Written rules (schriftlich fixierte Ordnung)
Written rules are the documented organisational rules on which MaRisk requires a German institution to base all its business, known in practice as the schriftlich fixierte Ordnung.
MaRisk AT 5 requires institutions in Germany to conduct their business on the basis of organisational rules such as manuals, work instructions and process descriptions, detailed in line with the nature, scale, complexity and riskiness of the activities. The rules must be documented, made known to the staff concerned, kept up to date and suitable as a basis for internal audit. German practitioners and auditors call this body of rules the schriftlich fixierte Ordnung. The wording is not a defined term in the circular: earlier versions required the rules to be fixed in writing, and the version of 30 June 2026 requires documentation in text form.
At a minimum the rules cover organisational structure and workflows, the allocation of tasks, competences and responsibilities, risk management and control processes, internal audit, compliance with legal requirements such as data protection, outsourcing and, depending on size and complexity, a code of conduct. For executives, they are the evidence that the organisation required by law exists and is applied.
Typical weaknesses are rules that describe an outdated process, missing links between rules and the controls that enforce them, unclear ownership, and versions that staff cannot easily find. The Swiss counterpart is the Weisungswesen, the body of regulations and directives a bank maintains under FINMA’s corporate governance requirements.
In practice
- 01Keeps one current, accessible version of every organisational rule and archives superseded versions.
- 02Updates rules promptly when processes, products or systems change, using the change process as the trigger.
- 03Designs rules so that internal audit can test actual practice against them.
- 04Records the tasks and individual responsibilities of senior management in a consistent overview.
How MRM-Solution supports it
- 01Generate policies from the modelled processes, so roles and responsibilities in the text match how the work is actually done.
- 02Keep an append-only audit trail of who changed what, when and in which role, plus a change log per policy.
Too good to be true? Then we should talk.
30 minutes. Your use case, maximum impact.
info@mrm-solution.com