61. Following the above assessment, competent authorities should form an opinion on the …

Following the above assessment, competent authorities should form an opinion on the institution’s ICT risk. This opinion should be reflected in a summary of findings which competent authorities should consider when assigning the score of operational risk in Table 6 of the EBA SREP Guidelines. Competent authorities should base their view on material ICT risks taking into account the following considerations to feed into the operational risk assessment:

• a. Risk Considerations
• i. The institution’s ICT risk profile and exposures;
• ii. The identified critical ICT systems and services; and
• iii. The materiality of ICT risk regarding critical ICT systems.
• b. Management and Controls considerations
• i. Whether there is consistency between the institution’s ICT risk management policy and strategy and its overall strategy and risk appetite;
• ii. Whether the organisational framework for ICT risk management is robust with clear responsibilities and a clear separation of tasks between risk owners and management and control functions;
• iii. Whether ICT risk measurement, monitoring and reporting systems are appropriate.; and
• iv. Whether the control frameworks for material ICT risks are sound.

1. Forbhreathnú

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Caighdeáin ghaolmhara

2. Ceanglais aitheanta

3. Caighdeáin ghaolmhara

• EBA -

  EN: Guidelines and other publications of the European Banking Authority (EBA), https://www.eba.europa.eu/. © European Banking Authority. Reproduction is authorised provided the source is acknowledged (EBA legal notice). Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by the EBA are authoritative.

  DE: Leitlinien und weitere Veröffentlichungen der Europäischen Bankenaufsichtsbehörde (EBA), https://www.eba.europa.eu/. © European Banking Authority. Wiedergabe mit Quellenangabe gestattet (Rechtlicher Hinweis der EBA). In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die von der EBA veröffentlichten Fassungen.