DORA-Art5-P1

ICT Governance and Control Framework Document COMMON

Board-approved document defining the internal governance and control framework for ICT risk management, including roles, responsibilities, reporting lines, and oversight mechanisms.

Formats

PDF

Evidence Class

ict-governance-framework

Availability

COMMON

Update Frequency

annual

Typical Author

CIO

Approval Chain

CIO → CRO → Board of Directors

Content Sections

• Executive Summary
• Governance Structure
• Board Oversight Responsibilities
• Three Lines of Defence Model
• ICT Risk Committee Terms of Reference
• Reporting Lines and Escalation
• Review and Approval History

Expected Fields

• document_version
• approval_date
• next_review_date
• approving_body
• governance_model
• oversight_frequency

Common Quality Issues

• Missing or outdated next_review_date
• Governance structure diagram absent or outdated
• No explicit mapping between governance roles and DORA articles
• Unsigned or missing board approval signature

ict_governance_framework_status

Schema ID

fs-ict-governance-framework

Control

DORA-Art5-P1

Valid Ranges

approval_date

within last 18 months

next_review_date

future date within 12 months of approval

board_oversight_frequency

at least quarterly for significant institutions

Related Schemas

• fs-ict-risk-framework-status

JSON Schema

{
  "properties": {
    "approval_date": {
      "format": "date",
      "type": "string"
    },
    "board_oversight_frequency": {
      "enum": [
        "monthly",
        "quarterly",
        "semi-annual",
        "annual"
      ],
      "type": "string"
    },
    "governance_model": {
      "minLength": 1,
      "type": "string"
    },
    "has_three_lines_of_defence": {
      "type": "boolean"
    },
    "ict_risk_committee_exists": {
      "type": "boolean"
    },
    "next_review_date": {
      "format": "date",
      "type": "string"
    },
    "reporting_lines_documented": {
      "type": "boolean"
    }
  },
  "required": [
    "governance_model",
    "approval_date",
    "next_review_date",
    "has_three_lines_of_defence",
    "board_oversight_frequency"
  ],
  "type": "object"
}