[non-validated] DORA: Management Body Resource Allocation [SFS 0 / SF 4]
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented evidence that its management body has allocated sufficient personnel and financial resources to implement the ICT risk management framework as specified in repository governance requirements?
Explanation
[non-validated] Has the financial entity's management body documented sufficient personnel and financial resources allocated for implementing the ICT risk management framework per repository-specified DORA requirements?
Criterion and evidence
Verify documented management body decisions specifying personnel assignments and financial commitments meeting repository-defined thresholds for ICT risk framework implementation under DORA Articles 4-5. Evidence period: ongoing compliance. Distinguish between standard/simplified regimes per Article 16; missing documentation renders assessment pending.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Applicability, proportionality and governance. Identify the assessed legal entity, its DORA role, applicable regime and management-body accountability. Determine financial-entity category, exemptions, group boundary, size and proportionality; distinguish the standard and simplified ICT frameworks and the role of non-critical versus designated critical ICT providers. Cover management-body ownership, resourcing and ICT-risk oversight. Do not treat every provider as directly subject to every financial-entity obligation. DORA article references: 1, 2, 3, 4, 5, 16. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence qualifies as sufficient documentation?
Documented management body decisions showing personnel roles covering framework maintenance and financial commitments exceeding repository-specified minimum thresholds. Must directly reference ICT risk management framework implementation requirements.
How are missing evidence scenarios handled?
Assessment remains pending when documentation is unavailable. Entity assertions without submitted evidence (e.g., verbal assurances) do not satisfy the criterion. Evidence must be produced during the active assessment period per ongoing compliance requirement.
Are alternative evidence forms permitted?
No valid alternatives exist per repository-specified requirements. Resource allocation must be formally documented; informal arrangements, implied commitments, or future promises cannot substitute for current documented evidence.
References
DORA: Applicability, proportionality and governance