CASE STUDY

Leading Bank in Turkey Relies on Archer forIntegrated Risk Management
Improvements in third-party governance, operational efficiency

Türkiye Vakıflar Bankası T.A.O. is one of the largest banks in Turkey, serving
individual and corporate customers through more than 900 physical branches
and internet banking. In addition to core financial services, the bank engages ininvestment banking and capital market activities, playing a leading role in financing
domestic and foreign trade. It also works with financial affiliates to offer otherproducts ranging from insurance to leasing and factoring services.
Given the size and diversity of its offerings and operations, Türkiye Vakıflar BankasıT.A.O. has the challenge of efficiently executing a multitude of distributed processes
and procedures associated with risk management. Since 2013, the bank has
relied on Archer to consolidate these processes on a single platform and enable astreamlined, efficient approach to them.
“Before using Archer, it was quite difficult to coordinate processes related to audit,
business impact analysis, loss events and so forth,” said Akif Mert AVCI, IT processand compliance manager in Türkiye Vakıflar Bankası T.A.O.’s information security
and risk and compliance department. “Just keeping track of the current versions ofdocuments that we constantly used was challenging. We needed a consolidated
environment to provide easier management.”

An integrated digital platform for a highly
distributed structure
Archer was the clear choice for Türkiye Vakıflar Bankası T.A.O. after a market surveyof technology providers for automating risk management processes. “Archer waswell ahead of its competitors in terms of managing relationships between recordsand having easy-to-use reporting tools,” said Akif Mert AVCI. “It is easily capable ofhandling our distributed infrastructure and meeting all our needs.”

Customer vital statistics
Industry: Financial Services
Product: Archer
What I like about Archer:• Consolidation of processes
and procedures on a singleplatform• Ease of correlation between
multiple applications andprocesses• Real-time reporting and fast,accurate report creation• High accuracy in creating
reports from cascadedapplications• Interface customized withlocal language

Türkiye Vakıflar Bankası T.A.O. employs multiple Archer solutions to address
requirements across areas of risk management that include IT security, audit,
business resiliency, compliance and third-party governance, benefiting particularly
from the high degree of correlation between the solutions, real-time reporting
capabilities and rapid, accurate report creation.
“Relationships between different modules and applications can be viewed easily,”noted Elif AHMETOĞLU, technical manager in Türkiye Vakıflar Bankası T.A.O.’s
information security and risk and compliance department, “and there is quick online
access to any record among interconnected records, which is one of the mostimportant benefits from our point of view.”
With the ability to proactively generate business impact analysis and IT risk
assessments and then correlate the relation between applications and IT risks,Archer can automatically calculate service criticality levels. Those real-time outputs
can then be used as inputs for other systems.
Archer also provides robust reporting functionality to Türkiye Vakıflar Bankası T.A.O..
For example, the findings of internal and external audits and penetration tests aremaintained in Archer Audit Management, from which reports of findings can begenerated using real-time data. By matching each business process with its findings,
end-to-end reporting can be easily generated.

“Archer was well ahead ofits competitors in termsof managing relationships
between records andhaving easy-to-use
reporting tools. It is easily
capable of handling ourdistributed infrastructure
and meeting all ourneeds.”– Akif Mert AVCI,
Information Security, IT
Process and ComplianceManager, Türkiye VakıflarBankası T.A.O.

Meeting critical third-party governance needs
Türkiye Vakıflar Bankası T.A.O. deals with many third parties and is required tocomply with regulations for management of third parties published by the Banking
Regulation and Supervision Agency (BRSA), which is responsible for oversight andregulation of the Turkish banking sector. Archer plays a key role in enabling thebank’s compliance.
“Regulation requires strong third-party management processes,” explained Akif
Mert AVCI. “However, this is not tough for us with Archer Third Party Governance.”
Within this solution, vendor profiles, purchase request forms, contracts, SLAagreements, invoices, vendor risk assessments and performance assessments areavailable, correlated and can be used to manage third parties and their activities.

Designed and implemented to maximize efficiency
Increasing operational efficiency is one of the chief benefits Archer delivers. “Foran organization the size and scale of Türkiye Vakıflar Bankası T.A.O., the magnitudeof the challenge of managing procedures and processes using manual tools likespreadsheets and physical documents cannot be overstated,” said Akif Mert AVCI.
“Keeping everything in a consolidated digital environment with Archer is bothcost-saving and function-gaining.”“Relationships between
different modules andapplications can beviewed easily, and thereis quick online accessto any record amonginterconnected records,
which is one of the mostimportant benefits fromour view.”– Elif AHMETOĞLU,Information Security, IT Risk& Compliance TechnicalManager, Türkiye Vakıflar
Bankası T.A.O.

Leading Bank in Turkey Relies on Archer for Integrated Risk Management | 2

In addition to benefiting from the inherent efficiencies Archer enables, TürkiyeVakıflar Bankası T.A.O. has been able to achieve further usability improvements byconfiguring and localizing Archer to meet local needs. Working with Archer partner
Cogris Bilişim, the bank made adaptations including translating user views to Turkish
and configuring built-in calculation fields and application designs for ease of use byboth technical and business users.
As Akif Mert AVCI described it, “Archer is a global leader, but one that can be easily
localized to meet specific needs.”

About Archer
Archer, an RSA company, is a leader in providing integrated risk management
solutions that enable customers to improve strategic decision making andoperational resiliency. As true pioneers in IRM software, Archer remains
solely dedicated to helping customers understand risk holistically by engaging
stakeholders, leveraging a modern platform that spans key domains of risk andsupports analysis driven by both business and IT impacts. The Archer customer
base represents one of the largest pure risk management communities globally,
with over 1,500 deployments including more than 90 of the Fortune 100. For more
information, go to rsa.com.

©2021 RSA Security LLC or its affiliates. All rights reserved. RSA and the RSA logo are registered trademarks or trademarks of RSA
Security LLC or its affiliates in the United States and other countries. All other trademarks are the property of their respective owners.
RSA believes the information in this document is accurate. The information is subject to change without notice. Published in the USA.
01/21 Case Study W437034