Skip to main content

MaGo – risk management system

MaGo – risk management system- Responsibility for the management tasks for the RMS is assigned to the entire management both at the individual company and at the group level. In addition to strategic decisions and stipulations on the organizational design of risk management, this includes in particular the establishment of a common risk culture, which ensures a uniform understanding and thus effective risk management.

The risk management system must include regulations on the following points, among others:

  • Management responsibility
  • Business and Risk Strategy
  • Determination of the overall solvency requirement
  • Stress tests

With Circular 2/2017 (VA), BaFin published the minimum requirements for the business organization of insurance companies (MaGo). The most important regulations for the risk management system can be found in this information blog.
MaGo – risk management system

MaGo – risk management system – role of management in the risk management system

The entire management is responsible for ensuring that the risk management system is designed appropriately and effectively.
The responsibility of the entire management does not release the supervisory board from the obligation to monitor whether the entire management has set up an appropriate and effective risk management system.

MaGo – risk management system – risk profile of the company

Irrespective of the responsibility of the entire senior management, the risk profile of the company may require that risk management be assigned to a senior manager.
The responsibility of the entire management for the risk management system, which cannot be delegated to one or more managers, relates to management tasks. The managerial tasks include, among other things, the strategic decisions and the definitions of the organizational framework of risk management, and thus in particular the receipt and handling of significant risks.
The management tasks also include the development of a common risk culture (“common risk language”), which ensures consistent and effective risk management in all areas of the company. This also includes developing a risk strategy, reviewing it at least once a year and adjusting it if necessary. The risk strategy, the review and any changes must be documented. The risk strategy represents the risks resulting from the business strategy. It must be designed in such a way that the operational control of the risks can be linked to it.
The entire management or the responsible manager must take appropriate account of the information from the risk management system when making their own decisions. This also requires an appropriate involvement of the URCF as the central body for operational risk management. The involvement of the URCF does not release the entire management or the responsible manager from their own decision-making responsibility.

MaGo – Further information from BaFin

With Circular 2/2017 (VA), BaFin published the minimum requirements for the business organization of insurance companies (MaGo). The current circular on the MaGo includes the following essential regulations:

  1. purpose of the circular
  2. Scope and definition of terms
  3. Relationship of the circular to EIOPA guidelines and other BaFin publications/entry into force
  4. Proportionalitätsprinzip
  5. Material Risks
  6. Overall responsibility of the management
  7. Group level governance requirements
  8. General Governance Requirements
  9. key functions
  10. risk management system
  11. Business organization requirements related to own funds
  12. Internal control system
  13. spin-off
  14. emergency management


If you´re interested in this topic, the following seminars might be just right for you!

Certified Compliance Officer (S+P) course

Are you newly appointed as a compliance officer in a non-financial company? With the Certified Compliance Officer course, the S+P Entrepreneur Forum conducts training to become a certified Compliance Officer (S+P).  This certified program offers well-founded  training at the highest level with top-class speakers with practical experience  – with maximum reference to entrepreneurial practice.


Your added value with the S+P certification program:

Our certification offer with a focus on your company:

  • Fast and direct implementation instructions from practice for practice
  • Modular structure of the certification
  • Flexible scheduling of the individual modular building blocks
  • The S+P Tool Box provides you with assistance for safe implementation in your own company practice
  • Sample guidelines, assessment tools and checklists guide you in putting what you have learned into practice.


Your practical implementation is our goal and with the certification offer we pave the way for you.

Book the Certified Compliance Officer (S+P) course. Convenient and easy with the  online seminar form and product no. A 14.


IT Compliance Manager

Are you fit & proper as an IT compliance manager? With the New IT Compliance Manager course, participants learn the following technical skills:


Book the New IT Compliance Manager course conveniently and easily with the online seminar form  and product no. A16.

Target group for the New IT Compliance Manager course

  • Board members and  managing directors  at banks, financial service providers, capital investment and fund companies, leasing and factoring companies
  • Executives and specialists from the areas of information security management, outsourcing controlling, risk controlling, compliance, data protection and  internal auditing


Your advantage over the New IT Compliance Manager course

Each participant receives the following S+P products with the seminar:

+ Organization manual for the information security guideline (approx. 30 pages)

+ S+P Tool Risk Assessment: Determination of IT protection requirements

+ S+P Check: User authorization management

+ S+P organization handbook data protection management (approx. 40 pages)

+ S+P Check: data protection, IT security and cyber risks


Program for the New IT Compliance Manager course

Implementing IT compliance securely

  • You need to know these “red lines”: implement the minimum requirements from BAIT, VAIT, DIN EN ISO 2700x and BSI basic protection in an audit-proof manner
  • Which risks are “material”? Differentiation of terms from Section 25b KWG; § 26 ZAG and § 32VAG
  • Outsourcing or outsourcing? Correct evaluation of software and IT services
  • IT compliance at a glance: dovetailing of IT strategy, IT governance, information security and information risk management
  • AT 7: Audit focus on IT compliance : IT strategy, IT environment and IT organization in the focus of the new MaRisk, MaGO, KAMaRisk and BCBS 239


With the New IT Compliance Manager course, participants receive the S+P Tool Box:

+ S+P Test: Is the IT system compliant?

+ Organization manual for the information security guideline  (approx. 30 pages)

+ S+P Check: Systemprüfung zum IT-System


IT governance: Risk analysis to determine the need for IT protection

  • Risk analysis in information management
  • Implementation of the qualitatively tightened IT risk analysis based on uniform scoring criteria
  • Assessment of the need for protection with a view to integrity, availability, confidentiality and authenticity
  • New BaFin requirements for cloud computing: strategy, risk analysis and materiality assessment
  • Information security management: Creation of the catalog of target measures and derivation of risk-reducing measures


With the New IT Compliance Manager course, participants receive the S+P Tool Box:

+ S+P Tool Risk Assessment: IT protection requirements with scoring and risk-oriented  derivation of the catalog of target measures


Obligations in data protection: Actively control interfaces between compliance, information security, money laundering prevention and data protection

  • Modules of an effective data protection system: Interface management to
    • Processing directory Art. 30 EU-DSGVO
    • Data protection impact assessment Art. 35 EU-DSGVO
    • Deletion concept Art. 17 EU-DSGVO and DIN standard 66398
  • Safe handling of self-developed IT applications, access rights, IT approvals and changes in the IT system
  • Efficient communication to outsourcing, data protection, money laundering and information security officers
  • Compliance control plan  – The most important monitoring and control actions
  • Compliance requirements for control and reporting obligations in the IT area


Each participant receives the S+P Tool Box with the New IT Compliance Manager course:

+ Checklist: data protection for practitioners in accordance with the new GDPR

+ Checklist: Monitoring and documentation of control actions

+ Job description for information security officer


In addition to the New IT Compliance Manager course, the participants were also interested in the following seminars:

Compliance management in the company

Compliance Update 2019

Outsourcing in the focus of banking supervision

MaRisk 2017 – risk-bearing capacity – SREP – ICAAP

MaRisk 6.0 – new requirements for risk management

Risk management and internal control system

Compliance and risk management for entrepreneurs

Quality management course with certification

Data protection – duties for directors and compliance

MaGo – risk management system