5.8 Information and communication technologies

Competent authorities should assess whether the investment firm has sound, effective and reliable information systems and whether their internal control functions have appropriate IT systems and support at their disposal with access to the internal and external information necessary to meet their responsibilities.

In particular, competent authorities should assess whether the investment firm is able to safeguard the security of its network and information systems to ensure confidentiality, integrity and availability of their processes, data and assets.

Competent authorities should assess whether the information systems effectively support the investment firm’s business and risk management.