2.3 Overall internal governance

In accordance with Title 5 of the EBA SREP Guidelines, competent authorities should assess whether the institution has an appropriate and transparent corporate structure that is ‘fit for purpose’, and has implemented appropriate governance arrangements. With specific regard to ICT systems and in line with the EBA Guidelines on internal governance, this assessment should include an assessment of whether the institution demonstrates:

• a. a robust and transparent organisational structure with clear responsibilities on ICT, including the management body and its committees and that key responsible persons for ICT (e.g. chief information officer ‘CIO’, chief operating officer ‘COO’ or equivalent role) have adequate indirect or direct access to the management body, to ensure that important ICT-related information or issues are adequately reported, discussed and decided upon at the level of the management body; and
• b. that the management body knows and addresses the risks associated with the ICT;

Further to section 5.2 of the EBA SREP Guidelines, competent authorities should assess whether the institution’s ICT outsourcing policy and strategy considers, where relevant, the impact of ICT outsourcing on the institution’s business and business model.