Three lines, one view: How Shawbrook connected risk across a £22B bank

Shawbrook’s risk organisation may have over 120 people, but risk management doesn’t sit with that team alone. For the £22 billion UK specialist bank, it’s a bank-wide responsibility shared across all three lines of defence. Business teams manage risks and controls, second-line teams provide oversight, and internal audit provides independent assurance.

To give the bank a single source of truth for risk, Shawbrook wanted all three lines working from the same information. “It was really important to us that we had all of this data and information in one place so that we could get the right insights out of it,” says Kate Marechal, Director of Operational Risk and Risk Services at Shawbrook.

The challenge: A GRC platform stuck in a “risk silo”

Shawbrook already had a GRC platform, but it only supported part of the bank’s risk programme. It had no internal audit or control testing functionality, limiting how broadly the platform could be used. Those missing capabilities left the three lines of defence working across disconnected systems rather than on a single shared platform.

“The tool that we had at the time didn't have an internal audit capability, and it couldn’t test controls,” explains Marechal. “It wasn't really embedded and being used properly across the organisation. It very much sat in a risk silo.”

Shawbrook was also growing through acquisitions, and Marechal knew the bank’s requirements would continue to evolve. “We recognised that as a bank we were growing quickly and changing along the way with new acquisitions or new ways of working,” she says. “We needed a tool that could scale with us and cope with that change.”

The solution: Connecting all three lines of defence with Optro

Shawbrook began looking for a platform that could support all three lines of defence and adapt to the bank’s needs as it grew. Marechal’s team also wanted the freedom to configure the platform themselves. “Being able to self-serve was really important to us,” she says. “We didn't want to have to rely on developers every time we wanted to make a change.”

After evaluating multiple solutions, Shawbrook selected Optro’s GRC Intelligence Platform. But the team didn’t want to simply recreate its existing GRC setup in the new platform. They saw the implementation as an opportunity to refresh the bank’s entire risk framework, including rethinking how its controls were structured.

Looking back on that approach, Marechal says, “If I were giving advice to someone thinking about moving to Optro, I would suggest not just using what they currently have in their existing tool, but thinking about what's possible with this connected risk platform.”

Shawbrook took a phased approach to implementation, with its first module going live about three months after signing the contract. “We had great support from the implementation team, who came over from the US to work directly with our business teams and design what the tool would look like for us specifically,” says Marechal. The bank started with the Issues module, then quickly added RiskOversight, OpsAudit, and Controls Management. Since then, Shawbrook has also rolled out Third-Party Risk Management (TPRM), CrossComply, and Cyber Risk.

As Shawbrook continues to expand its use of the platform — with Business Continuity Management (BCM) next on the roadmap — Optro provides support and resources to help the team get the most out of it. “We’ve had ongoing support from our customer success team, and we’ve also found Optro Academy really helpful,” says Marechal. “The step-by-step guides in the Help Centre also help people self-serve with how they use the tool.”

With risk, controls, audit, and compliance now connected in Optro, the platform serves as Shawbrook’s system of record for GRC. “When I think about connected risk and how we've implemented Optro, the breadth of information we have in the tool really helps us move from looking at risks in silos to having that cross-cutting view,” says Marechal.

That single source of truth is also the foundation Shawbrook will need for what comes next — a system of record trusted enough to put AI agents to work on top of it.

Results: Setting the stage for a system of action

Optro has been widely adopted across Shawbrook, with teams across all three lines using the platform to manage risk. With a connected view, leaders can see the wider impact of an issue and make more informed, risk-based decisions.

“When something goes wrong, we're very quickly able to answer: What processes does it impact? What controls are impacted? How does that affect our risks? Are there any third parties that we need to consider?” says Marechal. “Optro gives us a one-stop shop of insights that just wouldn’t have been possible before. And that insight helps our executive teams better understand risks and make the right decisions.”

Shawbrook recently added Accelerate, Optro's AI module that automates GRC workflows, continuously monitors controls, and analyses risk data. The company also plans to use Optro's MCP server to make that data available within the enterprise AI tools used across the bank. Accelerate and MCP will put that system of record to work — giving agentic AI the trusted, connected data it needs to flag emerging risk and surface insight in real time.

“We’re really excited to see what the Accelerate module can do for us, along with the MCP connector, which will help bring Optro data into the AI tools that the broader bank uses,” says Marechal.

Marechal also points to how Optro has developed since Shawbrook first implemented it. New functionality is released regularly, and the team has seen its own feedback incorporated into the product. For a growing bank, that gives Shawbrook confidence that Optro is a partner that can support its risk programme for the long term.

“Optro has given us the embedded platform we really wanted across all three lines. It’s helped us join the dots across the different areas of risk we manage,” adds Marechal. “Optro is a business platform, not just a risk or audit silo where no one really uses the data. For us, it’s added huge value.”

Don’t just document risk. Act on it.

Get a connected view of risk across your business and turn that understanding into action. Optro gives teams the context they need to understand how risks affect the business and know how to respond.

See Optro’s GRC Intelligence Platform in action

Book a demo