0%
 

Introduction

Welcome

Why This?

Citi’s culture and values are at the heart of how business is conducted. A strong risk and control environment is a key enabler of Citi’s culture of excellence.

This foundational course is part of Citi's Enterprise Risk Management Training Program (ERMTP). ERMTP is a series of courses which will build your understanding of your risk and control responsibilities.

Why Now?

Citi has a standard framework for managing risk. As part of Citi’s ERM Framework supporting capabilities, we are committed to equipping employees with knowledge and training to carry out day-to-day risk and control responsibilities.

Why Us?

  • Managing risk is everyone’s job at Citi. We are all risk managers.
  • Risk is inherent to Citi’s business and cannot be avoided. Everyone must be vigilant and manage risk with consistency and accountability.
  • The Enterprise Risk Management Framework (ERMF) is Citi’s standard for managing risk.
  • Everyone is responsible for escalating risks and concerns, and Citi provides an environment where this can be done without fear of retribution.

It is your responsibility to understand your role as it relates to managing risk, taking complete ownership of your actions, and supporting Citi in identifying and managing risk every day.

Course Objectives

After completing this training, learners will be able to:

  • Identify an End User Computing (EUC) or IT-enabled Smart Solution (ITeSS) using the EUC and ITeSS Decision Tree
  • Consider alternative technology solutions, such as ITeSS, to prevent new EUCs
  • Identify an EUC and the appropriate action to take if an EUC is discovered

Course Navigation Tips

This course is divided into five topics and an end-of-course assessment.

The Home button at the end of each topic takes you to the Home page.

The Menu button provides access to the individual topics.

The Resources button provides a list of useful links.

The Switch Language button lets you switch to a different language.

The Close button ends your training session and closes the course window.

Coming Next

In the next topic, we will introduce EUC and ITeSS, provide an overview of the EUC & ITeSS Decision Tree and explore how to identify when you are using an EUC or ITeSS.

End User Computing and IT-enabled Smart Solutions

End User Computing and IT-enabled Smart Solutions

Here we will learn what makes a tool an EUC or ITeSS, and how to determine when a tool you are using is an EUC or an ITeSS.

Scroll down to continue.

What is End User Computing (EUC)?


Citi Staff will often need to use applications, or tools, to perform their regular Business Processes. These tools are either created by End Users or developed and controlled by Information Technology (IT).

An End User Computing (EUC) can be created if IT solutions cannot be enhanced within the business required timeframe or when an alternative technology solution is not available. An EUC must be compliant with the requirements of the End User Computing Policy (EUCP) and the End User Computing Standard (EUCS).

EUCs are developed by an End User outside of the approved software development control framework such as the Citi Solution Delivery Life Cycle (CSDLC).

An EUC can be an efficient tool for supporting Business Processes. However, it must be managed properly during its development, implementation, and use, to ensure there is an effective reduction of risk exposure.

The Risks Associated with EUCs

What are the risks associated with using EUCs?

The use of EUCs introduces risk into Citi’s environment because an EUC lacks controls found in formal applications managed by a centralized technology group.

Select each tab to examine the risks of using EUCs, the Risk Levels of an EUC and how to reduce our reliance on EUCs.

Risks of using EUCs
Risk Levels
Reduce reliance on EUCs

Risks of using EUCs

EUCs are used for Business Processes that:

  • Have material reporting impact on the enterprise
  • Support an upload of financial data to a Citi system
  • Support an important Business Process included in the assessment unit’s Manager’s Control Assessment (MCA)

As EUCs are typically developed, used, and managed by End Users, there are multiple inherent risks stemming from improper management, such as, but not limited to:

  • Data integrity issues
  • Unauthorized access
  • Loss of availability
  • Unapproved or unintentional changes

go to next button

Risk Levels

The inherent risks associated with the use of EUCs can only be mitigated after an EUC is identified, registered and risk assessed. EUCs can be classified into the following four Risk Levels: Critical, High, Medium, and Low.

