ICT Risk Appetite and Reporting

ICT risk appetite describes the level and type of technology risk a financial entity is willing to accept in pursuing its services, and reporting is how information about that risk reaches decision makers. Appetite is expressed in service terms, so that it can guide decisions about a particular service, rather than as an abstract statement about technology in general. Reporting shows whether risk is within appetite, where it is approaching or exceeding it, and what action is being taken as a result.

Appetite and reporting work together. Appetite without reporting is a statement that nobody checks. Reporting without appetite is information without a decision standard, so that a rising risk can be noted without anyone being obliged to act. Under DORA, the two form the governance loop that connects the risk picture to senior management decisions about services, suppliers, and investment in resilience.

Appetite is expressed by describing, for a service, what disruption is tolerable and what is not, in terms that a disruption would actually produce. That may involve the duration of interruption, the proportion of customers affected, the types of transactions affected, or the integrity of data. The expression needs to be specific enough that a disruption can be judged against it, and honest enough that a tolerance which cannot be met in practice is recognised as a gap rather than restated more loosely to fit current performance.

Appetite also distinguishes between types of risk. An entity may accept a higher level of risk from a technology experiment in a contained environment than from a failure in a core customer service. It may accept different risk for data confidentiality, data integrity, and service availability, because those risks harm customers in different ways. Expressing those distinctions prevents a single, vague appetite statement from being applied to every service and every risk type as if they were the same.

Appetite guides decisions by providing a standard against which proposals are judged. A new service, a supplier arrangement, a change, or a legacy system continuation can be assessed against appetite: does it keep the service within appetite, does it move the service towards the boundary, or does it breach appetite unless additional protection or recovery is provided? That question turns appetite from a document into a decision tool, used at the point where a commitment is made rather than afterwards.

Appetite also guides prioritisation. Where several services are approaching appetite boundaries, resources for protection, detection, and recovery can be directed to the services where the gap matters most for customers and for the entity. That prioritisation is a governance judgement, informed by the risk picture, and it needs to be recorded so that the reasoning behind a priority choice can be examined later, when the service is disrupted or reviewed.

Risk reporting contains the current risk picture for services, the position against appetite, and the actions underway to address gaps. It includes incident and test experience, because those show how risk is materialising in practice rather than only in assessment. It includes change and supplier developments, because those alter the risk picture between formal assessments. It includes the status of protection, detection, and recovery arrangements, so that a reported risk is accompanied by a reported response.

Reporting also contains uncertainty and limitation. A report that presents only confirmed risks, without noting areas where information is incomplete or where supplier resilience is hard to observe, overstates the quality of the risk picture. Naming uncertainty allows decision makers to ask for more information, more testing, or more assurance where it matters, rather than treating an absence of reported risk as evidence that risk is absent.

Reporting reaches decision makers through a routine that is regular enough to catch change, and structured enough that trends can be seen over time. A single report can be misleading, because it captures a moment. A series of reports shows whether a risk is rising, whether an action is closing a gap, and whether a service is repeatedly approaching its appetite boundary. That trend view is what allows senior management to intervene before a boundary is breached, rather than after.

When appetite is approached or breached, the response is a decision, recorded with its reasoning. Options may include additional protection, changes to the service, renegotiation of a supplier arrangement, accelerated replacement of a legacy system, or acceptance of the position for a defined period with a defined rationale and review point. Acceptance without a rationale, a period, and a review point is not a decision. It is drift, and drift is how a temporary breach becomes a permanent risk position.