[non-validated] DORA: ICT Risk Management Framework and Assurance (SF D)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the financial entity documented accountable review procedures for its ICT risk management framework as specified in the repository's DORA topic description?
Explanation
[non-validated] The financial entity must maintain a documented and approved ICT risk management framework and digital operational resilience strategy, including accountable review and assurance procedures. This framework should define risk tolerance, strategy, independent control functions, audit follow-up processes, and periodic framework reviews as specified under DORA Article 6.
Criterion and evidence
Verify documented ICT risk framework with accountable review/assurance per DORA Article 6, covering risk tolerance, strategy, independent controls, audit follow-up, and framework reviews. Confirm entity applicability per SFS 0 and board accountability requirements within current operational period.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT risk framework and assurance. Maintain a documented, approved ICT risk framework and resilience strategy with accountable review and assurance. Cover the framework, risk tolerance, strategy, independent control/assurance functions, audit follow-up and framework reviews. SFS 0 owns entity applicability and board accountability; SFS A owns staff learning and information sharing. DORA article references: 6. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for accountable review procedures?
Documented review schedules showing board accountability and independent assurance mechanisms explicitly referencing DORA framework requirements. For simplified regime entities, documented procedures containing minimum elements specified in repository description.
How are missing evidence cases handled?
Pending verification through documented review and assurance records; not an automatic negative outcome. Evidence must reference repository-specified requirements without claiming external legal verification.
References
DORA: ICT risk framework and assurance