NO Contact us
Fjord city at dusk – Imperion, GRC consulting for financial services

Advisory for effective governance, risk management and compliance in the financial sector

From regulation to practical risk management as a value-creating part of the business

Expertise View services
Boardroom – advisory on governance, risk management and compliance

Our expertise

Advisers with long leadership experience in large, complex organizations as well as smaller start-ups

We combine insight from all three lines of defense

Partners

Four partners who complement each other

Services

How can we help you?

Select an area to see the need, our method and a typical deliverable.

Desk – contact Imperion for GRC advisory

Contact

Contact us for a GRC conversation

We are experts in GRC, whether the question concerns regulatory requirements or best practice. At Imperion we draw on our combined experience to give sound advice and recommendations on the next steps.

post@imperion.no

Privacy

Privacy notice

Controller

Imperion AS, org. no. 938 750 645, Oslo, is the controller for personal data processed in connection with this website. Questions about privacy can be sent to post@imperion.no.

What we process

When you send us an email, we process your name, email address and what you write to us. The purpose is to answer your inquiry and, where relevant, follow up a possible engagement. The legal basis is our legitimate interest in responding to inquiries, or that the processing is necessary to enter into a contract (GDPR Article 6(1)(f) and (b)).

As with any website, the web server records technical information when the page loads, such as IP address, time and browser type. The website is hosted by Domene AS (domene.no), which processes this information on our behalf as a data processor. The information is used only for operation and security.

Cookies

This website uses no cookies, no analytics tools and no tracking. If you choose light or dark mode yourself, the choice is stored locally in your browser so it is remembered next time. It is not sent to us or anyone else, and you can delete it by clearing your browser data. Fonts and images are embedded in the page, and nothing is loaded from third parties.

Retention and sharing

Inquiries are kept for as long as necessary to follow them up, and no longer than accounting and contractual considerations require. We do not sell or share personal data with others unless required to do so by law.

Your rights

You can request access to, correction of or deletion of data about you, and you can object to the processing. If you believe we process personal data in breach of the rules, you can lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

Last updated: November 2026

Expertise

Experienced partners who turn regulatory requirements into practical solutions

Imperion is an independent advisory firm focused primarily on governance, risk management and compliance. All our advisers are partners in the firm and have long experience both from recognized consulting firms and from senior positions in Nordic financial institutions. We have been accountable to management, boards and supervisory authorities, and therefore have a thorough understanding of both regulatory expectations and what it takes to turn them into sound governance in practice.

With our experience, we help clients translate regulatory requirements and risk management principles into practical solutions that work in day-to-day operations and avoid unnecessary friction. In every project, we tailor the solutions to the organization's ambitions and challenges. Our aim is always to help make risk management an integrated, value-creating part of the business. When risk management is a natural part of decision-making, product and service development, work processes and governance models, it provides a better basis for priorities and resource allocation, and contributes to stronger governance and control, higher profitability and greater customer satisfaction.

At Imperion, we want to make it easy for our clients to access experienced advisers through straightforward delivery models. With us, the partner who signs the agreement is always the one who delivers the assignment. When needed, specialist expertise from other advisers in the firm can easily be brought in.

Get in touch

Service area

Credit risk

From strategy and credit approval to portfolio monitoring and model control.

Need

Credit risk is normally a bank's largest risk. Strategy and risk appetite should govern credit policy, limits, mandates and day-to-day credit decisions. This must be in line with the EBA Guidelines on loan origination and monitoring and the Norwegian lending regulation (utlånsforskriften). Finanstilsynet increasingly finds weaknesses in credit case handling, debt-servicing capacity assessments and the follow-up of problem loans.

Method

We review the credit process from application to follow-up and link limits and mandates to the risk appetite. We test credit files and data quality, analyze scorecards, PD models and IFRS 9 loss models, and build indicators for early warning, concentration and default. Model development and validation are run as independent projects.

Typical deliverable

A credit process that is clearly anchored in the risk appetite and balances profitability against the desired risk tolerance. The portfolio is monitored in BI dashboards on a shared data source, so that weaknesses are identified earlier and model control works in operation.

Talk to us about this

Service area

Capital adequacy

Consistency between risk profile, capital needs, capital plan and regulatory reporting.

Need

CRR3 has applied in Norway since April 1, 2025. The regulation has changed the risk weights for exposures such as residential mortgages, commercial real estate and corporates, and has introduced new requirements for property valuation. For IRB banks, an output floor is being phased in gradually toward 72.5 percent of the standardized approach, and the risk-weight floor for residential mortgages has been raised to 25 percent. CRD6 sets new requirements for managing ESG risk, and the new market risk rules (FRTB) apply in the EU from 2027.