We will take a closer look at these Risk Levels and the methods to evaluate the need to create an EUC and ways to risk reduce an EUC in the topic: EUC Prevention and Risk Reduction.

go to next button

Reduce reliance on EUCs

EUCs must be seen as interim solutions to business needs, with an end goal of reducing the use of EUCs through approved Risk Reduction methods, as appropriate.

One of these Risk Reduction methods is IT-enabled Smart Solutions (ITeSS) as an alternative to EUCs.

What is an IT-Enabled Smart Solution?


An IT-enabled Smart Solution (ITeSS) is developed on an approved ITeSS Platform and compliant with the ITeSS Standard. Solutions approved in ITeSS platforms reduce inherent risks associated with the creation of EUCs.

Contact your Business & Function IT to confirm the list of ITeSS Platforms that are approved.

Why should we consider the use of an alternative solution such as ITeSS?
ITeSS are lower risk alternatives than EUCs as they have higher levels of controls due to being developed on a Citigroup Solutions Inventory (CSI) registered platform. Any risks of End User developed tools, such as EUCs, are mitigated during the ITeSS development cycle.

ITeSS is also one of the three Risk Reduction methods to replace the creation of EUCs and reduce our reliance on existing EUCs. We will cover the other two methods in the next topic: EUC Prevention and Risk Reduction.

Determining if a tool is an EUC or ITeSS


The EUC and ITeSS Decision Tree is a series of questions and criteria used to determine if a tool is an EUC or ITeSS.

The benefits of using the Decision Tree include:

  • Visual presentation of the determining questions and criteria
  • Easy to interpret and follow the flow through to determining decision
  • Identification of current tools in use

Use the Decision Tree to review all tools in your group, identify if any EUC or ITeSS is in use, and register any unregistered EUC in the EUC Inventory Tool.

Remember
It is important to keep vigilant and regularly review business tools or applications you use, as EUCs can pose risks to Citi.

EUC & ITeSS Decision Tree Questions

The following questions will help you recognize whether a tool is an EUC or ITeSS.

Remember, always follow these questions when you are assessing an End User developed tool, as they will help you recognize the features of EUC and ITeSS.

If you would like to download a copy of the EUC and ITeSS Decision Tree, select here. This will be helpful for your understanding of the Decision Tree process. This copy will also be useful for some of the Knowledge Checks and Assessment Questions you will need to complete later.

Select each item to review the questions and for a closer look at the various features of EUC and ITeSS.

 

A – Is the tool only used for a one-time or ad hoc purpose (i.e., tool is not re-used, recreated, or reconstructed on a regular basis)?

The tool is only used for a one-time or ad hoc purpose if:
  • It is a one-time use or ad hoc request, i.e., not used to support a regular or repeated Business Process; or
  • It is not re-used on a standard frequency, such as daily, monthly, or annually; or
  • It does not use a template, prior version, or re-uses logic to re-use, recreate, or reconstruct the tool on a regular or repeated basis.

Note:

Tools that are created on a repeated basis to support a Business or Function process are not considered as one-time or ad hoc purpose (i.e., spreadsheets created for individual deals).

Decision

If Yes, the tool is not an EUC or ITeSS.

If No, move to question B.

B – Does the tool contain Logic?

Examples of Logic include but are not limited to:
  • Computations and calculations, such as a formula, function, or macro
  • Conditional processing, such as “if-then” functions
  • Information selection criteria, such as queries, pivots, and charts
  • Programming code such as VBA, R, Python, Java, and SQL

Note:

Tools only containing filters and no other Logic are not EUCs.

Decision

If Yes, move to question C.

If No, Tool is not an EUC or ITeSS.

C – Does the tool have material regulatory, management, financial, or risk reporting impact on the enterprise?

Examples of material reporting impact include but are not limited to:
  • Reports provided to supervisory regulators per the Global Regulatory and Management Reporting Policy
  • Reports used by Citi senior management (Executive Management Team (“EMT”) -1 or higher) per the Global Regulatory and Management Reporting Policy
  • Board Level or material Legal Entity Level Reports
  • Official Governance Committee Reports per Citi Governance Policy
  • BCBS 239 Key Reports
  • Reports provided to customers, investors, and counterparties

Note:

Materiality is determined by the Business and Function Process Owners or the In-Business Risk & Control committee.

