38. The management body of financial entities should define, approve and regularly review a …

The management body of financial entities should define, approve and regularly review a strategy on the sound management of third-party risks, which should include a policy on third-party risk management as referred to in Section 6 which should complement financial entities operational risk management and supports its operational resilience. The policy should allow for the implementation of a holistic approach to third-party risk management. Financial entities should have the flexibility to develop either integrated or separate strategies regarding ICT and non-ICT third-party risk management. The management body should ensure, on the basis of an assessment of the overall risk profile of the financial entity, and taking into account the principle of proportionality, that the financial entity itself regularly reviews the risks identified in respect to third-party arrangements on the use of services supporting critical or important functions.

1. Yleiskatsaus

1.1 Viittaukset

1.2 Tunnistetut vaatimukset

1.3 Liittyvät standardit

2. Tunnistetut vaatimukset

3. Liittyvät standardit

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/