| Risk Supervisory view Score 1 There is no • discernible risk of significant prudential impact on the institution • considering the level of inherent risk and the management and controls. | Considerations for inherent risk Considerations for adequate management & controls The information sources to be considered under paragraph 37 did not reveal any significant ICT risk exposures. The nature of the institution’s ICT risk profile, in conjunction with the review of the critical ICT systems and the material ICT risks to the ICT Systems and Services, have not revealed any material ICT risks. |
| 2 There is a low risk of • significant prudential impact on the | The information sources to be considered under paragraph 37 did not reveal any significant ICT risk |
| institution considering the level • of inherent risk and the management and controls. | exposures. • The institution’s ICT risk The nature of the institution’s ICT policy and strategy is risk profile, in conjunction with the commensurate with its review of the critical ICT systems overall strategy and risk and the material ICT risks to the ICT appetite. Systems and Services, revealed a • The organisational limited ICT risk exposure (e.g. not framework for ICT risk is more than 2 out of 5 of the robust with clear predefined ICT risk categories). responsibilities and a clear |
| 3 There is a medium • risk of significant prudential impact on the institution considering the level • of inherent risk and the management and controls. | The information sources to be separation of tasks considered under paragraph 37 between risk owners and revealed indications of possible management and control significant ICT risk exposures. functions. The nature of the institution’s ICT • ICT risk measurement, risk profile, in conjunction with the monitoring and reporting review of the critical ICT systems systems are appropriate. and the material ICT risks to the ICT • The control framework for Systems and Services, revealed a ICT risk is sound. heightened ICT risk exposure (e.g. 3 or more out of 5 of the predefined ICT risk categories). |
| 4 There is a high risk of • significant prudential impact on the institution considering the level • of inherent risk and the management and controls. | The information sources to be considered under paragraph 37 provided multiple indications of significant ICT risk exposures. The nature of the institution’s ICT risk profile, in conjunction with the review of the critical ICT systems and the material ICT risks to the ICT Systems and Services, revealed a high ICT risk exposure (e.g. 4 or 5 out of 5 of the predefined ICT risk categories). |