External ICT Risk Manager or ICT Risk Controller

Effective ICT risk management is an essential prerequisite for the digital operational resilience of a financial entity. DORA requires a sound, comprehensive and documented ICT risk management framework with clearly defined roles, responsibilities and control structures. The management body must define, approve and oversee this framework and retains overall responsibility for it.

Depending on your organisational structure, we can support you either as an external ICT Risk Manager or by supporting the ICT risk control function as an external ICT Risk Controller.

DORA does not prescribe a function specifically entitled “ICT Risk Manager”. However, for the standard ICT risk management framework, DORA requires an appropriately independent ICT risk control function. As the Regulation does not provide a detailed description of each individual role, the specific allocation of responsibilities must be adapted to the entity’s business and governance model.

The ICT Risk Manager primarily performs operational and coordinating tasks. This role identifies and assesses ICT risks, develops appropriate measures, coordinates their implementation and consolidates information from IT, information security, business continuity and ICT third-party risk management.

The ICT Risk Controller performs a more independent control and oversight function. This role reviews and challenges risk assessments, monitors compliance with defined requirements, evaluates the effectiveness of measures and reports independently to the management body.

Internal audit must remain separate from both functions and serves as an additional independent level of assurance. DORA requires an appropriate separation between operational ICT risk management, the ICT risk control function and internal audit.