An internationally active private bank was required to address outstanding findings identified during a Section 44 regulatory audit while simultaneously implementing the requirements of DORA. The institution faced the challenge of strengthening its Third-Party Risk Management (TPRM) framework, enhancing governance structures, and establishing sustainable operational processes.

We assessed the existing operating model, prioritized the regulatory remediation measures, and developed a target operating model together with the relevant stakeholders. Our support included the redesign of policies and governance structures, the implementation of key outsourcing processes, the development of a new risk assessment methodology, and the reassessment of all existing outsourcing arrangements and third-party relationships.

As a result, all Section 44 audit findings were successfully remediated, and a DORA-compliant TPRM framework was established. The organization now benefits from a robust governance structure, consistent risk assessment standards, and a sustainable approach to managing third-party risks.

A national private bank sought to establish a consistent and regulatory-compliant approach to auditing its service providers. At the time, there was no overarching framework linking risks, responsibilities, and the involvement of relevant control functions in a structured and transparent manner.

We developed a risk-based audit framework built on the results of the bank’s third-party risk assessments and centrally coordinated through the Third-Party Risk Management (TPRM) function. All relevant second-line-of-defense functions were integrated into the approach, and a standardized audit plan was established, supplemented by provider-specific risk profiles. In addition, we designed processes for the planning, execution, governance, and follow-up of service provider audits.

As a result, the bank now benefits from a transparent and well-documented approach to auditing its service providers. Audit activities are planned and performed based on risk, while relevant control functions are involved in a structured and efficient manner. This has significantly strengthened the management of third-party risks and improved the efficiency and consistency of audit planning.

A bank was required to further enhance its Third-Party Risk Management (TPRM) framework to meet regulatory expectations. A particular focus was the efficient and transparent implementation of requirements defined by a special commissioner.

To address these requirements, we tailored our proven outsourcing management solution, ExAM, to the bank’s specific processes, governance structure, and regulatory needs. Following implementation, we provided training and operational support to ensure the solution was fully embedded within day-to-day activities.

As a result, ExAM was accepted by the special commissioner and recognized as a suitable foundation for the ongoing operation and development of the bank’s TPRM framework. Today, the institution benefits from a practical, regulatory-compliant solution that has been successfully integrated into its operational environment.

A financing provider sought to professionalize its Third-Party Risk Management (TPRM) framework efficiently, without having to develop its own IT solution. The objective was to implement a tool that supports regulatory requirements in a practical manner and can be deployed quickly.

We provided our proven ExAM solution, tailored it to the organization's specific requirements, and demonstrated the relevant functionalities through a live demo. In addition, we introduced the key use cases and supported the integration of the solution into the client’s existing processes and governance framework.

As a result, the organization received a ready-to-use solution specifically adapted to its operational needs. Today, the structured use of ExAM supports the efficient management of outsourcing arrangements and significantly improves the consistency and quality of documentation.

A factoring company was looking for a fast and pragmatic way to professionalize its established Third-Party Risk Management (TPRM) framework. The objective was to implement an immediately usable solution without the need for a lengthy implementation project or significant internal effort.

We provided our proven ExAM solution and introduced its key functionalities in two focused online sessions. The tool was integrated directly into the existing operating model and has since supported the day-to-day management, documentation, and monitoring of outsourcing arrangements.

As a result, the client was able to benefit from a structured and efficient operating model with minimal implementation effort. Today, ExAM serves as the central tool supporting the organization’s TPRM and outsourcing management activities, enhancing transparency, consistency, and traceability across its operational processes.

An automotive bank was tasked with implementing the requirements associated with the BaFin template for Third-Party Risk Management (TPRM) across the entire group. The key challenge was to establish a consistent approach across numerous subsidiaries, each with different responsibilities, processes, and levels of data maturity.

We led the functional implementation effort, coordinated the involvement of all participating entities, and developed a standardized operating model for data collection and quality assurance. In addition, we supported business and control functions in interpreting the regulatory requirements and ensuring the consistent completion of the template across the group.

As a result, the organization established a consolidated and reliable data foundation covering all relevant entities. Today, the bank benefits from a transparent group-wide view of its outsourcing arrangements and a structured process for the ongoing maintenance and enhancement of regulatory information and reporting requirements.

A building society sought to future-proof its Third-Party Risk Management (TPRM) framework through the implementation of our ExAM solution while simultaneously addressing the requirements of the Digital Operational Resilience Act (DORA). The challenge was to bring together existing processes, data structures, and regulatory requirements within a sustainable and scalable operating model.

We supported the organization in the functional design of the target framework, defined the business requirements for the new platform, and guided the business analysis activities. In addition, we managed the implementation process, developed the functional requirements necessary for DORA compliance, and led the business testing activities through to successful deployment.

As a result, the building society now benefits from a centralized platform supporting the management of its TPRM and outsourcing activities. DORA requirements have been embedded within the system, and key processes have been standardized. This has significantly improved transparency, data quality, and the efficiency of day-to-day third-party risk and outsourcing management activities.

An asset manager faced the challenge of implementing the requirements for a complete and reliable information register in an efficient and sustainable manner. At the same time, the organization wanted to reduce manual effort and significantly improve the quality and consistency of the underlying data.

We implemented our specialized InfoRex solution for the creation and maintenance of the information register and supported its functional configuration. In addition, we assisted with structuring the required data and migrating existing information into the new framework and methodology.

As a result, the asset manager now benefits from a centralized and transparent information register that reliably supports regulatory requirements. Data maintenance has become significantly more efficient, while transparency, consistency, and the overall quality of reporting and analysis have improved considerably.

A German fund bank was tasked with creating and submitting its DORA information register within a demanding timeframe while ensuring completeness and accuracy. The collection of information proved particularly challenging: data had to be consolidated from numerous sources, information provided by service providers needed to be validated, and newly introduced regulatory requirements had to be incorporated. The project was further complicated by the late availability of the BaFin template, limited market experience, and unclear validation messages during testing.

We assumed functional leadership of the project, established a comprehensive tracking process for questionnaires and supporting evidence, and consolidated data from multiple sources into a centralized master file. Approximately 60 contracts were reviewed and quality-assured, missing information was clarified with business units and service providers, and all data was progressively migrated into the final BaFin template. In addition, we supported all testing activities within the MVP portal, identified validation errors, and coordinated their successful remediation through to final acceptance.

As a result, the DORA Information Register was submitted successfully, on time, and without errors via BaFin’s production environment. All validation issues were resolved after only a limited number of test cycles. Today, the fund bank benefits from a robust Information Register and a transparent, well-structured data foundation that significantly simplifies future maintenance activities and regulatory reporting requirements.