Assess changes reliably in accordance with MaRisk AT 8.2
Changes to IT, processes and organisational structures can affect an institution's risk profile. A structured risk analysis in accordance with MaRisk AT 8.2 provides transparency and auditability.
The scenario
Assess changes systematically
for potential risks
Changes to organisational structures and processes, as well as to IT systems, can affect existing control mechanisms and an institution's risk profile. Under MaRisk AT 8.2, material changes therefore require an early assessment of their impact on control procedures and control intensity. In practice, this requires a consistent approach that classifies changes transparently and determines the necessary depth of analysis.
The challenge
Requirements for a robust risk analysis
The central challenge for the bank is to systematically capture the effects of a change and derive a sound risk assessment. Project management must first identify which departments are affected by the change. At the same time, it must ensure that the resulting risk assessments are documented transparently, traceably and in an audit-ready manner. Appropriate risk mitigation measures must then be defined on this basis.
,allowExpansion)
,allowExpansion)
The solution
Standardised assessment of material changes
The proven approach combines a standardised preliminary assessment with a consistent institution-wide framework for assessing materiality. For material changes, this is followed by a detailed analysis of the impact on control procedures and control intensity, involving the affected organisational units and relevant control functions.
In addition, further risk factors are considered and appropriate measures are defined, integrating regulatory requirements with existing change management, governance and IT processes.
The implementation
Systematically analyse and classify changes
Implementation follows a consistent process, from the initial assessment through to the documented decision on the measures to be taken. Criteria, assessments and justifications are supported by concrete facts relating to the change concerned, ensuring transparent and traceable documentation.
#1 Standardized Preliminary Examination
First, it will be checked which processes, organizational units, critical IT systems, controls, and data repositories are affected. Special triggers include migrations, releases, and cut-over scenarios, changes to risk management, payment transactions, or reporting, as well as impacts on internal control systems, information security, compliance, and other regulatory functions.
#2 Classification of Change
The classification as essential or non-essential is based on defined criteria. Key factors include relevance to business operations, changes in the risk profile, interventions in critical systems or controls, complexity and dependencies, as well as the potential financial, regulatory, or reputational damage extent.
#3 In-Depth Risk Analysis
In the case of significant changes, the probability of occurrence and potential damage amounts are assessed. In particular, operational and IT risks, information security and data protection, compliance and internal control systems, as well as – if relevant – third-party, emergency, data quality, reporting, and notification risks are considered, involving the responsible functions.
#4 Action Derivation
Concrete measures are derived from the identified risks. These include additional controls, expanded tests and technical safeguards, training, adapted emergency and fallback concepts, as well as updates to work instructions and process documentation.
The result
Audit readiness through consistent assessment criteria
A clear methodology provides a robust basis for consistently assessing material changes and documenting decisions transparently. Institutions identify the impact on control mechanisms at an early stage, involve relevant stakeholders systematically and define the necessary actions in a traceable manner. Fincon Reply supports the integration of this approach into existing change management, governance and IT processes, combining regulatory compliance with efficient workflows.
Fincon Reply is a business and IT consulting company with a focus on the financial services industry. We advise banks, the Sparkasse Finance Group, the Genossenschaftliche FinanzGruppe and insurance companies as well as their suppliers on their digital transformation. Core banking systems, insurance systems and their system landscapes are our areas of expertise. From the individual commissioning of experts to customized project teams and ready-to-use solutions - we provide you with everything you need from a single source.