How Ebury doubled operational risk program coverage without adding headcount

International transactions aren’t as simple as pressing ‘send’. Each one must meet strict requirements for accuracy, security, and compliance with local regulations.

London-based fintech organisation Ebury provides international payments, collections, and foreign exchange (FX) services that make those transactions possible across more than 30 regulated markets and 140 currencies. “Our mission is to help companies trade internationally with confidence,” says Maria Paz Sanchez, Vice President of Operational Risk at Ebury. “My team makes sure all this international trade is carried out safely from a regulatory perspective while minimizing risk.”

Sanchez's team maps risks and controls across the business, makes sure they're tested regularly, and helps senior management understand the company's overall risk profile. But maintaining that visibility required manually collecting updates from teams across the business, making routine updates a time-consuming task.

The challenge: Too much risk, too many spreadsheets

While Ebury had built a sophisticated global payments business, Sanchez's team was spending too much time managing its operational risk framework. The team documented risks and controls, coordinated control testing, tracked incidents, and gathered supporting evidence, with different teams responsible for different parts of the process.

“All the risk management was manual, so we were completely trapped in spreadsheets, email chains, and chat,” says Sanchez. “We couldn't keep the information up to date. As we mapped more risks and controls, it became impossible to keep all the spreadsheets and files current with so many stakeholders involved.”

Even when the spreadsheets were up to date, the team still had to work across different files to see how risks and controls related to one another. Since risks and controls were maintained separately, determining which controls addressed a particular risk often meant tracing information across several spreadsheets. That also made it difficult to give senior management a complete picture of operational risk across the business. “The breaking point was that our risks and controls existed in isolation,” says Sanchez. “It wasn't easy to link them together, so we were losing a lot of efficiency.”

As Ebury added more risks and controls — and more teams became involved — the manual workload continued to grow. “The only way to continue supporting the company's growth was to start looking for a GRC system,” says Sanchez.

The solution: One source of truth for operational risk with Optro

As the operational risk team began evaluating GRC platforms, three capabilities quickly became non-negotiable:

• A clear risk, control, and incident taxonomy with dynamically linked relationships
• API connectivity to integrate with Ebury's broader technology environment
• A user-friendly experience that would make it easy for first-line teams to complete self-assessments

Ebury selected Optro's AI-powered GRC Intelligence platform, implementing OpsAudit, RiskOversight, and Controls Management to replace the company’s spreadsheet-based process. Instead of managing risks, controls, and incidents as separate records across multiple files, the team could now link them within a single system.

The implementation was completed in just six months, despite several internal team changes along the way. For Sanchez, who had previously led GRC implementations at other organisations, the rollout stood out for both its speed and the level of support her team received.

“I've done implementations at different companies, and I have to say that the implementation with Optro was really fast,” says Sanchez. “We had a lot of support from the Optro team. I really was amazed that there's so much information, so many documents in the Academy and the customer support chat.”

One of the modules the team relies on most is WorkStream. It automates first-line self-assessments, allowing control owners to complete testing and provide supporting evidence directly through the platform, eliminating the need for manual follow-up. “The main feature we use today is the WorkStream module,” says Sanchez. “Being able to automate self-assessments with our first line has really been a game-changer for us.”

Results: Growing capacity across 39 business functions

With Optro, the operational risk team now manages significantly more control tests without needing additional people to manually review evidence. “We have around 400 risk controls, and thanks to WorkStream, we're able to manage roughly 190 to 200 control tests every month,” says Sanchez. “Without WorkStream, we'd probably need four people analyzing evidence. Instead, one full-time resource is able to manage it because the platform automates self-assessments with our first line.”

That additional capacity allowed Ebury to essentially double the scope of its operational risk program, expanding coverage from 20 business functions to 39. “That was a great win for us because now we have near-complete visibility into risks and controls across all the functions in the company,” says Sanchez.

By consolidating operational risk information in a single system, the team can also provide leadership with the insights needed to make informed risk decisions. “Now we have a real-time view of our risks, controls, and incidents all in one place,” says Sanchez. “We can give senior management our risk profile at any time. We know what the most critical risks are, which controls aren't effective, and where we need to place resources. Optro has completely changed senior management's perspective on risk, and I think it's really helping the company be safer.”

Ebury is now better equipped to scale its operational risk program as it grows, serving more than 27,000 companies worldwide. “Optro has transformed our risk management into something much more efficient,” says Sanchez. “Productivity has increased, and the visibility of our risk profile is now clear and transparent — clearer than ever.”

Trade spreadsheet sprawl for one view of risk and controls

Replace spreadsheets and disconnected manual processes with a connected GRC platform that brings risks, controls, incidents, testing, and evidence together in one place.

Explore Optro's AI-powered GRC Intelligence Platform.

Book a demo