[non-validated] DORA SFS 1 / SF 5: Documented ICT Risk Framework Review Procedures
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented procedures for reviewing its ICT risk management framework as specified in the repository's DORA topic description?
Explanation
[non-validated] Does the financial entity maintain documented procedures for reviewing its ICT risk management framework as specified in the repository topic description, including simplified regime requirements where applicable?
Criterion and evidence
Verify documented framework review procedures meeting repository topic boundaries during current operational period. Apply simplified regime where entity size/role qualifies per repository guidance. Scope out non-DORA applicable entities explicitly without automatic outcomes.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT risk framework and assurance. Maintain a documented, approved ICT risk framework and resilience strategy with accountable review and assurance. Cover the framework, risk tolerance, strategy, independent control/assurance functions, audit follow-up and framework reviews. SFS 0 owns entity applicability and board accountability; SFS A owns staff learning and information sharing. DORA article references: 6. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence qualifies for framework review procedures?
Documented procedures explicitly referencing repository topic boundaries, including review frequency, responsibilities, and update mechanisms. Simplified regime entities must include minimum specified elements per repository description.
How is missing evidence treated?
Pending verification; not automatic negative. Absence does not affect other conditions or constitute failure.
References
DORA Repository: ICT Risk Framework and Assurance