Michael Schwendemann-Compliance Consultant

Compliance department setup & DORA operationalization

• Setup of a complete compliance organization according to DORA
• Development and operationalization of SfO
• Use of AI agents for automation:
• Evaluation of due diligence questionnaires including risk classification
• AI-supported contract analysis (DORA/MaRisk compliance)
• Monitoring of external data sources (cyber incidents, news feeds)
• Setup of a decentralized risk and action register
• Creation of gap analyses and derivation of actions
• Setup and maintenance of the outsourcing information register
• Use of own TPRM frameworks, checklists and process models

Compliance department setup & DORA operationalization

• Setup of a complete compliance organization according to DORA
• Development and operationalization of SfO
• Use of AI agents for automation:
• Evaluation of due diligence questionnaires including risk classification
• AI-supported contract analysis (DORA/MaRisk compliance)
• Monitoring of external data sources (cyber incidents, news feeds)
• Setup of a decentralized risk and action register
• Creation of gap analyses and derivation of actions
• Setup and maintenance of the outsourcing information register
• Use of own TPRM frameworks, checklists and process models
• Project controlling - presentation and structured measurement of achieved project goals within management reporting.

• Creation of the information register
• Contract extensions and definition of critically important functions and providers
• Creation of strategy, policy and process description for third-party provider management
• Implementation of third-party provider management
• Setup of risk assessment processes and due diligence process
• Role description 'third-party provider manager'
• Contract reviews and additions of minimum contract content according to DORA
• Creation of exit planning and exit strategy
• Handling ICT incidents

• Implementation and restart of an IAM software (ORG by FSP) with project monitoring and control (10 employees)
• Stakeholder management at the C-level and creation of the implementation strategy
• Creation of a new document framework and active implementation as a business analyst in the areas of IT emergency management, outsourcing of IT services, contract management and risk evaluation as well as information risk management
• Definition of the information network and setup of the IDV process
• Contract negotiations and tenders
• Professional support for the setup of a central asset register in ServiceNow
• Optimization and update of BCM due to DORA
• Information security management, critical infrastructures, protection needs analysis, IT inventory, IT operations and operational information security
• Coordination of technical implementation taking dependencies into account

• Performing audit procedures as part of the annual financial statement
• Auditing in the areas of IT strategy, IT governance, information risk management and information security management
• Auditing operational information security, identity and access management as well as IT projects and application development
• Auditing IT operations, outsourcing management, third-party sourcing and IDP

• Feasibility study for introducing an access management system
• Creating the RfP and analyzing the role model to be implemented (RBAC or ABAC)
• Deciding on ABAC

• Specification and implementation of a custom IAM solution in compliance with regulatory and supervisory requirements and with a high level of automation
• Review and adjustment of authorization concepts for all relevant applications according to supervisory requirements (role model)
• Implementation of an RBAC role model
• Creation of guidelines for SoD and introduction of a monitoring process for SoD violations as well as establishment of processes to remediate or accept SoD violations
• Agile project management using Scrum and Kanban
• Updating the audit process and the SfO
• Optimization and support of recertification, ordering, JML and SoD processes
• Implementation, secure operation and continuous development of the IAM services
• Integration of applications into the IAM landscape
• Design, implementation and operation of interfaces to other systems
• Identifying optimization needs regarding regulatory requirements and developing solution options for continuous improvement
• Definition and implementation of the operating model with service providers
• Basic work for the introduction of One Identity and data transfer from the legacy system
• Assisting internal and external auditors during audits
• Creation of the protection requirements analysis and BIA as well as deriving further resilience measures

• Developing the new IT architecture for ES Treasury as part of Postbank's integration into the Deutsche Bank Group
• Focus on architecture in ALM and issuance

• Preparation of project proposals, project plans, project management, requirements and procurement management, as well as integration management
• Budget requests and control, status reporting, resource management, process analysis, communication and stakeholder management
• Dependency and risk management, implementation of regulatory requirements, and workshop facilitation
• Methods used: Scrum and agile methodologies
• Participation in projects for EMIR, Dodd-Frank, MiFID, MiFIR, FATCA, BCBS239, CRR, MaRisk, LQR, CRS, OPR, market risk, FX risk, stress testing, money market statistics, authorization concept, and other regulatory requirements
• Introduction of a DWH, new payment system PTS, internet FX trading platform, new general and sub-ledger
• Implementation of an automated margin hedge process integrating SAP-CML, SAP-CMS, and SAP-BCA
• Implementation of SEPA requirements, customizing and integration of UBIX
• Introduction of the new Covered Bond legislation, FX management, and lean management
• Setup of new accounting and liquidity management integrating all SAP applications and Front Arena
• Profit and loss calculation, risk management
• Establishing internal control system (ICS) and KPIs, control handbook, training, and maturity assessment
• Back-office/payment processing, fixing transactions, retail operations, reporting and integration with trading venues
• Liaison with external auditors, BaFin and ECB
• Implementation of an IAM management system (Omada Identity Suite) with requirements management, role concepts, functional specifications, considering regulatory requirements
• Implementation concept, SoD, reconciliation, conflict resolution, and support for external audits
• Support for process changes, application integration, workshops, and creation of an article catalog in OIS
• Setup of requirements management (change requests) and support in creating authorization concepts
• IT project management: directing rollouts and implementing optimization measures