IT governance at Japanese financial institutions: the FSA's six perspectives and where COBIT and FISC fit

What IT governance means: the FSA's and METI's definitions

IT governance is the mechanism by which management aligns IT with business strategy to create corporate value. The Financial Services Agency (FSA) defines it, in Points and Practices for Dialogue on IT Governance of Financial Institutions (the dialogue paper), as “the mechanism by which management exercises leadership, aligns IT with business strategy and achieves the creation of corporate value”. Translations of Japanese-only documents are ours.

The FSA adds that IT governance covers not only internal control but also growth strategies that raise earnings: stable systems are the precondition, and the question is how IT serves the strategy. The paper names three concerns when IT governance fails:

• IT management is impeded and system stability suffers.
• System costs beyond the institution's means go unchecked, with no review of what systems the strategy needs, harming its future soundness.
• Even with a strategy to compete with new players from outside finance, transforming the business, culture and talent strategy included, causes disruption.

IT governance versus IT management

The System Management Standards of the Ministry of Economy, Trade and Industry (METI), dated 26 April 2023, split the two by accountability: IT governance belongs to the board of directors or equivalent body, IT management to executive management such as the CEO and CIO. They define IT governance as the board's activities, guided by stakeholders' needs, to set the IT strategy and policies for using IT systems to raise the organisation's value and trust and to see them through: responding to stakeholders and evaluating, directing and monitoring IT management.

The FSA notes that system risk management has traditionally focused on controls for each phase, such as planning, development, operation and information security: the IT management that supports IT governance.

What is the FSA's dialogue paper on IT governance (2nd edition)?

The dialogue paper is a discussion paper setting out the FSA's thinking and points of focus for dialogue with financial institutions on IT governance. It stems from an overhaul of inspection and supervision, under which the FSA decided to set out its thinking on each theme in discussion papers, expressly as material for discussion, and abolished the inspection manual with its system risk checklists:

1. 1999: inspection manual for system risk management drawn up
2. December 2002: inspection checklist for system integration risk management published
3. June 2018: Basic Policy on Inspection and Supervision published
4. June 2019: 1st edition of the dialogue paper
5. December 2019: inspection manual abolished
6. 2020 to 2022: annual survey reports and case studies on IT governance and related topics
7. June 2023: 2nd edition, adding thinking and points of focus on digital transformation (DX)

Its status: not a checklist

The FSA says it “will not, in inspection or supervision, apply the individual points of this document mechanically or use them as a checklist”, and that dialogue will take full account of each institution's size and characteristics. Abolishing the manual, it explains, was not a rejection of established practice but a way to let institutions build on current practice in their own way.

The paper is aimed “mainly at deposit-taking financial institutions and insurance companies” but “does not prevent other companies providing financial services from using it”. It sets out how IT systems are now handled:

The dialogue depends on the issue

• Stable system operation at risk (user protection): dialogue on system risk management.
• System costs beyond the institution's means left unchecked (possibly affecting future soundness): dialogue within the discussion of future soundness.
• Disruption from shifting to IT-driven strategies: dialogue centred on industry best practice.

Themes for continued dialogue include next-generation plans for regional banks' shared system centres alongside each bank's own IT governance, global IT governance at major institutions, and how monitoring should adapt as DX and other forces change finance.

The six perspectives: from leadership by management to IT risk

The 2nd edition lists six items as its “basic thinking and points of focus for in-depth dialogue”: management's guiding role (1), the strategy itself (2) and four mechanisms behind both the IT and DX strategies (3 to 6).

(1) Leadership by management

Management should lead in deciding what the institution's IT systems should look like, given its financial strength and strategy. For DX it should set the destination, lead the organisation there, keep communicating to win stakeholders' trust and support, and build momentum. Management here includes the heads of internal control functions, the systems department among them, and of business units; it should raise its IT and digital literacy and discuss, with balance, how to ensure security and manage IT risk, cyber risk included.

(2) IT strategy and DX strategy

The IT strategy sets policy on replacing core systems, upgrading information systems, the cloud and information security, and on the target architecture, such as the mix of mainframe and open platforms and of on-premises and cloud, data platforms and API integration. Legacy rebuild methods (rehosting, rewriting, replacement and so on) should be chosen after weighing medium- to long-term IT costs, the future of the programming language and the removal of black boxes.

The DX strategy, defined as clearly distinct from the IT strategy drawn up by the IT organisation, is the policy and plan for digital business innovation and development, for higher profitability or a new business model. It sets strategic areas, such as channel reform, operational innovation, branch digitalisation, more customer touchpoints, cross-selling and new businesses, and a medium- to long-term roadmap. With limited capacity to invest, institutions might share functions with allied banks or join a platform.

