed to reduce critical vulnerabilities in its processes by an impressive 93%. What we saw was that the lean mindset offers a path little known in the banking sector until now: that of increasing efficiency in harmony with improving information security.
How you can get there too
BV continues to break new ground in the banking environment with the help of the lean philosophy. So that other institutions in this field can follow in its footsteps, some lessons remain as important tips that can help introduce lean in banks:
We hope BV's initiative inspires other banking institutions to see, through the lean philosophy, the possibility of making their processes more efficient without giving up security. In this way, we see the possibility of a banking future in which institutions are able to deliver more value to their customers, taking a true lean leap in the sector.
