Crisis Management (NFR)

Crisis management encompasses all measures for preparing for, managing, and recovering from crisis situations. For banks, MaRisk AT 7.3 and BAIT mandate establishing emergency management that ensures the continuity of critical business processes. DORA adds specific requirements for ICT-related incident response from 2025. Effective crisis management protects against reputational damage, regulatory sanctions, and existentially threatening operational disruptions.

Business Continuity Management (BCM) is the overarching management process that identifies which time-critical processes must be maintained during disruptions. Emergency planning defines concrete measures for emergency operations and recovery, including resources, responsibilities, and timelines. Crisis management activates the crisis team and coordinates decision-making, communication, and escalation during an acute crisis. All three disciplines interlink and must be planned in an integrated manner.

The crisis team typically includes the executive board, risk management, IT, legal, compliance, communications, and affected business units. The structure must be predefined with clear roles, deputies, escalation paths, and decision-making authority. A crisis handbook documents alerting chains, situation room setup, and reporting channels. Regular crisis exercises, at minimum annually, ensure the crisis team functions under pressure.

MaRisk AT 7.3 requires emergency concepts for time-critical activities and processes with regular review and testing. BAIT specifies IT emergency management requirements. DORA mandates ICT-related incident reporting and response, digital operational resilience testing, and information sharing from 2025. BSI Standard 200–4 provides a recognized BCM framework. BaFin reviews the adequacy of emergency management under SREP and expects documented business impact analyses.

The Business Impact Analysis identifies and assesses the effects of operational disruptions on business processes. It determines Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for each critical process, defines maximum tolerable downtime, and identifies dependencies between processes, systems, and external service providers. The BIA forms the foundation for all emergency plans and is mandatory for financial institutions under MaRisk and DORA.

Crisis exercises follow a defined sequence: planning with a realistic scenario (cyberattack, system failure, natural disaster), execution under conditions as realistic as possible with an activated crisis team, observation and documentation by an evaluation team, and structured debriefing with lessons learned and improvement measures. MaRisk requires at minimum annual emergency tests. ADVISORI supports from scenario development through exercise execution to results evaluation.

Costs depend on maturity level and scope. Typical project budgets range from EUR 100,

000 to 300,

000 for complete BCM setup including business impact analysis, emergency plans, crisis team establishment, crisis handbook, and initial exercise. Ongoing support including annual reviews, exercise delivery, and plan updates requires additional resources. ADVISORI offers modular packages from BCM quick checks through full implementation to ongoing crisis management support.