Adriatic Horizon Bank
A single case study links the two days: one bank, multiple ICT dependencies and decisions that build on each other.
A familiar operating model
AHB is a medium-sized retail and small-business bank headquartered in Selvarin, the capital of the fictional EU Member State of Vardania. Its competent authority in the scenario is the Vardania Financial Supervisory Authority (VFSA).
Act as one cross-functional advisory team. Agree on group decisions, distinguish verified facts from information gaps, and discuss the bank’s options rather than trying to find a single perfect answer.
External service landscape
| Reference / provider | Service | Known dependency |
|---|---|---|
| AHB-001 FinCore Services | Core banking: account ledger, balances and payment processing. | Hosting subcontractor involved; identity and locations unknown. |
| AHB-002 ChannelWorks | Web and mobile banking. | Digital channels depend on interfaces to FinCore. |
| AHB-003 WorkCloud | Hosted email, documents and collaboration for staff. | Partial fallback via telephone and local procedures. |
| AHB-004 SecureWatch | Continuous security monitoring and alerts. | Link to critical functions requires assessment. |
| AHB-005 ArchiveHouse | Paper records in physical archive. | Physical storage only; no electronic document service in this case. |
Business functions
Account management
Core ledger unavailability prevents reliable access to balances and account processing.
Payment execution
Prolonged disruption leaves payments unprocessed and could materially affect clients.
Digital customer access
Online and mobile banking matter, with limited alternatives via branches.
The provider/contract inventory is not reconciled; criticality is not consistently approved; the register is incomplete; incident escalation is untested end-to-end; and the FinCore exit plan is not yet convincing.
Discuss. Decide. Explain.
Each exercise comprises approximately 20 minutes of group discussion and 10 minutes of plenary exchange. Agree on one shared output and appoint a spokesperson. The downloadable handout includes suggested discussion outcomes, not grading keys.
D1 · 01Design AHB’s DORA implementation projectBoard-facing priorities · Governance · 20 + 10 minutes
IT has a technology inventory, Procurement keeps contract files, Risk & Compliance has a partial gap list and business owners have not aligned on function criticality. The Management Board needs a realistic starting plan.
Your shared tasks
- Identify the functions and roles that need to participate and coordinate work.
- Agree on exactly three first workstreams and explain their priority.
- Identify two Management Board decisions or resources required.
Group output
One-page board pitch with three priorities, reasons, owners and two board decisions. One speaker presents the group’s view.
D1 · 02Map ICT services and critical functionsFive providers · Three functions · 20 + 10 minutes
AHB receives services from FinCore, ChannelWorks, WorkCloud, SecureWatch and ArchiveHouse. Account management and payments depend on FinCore; digital channels also depend on ChannelWorks.
Your shared tasks
- For each provider, decide whether the contracted service is an ICT service.
- Discuss the functions AHB-F01, F02 and F03 and which may be critical or important.
- Identify services supporting the relevant functions and explain the link.
- Record two missing items of information that would improve the analysis.
Group output
One agreed dependency map, with one straightforward and one debatable classification explained. Official S01–S19 service codes are not required.
D1 · 03Draft key information-register entriesFinCore · Selected fields · No Excel required · 20 + 10 minutes
AHB has direct arrangement AHB-001 with FinCore Services for its core account ledger and payment engine. For this exercise AHB-F01 and AHB-F02 are classified as critical or important. FinCore uses an unidentified hosting subcontractor.
Your shared tasks
- Draft selected information fields: arrangement reference, direct ICT provider, service description, supported function codes, support for critical or important functions, and relevant hosting subcontractor(s).
- Write “not yet known” where the facts do not support an entry.
- Agree on three priority data requests and who should answer them.
Group output
One agreed simplified draft and a three-item information request list. This is not an exercise in completing a full supervisory register or filling official Excel rows.
D2 · 04Respond to an ICT incident — and reassessTwo-stage incident · Classification · 20 + 10 minutes
Stage A, Monday 08:45: FinCore has been unavailable since 08:30, affecting accounts and payments. About 6,000 of 80,000 affected-service users appear impacted. Cause and recovery time are unknown; AHB-F02 is classified as critical or important.
First group decision
Appoint an incident lead, agree on three urgent actions and identify missing facts. Decide whether major classification is established already or needs reassessment.
Stage B, 10:45 update: The outage is continuing (2 hours 15 minutes). About 34,000 of the 80,000 service users are now affected; a major payment batch remains unprocessed. There is no reliable recovery estimate and no confirmed data compromise.
Reassess together
Review the classification and discuss supervisory reporting and customer communication. Use the selected case criteria: an affected critical service plus the relevant special condition or at least two materiality thresholds. The case highlights a >10% affected-client threshold and >2-hour downtime of an ICT service supporting a critical or important function; full real-world rules may require further checks.
Group output
One evolving incident decision record, explaining what changed between stages, urgent actions with owners and a short client message or key reporting facts.
D2 · 05Prepare a credible exit strategy for FinCoreTransition choices · Contingency · 20 + 10 minutes
FinCore support may end in 12 months. Its contract provides only three months of transition assistance. AHB estimates migration to a new provider would require 9–15 months. No successor has been selected and ChannelWorks depends on FinCore interfaces.
Your shared tasks
- Compare replacement, a controlled FinCore extension and insourcing/redesign.
- Choose a preferred combination of options, acknowledging feasibility constraints.
- Identify two main obstacles and continuity measures for customers.
- Agree on three immediate actions and their owners.
Group output
An agreed exit route, with contingencies, accountable owners and a mini roadmap covering immediate stabilisation, alternative building and readiness evidence.
The handout contains Part III with suggested discussion outcomes. Different well-reasoned answers are welcome; the aim is collaborative learning, not testing.