Vendor Governance: Effective Service Provider Management

Vendor governance is the systematic oversight, assessment and management of external service providers throughout the entire outsourcing relationship. For financial institutions it is especially critical because MaRisk AT

9 and DORA impose binding requirements on outsourcing management. BaFin regularly examines whether institutions adequately govern their vendors – and audit findings in this area are among the most common supervisory complaints. Core elements include SLA monitoring, risk-based KPIs, regular assessments and documented escalation processes.

MaRisk AT

9 requires risk-based governance of all material outsourcing arrangements with continuous monitoring, regular risk analyses and documented exit strategies. DORA (Chapter V) extends this with specific requirements for ICT third-party providers: a complete register of information, concentration risk analyses, minimum contractual requirements and audit rights. Since January 2025, institutions must comply with both frameworks in parallel – the so-called dual-framework model for ICT and non-ICT outsourcing.

Effective KPIs for vendor governance operate across three tiers: operational (SLA fulfillment, response times, error rates), tactical (risk assessment, compliance status, cost adherence) and strategic (value contribution, innovation performance, partnership quality). The key is linking KPIs to defined thresholds with automated escalation levels. For regulated institutions, KPIs must also reflect MaRisk and DORA requirements – such as availability of critical ICT services or adherence to contractual audit rights.

Vendor selection covers the identification, evaluation and contracting of suitable service providers before the agreement is signed. Vendor governance begins afterwards and covers the entire ongoing relationship: performance monitoring, risk management, escalation, regular assessments and potentially exit management. Under MaRisk and DORA both phases are regulatory-relevant, but governance is the more resource-intensive part with continuous reporting and evidence obligations.

ISAE

3402 reports (Type I and Type II) and ISO 27001 certifications are important but insufficient evidence on their own. The OeNB and BaFin emphasize: a certification does not replace the institution’s own assessment. What matters is substantive evaluation – does the audit scope match the outsourced functions? Are the tested controls relevant to the institution’s own risk profile? Type II reports covering an audit period are more meaningful than Type I reports that only capture a point in time.

Audit findings on vendor governance are among the most common BaFin complaints during special examinations under Section

44 KWG. Typical findings concern inadequate SLA monitoring, missing risk analyses, superficial evaluation of vendor reports and absent exit strategies. Institutions must remediate findings within defined deadlines and demonstrate implementation. Repeated deficiencies can lead to supervisory measures – up to orders for re-insourcing critical functions.

ADVISORI implements MaRisk- and DORA-compliant vendor governance for financial institutions. Our services include: design of governance structures with multi-tier management levels, development of risk-based KPI frameworks, implementation of monitoring and reporting systems, conducting vendor assessments and health checks, creation of exit strategies and contingency plans, and build-out of the DORA register of information. As a consultancy specialized in regulated institutions, we combine operational vendor management with regulatory compliance.