Monetary Authority of Singapore Technology Risk Management Guidelines 3.1: 3.1 Role of the Board of Directors and Senior Management

Both the board and senior management should include members able to understand and manage technology risk, including cyber risk; they should ensure a CIO, CTO or Head of IT and a CISO or Head of Information Security with the requisite expertise are appointed, with the appointments approved at least by the CEO; that a technology risk management strategy is established and implemented; that key IT decisions follow the FI's risk appetite; and they should set the tone from the top for a culture of technology risk awareness. The board or its delegated committee is responsible for ensuring a sound technology risk management framework and an independent technology risk management function, giving the executives who carry out the strategy sufficient authority, resources and access to the board, approving the technology risk appetite and tolerance statement, regularly reviewing the strategy, assessing management's competence to manage technology risk, and ensuring an independent audit function. Senior management is responsible for establishing the framework and strategy, managing technology risk under it, ensuring sound policies, standards and procedures are maintained and implemented, delineating staff roles and responsibilities (for example in a RACI matrix), and informing the board promptly of salient and adverse technology risk developments and incidents likely to have a major impact.