(3) IT organisation and DX promotion organisation

Organisational capability turns on who leads planning and development, which departments, subsidiaries and committees take part, and how IT, digital and information security talent is secured and developed, and above all on how decisions and responsibilities for planning, developing, operating and managing systems are split between management, the systems department and user departments. Where business units work in an agile way under delegated authority, the IT organisation should standardise methods, policies, tool selection and development environments to keep development under control.

(4) Optimised IT resources

Resources are optimised across people, things and money to deliver the IT strategy, outsourcing strategy included. People: define the skills needed concretely and develop IT and digital talent to a plan. Things: judge new technologies such as APIs, AI and the cloud on their security risk and on the opportunity lost by not adopting them. Money: do not take the budget for maintenance and regulatory compliance as given; secure strategic investment that creates corporate value.

(5) IT investment management process

Set a medium-term plan and annual budget for strategic IT investment and the DX projects within it, with a process that moves quickly from proposal through review to decision. Afterwards, evaluate projects expected to earn by ROI or similar measures in a PDCA cycle that adds resources, scales back or withdraws. Projects at proof-of-concept (PoC) stage, or needing medium-term work, can be tracked against plan with KPIs until revenue is in sight.

(6) Properly managed IT risk

Running existing systems on autopilot can itself be a business risk, in competition and cost, so the operational and other risks of adopting new technology should be weighed against the risk of forgoing future earnings or savings by not adopting it. DX brings risks from new products and services, system failure, information security (including cyber) and external partners (economic security, money laundering and terrorist financing, a partner pulling out). New products and services need security by design from the planning and design stage, and low-quality, unreliable data can make AI analysis produce wrong output.

COBIT 2019, ISO/IEC 38500:2024, the System Management Standards and the Digital Governance Code compared

The dialogue paper says what to discuss and leaves how to build the framework to general standards, naming as examples FISC's Security Guidelines and System Audit Standards for financial institutions, ISACA's COBIT, and METI's System Management Standards and System Audit Standards.

One workable division: the dialogue paper for what to discuss; ISO/IEC 38500 and the System Management Standards for the roles of the board and executive management; COBIT for objectives, processes and metrics; and the FISC Security Guidelines for the level of individual security measures. The System Management Standards themselves say exhaustive application is not effective: select and adapt items to the organisation.

Mapping the six perspectives to COBIT 2019

COBIT 2019 sorts its 40 objectives into five domains: the 5 governance objectives in EDM (Evaluate, Direct and Monitor), and the 35 management objectives in APO (Align, Plan and Organize), BAI (Build, Acquire and Implement), DSS (Deliver, Service and Support) and MEA (Monitor, Evaluate and Assess).

How the FISC Security Guidelines and the FSA's cybersecurity guidelines fit in

Perspective (6), IT risk, rests on two IT management documents: the FISC Security Guidelines, setting security standards for information systems, and the FSA's Guidelines on Cybersecurity for the Financial Sector, setting out points of focus for the cybersecurity management framework.

FISC Security Guidelines

Published by the Center for Financial Industry Information Systems (FISC), the FISC Security Guidelines on Computer Systems for Financial Institutions set standards for the security measures financial institutions are considered to need in developing, introducing and operating financial information systems, with commentary and examples for each item. First issued in December 1985 and revised many times since, they are now in their 14th edition (March 2026), which reflects revisions on AI security measures, cybersecurity, post-quantum cryptography (PQC), system failure cases and various guidelines.

Under the inspection manual, inspectors examining a business in depth checked it against these guidelines. The dialogue paper still expects generally available guidelines to be used in IT management and names these first.

Guidelines on Cybersecurity for the Financial Sector

Issued on 4 October 2024 as a more detailed document separate from the supervisory guidelines, these guidelines set out “fundamental response measures” and “recommended measures” for governance, identification, defence, detection, response, recovery and third-party risk management. The first are the basics institutions generally need, including cyber hygiene; the second are practices desirable for institutions whose incidents could seriously affect local communities and the economy, and good practices for major institutions to refer to. Neither tier demands a uniform response: institutions assess their own risks and act on them, a risk-based approach.

They apply to every business type whose supervisory guidelines contain cybersecurity management provisions, including major banks, small and regional financial institutions, insurers, financial instruments business operators and crypto-asset exchange service providers, and to financial instruments exchanges, and note that those provisions form part of system risk management.