Method

We review the classification of exposures, collateral and loan-to-value, and check that property values meet the CRR3 requirements. We test the calculations and their traceability from source systems to COREP. We also challenge the ICAAP scenarios and calculate how they affect capital targets, buffers and the margin above the capital requirement.

Typical deliverable

A verifiable risk exposure amount with documented data flows, a capital plan with stress scenarios and measures, and an annual cycle that links ICAAP, capital targets and regulatory reporting.

Talk to us about this

Service area

IFRS

Verifiable financial reporting, IFRS 9 and preparation for IFRS 18.

Need

IFRS 18 applies from 2027, with new categories in the income statement and new disclosures. Amendments to IFRS 9 and IFRS 7 from 2026 affect the classification of loans and disclosure requirements.

Method

We validate staging, loss models, macroeconomic scenarios and management judgments, test data, migration matrices, reconciliations and the basis for disclosures, and prepare a transition plan agreed early with the auditor.

Typical deliverable

Well-founded accounting estimates, traceable reporting from model to accounts, and controls at every financial close. The deliverable does not replace the statutory audit.

Talk to us about this

Service area

DORA

Digital operational resilience, third-party risk and control of critical ICT dependencies.

Need

Complex supply chains, concentration risk, cyber threats and rapid technological change raise the bar for digital operational resilience. DORA requires the organization to document control of ICT risk, critical suppliers, incidents, roles, responsibilities and continuity, including where services are outsourced. At the same time, the compliance and risk management functions have independent second-line control tasks and must contribute to independent monitoring and assessment of whether governance, risk management and control work as intended.

Method

We assess governance, critical ICT services, organization, governance model and supplier dependencies, quality-assure the register of information and the contracts, and test whether preparedness, incident management, recovery and exit plans work in practice. We also assess how the compliance and risk management functions fulfill their independent control responsibility, including the control plan, methodology, reporting, documentation and follow-up of deviations.

Typical deliverable

A risk-based DORA assessment with an overview of critical dependencies and material gaps, a quality-assured register of information and a prioritized action plan. The deliverable can also include independent second-line controls and documented assurance to management and the board that the DORA requirements are implemented and work in practice.

Talk to us about this

Service area

AML, KYC and CTF

Preparation for the EU Anti-Money Laundering Regulation (AMLR), building on the financial institution's own framework for managing money laundering risk.

Need

For entities subject to anti-money laundering rules, the AMLR introduces stricter and more detailed requirements, including for customer due diligence, risk assessments, beneficial ownership, internal control and group-level oversight. The AMLR also creates room for greater efficiency and automation, which will affect areas such as technology, operational processes and customer friction.

Method

We help the entity prepare with the right scope, proportionate to its size, complexity and risk profile. We start with a targeted gap analysis against the AMLR and the regulatory technical standards (RTS) published so far, reviewing the risk assessment, customer due diligence, systems and governance model. We assess whether onboarding and KYC systems can collect, verify and store more detailed information, whether the data can be reused for monitoring, screening and reporting, and whether the systems can identify linked transactions. For groups, we also look at whether policies, governance, controls and information sharing are consistent across countries and entities. Gaps are prioritized by risk and deadline, and we prepare a plan for when and how measures should be launched, so that the entity avoids investing before the requirements are settled.

Typical deliverable

A gap analysis against the AMLR with prioritized measures, and an assessment of data, verification and systems, including the handling of linked transactions. For groups, we also assess whether AML controls are consistent across countries and entities. The results are brought together in an action plan with ownership, milestones and resource needs, and decision support for management and the board. Where needed, we support project work to close the identified gaps. We can also take part in existing project and steering groups to safeguard quality, requirements, vendor dialog, execution and reporting.

Talk to us about this

Service area

AI Governance

Comprehensive management of AI risk, with the AI Act as part of the regulation to be complied with.

Need

AI has changed the way we work. New models are now used in everything from customer dialog and case handling to credit assessment, control and product development. Much of this use starts from the bottom of the organization, often before the firm has decided how AI should be governed.

The firm must assess which risks this entails and who is accountable. At the same time, regulation such as the EU AI Act, data protection rules and DORA sets requirements for governance, transparency and control. It is also a matter of trust: customers, supervisors and the board must be able to rely on AI being used responsibly. Responsible AI, meaning the use of AI that is fair, explainable, safe and protects privacy, must therefore be turned from principles into practice.

Method

We help the firm build AI governance that is robust but proportionate to its size, complexity and maturity. It should not be a separate system alongside the business, but part of existing governance and processes.

We help assess where AI is used and planned, what risk this entails, and how existing frameworks for risk management, information security, data protection and model risk can be extended. Together with the client, we develop principles for responsible use of AI, risk classification of use cases and a clear allocation of roles and responsibilities across the first, second and third lines of defense.

