2.1 General principles

Competent authorities should assess whether the institution’s general governance and internal control framework duly cover the ICT systems and related risks and if the management body adequately addresses and manages these aspects, as ICT is integral to the proper functioning of an institution.

In conducting this assessment, competent authorities should refer to the requirements and standards of good internal governance and risk control arrangements as specified in the EBA Guidelines on Internal Governance (GL 44)⁷ and international guidance in this field to the extent these are applicable given the specificity of ICT systems and risks.

The assessment in this Title does not cover the specific elements of the ICT system governance, risk management and controls that are focused on managing specific ICT risks addressed under Title 3 of these Guidelines, but focuses on the following areas:

• a. ICT strategy - whether the institution has an ICT strategy that is adequately governed and is in line with the institution’s business strategy;
• b. overall internal governance– whether the institution’s overall internal governance arrangements are adequate in relation to the institution’s ICT systems; and
• c. ICT risk in the institution’s Risk management framework –whether the institution’s risk management and internal control framework adequately safeguards the institution’s ICT systems.

Point a) referred to in paragraph 22, while providing information about elements of the institution’s governance, should mainly feed into the assessment of the business model addressed under Title 4 of the EBA SREP Guidelines. Points b) and c) further complement assessments of topics covered by Title 5 of the EBA SREP Guidelines and the assessment described in these Guidelines should feed into the respective assessment under Title 5 of the EBA SREP Guidelines.

The outcome of this assessment should inform, where relevant, the assessment of risk management and controls in Title 3 of these Guidelines.