61. Following the above assessment, competent authorities should form an opinion on the …

Following the above assessment, competent authorities should form an opinion on the institution’s ICT risk. This opinion should be reflected in a summary of findings which competent authorities should consider when assigning the score of operational risk in Table 6 of the EBA SREP Guidelines. Competent authorities should base their view on material ICT risks taking into account the following considerations to feed into the operational risk assessment:

• a. Risk Considerations
• i. The institution’s ICT risk profile and exposures;
• ii. The identified critical ICT systems and services; and
• iii. The materiality of ICT risk regarding critical ICT systems.
• b. Management and Controls considerations
• i. Whether there is consistency between the institution’s ICT risk management policy and strategy and its overall strategy and risk appetite;
• ii. Whether the organisational framework for ICT risk management is robust with clear responsibilities and a clear separation of tasks between risk owners and management and control functions;
• iii. Whether ICT risk measurement, monitoring and reporting systems are appropriate.; and
• iv. Whether the control frameworks for material ICT risks are sound.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/