[non-validated] DORA SFS 1 / SF 3: Independent Control/Assurance Functions Documentation
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented an independent ICT assurance function within its risk management framework according to the repository's DORA topic specification during the current operational period?
Explanation
[non-validated] Does the financial entity document independent control/assurance functions as part of its risk management framework, in accordance with the repository's DORA topic specification?
Criterion and evidence
Applies to entities covered under repository topic boundaries considering entity role and size for simplified regime applicability. Requires documented independent control/assurance functions with defined responsibilities and review procedures meeting repository-specified requirements during current operational period. Missing evidence remains pending; simplified regime entities require minimum elements specified in repository description.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT risk framework and assurance. Maintain a documented, approved ICT risk framework and resilience strategy with accountable review and assurance. Cover the framework, risk tolerance, strategy, independent control/assurance functions, audit follow-up and framework reviews. SFS 0 owns entity applicability and board accountability; SFS A owns staff learning and information sharing. DORA article references: 6. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence demonstrates compliance with this requirement?
Documented description of independent control/assurance functions with defined responsibilities, reporting lines, and review procedures explicitly referencing repository topic boundaries. For simplified regime entities, documented mechanism containing minimum elements specified in repository description.
How is missing evidence treated?
Pending verification through submission of required documentation; absence of evidence is not an automatic negative outcome per repository specification.
References
DORA: ICT risk framework and assurance