[non-validated] DORA SFS D / SF 6: Conflicts of interest management for ICT third-party arrangements
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity implemented documented conflict resolution procedures for identified conflicts of interest in ICT third-party arrangements as specified in repository topic boundaries?
Explanation
[non-validated] Has the designated financial entity documented procedures for identifying and managing conflicts of interest between ICT providers and internal departments as required under DORA Articles 28-29?
Criterion and evidence
Applies to designated financial entities under DORA scope. Evidence must demonstrate documented conflict-of-interest management procedures specific to ICT arrangements per DORA Articles 28-29 within current supervisory review period. Absence constitutes failure; pending when evidence unavailable despite documented search within repository constraints.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: ICT third-party risk, concentration and register. Govern ICT provider arrangements, due diligence, concentration risk and the register of information. Cover third-party strategy, accountable ownership, pre-contract assessment, provider selection, conflicts, concentration and the entity/group register with applicable submissions. SFS E owns contractual clauses, subcontracting and exits; SFS F owns designated-provider oversight interactions. DORA article references: 28, 29. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this condition?
Documented procedures specifically addressing conflicts between ICT providers and internal departments as mandated by DORA Articles 28-29. Evidence must include critical/non-critical provider distinctions and active monitoring mechanisms within current review period. Generic risk policies without conflict-specific protocols do not satisfy this requirement.
References
DORA: ICT third-party risk, concentration and register