[non-validated] DORA SFS 1 / SF 4: ICT Risk Framework Audit Follow-up
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented audit follow-up procedures for ICT risk management within its approved framework per the repository's DORA topic description covering required elements?
Explanation
[non-validated] Has the financial entity documented its audit follow-up within the ICT risk management framework as specified in the repository's DORA topic boundaries?
Criterion and evidence
Applies to designated financial entities under repository topic boundaries; simplified regime applicability based on size/risk profile. Evidence period: current operational period. Requires documented audit follow-up per repository topic description (keyDescription passage).
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT risk framework and assurance. Maintain a documented, approved ICT risk framework and resilience strategy with accountable review and assurance. Cover the framework, risk tolerance, strategy, independent control/assurance functions, audit follow-up and framework reviews. SFS 0 owns entity applicability and board accountability; SFS A owns staff learning and information sharing. DORA article references: 6. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence?
Documented audit follow-up as specified in the repository's topic description (keyDescription passage). Absence of documentation constitutes non-compliance.
Are acceptable alternatives recognized?
Entities qualifying for the simplified regime per repository guidelines must implement a documented mechanism containing minimum elements specified in the repository description.
References
DORA: ICT risk framework and assurance