Securities firms: the supervisory guidelines refer to the 2nd edition

The paper applies to securities firms too. The system risk section (III-2-8) of the FSA's Comprehensive Guidelines for Supervision of Financial Instruments Business Operators, etc. says properly functioning IT governance is just as important for these firms and cites the 2nd edition (June 2023). Its points of focus for the system risk management framework (III-2-8-1) cover:

• Awareness of system risk
• Establishing an appropriate risk management framework
• System risk assessment
• Information security management
• Cybersecurity management
• System planning, development and operations management
• System audit
• Outsourcing management
• Contingency plans
• System integration risk and project management
• Response to system failures

The points most directly tied to IT governance ask whether the board, fully aware of system risk, has set a basic policy for company-wide risk management; whether an officer is in overall charge of systems; and whether the board has approved a medium- to long-term development plan built on a clear system strategy policy within the business strategy. On cybersecurity, they ask whether the board has built the necessary framework in light of the FSA's cybersecurity guidelines, and they cite the FISC Security Guidelines as reference on information security and system risk.

Further points cover internet trading (III-2-8-2), and firms must report to the authorities immediately on becoming aware of a system failure or cybersecurity incident. Securities firms are also designated critical infrastructure operators under the Basic Act on Cybersecurity.

KRIs, ledgers and outsourcing: keep evidence you can explain

Explaining IT governance in dialogue takes evidence beyond policies and rules: indicator trends, ledgers, outsourcee assessments and decision records. The FSA's cybersecurity guidelines specify the reporting and ledgers expected, an approach that suits IT risk generally.

What the cybersecurity guidelines ask for

• At least once a year, reports to management on the cybersecurity risks faced, risk assessment results and progress on the implementation plan (fundamental response measure).
• At least twice a year, reports to management on key performance indicators (KPIs) and key risk indicators (KRIs) (recommended measure).
• Example KRIs: attempted cyberattacks, audit findings, incidents and unresolved vulnerabilities. Example KPIs: reporting rate in targeted email training, vulnerability response rate, information asset inventory progress and training participation rate.
• Comprehensive, up-to-date ledgers of information systems and external system services (outsourcees and cloud services), including systems run by individual departments (fundamental response measure).
• Support periods and software versions recorded in the hardware and software ledgers (fundamental response measure); a software bill of materials (SBOM) for in-house software and the like (recommended measure).

Example KRIs for each perspective

KRIs on the six perspectives move board reporting from description to trend-based decisions. Our example:

Outsourcing and records of decisions

Outsourcing cuts across every perspective. The supervisory guidelines for securities firms expect outsourcees (system subsidiaries included) to be chosen against selection criteria, contracts to set out roles and responsibilities, audit rights, subcontracting procedures and service levels, and outsourced work to be monitored regularly. For system integration, the dialogue paper asks the institution to stay actively involved rather than leave it to the outsourcee.

None of this evidence needs to be created for the dialogue: the FSA says dialogue should not overburden institutions and that the content and frequency of regular submissions should be reviewed. The least burdensome approach is to keep the ledgers, meeting papers and approvals of daily management fit to explain as they stand.

How to proceed: from assessment to a roadmap and monitoring

In practice: assess the current state against the six perspectives, set a prioritised roadmap, then monitor with indicators.

1. Assess: for each perspective, take stock of policies, organisation and authority, rules, ledgers and committee records, and check that facts support the position.
2. Find gaps: measure against COBIT 2019 objectives and capability levels, the FISC Security Guidelines and the fundamental response measures of the cybersecurity guidelines, selecting what fits your size and characteristics.
3. Prioritise: separate issues of user protection (stable system operation), future soundness (system costs) and business transformation.
4. Plan and approve: separate what the board approves (IT strategy, medium- to long-term development plan, risk appetite) from what executive management carries out.
5. Monitor: report KPIs and KRIs to management regularly; judge investments by ROI or KPIs to scale up, scale back or withdraw.
6. Review: assess the framework's effectiveness at least once a year, feeding in internal and system audit results.

How findn can help

findn Co., Ltd. provides IT consulting focused on financial institutions: IT strategy, IT governance frameworks aligned with the FISC Security Guidelines, COBIT and similar standards, IT risk and compliance, and information security and data governance. It is certified to ISO/IEC 27001:2022, and its CEO, Saravana Prathap (CISA), moved to Japan in 2005 and has since worked with major securities firms in Japan and abroad. findn also offers shachi, an IT governance platform for Japanese financial institutions covering a risk ledger with KRIs, policies and regulatory reports, an inspection binder, an audit trail, an IT asset ledger and SBOM/AIBOM.