Decision

If Yes, move to question F.

If No, move to question D.

D – Does the tool support an upload of financial data to a System of Record or Authorized Redistributor as defined by the Citi Data Governance Policy?

Decision

If Yes, move to question F.

If No, move to question E.

E – Does the tool support an activity or a control in the assessment unit’s MCA where the associated inherent risk level is 1-3?

Tools that do not support a Business Process/activity or control in the Assessment Unit’s MCA, with an inherent risk of 1-3 are not considered to satisfy the definition of an EUC.

Decision

If Yes, move to question F.

If No, Tool is not an EUC or ITeSS.

F – Is the development, implementation, and maintenance of the tool compliant with the Citi Solution Delivery Life Cycle Standard (CSDLC)?

Business and Function HEAP (Head of Enterprise and Architecture Planning) and CIO (Chief Information Officer) may provide special provisions to classify tools that are developed, implemented, and maintained following CSDLC-like controls such as Core IT System.

Decision

If Yes, Tool is a Core IT System, and not an ITeSS or EUC as it was developed, implemented and/or maintained in compliance with the CSDLC.

If No, move to question G.

G – Is the tool implemented on an approved ITeSS Platform and compliant with the IT-enabled Smart Solutions (ITeSS) Standard?

An ITeSS Platform is an application or system developed with Citi approved software to create, test, maintain, and execute ITeSS Use Cases. ITeSS Platforms must be registered in Citi System Inventory (CSI) and are owned and managed by Citi IT.

Decision

If Yes, Tool is an ITeSS.

If No, Tool is an EUC.

Knowledge Check

An IT-provided application is not immediately available or suitable for a specific Business Process need.

Creating a customized spreadsheet tool with formulas and macros for reconciling and consolidating data from various sources can significantly streamline a financial reporting process in each Business Process cycle.

However, this spreadsheet tool does not undergo IT-approved development steps such as CSDLC, therefore it does not meet IT security standards.

Using the EUC and ITeSS Decision Tree, is this tool potentially an EUC?

Select the correct response and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key to resume using the Space key.

Submit

Coming Next

In the next topic, we will take a closer look at EUC Prevention and Risk Reduction.

EUC Prevention and Risk Reduction

EUC Prevention and Risk Reduction

Here we will explore the steps to take before considering the creation of a new EUC, the four EUC Risk Levels and the alternative methods that can help reduce our usage of EUCs.

Scroll down to continue.

EUC Pre-Creation and Identification

Before an EUC is created, Citi Staff should consider these initial steps for reducing EUC risk exposure and limiting the firm’s overall reliance on EUCs:

  • Identify all unregistered EUCs; and
  • Evaluate alternative technology solutions prior to creating new EUCs and ensure proper pre-creation due diligence

Select each tab to take a closer look at both steps involved in the prevention process for creating an EUC.

EUC Pre-Creation
EUC Identification

EUC Pre-Creation

All Citi Staff must submit an EUC creation request to the EUC Accountable Business Owner (ABO) for review and approval prior to creating a new EUC.

An EUC Accountable Business Owner (ABO) is accountable for the compliance with the EUC Standard for all EUCs under their purview. Staff should consult with Business and Function IT and assess if the need for a new EUC can be met using an alternative technology solution or enhancing a Core IT System within the required timeframe to meet the business requirements.

go to next button

EUC Identification

All Citi Staff must identify all EUCs within their Business Process.

An EUC ABO should ensure that all tools used within the Business Processes are reviewed to identify all EUCs at least annually using the EUC & ITeSS Decision Tree.

EUC Registration and Risk Assessment

All Citi Staff must register and determine the risk level of all identified EUCs within their Business Process in the EUC Inventory Tool.

An EUC ABO reviews and approves the EUC Registration and Risk Assessment before an EUC can be used in the Business Process.

Knowledge Check

What are the appropriate actions to take if you suspect a potential EUC is in use in your Business Process?

Select all that apply and then select Submit.

