Belgian banks, insurers and financial market infrastructures are subject to a continuous, supervised obligation to understand the services delivered by their ICT providers, the criticality of each arrangement, and the consequences of provider failure. The Digital Operational Resilience Act has shifted oversight of ICT third-party arrangements from a periodic compliance exercise to an ongoing control that supervisors actively assess.
In practice, many institutions continue to manage this through manual processes and registers that are maintained infrequently and inconsistently.
KPMG supports these institutions both through advisory engagements and through a managed service in which we operate defined elements of the third-party risk lifecycle on the client's behalf. We are seeking a Manager to lead delivery of this work and to contribute to the further development of the managed service within our cyber practice.
- Lead TPRM engagements for institutions supervised by the NBB and the FSMA, covering target operating model design, register of information development and remediation, criticality and materiality assessments, contractual gap analysis, exit strategies, and concentration and subcontracting risk.
- Assume responsibility for delivery quality within the TPRM managed service, including provider due diligence, continuous monitoring, assurance reviews and reporting to client risk committees. You will also contribute to the industrialisation of the service through the development of playbooks, tooling, delivery models, quality gates and commercial structure.
- Support the growth of the service in collaboration with the partner group. This includes shaping the proposition, developing proposals and pricing, and building pipeline within existing client relationships. Commercial support will be provided, and an active contribution to business development is expected.
- Translate supervisory requirements into operational processes. This includes DORA Chapter V and the associated RTS and ITS, the EBA outsourcing guidelines, EIOPA guidance and applicable NBB circulars, converted into arrangements that a second line function can realistically operate.
- Coach and develop a team of consultants and senior consultants, and act as escalation point for technical and regulatory judgement.
- Contribute to the practice's market presence through client roundtables, webinars, publications and engagement with the wider regulatory dialogue.
