newsonline24

1. The Industrial Project Manager: Efficiency, Market, Technology

The traditional industrial project manager is guided by a clear triad: time, cost, quality. His success is measured by whether the new product is launched on time, the new production line runs stably, or the marketing campaign generates the desired leads. The context is predominantly business and technology driven. Risks are assessed primarily in terms of delays, budget overruns, or technical failures. Key stakeholders are senior management, business units, customers, and suppliers; external audits play a rather marginal role.

His methodological toolbox is broad: classic waterfall models, agile approaches such as Scrum or Kanban, and hybrid methods depending on project characteristics. Certifications like IPMA, PMP, or PRINCE2 increase professionalism, but they mainly aim at steering projects efficiently, transparently, and with economic success. Governance frameworks are often defined internally – project manuals, PM offices, collections of best practices – and are only indirectly influenced by regulation, for example through product safety laws or sector‑specific standards.

As a result, the industrial project manager is a generalist of value creation: he ensures that ideas become reality, processes run smoothly, and investments pay off. His pain points lie in resource conflicts, shifting priorities, technical uncertainties, and market changes. Yet one aspect is almost entirely missing: direct pressure from a supervisory authority that evaluates projects not only economically, but also legally and organizationally as components of a broader stability framework.

2. The BaFin-Institution Project Manager: Regulation, Supervision, Auditability

The situation is entirely different for the project manager sitting in the cockpit of a BaFin‑regulated institution. He also has to plan, coordinate, and implement projects – but his initiatives directly affect the institution’s ability to meet its regulatory obligations. Whether it is the introduction of a new regulatory reporting system, the implementation of DORA requirements, the adjustment of AML monitoring tools, or the rollout of NIS‑2 controls: here each project is a building block of the institution’s regulatory overall picture. Success is therefore measured twice: the project has to work, and it has to withstand audits by BaFin, the Bundesbank, external auditors, and internal audit.

The pain points are correspondingly sharp: unclear regulatory responsibilities within the project, late involvement of compliance and risk, missing legal impact analysis, incomplete documentation, and decisions that cannot be reconstructed. A particular risk adds to this: a project that appears “finished” from a business perspective may be considered deficient by supervisors if control functions were not sufficiently involved, documentation is not audit‑proof, or key regulatory requirements have only been implemented technically but not embedded organizationally. The project manager in a BaFin‑regulated institution therefore carries responsibility that goes far beyond usual PM metrics.

His stakeholder landscape is much more complex. Besides the management board and business units, compliance, risk management, internal audit, IT security, data protection, and, where relevant, recovery and resolution functions are involved. External parties – auditors, BaFin, and the Bundesbank – are not part of the operational project work, but they are the ultimate evaluators. The project manager must understand how his projects appear in the supervisory view of the institution: as orderly, well‑controlled change, or as a source of new risks and findings.

3. Pain-Oriented Comparison: Where Industrial Logic Fails in Regulated Institutions

The greatest danger for regulated institutions is not the absence of project management, but the uncritical transfer of industrial project management into a supervised environment. Many institutions rely on standard PM frameworks and believe they are well equipped for regulatory projects. In practice, however, audit reports, special examinations, and supervisory measures show that project management without regulatory depth quickly reaches its limits.

A first pain point is goal definition. In industry, describing technical and economic objectives is usually sufficient. In a BaFin‑regulated institution, however, every supervisory‑relevant project must also have clearly formulated regulatory objectives: which rules are being addressed, which supervisory expectations are being implemented, which risks are mitigated? If this layer is missing, projects remain “blind” from a supervisory perspective. The project manager becomes an executor of business wishes rather than a driver of the institution’s regulatory resilience.

A second pain point concerns the involvement of control functions. Industrial project managers often work mainly with business units and IT; compliance‑like roles may exist informally at best. In a BaFin‑regulated institution, by contrast, the involvement of compliance, risk, and internal audit is not optional but an essential part of a three‑lines‑of‑defence model. If this involvement is organized late or not at all, serious gaps arise: audits criticize that key risks were not properly assessed, controls were not adjusted, or regulatory requirements were only implemented in systems instead of being embedded in processes.

The third pain point is documentation and evidence. In industry, pragmatic project documentation often suffices, serving mainly internal learning and reporting purposes. In a BaFin‑regulated institution, documentation is an audit instrument. Decisions must be traceable, risk assessments recorded, and responsibilities clearly assigned. A project manager who underestimates this dimension may deliver a “nice result” but a weak audit trail. At the latest in the next audit, it becomes clear that the institution cannot explain why certain solutions were chosen, risks accepted, or controls changed.

Finally, risk assessment itself is fundamentally different. While the industrial project manager primarily sees projects as investments or efficiency measures, the project manager in a BaFin‑regulated institution has to consider every major project as a driver or mitigator of risk within the overall system. A reporting project that improves technical performance but is not properly signed off from a regulatory standpoint increases the risk of incorrect or incomplete reporting – with potential sanctions. A DORA project that focuses only on IT aspects and neglects organizational resilience remains incomplete in the eyes of supervisors.

