We don't do compliance.
We do regulatory alpha.

Before the inspection letter arrives, every Chief Risk Officer must answer twelve questions with absolute clarity. Not in theory. Not in a steering-committee deck. In the evidence the inspector will actually request — and in the sequence supervisors use. This is the framework that separates banks that shape the inspection narrative from those that scramble through findings negotiation.

12
Questions — the CRO diagnostic
4
Phases of the OSI engagement cycle
60d
Lead time that meaningfully moves the grade
3
OSI engagements accepted per quarter

An on-site inspection is not an audit. It is a test of control.

When the JST walks in, they are not verifying that you said the right things in your RAS. They are verifying that the institution behaves as the documents claim — under pressure, in real data, under the eye of an inspector who has seen how your peers actually operate. Failure is expensive and asymmetric.

01
Capital

A supervisory add-on of 25–75 bps on P2R is the typical price of structural findings. For a mid-sized SSM bank, €400m–€1.2bn of additional capital consumption.

02
Time

Follow-up letter, remediation plan, Board validation, TRAIR reassessment — 18 to 30 months of senior-management bandwidth redirected from strategy to defence.

03
Reputation

Supervisory perception compounds. A weak OSI feeds the next SREP, the next TRIM cycle, and sets a risk-taking ceiling the Board never explicitly voted for.

04
Career

CROs rarely leave after one difficult SREP. They leave after the second. The OSI is where the second one is written, months before it is published.

Four phases. Twelve questions. One chance to get it right.

Most OSI failures are sequencing failures. The institution knows the answers — in fragments, in different committees, in different heads — but cannot assemble them in the order and cadence the inspector requires. We have organised the twelve questions around the four phases of the supervisory engagement cycle.

01
Phase 01 · Pre-Notification Posture

Inspections begin long before the letter arrives.

By the time the mission letter is signed at the JST, the inspector has already read two SREP cycles, three internal audit reports and every supervisory exchange minute. Your score is partially set. These three questions determine the baseline.

01
Governance

Can your Board prove — on paper — that it governs risk, not just hears about it?

The inspector will ask for the last four Board Risk Committee minutes and trace one escalation per meeting through to resolution. "The Board was informed" is not governance. "The Board decided, dated, and required evidence of closure" is.

Evidence inspector will requestBRC minutes (12m), escalation log with owners and due dates, tested escalation simulation from 1st-line incident to CEO within 72h.
02
Supervisory Intelligence

Who in your institution knows what your JST Coordinator is writing about you?

Supervisors telegraph their concerns. Thematic reviews, horizontal benchmarks, JST speeches and sector "Dear CEO" letters are the inspection brief in plain sight. If you cannot name the three themes your JST is escalating in 2026, you are preparing for the wrong inspection.

Evidence inspector will requestSummary of last four supervisory exchanges, mapped JST thematic priorities, documented internal response to the current SSM supervisory priorities.
03
Risk Appetite

Are your materiality thresholds defensible — or are they optimistic?

Most RAS documents use thresholds that were calibrated in benign conditions and have never been tested. Inspectors look for the gap between what the RAS escalates and what actually gets escalated. Where that gap exists, the inspector will document it — and so will the SREP.

Evidence inspector will requestRAS with dated board approvals, breach log with explicit management actions, back-test of thresholds against last two years of loss events and supervisory add-ons.
02
Phase 02 · Mobilisation & Evidence · First 48 Hours

In the first 48 hours, you set the tempo of the entire mission.

An inspector forms their working hypothesis on the pace at which you deliver the first three document requests. If the initial exchanges are slow, ambiguous or mis-sequenced, the default assumption is that controls are weak elsewhere. These three questions decide that tempo.

04
Data Room

Can you produce any requested artefact within two working hours — tested in the last 30 days?

The inspection data room is not a SharePoint. It is a tested retrieval capability organised by scope area, indexed to the mission letter, and rehearsed under a fire-drill. Banks that cannot execute a blind retrieval of a board paper from 2023 in under two hours are telling the JST something about their control environment.

Evidence inspector will requestData room architecture, index of 500+ artefacts, timestamped log of last fire-drill showing median retrieval latency under 90 minutes.
05
Process Documentation

Do your core-risk SOPs describe the bank as it actually operates today?

Credit granting, model validation, collateral revaluation, NPL workouts, stress testing — each must be documented at the level a new hire could execute without a call. Version control matters. "Last reviewed 2022" is the single most common finding in credit OSIs and it is avoidable.