We make sure AI governance is built into what the firm already does: product and service development, new product approval, procurement and vendor management, change management and internal control. This makes the assessment of AI a natural part of decision-making rather than an extra step after the fact.

Typical deliverable

An overview of AI use and risk classification of use cases. A policy and principles for responsible AI. An AI governance framework with roles, responsibilities and decision rights. Adapted processes for product development, procurement and vendor management. Reporting and decision support for management and the board. Plans for tailored training of the board, management and staff.

Talk to us about this

Service area

Operational risk

From risk appetite to daily operations, with clear ownership and decision-ready reporting.

Need

Operational risk management is not only about backward-looking assessments based on incidents, deviations and losses. The forward-looking perspective is at least as important, identifying and assessing risks before they materialize, for example through risk assessments, scenario analyses and assessments of changes in the business, technology, processes and operating conditions.

Financial institutions need a comprehensive control framework that strengthens resilience and prevents operational losses. Risk appetite, limits and escalation must be consistent with ownership and accountability across the three lines of defense. Weak governance and control can lead to Pillar 2 add-ons.

Method

We assess maturity and gaps against requirements and expected practice, and establish policies, risk appetite, qualitative and quantitative methods for assessing risk, thresholds, and roles and responsibilities. Risk and control self-assessments provide the basis for assessing risk and the control environment. A shared taxonomy and data ownership link incidents and losses to key indicators, scenarios and stress testing.

Typical deliverable

A comprehensive operational risk management framework in operation, with clear risk owners and reporting lines, quality-assured incident and loss data with clear escalation, and robust continuity plans. This is combined with forward-looking risk assessments that identify new and changing risks before they materialize, giving management a comprehensive risk picture, clear priorities and a sound basis for risk-mitigating measures.

Talk to us about this

Service area

Compliance

Risk-based compliance with clear ownership, documented controls and follow-up.

Need

A compliance function is expected to have a mandate anchored in the board, clear roles, an annual plan, direct access to the board and sufficient capacity.

Method

We map relevant regulation and best practice, document and propose prioritized changes and ownership, and test actual compliance through a test plan and documentation. We also have long experience in setting up effective operating models for the compliance function, with a proposed annual plan and planned activities, including reporting to management and the board.

Typical deliverable

Gap assessments against upcoming or existing high-risk regulation and best practice, operating models and concrete content for an effective compliance function, assessments of organization and division of responsibilities between the first, second and third lines, follow-up of risk-mitigating measures, interim management and coaching of compliance roles.

Talk to us about this

Service area

Internal audit

Outsourced internal audit or reinforcement of the financial institution's own function.

Need

Small and medium-sized financial institutions need access to specialist internal audit expertise that is often very demanding to build in-house. As requirements grow in number and complexity, the board needs independent expert assessments of whether risk management, compliance and internal control are effective, so that it can fulfill its mandate and oversight responsibility.

Method

Drawing on our broad experience of internal audit in banking and finance, we prepare a prioritized, risk-based audit plan and carry out audits of credit, capital, operational risk, compliance, anti-money laundering, ICT, DORA and other key requirements, in line with the Global Internal Audit Standards. Internal audit is a critical, value-creating function that secures the board's independent oversight of the business by combining deep experience in audit, risk management and compliance.

Typical deliverable

Independent, risk-based and precise assessments for the board, with clear recommendations based on long specialist experience of auditing financial institutions. Through clear structure, methodology, in-depth expertise, and sound reporting and communication, internal audit can be a key part of a company's long-term value creation.

Talk to us about this

Service area

Interim management

Interim management that ensures continuity today and builds a stronger function for the future.

Need

When a key person leaves, regulatory requirements change or the business faces change, the need for experienced leadership can arise quickly. An interim manager gives the business immediate access to leadership expertise and experience, without losing momentum in a critical function.

Method

We have experience in roles such as CRO, CCO, AML officer and head of operational risk, and can therefore quickly get to grips with the role, the business and the most important risk areas.

We take full responsibility for the function and the team, participate actively in management teams and audit committees, and handle reporting to the board and management. Drawing on experience from different organizations, we can also bring new perspectives and identify opportunities to improve processes, governance, working methods and reporting.

For us, interim management is not just about filling a role for a limited period. We also aim to create lasting value. That is why we place great emphasis on knowledge transfer, developing employees, and establishing structures and work processes that the business can build on once the assignment has ended.

Typical deliverable

A control function that works effectively from day one, with clear leadership, good interaction with the organization and relevant reporting to the board and management. When the assignment ends, the business should not only have had a temporary need covered, but also have strengthened its expertise, processes and structure.

Talk to us about this

Service area

GRC change management

Change management to ensure compliance with existing or upcoming regulation, delivered either as a project or as business as usual (BAU).

