Strengthen Third-Party Risk Management governance to meet European Central Bank regulatory requirements.
Context
A European banking group generating more than €3 billion in banking revenues is subject to a European Central Bank inspection focused on its Third-Party Risk Management (TPRM) framework. The inspection results in a set of remediation recommendations, with prolonged non-compliance exposing the bank to regulatory sanctions and potential restrictions on its banking license and business activities.
Following an initial response that establishes a high-level TPRM strategy, the bank engages Albus Partners to operationalize this strategy and sustainably strengthen its governance, risk oversight, and control framework.
Our approach
The engagement is structured around three key workstreams:
Establishment of the Third-Party Risk Management function:Designed and implemented a dedicated TPRM function within the Finance organization, in close collaboration with Procurement. This included defining the target governance model, roles and responsibilities, and the associated decision-making and oversight bodies.
Development of TPRM governance tools and processes: Designed and built from the ground up a semi-automated TPRM dashboard consolidating 20 Key Risk Indicators (KRIs), providing regular reporting to the Board of Directors and the Supervisory Board. The solution was subsequently handed over to internal teams, enabling autonomous monthly updates and quarterly executive reporting.
Enhancement of third-party selection and onboarding processes:Redesigned the supplier assessment framework in partnership with Procurement teams and introduced additional control gates to ensure TPRM risks are systematically assessed and addressed from the earliest stages of third-party selection and onboarding.
Results
Closure of all recommendations issued by the European Central Bank, eliminating the risk of sanctions related to Third-Party Risk Management (TPRM).
A sustainable Third-Party Risk Management function, fully integrated into the organization's operating model and managed autonomously by internal teams.
