Three lines, one view: How Shawbrook connected risk across a £20B bank

At Shawbrook, risk management doesn’t sit with that team alone. For the UK specialist bank, it’s a bank-wide responsibility shared across all three lines of defence. Business teams manage risks and controls, second-line teams provide oversight, and internal audit provides independent assurance.

Shawbrook’s specialist lending proposition has helped it build a diverse portfolio of assets across SME, Real Estate, and consumer markets, growing to £20.1bn as at HY26. Shawbrook’s model combines technology and talent, underpinned by years of proprietary data, and credit excellence is core. Democratising and distributing data throughout the bank is therefore critical, including across the three lines of the bank’s risk organisation. “Being a specialist demands constant evolution, and we wanted to accelerate and scale up our ability to interrogate the data we have in Shawbrook across risk, ensuring every area can surface the right insights at the right time, consistently.” says Kate Marechal, Director of Operational Risk and Risk Services at Shawbrook.

Shawbrook has also grown through acquisitions, and Marechal knew the bank’s requirements would continue to evolve. “We recognised that as a bank we were growing quickly and changing along the way with new acquisitions or new ways of working,” she says. “We needed a tool that could scale with us and cope with that change.”

The solution: Connecting all three lines of defence with Optro

Shawbrook began looking for a platform that could support all three lines of defence and adapt to the bank’s needs as it continues to grow and evolve its specialist proposition and capabilities. Marechal’s team also wanted the freedom to configure the platform themselves. “Being able to self-serve was really important to us,” she says. “We didn't want to have to rely on developers every time we wanted to make a change.”

After evaluating multiple solutions, Shawbrook selected Optro’s GRC Intelligence Platform. But the team didn’t want to simply recreate its existing GRC setup in the new platform. They saw the implementation as an opportunity to refresh the bank’s risk framework, including a rethink of how its controls were structured.

Looking back on that approach, Marechal says, “If I were giving advice to someone thinking about moving to Optro, I would suggest not just using what they currently have in their existing tool, but thinking about what's possible with this connected risk platform.”

Shawbrook took a phased approach to implementation, with its first module going live about three months after signing the contract. “We had great support from the implementation team, who came over from the US to work directly with our business teams and design what the tool would look like for us specifically,” says Marechal. The bank started with the Issues module, then quickly added RiskOversight, OpsAudit, and Controls Management. Since then, Shawbrook has also rolled out Third-Party Risk Management (TPRM), and CrossComply.

As Shawbrook continues to expand its use of the platform, with Business Continuity Management (BCM) next on the roadmap, Optro provides support and resources to help the team get the most out of it. “We’ve had ongoing support from our customer success team, and we’ve also found Optro Academy really helpful,” says Marechal. “The step-by-step guides in the Help Centre also help people self-serve with how they use the tool.”

With risk, controls, audit, and compliance now connected in Optro, the platform serves as Shawbrook’s system of record for GRC. “When I think about connected risk and how we've implemented Optro, the breadth of information we have in the tool really helps us generate cross-cutting views of our data and risks in real time,” says Marechal.

That single source of truth is also the foundation Shawbrook will need for what comes next — a system of record trusted enough to put AI agents to work on top of it.

Results: Setting the stage for a system of action

Optro has been widely adopted across Shawbrook, with teams across all three lines using the platform to manage risk. With a connected view, leaders can see the wider impact of an issue and make more informed, risk-based decisions.

“When something goes wrong, we're very quickly able to answer: What processes does it impact? What controls are impacted? How does that affect our risks? Are there any third parties that we need to consider?” says Marechal. “Optro gives us a one-stop shop of insights, and that insight helps us to better understand risks and make the right decisions – whether at the local or executive level.”

Shawbrook recently added Accelerate, Optro's AI module that automates GRC workflows, continuously monitors controls, and analyses risk data. The company also plans to use Optro's MCP server to make that data available within the enterprise AI tools used across the bank. Accelerate, and MCP will put that system of record to work — giving agentic AI the trusted, connected data it needs to flag emerging risk and surface insight in real time.

“We’re really excited to see what the Accelerate module can do for us, along with the MCP connector, which will help bring Optro data into the AI tools that the broader bank uses,” says Marechal.

Marechal also points to how Optro has developed since Shawbrook first implemented it. New functionality is released regularly, and the team has seen its own feedback incorporated into the product. For a growing bank, this gives Shawbrook confidence that Optro is a partner that can support its risk programme for the long term.

“Optro has given us the embedded platform we really wanted across all three lines. It’s helped us join the dots across the different areas of risk we manage,” adds Marechal. “Optro is a business platform, not just a risk or audit silo where no one really uses the data. For us, it’s added huge value.”

Don’t just document risk. Act on it.

Get a connected view of risk across your business and turn that understanding into action. Optro gives teams the context they need to understand how risks affect the business and know how to respond.

See Optro’s GRC Intelligence Platform in action

Book a demo