Submit

EUC Risk Levels

EUCs can be classified into four Risk Levels: Critical, High, Medium, and Low.

Select each item to learn about the four Risk Levels and the changes that can raise the level of risk.

 

Critical

  • Involved in the direct data input, data correction, or report production of the Citigroup, and/or CBNA BCBS 239 Report
  • Supports a Data Operating Model (DOM) prioritized use case, identified in Operating Facts Manager (OFM)

High

  • Involved in the direct data input, data correction, or report production of other Regulatory or Management report(s) (e.g., generating data to be used in the report)
  • Models that are registered as High Risk in the Model Risk Management System
  • Used as a Data Source for a Franchise Critical or Data Bridge (169911) CSI Application
  • Contains data that is classified as Confidential Personally Identifiable Information (PII), Sensitive PII or Restricted
  • Used to comply with a surveillance activity, where non-compliance or an SLA breach or errors could result in a failure to comply with AML or other compliance standards
  • If the EUC calculates an adjustment

Medium

  • Involved in the analysis of the report’s output (e.g., variance analysis, either pre or post report production)
  • Registered as Medium Risk in the Model Risk Management System
  • Contains data that is classified as Internal PII or Confidential
  • Used to perform a function that is important to operation of a key Business Process defined in the MCA Standard

Low

  • Registered as Low Risk or Non-Material in the Model Risk Management System
  • Used as Data Source for a Non-Franchise Critical CSI Application
  • Contains data that is classified as Public or Internal

Controlling and Limiting EUCs


Remember, once you have identified an EUC you should:

  1. Register and risk assess the EUC in the EUC Inventory Tool
  2. Implement the appropriate controls to mitigate the risk exposure during the EUC’s use
  3. Have a Risk Reduction plan to reduce reliance on EUCs

Let’s take a deeper dive into the EUC Risk Reduction methods by exploring some scenarios.

In the following scenarios you will need to figure out which reduction method should be prescribed to resolve the risk-based issues.

EUC Risk Reduction Methods

While EUC Risk Reduction is always the goal, the ultimate objective for the firm is to eliminate Critical and High Risk EUCs as much as possible and reduce the reliance on EUCs.

Here are the three Risk Reduction methods prescribed by the EUC Standard to reduce reliance on EUCs.

Select the three circular images to examine the definitions of each method.

Business re-structuring/​Process re-engineering
 

Business re-structuring/Process re-engineering is a change or modification of the business such as divestiture.

It is also the change or modification of the Business Process(es) resulting from, but not limited to:

  • Business transformation
  • Organizational re-structuring
  • Process simplification
  • Process optimization

As a result of process re-engineering, the whole process undergoes a major change and the EUC is eliminated.
Migration/​Enhancement to Core IT system
 

An EUC is eliminated via Migration/​Enhancement to Core IT when the IT system or application is managed by Enterprise or Business and Function IT and the application complies with Citi Solution Delivery Life Cycle Standard (CSDLC) and all applicable Citi IT policies.

The CSDLC can be accessed within the Resources section.
IT-enabled Smart Solutions (ITeSS)
 

ITeSS Use Cases are built on approved ITeSS platforms managed by Business and Function IT. ITeSS Use Case Owners build Use Cases, but these Use Cases must comply with the ITeSS Standard and must be approved by Business and Function IT prior to deployment on the ITeSS platform.

ITeSS is one of the three Risk Reduction methods to replace Critical, High, and Medium Risk EUCs.

Knowledge Check 1

An EUC Owner is managing multiple EUCs to support critical tasks for their Business Process.

The unit’s EUC Accountable Business Owner advised the EUC Owner to consult their Business & Function IT Team to evaluate alternative solutions for their unit to reduce reliance on EUCs.

The Business & Function IT Team reviewed their unit’s EUCs and found out that an existing Core IT system can be enhanced within a reasonable time to support their specific Business Process requirements.

What type of Risk Reduction method is described in this case?

Select the correct response and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key to resume using the Space key.

Submit

Knowledge Check 2

Citi Staff use an EUC to consolidate data for a report that is shared with bank regulators. There has been a change in the requirement by the regulators that will result in modifying the report structure and submission.

