Governance Board Oversight and Accountability
Under DORA, board oversight means decisions, challenge and tracked follow-up, not attendance alone. This pillar guide explains how governance turns ICT risk into accountable action.
Line 15: Governance, board oversight and accountability
Who owns resilience at board level, what the board must approve and review, and how accountability is evidenced rather than asserted.
The line guide
Working guides on this line
Accountability When a Service Fails
Accountability when a service fails is tested by the governance record made before the failure. This guide explains how decisions, challenge and follow-up show whether oversight was real.
Board Reporting on Resilience
Board reporting on resilience under DORA must give the management body a service view, not a technology inventory. This guide explains what useful reporting contains, and what it leaves out.
Board Responsibility for ICT Risk
Board responsibility for ICT risk under DORA means the management body owns the framework and its review. This guide separates that responsibility from delegation to executives or providers.
Board Training on ICT Risk
Board training on ICT risk under DORA is about collective understanding, not technical mastery. This guide explains how training helps a management body ask better questions and judge answers.
Documenting Governance Decisions
Documenting governance decisions under DORA creates the record that proves oversight happened. This guide explains what to record, how to keep it usable, and why attendance alone is not enough.
Governance and Risk Appetite Statements
Risk appetite statements under DORA governance translate board tolerance into boundaries for ICT risk decisions. This guide explains how appetite is set, used and revisited without inventing numbers.
Governance for ICT Third-Party Risk
Governance for ICT third-party risk under DORA keeps the management body in control of services run partly outside the entity. This guide explains oversight of providers, concentration and exit.
Governance for Small Firms
Governance for small firms under DORA must be proportionate, not absent. This guide explains how a smaller management body oversees ICT risk with fewer people and clearer priorities.
Governance of Testing and Findings
Governance of testing and findings under DORA turns test results into board decisions. This guide explains board oversight of scope, severity and remediation until findings close.
Governance Reporting Lines and Escalation
Reporting lines and escalation under DORA governance ensure bad news reaches the management body in time to act. This guide explains clear routes and the culture that makes them work.
Management Body Strategy and Oversight
Strategy and oversight under DORA link board direction to everyday ICT risk work. This guide explains how a management body sets direction, monitors it, and revises it when evidence changes.
Resilience Roles and Accountability
Resilience roles under DORA turn a shared ambition into named responsibility. This guide explains how management, risk, technology and assurance roles fit together without blurring ownership.
Three Lines and Resilience Assurance
The three lines model gives DORA governance a checking structure: operations, risk challenge and assurance. This guide explains each line without collapsing them.