[non-validated] DORA SFS D / SF 4: Accountable Ownership for ICT Third-Party Risk Management
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity designated and documented accountable ownership for ICT third-party risk management with explicit oversight responsibilities and reporting lines as required by DORA Articles 28-29?
Explanation
[non-validated] Has the entity established documented accountable ownership for ICT third-party risk management with oversight responsibilities per DORA Articles 28-29?
Criterion and evidence
Documented assignment of accountable ownership for ICT third-party risk management by designated financial entities under DORA scope, with oversight responsibilities evidenced during current review period defined by supervisory authority.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT third-party risk, concentration and register. Govern ICT provider arrangements, due diligence, concentration risk and the register of information. Cover third-party strategy, accountable ownership, pre-contract assessment, provider selection, conflicts, concentration and the entity/group register with applicable submissions. SFS E owns contractual clauses, subcontracting and exits; SFS F owns designated-provider oversight interactions. DORA article references: 28, 29. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this requirement?
Documented evidence showing designated accountable ownership with oversight responsibilities (e.g., Chief Risk Officer role documentation). Organizational charts without accountability assignments are insufficient. Evidence must cover oversight mechanisms per repository-prose boundaries.
How are missing evidence scenarios handled?
Pending determination when documented search efforts within repository-prose boundaries yield no evidence. A schedule alone does not satisfy the requirement; actual executed evidence of documented ownership is required. Absence of documentation constitutes non-compliance.
References
DORA: ICT third-party risk, concentration and register