IT Risk Management
IT Risk Management tests how a bank identifies, assesses, treats and monitors technology risk, and how it keeps critical services running. Expect questions on risk registers, the three lines of defence, BCP/DR, business impact analysis, RTO/RPO and RBI's governance expectations.
Core rules
- Risk equation: risk is likelihood multiplied by impact; assess inherent risk, apply controls, then record residual risk.
- Process: identify, analyse, evaluate, treat, monitor and communicate, aligned with ISO 31000 and the bank's risk appetite.
- Three lines of defence: business owns the risk, risk and compliance oversee, internal audit provides independent assurance.
- Business impact analysis: identifies critical systems and sets recovery objectives. RTO is the maximum tolerable downtime; RPO is the maximum tolerable data loss.
- Treatment options: avoid, reduce, transfer or accept; acceptance must be by an authorised person within appetite.
- Third-party risk: vendors and cloud providers need due diligence, contractual security clauses, exit plans and periodic review.
Worked example
Core banking is rated RTO four hours and RPO 15 minutes. The DR site has an eight-hour RTO and one-hour RPO. This fails the BIA: the controls must meet the stated tolerance, not merely exist. Remedies include synchronous replication or more frequent log shipping, a tested failover and a revised DR runbook; the residual risk must be logged and escalated if it remains outside appetite.
Traps
Quoting residual risk as inherent risk; accepting risk without authority; leaving the DR plan untested; treating BCP as an IT-only exercise; forgetting vendor and cloud concentration risk.