Key Roles & Responsibilities

Second Line Oversight & Framework Integration

• Define and embed Technology Risk (IT & Information Security) appropriately within the Operational Risk Taxonomy and Framework, ensuring clear, documented delineation of 1LOD vs 2LOD accountability in line with company’s governance models.
• Provide independent 2LOD oversight of the Technology Risk Management Framework, assessing its alignment and interdependency with first-line control frameworks (e.g. Third-Party Risk Management, IT Controls, Cybersecurity, etc.) and ensuring coherence with second line Operational Risk and Resilience frameworks.
• Support the maturation of a consistent service-based view of technology risk by challenging 1LOD mapping of applications, infrastructure and third-party ICT services to internal and client-facing business services.

Risk Identification, Assessment & Challenge

• Review and challenge first line identification and assessment of technology risks, including (i) application risk (ii) infrastructure dependencies (iii) information security risks and (iv) third-party technology dependencies, ensuring consistency with the company’s risk taxonomy and regulatory expectations.
• Assess the quality, completeness, and consistency of Technology Risk Registers, control inventories, incident remediation activities and impact analysis.
• Provide credible 2LOD challenge where risk assessments, severity ratings, or residual risk conclusions are not sufficiently supported.

Operational Resilience

• Support integration of technology risk into the firm’s Operational Risk & Resilience frameworks, including regulatory/jurisdictional aligned frameworks including:

i) mapping of technology dependencies to important business services

ii) assessment of ICT/technology-related incidents and materiality thresholds

iii) align on incident classification and escalation decisions with reporting standards ensuring impacts both technically and operationally are appropriately assessed and captured on associated incident reporting portals.

• Provide second line review and challenge of technology related incidents, including severity, client impact, and regulatory reporting considerations.
• Contribute and support with resilience testing and scenario analysis from a technology dependency perspective.
• Third Party & Technology Dependency Risk