49. Competent authorities should review whether the institution has appropriate risk management …

Competent authorities should review whether the institution has appropriate risk management policies, processes and tolerance thresholds in place for the identified material ICT risks. These can be a part of the operational risk management framework or a separate document. For this assessment competent authorities should take into account whether:

• a. the risk management policy is formalised and approved by the management body and contains sufficient guidance on the institution’s ICT risk appetite, and on the main pursued ICT risk management objectives and/or applied ICT risk tolerance thresholds. The relevant ICT risk management policy should also be communicated to all relevant stakeholders;
• b. the applicable policy covers all significant elements for the risk management of the identified material ICT risks;
• c. the institution has implemented a process and underlying procedures for the identification (e.g. ‘risk control self-assessments’ (RCSA), risk scenario analysis) and monitoring of the involved material ICT risks; and
• d. the institution has an ICT risk management reporting in place that provides timely information to senior management and the management body, and which allows senior management and/or the management body to assess and monitor whether the institution´s ICT risk mitigation plans and measures are consistent with the approved risk appetite and/or tolerance thresholds (where relevant) and to monitor changes of material ICT risks.

3.3.2 Organisational management and oversight framework

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA -

  EN: Guidelines and other publications of the European Banking Authority (EBA), https://www.eba.europa.eu/. © European Banking Authority. Reproduction is authorised provided the source is acknowledged (EBA legal notice). Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by the EBA are authoritative.

  DE: Leitlinien und weitere Veröffentlichungen der Europäischen Bankenaufsichtsbehörde (EBA), https://www.eba.europa.eu/. © European Banking Authority. Wiedergabe mit Quellenangabe gestattet (Rechtlicher Hinweis der EBA). In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die von der EBA veröffentlichten Fassungen.