When BaFin comes knocking...
§44 SPECIAL IT EXAM
We have extensive experience in preparing for, conducting, and following up on special IT audits under Section 44 of the German Banking Act (KWG), as well as in mitigating findings by the German Federal Financial Supervisory Authority (BaFin).
What is the best way to prepare for a Section 44 audit, and how does it proceed? What types of findings—and at what levels of severity—can be expected, and what consequences might these have for management?
Preparing for the KWG '44 Exam
MITIGATION
How do you implement a comprehensive mitigation program to address the findings, including regular reporting to BaFin, and how do you find suitable (external) personnel to carry out the remediation?
From strategy and analysis to implementation, remediation, and ongoing operations, we can provide you with comprehensive support through our expertise. We have already navigated and resolved these types of cases and are familiar with all the potential pitfalls you may encounter.
To give you an idea of the projects we've successfully completed and our expertise, we've compiled a few anonymized client testimonials for you.
§44 IT Special Audit: Reference Projects
Industry:
Banking / Finance
Position:
, Project Manager for IT Security & Regulatory Affairs
Areas of Responsibility:
- Audit preparation and planning
- Support and coordination of the audit
- Responsible for all matters related to the bank’s IT security
- Primary interviewer and point of contact for BaFin/Bundesbank auditors
- Compilation and QA of supporting documentation and responses
- Risk assessment and management of residual risks
- Selected topics: structural analysis, security needs analysis, target-actual comparison, risk management, vulnerability management, penetration tests, event management (SOC/SIEM), incident management, network security, firewall management, encryption
- Planning, setup, implementation, and responsibility for the mitigation project addressing the §44 audit findings
Industry:
Banking / Finance
Position:
, Project Manager for Cybersecurity Maturity Management and Audit Follow-Up
Areas of Responsibility:
- Initial cybersecurity maturity analysis in accordance with the NIST Cybersecurity Framework
- Expansion of the framework, improvement of measurability, and annual maturity audits
- Regular reporting and presentation of the maturity level to executive boards, supervisory boards, regulators, government agencies, and works councils
- Coordination of maturity levels with an independent risk management body in the second line of defense
- Recruiting, onboarding, and developing employees
- Development of management action plans/recommendations and project packages to increase the maturity level
Industry:
Banking / Finance
Position:
Project Manager
Responsibilities:
- Supporting and coordinating auditor inquiries
- Interview partner and point of contact for the respective auditors
- Compilation and QA of supporting documentation and responses
- Risk assessment and management of residual risks
- Across all subject areas: structural analysis, security needs analysis, target-actual comparison, risk management, vulnerability management, penetration testing, event management, incident management, network security, firewall management, encryption
Industry:
Banking / Finance
Role:
Consultant
Areas of Responsibility:
- Identifying “quick wins” and developing prioritized work packages to implement corrective measures
- Implementation of prioritized mitigating measures to reduce overall risk
- Developing and implementing process improvements and operational restructuring in close collaboration with the relevant departments and the 2nd Line of Defense
- Developing and introducing a catalog of target measures to derive protective measures based on the criticality of the systems to be protected
- Conducting risk analyses to determine the criticality of systems requiring protection and deriving recommended measures
Industry:
Banking / Finance
Position:
Project Associate
Responsibilities:
- Supporting audits related to vulnerability management and network security
- Serving as an interview partner and point of contact during the audit
- Compiling necessary evidence packages, such as supporting documentation and responses
- Addressing identified risks in accordance with risk treatment strategies
- Developing management action plans to address the risks
- Development of process improvements and operational restructuring in close collaboration with the relevant departments
- Coordination of process improvements with the 2nd and 3rd lines of defense
- Implementation of the identified process improvements and compilation of evidence to address deficiencies
Industry:
Banking / Finance
Role:
Project Associate
Areas of Responsibility:
- Follow-up on IAM-specific audit findings from the §44 special IT audit
- Responsible for questions regarding Identity and Access Management (IAM)
- Compilation and QA of supporting documentation and responses
- Risk assessment and management of residual risks
Industry:
Banking / Finance
Position:
Project Associate
Responsibilities:
- Development and implementation of security policies
- Coordination of policies with various business departments
- Conducting policy reviews for quality assurance
- Ensuring compliance with relevant legal and regulatory requirements
- Creating and maintaining detailed documentation for internal and external audits
- Close communication and collaboration within the team to foster a strong security culture
WIDELY ESTABLISHED IN INFORMATION SECURITY
EXPERTISE
From junior risk manager to senior auditor, ISO 27001 lead auditor, IT-Grundschutz lead auditor, and all the way to a long-standing, experienced, and award-winning information security officer (ISB). Our employees cover nearly every area of information security.
We bring over 100 years of professional hands-on experience to your company.
YOUR STRENGTH IS
OUR EXPERIENCE
Whether you’re a small business, a medium-sized company, or a large international corporation—whether you’re in government, manufacturing, retail, banking, the automotive industry, energy, or aviation—our employees have seen (almost) it all and always find the best and most effective measures to bring and maintain your company’s information security at the desired level of maturity.
Do you have any questions, would you like us to call you back, or would you like a quote?
Frequently Asked Questions About the §44 KWG Special IT Audit
Under Section 44 of the German Banking Act (KWG), BaFin may order special audits of banks and financial service providers—including those with a focus on IT. Among other things, the audits examine compliance with regulatory IT requirements (currently primarily DORA), information security, access permissions, and outsourcing. The audits are usually conducted by auditors commissioned by BaFin.
This applies to credit and financial services institutions supervised by BaFin and the Bundesbank. Today, special IT audits are generally based primarily on DORA and the MaRisk; the former banking supervisory IT requirements (BAIT) have largely been replaced by DORA.
The focus is typically on IT governance and strategy, information risk and information security management, user permissions, IT operations, outsourcing to third-party IT providers, and IT project management, as measured against DORA and MaRisk.
We recommend conducting a gap analysis against DORA and MaRisk, addressing any identified gaps, and preparing audit-ready evidence and documentation. We provide targeted preparation for financial institutions, assist during the audit, and support them in addressing audit findings.
Following notification by BaFin, the auditors review documents, conduct interviews and technical analyses, and document their findings in an audit report. The identified deficiencies must then be corrected by the specified deadline, often with follow-up by the regulatory authority.
We handle the preparation (gap analysis, documentation), provide support during the audit, and address any findings (remediation). Our consultants are familiar with DORA, MaRisk, and the audit process based on their extensive experience with numerous audits in the financial sector.
That depends on the size of the institution, the scope of the audit, and the initial situation. After a brief scoping session, we’ll put together a suitable package and provide you with a transparent estimate of the costs involved. The best way to discuss this is in person.