ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 4.2: Give the audit function the competence and coverage to assess IT risk independently, with a board-approved plan, tracked findings and external audit

What does 4.2 require?

The audit function gives the board and senior managers an independent, objective view of whether controls effectively mitigate IT risk and has the skills, training and experience to do so whether internal, intra-group or outsourced. The audit programme covers IT risk across all IT resources supporting business services including those supported by third parties and assesses the adequacy of IT frameworks, policies and procedures as well as control effectiveness; the IT audit plan is approved by the Audit Committee or equivalent, sets auditable areas per year with cycles commensurate to the criticality and risk of systems, interconnections and dependencies; all IT audit findings are tracked, escalated and monitored to resolution; and IT is incorporated into external audit programmes for an additional independent perspective.