Outsourcing management is one of the most demanding cross-cutting areas of regulatory compliance. With the stricter requirements of AT 9 MaRisk, Section 25b of the German Banking Act (KWG), the EBA guidelines on outsourcing and, in particular, the DORA Regulation with its far-reaching specifications for ICT third-party risk management, the effort required to set up, maintain and manage regulatory-compliant outsourcing management has increased significantly. WCTS supports you in structurally establishing the outsourcing function, running it permanently or acting as a reliable deputy during bottlenecks.
About
Effective outsourcing management combines legal, regulatory and operational expertise, from the initial risk analysis of individual outsourcing arrangements, contract management and ongoing monitoring, through to regulatory notifications and the maintenance of the outsourcing register. In addition, there are specific DORA requirements for ICT third-party service providers: detailed contractual content pursuant to Art. 30 DORA, identification of critical and important functions, concentration risk analyses, exit strategies as well as the mandatory register of information. We offer our services flexibly across three models:
Full outsourcing of the function — we take over the outsourcing management professionally and permanently as an external function: risk assessment of new outsourcing arrangements, management of the contract process including clause reviews under MaRisk, EBA Guidelines and DORA, maintenance of the central outsourcing register as well as the DORA register of information, ongoing monitoring of service providers, notifications pursuant to Section 24 KWG, reporting to senior management and supervisory bodies, as well as escalation in the event of performance issues or concentration risks.
Support for your internal function — you retain the function internally, and we provide selective or ongoing support: in the initial design of a compliant outsourcing management framework, in the revision of policies and processes, in DORA readiness and the alignment of existing contracts with Art. 30 DORA, in conducting risk assessments of individual outsourcing arrangements, in preparing concentration risk analyses and exit strategies, or in setting up the outsourcing register and register of information.
Temporary execution of the function — in the event of vacancies, cover requirements or during periods of increased workload, such as during DORA implementation, in the context of M&A-related contract migrations or during extensive contract renegotiations, we take over the function on a temporary basis, ensuring the continuous, regulatory-compliant execution of these tasks.
We tailor the scope and intensity of our services to the business model, the outsourcing landscape and the risk profile of your institution, ensuring that requirements from MaRisk, KWG, EBA Guidelines and DORA are met consistently.