Evidence inspector will requestSOP library with last-review dates, RACI alignment to org chart, walkthrough evidence showing SOP matches observed practice in two sample workflows.
06
Intake Protocol

Who speaks to the inspector, in what order, with what pre-read?

Uncoordinated meetings are the most common self-inflicted wound of an OSI. Three different SMEs answering the same question with three different numbers is a finding before it is a problem. An intake protocol — named single point of contact, pre-briefed interviewees, rehearsed responses to the 30 most likely questions — is table stakes.

Evidence inspector will requestOSI engagement charter, SPOC log, interviewee rehearsal schedule, Q-list of 30 most likely inspector questions with agreed institutional responses.
03
Phase 03 · Technical Credibility · Active Mission

Technical findings are rarely about the number. They are about the process that produced it.

Inspectors are less interested in whether your PD model is calibrated correctly than in whether you can prove how it was calibrated, who approved it, and what the override trail looks like when the result is inconvenient. These three questions determine the substantive grade of the inspection.

07
Model Governance

For every live IRB, IFRS 9, stress-test and AML model — can you walk the full approval trail in one continuous narrative?

The model approval file must reconstruct: initial development, independent validation, Board sub-committee approval, regulatory non-objection (where applicable), annual back-testing, material changes and their re-approval. TRIM-style inspections have industrialised the request for exactly this trail. Gaps get documented; gaps get findings.

Evidence inspector will requestComplete inventory of risk models, approval packs, back-testing reports with traffic-light ratings, log of overrides with business rationale and risk sign-off.
08
Stress & ICAAP

Would your ICAAP scenarios survive 30 minutes with a sceptical inspector?

Reverse stress tests, idiosyncratic scenarios, narrative plausibility, transmission of macro shocks into P&L and capital — if the story breaks under cross-examination, the finding writes itself. Your ICAAP is a supervisory-facing document whether you wrote it that way or not.

Evidence inspector will requestICAAP narrative, scenario calibration memo, reverse stress results, evidence that the CRO and CFO have rehearsed the capital-planning story end to end.
09
Third-Party & Outsourcing

Do you control your critical outsourced functions — or do you coordinate them?

DORA, EBA Outsourcing Guidelines, and SSM expectations have converged: the bank remains responsible for operations it has outsourced. Inspectors pull the register, pick two critical vendors, and request the last three KPI reviews, the exit plan, and evidence of Board oversight. If any of those are missing, the inspection changes character.

Evidence inspector will requestRegister of critical outsourcing, SLAs, DORA mapping of ICT third parties, exit strategies, Board oversight minutes covering outsourcing performance.
04
Phase 04 · Narrative & Negotiation · Findings and Aftermath

A finding is never final on the day it is drafted.

Between the end of the on-site phase and the Final Written Report, there is a window — usually six to twelve weeks — in which the institution shapes the wording, severity and cadence of the findings it will live with for two SREP cycles. The last three questions decide whether you use that window.

10
Root Cause & Remediation

For every open finding, do you have a dated root-cause analysis — or do you have a to-do list?

Inspectors distinguish between action plans and remediation. An action plan fixes the symptom. Remediation fixes the mechanism. When the Draft Written Report lands, the institutions that can demonstrate root-cause discipline receive different language — and different severities — than those that cannot.

Evidence inspector will requestRCA template, example completed RCAs for two closed findings, evidence of Internal Audit re-opening cases where RCA was superficial.
11
Response Protocol

Is your DWR response factually tight, legally clean, and politically useful to the inspector's own escalation?

Inspectors negotiate findings with the JST coordinator. A bank that supplies evidence-grade rebuttals — dated, sourced, concise — gives the inspector material to soften or re-rank a finding. A bank that supplies commentary strengthens the original wording. This is an art form that should not be learned live.

Evidence inspector will requestDraft Written Report response template, legal review protocol, Board validation sequence, documented precedent of downgrading severity through evidence.
12
Relationship Capital

Does your JST see you as transparent — or as well-prepared?

Those are not the same thing. "Well-prepared" is the posture of a bank that has rehearsed its defences. "Transparent" is the posture of a bank that escalates what it sees, invites supervisory dialogue on difficult issues, and accepts the short-term friction of doing so. Every OSI is scored partly on this distinction. Relationship capital compounds — or corrodes — across every cycle.

