DORA Experts in Munich

System Transformation Audit

Supporting a project-related IT audit of a system transformation within the financial services sector, focusing on controls associated with different types of system migrations. The work involves reviewing migration-specific documentation and supporting evidence to assess whether the controls for each migration type are adequately evidenced and sufficient to address the associated migration risks. Particular emphasis is placed on the adequacy of control measures, the reliability of supporting evidence, and safeguards relating to data integrity and migration-related risks.

Team Size: 2 project managers, 1 delivery manager, 2 senior consultants

Tasks & Responsibilities:

• Reviewing documentation and supporting evidence for different types of system migrations.
• Assessing migration-specific control procedures and evaluating whether the controls are appropriate and sufficient to address the associated risks.
• Evaluating the adequacy and completeness of evidence provided to demonstrate that migration controls have been performed as intended.
• Reviewing relevant control measures designed to safeguard data completeness, accuracy, and integrity during migration, where applicable.
• Identifying potential control gaps, insufficient evidence, and areas requiring further clarification or additional audit procedures.
• Assessing whether the documented migration approach and associated controls adequately address the risks arising from the respective migration type.
• Coordinating with relevant project stakeholders to clarify migration procedures, obtain supporting documentation, and follow up on open audit questions.
• Documenting audit procedures, evidence reviewed, control assessments, and observations in accordance with the engagement's audit methodology.

Audit Standards, Methodologies and Regulatory Frameworks: Migration Controls Assessment, Migration Risk Assessment, Evidence Review, Control Testing, IT Audit Documentation.

Areas of Expertise: System Transformation, System Migration Controls, Migration Risk Assessment, Control Evaluation, Evidence Assessment.

Main Results & Achievements:

• Contributing to the assessment of migration controls and the identification of potential control gaps.
• Identifying evidence deficiencies and areas requiring further clarification.
• Documenting audit observations and supporting the evaluation of migration-related risks and control effectiveness.

"Reasoning Models: From LLM Foundations to NOC Automation."

• Lead Architecture in an interdisciplinary architecture team covering enterprise, solution, NOOTS, cloud and security architecture as well as regulatory and European interoperability requirements.

• Public / Government

• Development and management of target architectures, principles, standards and technical guardrails; assessment of Security-by-Design, IAM, data protection and interface/integration architectures; architecture reviews, security assessments, risk analyses, and preparation of decision records, target visions, roadmaps and decision papers. Architectural knowledge and consideration of relevant AD-NOOTS requirements, particularly for IAM, authorization, secure integration and interoperability.

• Technologies / Methods: Enterprise Architecture, Solution Architecture, Security Architecture, Cloud Architecture, NOOTS / EU-OOTS, IAM, Authorization, Security-by-Design, API/Integration Architecture, Interoperability, Risk Analysis, Architecture Governance

• Security and integration requirements as well as technical decisions are structured in reliable architecture and decision artifacts.

• Topics: Business Analysis, Data Privacy, Data Management, Stakeholder Management, Conceptualization
• This project focuses on developing and implementing a strategic approach for data deletion in SAP systems. The goal is to identify the relevant data and structures during system migration to ensure both data privacy and IT system efficiency. At the same time, downtime should be minimized and regulatory requirements met.
• Development of a comprehensive approach for data deletion in SAP systems, considering data privacy and business requirements.
• Ensuring efficient and structured data transfer to the new system.
• Optimizing system efficiency and reducing downtimes during migration.
• Creating functional and technical concepts to ensure compliant and sustainable data management.
• Topic preparation: Detailed study of the "data deletion" area to lay the foundation for a structured data migration.
• Definition of project structure: Setting roles, interfaces and the project's organizational structure.
• Regulatory requirements: Analysis of data privacy regulations and business requirements to define deletion criteria.
• Approach: Developing possible scenarios and methods for data cleansing and deletion.
• Deletion concepts: Creating functional and technical deletion concepts that structure the implementation and provide clear guidelines.
• Setting deletion criteria: Defining which data and structures to delete or transfer.
• Responsibilities: Clarifying responsibilities within the project team and among stakeholders.
• Analysis of ongoing activities: Identifying and collecting existing activities in the "data deletion" area.
• Effort, cost and timeline planning: Creating estimates for resources, effort and budget.
• Implementation initiatives: Developing and executing concrete measures to apply the defined deletion strategies.
• IT system efficiency: Analyzing the existing IT infrastructure to identify optimization potential for data deletion and transfer.
• Technology trends: Evaluating new technologies and tools that can support the data cleansing process.
• Cost-benefit analysis: Assessing the financial impact of data cleansing and the introduction of new solution approaches.
• Risk management: Identifying potential risks during implementation and developing appropriate mitigation measures.
• This project lays the foundation for a sustainable and compliant data transfer to a new SAP system. With a clear approach to data deletion, it meets data privacy requirements, reduces downtimes and increases the efficiency of the new system. The results and recommendations will help companies develop a future-proof data strategy that meets legal and business needs.