Monetary Authority of Singapore Technology Risk Management Guidelines 3.2: 3.2 Policies, Standards and Procedures

The FI should establish policies, standards and procedures to manage technology risk and safeguard information assets, incorporating industry standards and best practice where appropriate, and review and update them regularly against the evolving technology and threat landscape. Risks from deviations should be thoroughly assessed, with the assessment approved by senior management and approved deviations reviewed periodically so residual risk stays acceptable. Compliance processes, including follow-up of non-compliance, should verify that policies, standards and procedures are adhered to.