Outsourcing Management Health Check: Maturity and Compliance Review

An outsourcing management health check systematically reviews all core areas of your outsourcing governance: the outsourcing strategy and its alignment with business objectives, the completeness of the outsourcing register under MaRisk AT

9 and DORA, risk assessment methodology for material and critical outsourcing arrangements, due diligence processes for vendor selection, SLA monitoring and performance oversight, escalation and exit management, and compliance with BaFin notification requirements. The goal is an objective status assessment with concrete gap findings and prioritised recommendations.

The health check covers all relevant regulatory frameworks: MaRisk AT

9 (outsourcing requirements), DORA Chapter V (ICT third-party risk management and information register), EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02), BAIT/VAIT/KAIT for IT outsourcing, Section 25b of the German Banking Act (KWG) for credit institutions, and BaFin circulars on notification obligations. We assess each requirement against your current state and document gaps with severity ratings and urgency classification.

An audit checks compliance with defined requirements and ends with pass/fail assessments. A health check goes further: it evaluates the maturity of your entire outsourcing management using a stage model (typically

5 levels from ad-hoc to optimised), identifies best-practice gaps beyond minimum regulatory requirements, and delivers a concrete improvement roadmap. While audits look backwards, the health check is forward-looking and shows where the greatest leverage for improvement lies.

The most frequent findings from our practice: incomplete outsourcing registers (missing sub-contractor chains, no DORA-compliant ICT classification), gaps in risk analyses without concentration risk consideration, missing or untested exit strategies for critical outsourcing arrangements, SLA monitoring without measurable KPIs or automated escalation, outdated contracts lacking DORA clauses (audit rights, access, termination periods), and poor integration between outsourcing management, IT risk management and internal audit.

A focused health check for 10–20 outsourcing arrangements typically takes 3–4 weeks; a comprehensive review for institutions with over

100 arrangements takes 6–8 weeks. The process: kick-off and document review (week 1), interviews and process analysis (weeks 2‑3), gap assessment and maturity rating (weeks 3‑4), management presentation with action plan (week 4). Costs depend on institution size and outsourcing complexity.

Recommended triggers: before upcoming BaFin special audits or year-end audits with outsourcing focus, after new regulation takes effect (DORA since January 2025, MaRisk update), when significant changes occur in the outsourcing landscape (cloud migration, vendor changes), as a regular status assessment every 12–18 months, or after incidents related to outsourcing. The earlier gaps are identified, the more cost-effective the remediation.

ADVISORI conducts the health check as an independent third party, drawing on experience from over

100 outsourcing reviews at banks and financial service providers. Our approach: standardised assessment matrix based on MaRisk AT 9, DORA and EBA guidelines, maturity model with

5 levels and industry benchmarking, structured interviews with outsourcing officers, IT, risk management and internal audit, prioritised action plan with quick wins, and optional support during implementation.