ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 1.3: Assign clear accountability for IT risk, name an owner for every risk source and make consequences realistic

What does 1.3 require?

The Governing Body holds senior management accountable for effective IT risk management and ensures senior management includes appointment holders with the experience and expertise to manage IT risk, has an IT strategy covering use of IT and management of its risks, holds enough authority and resources, and enough access to the board, and has built, written down and put into practice an effective IT risk framework. Responsibility and accountability for IT risk are clearly assigned to staff, for instance through a RACI matrix; every system, dataset and third-party arrangement that can give rise to technology or data risk has a clear owner accountable for risk events; and the impact of a risk event on consumers, the institution and staff is set out realistically and proportionately so that staff take IT risk seriously without being tempted to hide events for fear of excessive penalties.