Evidence inspector will requestLog of proactive supervisory disclosures in the last 24 months, evidence of self-identified findings raised to the JST before inspection, documented supervisory response.

The banks that navigate OSIs well are not the banks with the thickest files. They are the banks whose CROs have rehearsed the conversation — and whose documents match what the institution actually does.

Hannan Mohammad · Founder · Ezelman

Day 0. Day 7. Day 30. Day 60.

If the inspection letter lands on your desk today, these are the four checkpoints you hit — in this order, at this cadence — between notification and the first on-site visit. This is what the best-prepared G-SIBs in Europe actually do. It is not theory. It is a timetable.

Day 0 · Letter Received

Stand up the war-room. Not a committee — a war-room.

The first decision is structural: the OSI response is taken out of line-management and given to a named programme director reporting directly to the CRO (or CEO for severe inspections). Within 24 hours, three artefacts are produced.

Scope mapping: translate the mission letter into a Responsibility Assignment Matrix against your org chart, naming one accountable executive per sub-scope.
Engagement charter: single point of contact, escalation tree, legal and communications protocol, rules of engagement with the inspection team.
Data room mobilisation: baseline request list pre-populated, indexed to the mission letter, tested with one blind retrieval.
Day 7 · Diagnostic Baseline

Run the twelve-question diagnostic against the real evidence.

This is not a self-assessment. Senior practitioners — ideally ex-supervisors — stress-test each of the twelve dimensions against what the institution can evidence today, not what it believes it can evidence. The output is a heat-map with three categories of gap: remediable in 30 days, remediable in 60, structural.

Heat-map: each of the 12 questions scored on evidence, defensibility and alignment with supervisory priorities.
Gap log: ranked by severity × OSI proximity, with single accountable owner and Day-30/Day-60 close date.
Red-team findings: the three findings the inspector is most likely to write — pre-drafted in inspector language, with proposed rebuttals.
Day 30 · Dry-Run

Rehearse the inspection with people who have sat in the inspector's chair.

Ten named interviewees — CRO, CFO, Head of Credit, Head of Models, Head of Internal Audit, CISO, Head of Outsourcing, COO and two line-1 SMEs — are interviewed under OSI conditions, in English, over three days. The transcript reveals inconsistencies before the inspector does. Governance artefacts are simultaneously tested in a second blind fire-drill.

Mock interview report: what each interviewee said, where the institutional story fractures, specific phrasing to align before the real mission.
Evidence fire-drill #2: 25 artefacts requested at random; log of retrieval time, completeness and clarity scored against Day-0 baseline.
Board pre-read: a 12-page dossier the CEO can take to the Risk Committee, translating the OSI into three decisions the Board must make.
Day 60 · Mission Start

Arrive at the kick-off meeting with the narrative pre-written.

On the morning the inspection team walks in, the CRO opens with a 40-minute institutional narrative: risk profile, material evolutions since the last SREP, known weaknesses the bank is already addressing (with dated commitments), and the three topics where the bank would welcome supervisory dialogue. This posture — confident, transparent, prepared — sets the temperature for the entire mission.

Opening narrative: rehearsed CRO presentation, aligned with CFO and CEO messaging, addressing the JST's known thematic priorities head-on.
Daily briefing cadence: 30-minute end-of-day with the programme director; agreed escalation criteria for mid-day events.
Findings tracker: live log of emerging inspector questions, institutional responses, and rebuttal packs — so the DWR response window starts on Day 1, not Day 60.

The three most expensive OSI failures — and the institutional reflex behind each.

Drawn from anonymised patterns observed across recent significant-bank inspections in France, Belgium, Luxembourg and Germany. None of these are model errors. All of them are preparation errors.

Pattern 01

The "We Already Told You" defence.

The institution responds to inspector questions by referring back to three-year-old Board papers or prior supervisory correspondence. The inspector hears: the bank has not moved on. The finding is written as governance weakness, not as a technical issue — and governance findings travel further in the SREP.

Typical costOne additional P2R bp per finding, escalation to JST coordinator, and 18 months of "enhanced monitoring" added to the supervisory dialogue.

Pattern 02

The "Second-Line Discovers It During the Inspection" problem.

Risk, compliance or internal audit raise a material issue mid-mission — often honestly, often correctly — but in front of the inspector rather than in the Day-7 diagnostic. The institution loses the ability to frame the issue. The inspector frames it, and the framing becomes a finding.

