Find out why contract management plays an essential role in the implementation of the upcoming EU regulation in the third part of our blog series on DORA.
At the beginning of every business collaboration, there is a contract. This is also the case when commissioning an ICT service provider. This agreement contains all the relevant information about the supplier, the specified service, the subcontractors involved, and much more, and thus forms the basis for all subsequent activities.
However, if this data is not recorded digitally from the start of the business process, the players have to perform many tasks more than once. For example, the manual creation and maintenance of lists, calendar entries and evaluations. The use of the appropriate tools not only optimizes workflows, but also supports the verifiable fulfillment of the new legal requirements and due diligence obligations.
If financial companies want to digitalize their business processes in a well thought-out way for the implementation of DORA, they must therefore start at the source of the information - contract management. This is where all data originates, and the tasks to be completed can be controlled from there using structured workflows. From the initial sourcing of a supplier, to the conclusion of contracts, to the ongoing controlling and reporting of agreements: With the smart software Fabasoft DORA you map all levels of your outsourcing process digitally and audit-proof.
1. Traceable documentation on ICT service providers
Entering and storing the relevant information in one digital location enables the automation of the sourcing of a supplier and the subsequent process steps.
When a new ICT service provider is added to the system, the software automatically manages the collection of all necessary documentation: including risk assessments and other due diligence measures, materiality assessments, outsourcing approvals and notifications, certificates, and service descriptions and specifications. By defining deadlines, reminders and, if necessary, escalation workflows are started, which remind users in time of reviews to be carried out and documents to be renewed via e-mail and push notifications. In this way, the responsible parties ensure that all activities are verifiably carried out.
For secure collaboration with ICT third-party suppliers, the smart tool integrates them into the process without media discontinuity. As an external member, the vendor is given access to the required contract files with read or write rights. This means that the partner can be actively integrated into workflows and can share, edit or sign documents independently. This prevents a change of system and resulting security risks.
2. Template-based creation of a new contract
Once the partner has been entered and evaluated, digital contract management provides support for the subsequent contract process. During the automated creation of a new agreement, all DORA-specific information that the document must contain is transferred directly from the file to the contract. Examples are the evaluation of the outsourcing, the description of the outsourcing object, the criticality or the documentation of the assets. The application and management of the standard contractual clauses specified by the EU is also carried out reliably and in a controlled manner with the help of the clause library. The contract history can be traced back at any time through the "time travel" function of Fabasoft DORA and can be restored if required.
The subsequent review & approval processes are based on the respective process organization, so depending on the facts, the right people and departments are involved. Those responsible can prove this at any time - especially in audit situations - thanks to the transparent electronic workflow signatures. The verifiable digital approvals in the system simplify collaboration and also work on mobile devices.
3. Automated fulfillment of reporting obligations
For recurring, annual or event-related reporting (e.g., for risk and materiality assessment or for SLA reviews¹ ), automated reporting provides support. Since all information is categorized in the digital file right from the start, the required analyses can be generated at the push of a button. A structured register of information with various filtering and sorting options keeps track of all critical ICT service providers at all times. This also makes it possible to quickly give information to auditors or authorities – because ad hoc inquiries are to be expected.
Providing reports and logs is simple and secure using the product's own "external space". For this purpose, the authorities are given access to a delimited data room within the cloud, which is used for document exchange and collaboration with external parties.
Manually maintained lists and insecure data transfer via email are now a thing of the past.
Conclusion
After the General Data Protection Regulation (GDPR) and the German Supply Chain Due Diligence Act (LkSG), DORA is the next set of regulations in whose implementation the digitalization of business processes in contract management plays a crucial role. The use of the right digital tools not only leads to significant workload reductions, but also gives those responsible the necessary assurance that they are demonstrably complying with all the required due diligence obligations. Audit situations and spontaneous requests can be handled effortlessly.
Are you looking for the right software to implement DORA in your company? Arrange a free and non-binding meeting with our consulting team at dora@fabasoft.com. We are happy to address your individual use case and show you how to establish the right digital business processes simply, quickly and securely.
¹ SLA = Service Level Agreement
