What Happens Next?

COHN: I think that the ‘new normal’ is going to remain pretty fluid, at least in the short-term. I mean, it’s not yet clear what the ‘new normal’ will ultimately need to be. For instance, the once unthinkable notion of a highly regulated institution having its people work remotely or from home is now known to be possible. It may not be ideal, in all instances, but it seems pretty clear that some jobs will become permanently remote in nature. It looks like banks will fracture into a mix of remote and in-office work, and that the concept of the ‘central office’ may be less relevant as work becomes more distributed, geographically. We’re already seeing firms move into cities and other locales that are cheaper to operate in.

This has real implications for how we manage risk. The standard approach—the Three Lines of Defense— is predicated in part on the idea that people at work are sitting next to one another, talking through concerns, overhearing one another’s conversations, and watching each other at work. That context provides a check on misconduct. As does the idea of 2nd Line compliance officers ‘walking the beat’ and patrolling the office. Without that day-to-day interaction among employees being concentrated in one physical space, much is lost. Figuring out what to do about that is something all firms are now contending with. I think they’re doing the best they can, but the simple fact is that their processes and systems are not designed for this new work context. As a result, I think that we’re going to find a lot of dirty laundry when we do a post-COVID look-back.