ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 2.3: Operate a risk assessment framework covering all IT risk domains, integrated with operational risk, with governance, a risk appetite, residual risk acceptance and a risk register

What does 2.3 require?

The institution manages the overlapping domains of project management, IT operations, data security, cybersecurity and IT-focused third-party risk, considering all relevant domains for each system or dataset, and integrates IT risk into its overall operational risk management with IT risk staff included in operational risk governance. Governance structures suited to its nature, scale and complexity oversee development of the framework, review it regularly, maintain sound IT risk policies and processes, assign accountability and manage risk according to the framework and IT strategy, with regular independent assessment by internal or external audit. The framework follows at least the GEN Rule 3.3.4 lifecycle (identify, assess, mitigate, control, monitor) and defines and measures risk the same way in every domain. The Governing Body and senior management articulate a risk appetite or tolerance that guides all key IT decisions, with exceptions only in extraordinary circumstances approved at the right level; risk owners know the inherent and residual risk of their risk sources, controls reduce residual risk to acceptable levels or the risk source is replaced, residual risk acceptance is approved by management or the Governing Body according to the risk, and owners' accountability matches their authority and competence; insurance may support but never replaces controls. An accurate, current IT risk register records for each risk its owner, description, materiality, indicators with action thresholds, controls and residual risk, and whether the residual risk was accepted, and is updated as risk sources and the environment change with a record of changes.