232. Competent authorities should consider whether the internal audit function is effective and …

Competent authorities should consider whether the internal audit function is effective and possesses sufficient knowledge, skills and expertise to audit institution’s ICT risk management framework, by reviewing whether:

• a. the ICT risk management framework is audited with the required quality, focus and frequency, and is commensurate to the ICT risk profile of the institution;
• b. the audit plan includes audits on the material ICT risks identified by the institution, including independent reviews of ICT response and recovery plans;
• c. critical ICT audit findings are timely verified and remediated, including reporting to the management body;
• d. ICT audit findings, including agreed actions, are formally followed up and progress reports periodically reviewed by the senior management and/or the audit committee.

6.4.4. Assessment of reputational risk

1. Vue d’ensemble

1.1 Références

1.2 Exigences identifiées

1.3 Normes associées

2. Exigences identifiées

3. Normes associées

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/