Case Study: How a Global Investment Bank Achieved DORA Readiness Across 14 Subsidiaries in 6 Months
At a glance
Industry: Finance — Global Investment Banking
Region: DACH (Europe), 14 subsidiaries
Regulations: DORA, Basel IV, PCI DSS v4
ServiceNow modules: Risk Management, Policy and Compliance Management, Operational Resilience (DORA), Third-Party Risk Management, Audit Management, Performance Analytics, Now Assist for IRM
Implementation time: 6 months (board dashboard live in 3 months)
Headline result: 62% reduction in audit preparation time
The challenge
A global investment bank headquartered in the DACH region had to demonstrate compliance with the EU's Digital Operational Resilience Act (DORA) across 14 subsidiaries. Each entity had grown its own way of managing risk, and the group faced four critical problems:
Disconnected GRC tools — subsidiaries used different systems and spreadsheets, so there was no single source of truth
No unified ICT risk view — the group could not see ICT risks, incidents and critical third parties in one place, a core DORA expectation
Slow board reporting — quarterly risk reports were compiled manually and ran around six weeks behind
Heavy audit effort — every audit required weeks of evidence gathering across entities
With regulators expecting DORA readiness and auditors scrutinising ICT risk, the bank needed a group-wide platform — fast.
How the REDE team resolved it
1. Assess and harmonise (Month 1). REDE ran a DORA gap assessment across all 14 entities and designed a common risk taxonomy and control framework, mapping DORA, Basel IV and PCI DSS v4 requirements to one set of controls — test once, comply with many.
2. Build the core platform (Months 2–3). The team deployed ServiceNow IRM using REDE's pre-built control libraries and workflow templates. Risk registers, policies and controls from every subsidiary were migrated into a single instance, with entity-level segregation for local ownership.
3. Board dashboard first (by Month 3). REDE prioritised a real-time DORA ICT risk dashboard for the board, built on Performance Analytics, so leadership could see group-wide ICT risk, incidents and third-party exposure without waiting for manual reports.
4. Resilience and third parties (Months 4–5). Operational Resilience capabilities were configured to map critical business services and support DORA incident reporting, while Third-Party Risk Management created the ICT third-party register and automated vendor assessments.
5. Audit, AI and roll-out (Month 6). Audit Management and automated evidence collection were switched on, Now Assist for IRM was enabled to summarise issues and speed remediation, and the solution was rolled out to all 14 subsidiaries with training and handover.
Solution design highlights
One group-wide control library mapped to DORA, Basel IV and PCI DSS v4
Entity-level data separation with consolidated group reporting
Integrations feeding ICT incidents and asset data into risk scoring
Automated control testing and continuous evidence collection
AI-generated issue summaries and remediation recommendations
Results
62% reduction in audit preparation time
Real-time board reporting in place of reports that lagged by six weeks
All 14 subsidiaries on one platform within 6 months
Unified ICT risk and third-party view supporting DORA compliance
"REDE transformed our DORA and risk operations in just 6 months." — Andrew P., Head of Operational Risk
About REDE Consulting
REDE Consulting helps regulated enterprises across the USA, Europe and South-East Asia turn risk and compliance into a strategic advantage. We combine deep ServiceNow IRM/GRC expertise with Databricks Data + AI to create one connected risk intelligence layer for Finance, Pharma & Life Sciences, and Healthcare.
Our services include:
Strategic advisory & regulatory intelligence — maturity assessments, gap analysis and roadmaps
ServiceNow IRM/GRC implementation — risk, policy, audit, third-party risk, resilience and automated control testing
AI-powered development & data-led governance — custom ServiceNow builds, Databricks pipelines, predictive risk analytics and AI governance
Managed services & continuous governance — continuous monitoring, optimisation and remote expert pods
With certified consultants (ServiceNow, CISA, CRISC, CISM and GxP), pre-built accelerators and coverage of 150+ compliance frameworks, we help global clients go live 40–60% faster.
Connect with our team
Facing a similar challenge? Email us at info@rede-consulting.com or visit www.rede-consulting.com to talk to our experts about your risk and compliance goals.
Comments