FFIEC IT Examination Handbook DAM-II.B.1: II.B.1 Board, Senior Management, and Other Common Roles (Development, Acquisition, and Maintenance)

The board or its committee confirms that development, acquisition and maintenance activities align with strategic objectives and risk appetite, approves significant IT investments, policies and standards and significant projects, and has the knowledge to challenge management credibly, with the audit committee validating audit activity; senior management approves and champions projects, keeps execution aligned with objectives and risk appetite and provides adequate resources and qualified staff; the CIO leads day-to-day development, acquisition and maintenance under policy and strategy, consults risk management and legal counsel, integrates new projects and systems into operations and helps determine feasibility; and the other common roles the booklet lists are assigned.