2.2 ICT strategy

Under this section competent authorities should assess whether the institution has an ICT strategy in place: that is subject to adequate oversight from the institution’s management body; that is consistent

7 EBA Guidelines on Internal Governance, GL 44, 27 September 2011. with the business strategy, particularly for keeping its ICT up-to-date and planning or implementing important and complex ICT changes; and that supports the institution’s business model.

2.2.1 ICT strategy development and adequacy

Competent authorities should assess whether the institution has a framework in place, proportionate to the nature, scale and complexity of its ICT activities, for the preparation and development of the institution’s ICT strategy. In conducting this assessment competent authorities should take into account whether:

• a. the senior management⁸ of the business line(s) is adequately involved in the definition of the institution’s strategic ICT priorities and that, in turn, senior management of the ICT function is aware of the development, design and initiation of major business strategies and initiatives to ensure the continued alignment between ICT systems, ICT services and the ICT function (i.e. those responsible for the management and deployment of these systems and services), and the institution’s business strategy, and that ICT are effectively up-dated;
• b. the ICT strategy is documented and supported by concrete implementation plans, in particular regarding the important milestones and resource planning (including financial and human resources) to ensure that they are realistic and enable the delivery of the ICT strategy;
• c. the institution periodically updates its ICT strategy, in particular when changing the business strategy, to ensure continued alignment between the ICT and business medium-term to long-term objectives, plans and activities; and
• d. the institution’s management body approves the ICT strategy, implementation plans and monitors its implementation.

2.2.2 ICT strategy implementation

If the institution’s ICT strategy requires the implementation of important and complex ICT changes, or changes with material implications for the institution’s business model, competent authorities should assess whether the institution has a control framework in place, appropriate to its size, its ICT activities as well as the level of change activities, to support the effective implementation of the institution’s ICT strategy. In conducting this assessment competent authorities should take into account whether the control framework:

• a. includes governance processes (e.g. progress and budget monitoring and reporting) and relevant bodies (e.g. a project management office (PMO), an ICT steering group or equivalent) to effectively support the implementation of the ICT strategic programmes;
• b. has defined and allocated the roles and responsibilities for the implementation of ICT strategic programmes, paying particular attention to the experience of key stakeholders in organising, steering and monitoring important and complex ICT changes and the

8 Senior management and management body as defined in the Directive 2013/36/EU of 26 June 2013 in Article 3 (7) ‘management body’, and Article 3 (9) ‘senior management’. management of the wider organisational and human impacts (e.g. managing resistance to change, training, communication).

• c. engages the independent control and internal audit functions to provide assurance that the risks associated with ICT strategy implementation have been identified, assessed and effectively mitigated and that the governance framework in place to implement the ICT strategy is effective; and
• d. contains a planning and planning review process that provides flexibility to respond to important identified issues (e.g. encountered implementation problems or delays) or external developments (e.g. important changes in the business environment, technological issues or innovations) to ensure a timely adaptation of the strategic implementation plan.