Enhancing the Core IT System takes time and will not meet the business specific requirement.

Business and Function IT offered the Staff an alternative technology solution built on an approved ITeSS Platform to automate the manual process which results in eliminating the need for the EUC.

What type of Risk Reduction method is described in this case?

Select the correct response and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key to resume using the Space key.

Submit

Coming Next

The following topic will provide a recap of the course before you attempt the Assessment.

Summary

Course Summary

Review the key takeaways from this course.

Scroll down to continue.

EUC and ITeSS Standard Course Summary


In this course, you learned that:

  • Improper management of end user developed applications or tools such as EUCs, present inherent risk for Citi's operations.

  • The use of the Decision Tree provides consistency in identifying and validating End User developed tools that are EUCs and ITeSS.

  • Prior to creating new EUCs, Citi Staff should check if alternative technology solutions are available.

  • Identify all unregistered EUCs, register them, and determine their risk level.

  • Eliminating Critical and High Risk EUCs is the ultimate objective for the firm and there are three Risk Reduction methods to reduce our reliance on EUCs.

  • Identifying an EUC requires registration and risk assessment with the EUC Inventory Tool, implementation of controls to lower risk exposure during an EUC’s use and the development of an EUC Risk Reduction plan.

Coming Next

In the next topic, it’s time to check your understanding of the content by completing a short assessment.

Assessment

Assessent Intro

Which of the following selections does this statement describe:

It is a series of questions and criteria that is used to determine if a tool is an EUC or ITeSS.

Select the best response and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key to resume using the Space key.

Submit

According to the Decision Tree, which criteria support correctly defining an End User Computing or IT-enabled Smart Solution?

Select all that apply and then select Submit.

Submit

What are the initial steps for reducing EUC risk exposure and limiting the firm’s over-all reliance on EUCs?

Select all that apply and then select Submit.

Submit

Which of the following are examples of inherent risks presented by End User developed tools such as EUCs?

Select all that apply and then select Submit.

Submit

What should all Citi Staff do prior to creating a new EUC?

Select the best option and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key to resume using the Space key.

Submit

Once you have determined that a tool you are using to support your business process is an EUC, what is the first action to take?

Select the best option and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key to resume using the Space key.

Submit

What are the Risk Reduction methods prescribed by the EUC Standard to reduce reliance on EUCs?

Select all that apply and then select Submit.

Submit

In contrast to EUCs, ITeSS enables a path for End User developed tools to reduce risk for Citi.

Which of the following statements is also true about ITeSS?

Select the best option and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key to resume using the Space key.

Submit

What is the risk level classification of an EUC that is involved in the direct data input, data correction, or report production of the Citigroup, and/or CBNA BCBS 239 Report?

Select the best option and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key to resume using the Space key.

Submit

Which of the following statements accurately describes ITeSS?

Select the best option and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key to resume using the Space key.

Submit

Assessment Results

Copyright © Citi and/or its affiliates. All rights reserved.

This course provides an overview of End User Computing (EUC) and Citi’s effort in reducing the risk and reliance on EUCs by considering alternative technology solutions including approved IT-enabled Smart Solutions (ITeSS).

This training will take approximately 20 minutes to complete.

Scroll down to view the topic list, then select the Introduction topic to begin. Select the Home button at any time to return to this menu.

This course is divided into four topics and an end-of-course assessment. After completing the training content, you must score 80% or higher in the assessment to receive credit for this course.

A list of useful links is available at any time by selecting the Resources button .

If you are accessing the course from a personal device directly over the Internet (outside of the Citi network), some links may not work if they link to content within Citi’s network. This will not impact your ability to complete the course.

Topics

Introduction

End User Computing and IT-enabled Smart Solutions

EUC Prevention and Risk Reduction

Course Summary

Assessment

Home
Introduction to the End User Computing (EUC) and IT-enabled Smart Solutions (ITeSS) Standard
Introduction
End User Computing and IT-enabled Smart Solutions
EUC Prevention and Risk Reduction
Course Summary
Assessment

go to close menu button

 

go to close button