Parent Company
Independent licensee with institution-specific business model, central management functions and group-wide service relationships.
Two companies. Two supervisory regimes. One claim: a consistent, proportional and audit-proof written fixed order for the entire corporate group.
The challenge was not a missing individual document. It lay in the relationships between them: divergent requirements, shared resources, group-internal services and historically grown responsibilities had to be transferred into a contradiction-free overall system.
Independent licensee with institution-specific business model, central management functions and group-wide service relationships.
Independent licensee with institution-specific business model and recipient of group-internal governance and ICT services.
Bring the loose ends together — without dissolving the legal independence of the institutions. THE MANDATE CORE
The working approach did not follow a document checklist. The starting point was the business model, responsibility architecture and risk profile. Only then was the required documentation derived.
The map shows the written fixed order from the auditor's perspective: from the business model to strategies and risk architecture to guidelines, processes and reliable evidence.
Anonymized reference mandate. Scope, designations and regulatory allocation must always be validated institution- and situation-specifically.
Quality is not measured by the number of pages, but by whether management, departments, control functions and auditors recognize the same system.
KWG, ZAG, MaRisk and DORA requirements are evaluated separately and deliberately linked.
As much regulation as necessary, as little complexity as possible — no over-compliance.
Responsibility, process, control point and evidence are consistently thought together.
Versioning, release, references and evidence create an audible chain of effects.
Similar situation?