Monetary Authority of Singapore Technology Risk Management Guidelines 4.1: 4.1 Risk Management Framework

The FI should establish a framework to manage technology risk, with governance structures and processes, well-defined roles and clear reporting lines, and institute risk management practices and internal controls for data confidentiality and integrity, system security and reliability, and stability and resilience of the IT environment. A risk owner (a function or group of functions with the authority to manage the risk) should be identified for each specific technology risk. The framework should include risk identification, risk assessment, risk treatment, and risk monitoring, review and reporting (including risks customers are exposed to and changes in strategy, systems and operating conditions, with key risks reported to the board and senior management), and its adequacy and effectiveness should be reviewed regularly.