Counting the manual steps before choosing the system

I keep a register of every recurring task that staff perform because a system cannot: a spreadsheet maintained beside the ledger, a field typed twice, a call made to confirm something the data should already say. Each entry has an owning manager, an estimate of monthly hours, the risk it carries and the system change that would remove it. Operations colleagues add entries; my team does not decide alone what counts. The register opened in September 2021 with 212 entries and held 104 in June 2026, after many removals and some new additions. I put it beside every technology proposal, so the board risk committee can see what an investment retires and what it leaves untouched. A proposal that adds a channel while preserving twenty workarounds deserves a different conversation from one that removes them.

Our deposit and mortgage ledger dates from 1987 and runs on a mainframe hosted by an outsourced provider. Replacing it is necessary, but the first lesson of our inventory was that most of the trouble attributed to the ledger arrived from outside it, in broker files and deposit-dealer instructions. I therefore sequenced modernisation from the edges inward: validating data where it enters, standardising the files our eleven deposit brokers send, and placing a posting service in front of the mainframe so channels no longer wait for its batch timetable. The core contract we signed in 2024 then needed 46 interfaces rather than 81. I still want a new core. I simply want it to inherit cleaner inputs, a shorter list of exceptions and a team that understands why each remaining interface exists.

We run digital channels, the broker portal and our data platform in a Canadian region of a public cloud provider; the ledger stays on the hosted mainframe until conversion. As a federally regulated institution, we work within OSFI's guideline on technology and cyber risk management and its expectations for third-party arrangements, which I read as asking whether we understand, control and could leave each material service. For each arrangement my team keeps a costed exit plan, evidence of the provider controls we rely on, and encryption keys we manage ourselves. Customer-managed keys cost us some convenient services, and I accept that. I also report concentration plainly: three of our most important systems depend on two providers, and the risk committee should weigh that rather than assume a contract has transferred the risk.

Mortgage fraud at a broker-funded lender usually arrives as a well-presented document: an altered employment letter, an edited bank statement, a pay stub from an employer nobody can reach. Since 2024 we verify income and account data directly from source, with the applicant's consent, and check every uploaded document for signs of editing. Online GIC openings use document and face matching alongside the identity-verification requirements of federal anti-money-laundering rules. I care as much about the person a control wrongly stops. Newcomers to Canada, self-employed borrowers and older depositors without a smartphone need an alternative that is not slower by design. We staffed a referral desk for them and track how many applicants it serves, how long they wait and how many are later approved.

Canada is moving towards real-time payments and a federal framework for consumer-driven banking, both still being implemented. I prepare for them in general terms rather than by predicting dates. The common requirement is that our systems answer correctly at any hour without a person correcting the ledger overnight. We built a posting layer that applies payments intraday, automated most exception handling and created internal application programming interfaces for account and transaction data, with a consent record attached to every access. When the federal rules settle, we expect to adapt these interfaces rather than build new ones. I would rather explain a later connection to the board than connect early and depend on staff resolving exceptions by hand after customers have been told their money moved.