# The Swedbank Outage shows that Change Controls don't work

DevFeed: [The Swedbank Outage shows that Change Controls don't work](<https://devfeed.tech/articles/the-swedbank-outage-shows-that-change-controls-don-t-work-27908.md>)

Original publisher: [Read original article](<http://highscalability.com/blog/2023/8/16/the-swedbank-outage-shows-that-change-controls-dont-work.html>)

Author: Bruce Johnston

Published: 2023-08-16T17:05:12Z

Content type: opinion

Language: en

Sources: [High Scalability](<https://devfeed.tech/sources/high-scalability.md>), [High Scalability](<https://devfeed.tech/sources/high-scalability-2.md>)

Topics: [incident](<https://devfeed.tech/topics/incident.md>), [systems](<https://devfeed.tech/topics/systems.md>)

Tags: [banking](<https://devfeed.tech/tags/banking.md>), [change](<https://devfeed.tech/tags/change.md>), [incident](<https://devfeed.tech/tags/incident.md>), [management](<https://devfeed.tech/tags/management.md>), [outage](<https://devfeed.tech/tags/outage.md>), [payments](<https://devfeed.tech/tags/payments.md>), [risk-management](<https://devfeed.tech/tags/risk-management.md>)

## AI overview

The article examines the Swedbank outage caused by an unapproved IT change and the Swedish FSA's findings that the bank's internal controls and change management process failed. It argues that manual approvals and change meetings do not by themselves mitigate risk in modern technology organizations.

## Source excerpt

This week I've been reading through the recent judgment from the Swedish FSA on the Swedbank outage. If you're unfamiliar with this story, Swedbank had a major outage in April 2022 that was caused by an unapproved change to their IT systems. It temporarily left nearly a million customers with incorrect balances, many of whom were unable to meet payments. After investigation, the regulator found that Swedbank had not followed their change management process and issued a SEK850M (~85M USD) fine. That's a lot of money to you and me, but probably didn't impact their bottom line very much. Either way I'm sure the whole episode will have been a big wake up call for the people at the bank whose job it is to ensure adequate risk and change controls. So, what went wrong and how could it have been avoided? How did the Swedbank incident happen? The judgment doesn't describe the technical details behind the incident, but it does provide glimpses into how they assessed what went wrong: "The deficiencies that were present in Swedbank's internal control made it possible to make changes to one of the bank's most central IT systems without following the process in place at the bank to ensure continuity and reliable operations. This violation is therefore neither minor nor excusable." "none of the bank's control mechanisms were able to capture the deviation and ensure that the process was followed" "one of the main causes underlying the IT incident was non-compliance with the change management process and that it is probable that this also resulted in a slower analysis of the incident and a greater impact on the operations." "good internal control is a prerequisite for a bank to be able to fulfill the requirements on risk management" Even if you think $85M isn't much of a fine - simply the cost of doing business - the full range of options open to the regulator included removing Swedbank's banking license: "It is therefore not relevant to withdraw Swedbank's authorisation or issue th