4. Clear “Versus”: Industrial vs. BaFin-Institution Role Profiles

To highlight these differences, a systematic “versus” perspective is helpful:

• Industry versus BaFin‑institution in terms of objectives: industrial projects aim at market, efficiency, and technology; projects in BaFin‑regulated institutions additionally aim at regulatory stability and auditability. A project manager in such an institution cannot consider a project successful if it works technically but remains vulnerable from a supervisory standpoint.
• Industry versus BaFin‑institution in terms of stakeholders: while the industrial project manager operates primarily in an economic stakeholder logic, the project manager in a BaFin‑regulated institution works within a multi‑layered system of management, operational units, and control functions. His communication and conflict‑management skills must therefore balance not only commercial interests but also regulatory and audit perspectives.
• Industry versus BaFin‑institution in terms of method and governance: industrial project management is often method‑driven; governance is a matter of internal standards. In a BaFin‑regulated institution, governance has to be anchored in regulation: project manuals must define the roles of compliance, risk, and internal audit, specify minimum documentation and sign‑off requirements, and ensure that projects are embedded into the institution’s risk and control architecture.
• Industry versus BaFin‑institution in terms of success metrics: in industry, a project is successful when it meets its KPIs. In a BaFin‑regulated institution, a project is truly successful only if it meets KPIs and does not trigger significant audit findings. “BaFin‑proof” or “audit‑proof” becomes a separate success dimension that the project manager has to actively manage.

This “versus” picture is far from an academic exercise. It shows that the widespread assumption of interchangeable project manager roles causes institutions to manage projects professionally but insufficiently secure them from a regulatory perspective. The result is supervisory measures, additional audits, and expensive follow‑up projects to “repair” initiatives that were already implemented.

5. Recommendations: From Industrial PM to Regulatory Project Lead

How can institutions address these pain points? The answer is not to abandon classical project management methods, but to evolve them into a regulatory‑sensitive role model.

First, institutions should define a dedicated role profile for “Project Manager – Supervisory/Regulatory Projects”. This profile must explicitly state that the project manager is responsible not only for time, cost, and quality, but also for regulatory goal achievement, proper involvement of control functions, and the auditability of project outcomes. Clear anchoring in the project management handbook and in job descriptions creates transparency and prevents complex supervisory projects from being run “on the side” by whoever happens to have PM experience.

Second, a competence matrix is needed that goes beyond traditional PM skills. In addition to methodological expertise, this includes regulatory know‑how (e.g. CRR/CRD, AMLR, DORA, NIS‑2, MaRisk), understanding of internal control systems, and audit experience. Institutions should establish targeted training programmes for project managers in which regulatory knowledge is linked to practical case studies: what does an audit‑proof project lifecycle look like? Which documents do auditors expect? What types of errors appear repeatedly in supervisory reports?

Third, project standards must be adapted. Classical phase models should be supplemented with regulatory milestones: legal impact analysis in the initiation phase, mandatory involvement of second‑line functions in design and planning, defined testing and acceptance procedures with participation of compliance, risk, and where appropriate internal audit. Minimum documentation should be specified in a way that is not only useful for the project team but also for auditors: decision minutes, risk analyses, acceptance reports, and evidence of control‑function involvement.

Fourth, the definition of success must change. Institutions should systematically evaluate whether major projects pass supervisory and audit reviews without significant findings. This may include an internal “mock audit” after completion of a major regulatory project: can the institution clearly demonstrate which requirements were addressed, which risks assessed, and which controls adjusted? In this way, the project manager is consciously placed in the role of a “Regulatory Project Lead” who derives success metrics not only from business logic but also from supervisory logic.

Finally, a forward‑looking view is required. Increasing digitalization, mass data processing, the use of AI, and the tightening of European regulation (for example through DORA and the new AML package) will further increase project complexity in BaFin‑regulated institutions. The industrial project manager remains an important role model for efficiency, structure, and method. But in a regulated environment, that alone is no longer enough. Institutions need project leaders who can confidently connect regulatory requirements, IT, and governance – and who understand that every major project also tells a regulatory story. Whether that story convinces supervisors or leads to additional measures is not decided in the audit room, but at the level of the project manager’s role understanding.

References

European Banking Authority (EBA)

• European Banking Authority (2019). Guidelines on ICT and security risk management (EBA/GL/2019/04). Available at: ]https://www.eba.europa.eu/…
• European Banking Authority (2026). Draft revised joint EBA and ESMA Guidelines on the assessment of the suitability of members of the management body and key function holders. Press release and consultation: ]https://www.esma.europa.eu/…

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

• BaFin (2024). Rundschreiben 10/2017 (BA) – Bankaufsichtliche Anforderungen an die IT (BAIT), as amended on 16 December 2024. PDF available at: ]https://www.bafin.de/…
• BaFin / Deutsche Bundesbank (2024). Minimum requirements for risk management (MaRisk) – explanatory notes. PDF (overview, with references to BaFin circulars) available at: ]https://www.bundesbank.de/…
• BaFin (2026). Job posting: Projektmanager (m/w/d) – IT projects and mass data processing. Available at: https://talents.studysmarter.de/….

European Securities and Markets Authority (ESMA)

• ESMA (2023). Guidelines on MiFID II product governance requirements (product governance). Download via ESMA Guidelines & Technical Standards: ]https://www.esma.europa.eu/…
• ESMA (2026). Guidelines on the submission of periodic information by benchmark administrators under the Benchmarks Regulation. Download via ESMA Guidelines & Technical Standards: ]https://www.esma.europa.eu/…

Whitepaper

Free whitepaper for BaFin‑regulated institutions
The pain points outlined in this article only cover part of the practical challenges in project management for BaFin‑regulated institutions – from DORA‑related governance and implementation roadmaps to the alignment of project ICS and line ICS. Building on the regulatory frameworks referenced above, we have compiled a detailed, practice‑oriented whitepaper with:

• a checklist for audit‑proof project management,
• a mapping of key regulatory frameworks (MaRisk, DORA, PSD2, AI Act), and
• concrete implementation recommendations for supervisory‑relevant projects.

You can request this whitepaper free of charge by using our contact form:
https://sp-unternehmerforum.de/….