Audit memo drafted. 3 medium and 1 high finding identified, all with MaRisk paragraph reference and management response template.
The audit scope (outsourced credit decisioning to LendOps AG) maps to MaRisk AT 9 and BTO 1. Four findings: 1 high (no documented exit strategy for the outsourced service), 2 medium (no quarterly performance review on file; SLA monitoring gap), 1 low (minor documentation inconsistency in the outsourcing register).
Output
Audit scope and methodology
Scope: outsourcing of credit decisioning to LendOps AG. MaRisk chapters in scope: AT 9, BTO 1, AT 4.4, AT 7.2. 18 controls tested via document review, SLA evidence sampling, and a 30-decision substantive test. Methodology consistent with IIA International Professional Practices Framework.
Findings summary
4 findings total. 1 HIGH (no documented exit strategy for the outsourced service — breach of MaRisk AT 9(10)). 2 MEDIUM (Q3/Q4 2025 quarterly performance review not filed; SLA monitoring evidence only for Q1 2025 — both breach MaRisk BTO 1.3). 1 LOW (outsourcing register contains stale vendor contact data).
HIGH — No exit strategy documented
MaRisk AT 9(10) requires a documented Notfallplan for material outsourcing. None on file for LendOps AG. Recommended action: produce exit strategy by Q3 2026, including alternative providers, transition timeline, and data-return protocol. Management response: agreed, owner: COO, due 2026-09-30.
MEDIUM — Missing quarterly performance reviews (Q3, Q4 2025)
MaRisk BTO 1.3 requires regular monitoring of outsourced activities. Q3 and Q4 2025 performance reviews not filed. Recommended action: retroactively review Q3/Q4 by Q3 2026 and embed quarterly review in the operating-model checklist. Management response: agreed, owner: head of credit, due 2026-09-30.
Management response slots
Each finding above has a management response template embedded for the responsible head to complete before audit-committee review. Submission deadline 2026-06-15.
Reasoning timeline
Task: Map the audit scope to MaRisk chapters and in-scope controls.
Primary: AT 9 (Outsourcing), BTO 1 (Credit Process). Secondary: AT 4.4 (Internal Audit System), AT 7.2 (Technical-Organisational Equipment). 18 controls in scope.
“Bei der Auslagerung wesentlicher Aktivitäten und Prozesse hat das Institut Vorkehrungen zu treffen, um die ordnungsgemäße Durchführung der ausgelagerten Aktivitäten und Prozesse zu gewährleisten.”
Task: Design testing procedures with appropriate sampling.
12 testing procedures designed: contract review (1), SLA evidence (3 months sampling), exit plan (1), risk assessment (annual), Q4 2025 spot test on 30 credit decisions, etc.
Task: Pull evidence from audit-trail systems for each control.
16 of 18 controls have retrievable evidence. 2 gaps: quarterly performance review (none filed Q3 + Q4 2025), exit-strategy document (not on file).
Task: Synthesise findings from evidence-vs-control comparison.
4 findings: HIGH (no exit strategy documented), MEDIUM (no Q3/Q4 2025 performance review), MEDIUM (SLA monitoring sampled only 1 of 3 quarters), LOW (outsourcing register has stale contact data).
“Für wesentliche Auslagerungen sind Notfallpläne vorzuhalten, die Vorkehrungen zur Sicherstellung der Geschäftsfortführung bei Ausfall des Auslagerungsunternehmens umfassen.”
“Die regelmäßige Überwachung der ausgelagerten Aktivitäten ist sicherzustellen.”
Task: Draft the audit memo and the executive summary for the audit committee.
9-page memo, including methodology, findings table, management-response slots, and a 1-page exec summary.
Task: Assemble the final memo and verify methodology compliance.
Methodology consistent with IIA standards and MaRisk AT 4.4. Memo ready for the head of internal audit's review.