Typical costPublic finding on self-identified weakness, accelerated remediation timeline (6 months vs 18), and a permanent loss of narrative control for that topic.

Pattern 03

The "DWR arrived on a Friday" collapse.

The Draft Written Report lands with a tight response deadline. The institution has no pre-built response protocol, no legal sign-off path, no Board validation sequence and no library of evidence. It submits a commentary — not a rebuttal. The finding goes into the Final Written Report at its original severity. Two years of SREP follow.

Typical costForgone opportunity to downgrade 2–3 findings per mission, locked-in capital add-ons and a weaker position at the next supervisory dialogue.

Lessons from practice — what separates banks that shape the inspection from those that survive it.

48h
Evidence retrieval SLA that marks a prepared institution
60d
Lead time a focused diagnostic can meaningfully move the OSI grade
12
Questions that cover 80% of supervisory-finding patterns in significant banks
Dry-runs — the empirical minimum for senior-interviewee readiness
01

Real-time evidence beats a beautiful deck.

An inspector who receives live system queries — not a pre-compiled PDF — walks out with a different view of your controls. Decks show what you want to see. Live data shows what you can see.

02

Supervisory alignment is a strategy, not a posture.

The best OSI outcomes come from CROs who have been in structured contact with their JST long before the letter. You do not negotiate your way out of findings. You prevent them — through disclosure discipline.

03

Execution rigor is the differentiator.

Inspectors look for discipline, not perfection. Dated decisions, tested controls, audited closures. Banks known for follow-through negotiate post-inspection with credibility; the rest negotiate from weakness.

Three entry points. One standard of senior practitioner delivery.

Every Ezelman OSI engagement is led personally by senior practitioners with direct SSM, PRA and G-SIB risk-function experience. No pyramid. No first-year associates running your data room. Choose the depth that matches where you are in the cycle.

Tier 01

Readiness Sprint

For CROs who suspect they have an OSI coming — or who want a calibrated benchmark before the letter.

A focused two-week diagnostic: the twelve-question framework applied to your institution, a red-team scoring exercise, and a Board-ready dossier with a prioritised gap list.

  • 12-question diagnostic with evidence review
  • Heat-map & ranked gap register
  • Top-three red-team findings with rebuttals
  • Board pre-read (12 pages)
2 weeks · senior-led
Scope a Sprint →

Tier 03

Post-Inspection Remediation

For banks operating under an FWR with open findings and an impending follow-up.

Structural remediation: root-cause discipline, remediation governance, evidence architecture, and calibrated supervisory dialogue to restore relationship capital and close findings credibly.

  • RCA framework & remediation programme design
  • Evidence architecture & Internal Audit alignment
  • Supervisory dialogue & JST communication strategy
  • Follow-up inspection preparation
3–9 months · partnered delivery
Discuss Your Findings →

Built for CROs who need someone who has sat on the other side of the table.

Ezelman is a boutique financial-risk advisory firm serving G-SIBs and Tier-1 banks across Europe and the GCC. We do not bring an army. We bring senior practitioners who have worked inside risk functions, supervisory authorities and CRR3 programme leadership — and who deliver the work personally, not through layers.

We are selective. We take on a small number of OSI engagements each quarter to preserve the quality of senior attention, the discretion our clients rely on, and the pace at which we can genuinely shape outcomes.

Coverage & Capability

  • Jurisdictions: ECB / SSM, ACPR, BdF, PRA, FINMA, central GCC authorities.
  • Regulations: CRR3 / Basel 3.1, IRRBB, ICAAP / ILAAP, TRIM, IFRS 9, DORA, EBA Outsourcing.
  • Mission types: Credit risk OSI, Internal-models inspection, Governance & risk-culture review, ICT / operational resilience.
  • Sectors: Universal banks, investment banks, corporate & investment banking, retail portfolios.
  • Delivery: Senior-led, on-site where needed, multilingual (EN / FR / AR).
Limited to 3 OSI engagements per quarter

If the letter hasn't arrived, you still have leverage.
If it has, you have sixty days.

Book a 45-minute confidential scoping call with the founder. We will walk the twelve questions against your institution, identify where the real exposure sits, and tell you candidly whether an engagement with us makes sense — or whether you can run the readiness internally.

HM
Hannan Mohammad · Founder & Managing Partner, EzelmanEvery OSI engagement is scoped personally.