[non-validated] DORA SFS D / SF 5: Conflicts of Interest Management
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented procedures for identifying and managing conflicts of interest between ICT providers and internal departments as required by DORA Articles 28-29?
Explanation
[non-validated] Has the designated financial entity documented procedures for identifying and managing conflicts of interest between ICT service providers and internal departments as required by DORA Articles 28-29?
Criterion and evidence
Applies to designated financial entities under DORA scope. Requires documented evidence of conflict-of-interest identification protocols and resolution mechanisms specific to ICT provider arrangements during the current supervisory review period. Positive evidence must demonstrate implementation per repository topic boundaries; failure occurs with absence of required documentation; pending status applies when evidence unavailable despite documented search within repository constraints.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT third-party risk, concentration and register. Govern ICT provider arrangements, due diligence, concentration risk and the register of information. Cover third-party strategy, accountable ownership, pre-contract assessment, provider selection, conflicts, concentration and the entity/group register with applicable submissions. SFS E owns contractual clauses, subcontracting and exits; SFS F owns designated-provider oversight interactions. DORA article references: 28, 29. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for conflict-of-interest management?
Documented procedures showing specific mechanisms for identifying and resolving conflicts between ICT providers and internal departments per DORA Articles 28-29 repository boundaries. Generic vendor management policies without ICT-specific conflict protocols are insufficient (see fixture-00D5-2).
How are missing evidence cases handled?
Pending determination applies when no documentation is found despite verified search within repository-prose boundaries (see fixture-00D5-3). Absence of evidence does not equate to compliance failure but requires explicit pending status.
References
DORA: ICT third-party risk, concentration and register