Need

Regulatory deadlines combined with BAU without ownership, or defined projects that have stalled, require more than new plans. Unclear mandates, lack of prioritization and lack of capacity cause time-critical goals and projects with dependencies on business operations and regulatory deadlines to stall and miss their delivery targets.

Method

We assess criticality against delivery and decide whether it is most appropriate to deliver as BAU or as a project. Whatever the delivery method, it is critical that the gaps are defined and that the relevant measures are prioritized with regard to time, cost and quality.

Typical deliverable

Clear delivery targets and a reasoned recommendation on delivery method (BAU or project), a proposed scope, implementation plan and organization of activities that keep delivery risk low, and execution, either in a coordinating role in BAU, as project manager or as a member of the steering committee. Quality assurance during execution, testing and acceptance of the deliverable, and implementation in operations.

Talk to us about this

Service area

GRC platform

Digitalizing the GRC platform, whether frameworks, execution activities, roles and responsibilities, or risk reduction and follow-up.

Need

New requirements, system integrations, complex business processes, unclear ownership of processes, systems and risk-mitigating measures, and cost pressure can make it relevant to digitalize the GRC platform, with documentation, traceable controls and clear accountability.

Method

Digitalization can take several forms. Sometimes selecting a system vendor is the right option, which requires a selection process with RFI/RFP and procurement. At other times organizations choose to build on something that already works but needs improvement.

Typical deliverable

An assessment of the current situation and a recommendation on platform choice, identification of core processes suited to digitalization (for example incident registration or risk assessments), security and access requirements, taxonomy and execution of the RFI/RFP.

Talk to us about this
Portrait of Peer Timo Andersen-Ulven

Partner

Peer Timo Andersen-Ulven

Credit risk, capital and regulatory reporting

More than 30 years of experience in Nordic finance. Peer Timo was Chief Credit Risk Officer (CCRO) and a member of the group executive management at Bank Norwegian, where he built the team and the approach to risk that made the bank highly profitable. He later led risk analytics at Avida Finans and rebuilt the function. As a partner in KPMG Risk Advisory he was responsible for banking and finance in Norway and worked with more than 40 banks. Before that he led the Basel II program at Santander Consumer Finance Nordics for nine years.

LinkedIn peer.timo@imperion.no
Portrait of Bjørn T. Sand

Partner

Bjørn T. Sand

Regulatory change and project management, operational risk management, compliance risk management, GRC operating models, GRC systems and digitalization

More than 30 years of experience in Norwegian and Nordic banking and finance. Bjørn Tore has long experience leading GRC change processes in large and complex organizations, and is experienced in communicating with boards, management and specialist teams. He was GRC lead at Capgemini Invent with a Nordic perspective. Bjørn Tore also has experience as Group Compliance Officer (CCO) and Chief Operational Risk Officer, and as a member of the management team of Group Risk Management at DNB. As program director for the Basel II implementation at DNB, he was responsible for DNB becoming the first Nordic bank with IRB approval.

LinkedIn bjorn.tore@imperion.no
Portrait of Louise Irtelius

Partner

Louise Irtelius

Risk management, compliance, AML, operational risk, AI governance and technology-driven GRC transformation, change and project management

Louise has more than 15 years of experience as an adviser in the financial industry, with specialist expertise in governance, risk management, compliance and AML. She combines expertise in financial regulation with long experience as a project manager, and always works to ensure that complex regulatory requirements are turned into solutions that work in practice. Louise has also helped many organizations with technology-driven GRC transformation, from manual processes to integrated, data-driven solutions, with a focus on sound governance, compliance and good AI governance. She has extensive leadership experience from advisory firms and complex client engagements, and has led a number of major change projects in Norway and internationally.

Louise has been a director at EY and Transcendent Group, and as a consultant has held interim positions as Chief Risk Officer and Chief Compliance Officer in Norwegian banks.

LinkedIn louise@imperion.no
Portrait of Carl Olsson

Partner

Carl Olsson

Compliance, AML/FCP, risk management, internal audit, technology/AI, digitalization, project management, strategy, governance, change management, GRC transformation and product development

Carl has almost 20 years of experience in banking, finance and technology, and has held several leadership roles in compliance, financial crime, risk management, project management, governance, transformation, technology, AI and product development, and strategy. He has extensive experience of building and developing GRC functions in leading organizations, and his previous roles include CEO and Head of Governance & Compliance at Advisense Norway, head of financial crime at Danske Bank Norway and LC&I FC Risk Nordics, CCO at Nordic Credit Rating and Vice President AML & Compliance at Tieto. Carl is also an active industry voice and leads two professional networks in Norway in compliance and financial crime.

LinkedIn carl@imperion.no