Member of the Month | Mr. Ben So: Risk is a Conversation, Compliance is Only the Starting Point

This month, the Hong Kong China Network Security Association (HKCNSA) is delighted to feature Mr. Ben So as our Member of the Month.

With nearly three decades of experience in banking technology and information security in Hong Kong, Ben has witnessed every major shift in banking digitalization—from early infrastructure management to leading technology risk management today—and has personally experienced the evolution of the technology risk function from "back-office support" to the "core of corporate strategy."

Over the years, he has continuously pondered a fundamental question: In an environment of accelerating technological advancement, how can organizations effectively manage risk while maintaining innovation and competitiveness?

Risk is Not Just a Calculation, It Is a Conversation

Reflecting on his years of experience, Ben points out that many people equate risk management with calculating probabilities and filling out risk registers. However, he notes that the most dangerous risks are often the ones that never make it onto a spreadsheet: "The cultural blind spots, the unspoken assumptions, and the decisions deferred because no one wanted to raise an uncomfortable question in the boardroom are where risk truly accumulates." In his view, risk management is inherently a continuous conversation rather than a one-time calculation.

He emphasizes the critical importance of risk communication. Technology risk professionals cannot simply report that "our platform has a critical vulnerability"; instead, they must translate technical findings into business consequences that senior executives understand: "If this vulnerability is exploited, we face potential regulatory scrutiny, customer data leakage, and reputational damage that could take several years to repair." 

Moving from the Back Office to the Core

Spanning infrastructure management, information security, and technology risk management, Ben recalls that technology risk was once viewed primarily as a support function focused on system stability and regulatory compliance. With the rapid development of digital banking, fintech, open banking, and artificial intelligence, technology has gradually become the core of business operations.

Today, he points out, technology risk teams no longer just monitor control implementation; they must participate in business strategy discussions, help companies strike a balance between innovation and risk, and ensure the safe deployment of new technologies. Technology risk management is progressively evolving from a traditional control function into a vital advisory role in corporate decision-making.

Compliance is the Floor, Not the Ceiling

"Compliance is the floor, not the ceiling." 

Ben uses this phrase to summarize his view on compliance. He believes that many institutions spend vast resources satisfying regulations and audits, but if the goal is merely to "pass the audit," true defensive capabilities do not improve. "What truly matters is continuous operational resilience and the capability to navigate the unknown." 

Looking ahead, risk management will place even greater emphasis on continuous monitoring, ongoing improvement, and adaptability. Organizations must build the capability to address unknown challenges, rather than merely meeting regulatory requirements.

This mindset applies equally to emerging technologies. Whether dealing with artificial intelligence, data analytics, or future technological applications, enterprises must maintain a balance between governance frameworks, risk assessment, and business development, rather than reacting only after issues arise.

What Does the Next Generation Need?

Regarding talent development, Ben offers pragmatic advice. He believes that young professionals should build a comprehensive skill set rather than focusing solely on obtaining certifications or mastering a single specific technology. While technical knowledge is essential, understanding business operations, communicating effectively with diverse stakeholders, and thinking from a risk perspective are equally indispensable.

"Get your hands dirty first." He advises aspiring professionals entering technology risk and cybersecurity to build experience through foundational operations and technical work. In his view, only by troubleshooting system failures at 4 AM or personally investigating security incidents can one truly understand the root causes behind risks. In a rapidly changing digital environment, continuous learning has become a fundamental requirement.

Conclusion

Ben's experience reflects a critical trend: technology risk management is no longer merely a component of compliance work, but a vital foundation for building organizational resilience.

Today's technology risk professionals must understand technology as well as business, regulatory environments, and organizational operations. Their role has progressively shifted from controlling risk to helping enterprises achieve innovation and sustainable growth under controllable risk conditions.

Risk is never just a mathematical formula; it is a continuous conversation. Compliance is merely the starting point for building long-term resilience.

HKCNSA is delighted to feature Mr. Ben So as this month's Member of the Month, and looks forward to his continued contributions of professional insights to technology risk management, cybersecurity governance, and fintech development.