Board approval conflict: risk appetite versus budget cuts and a conflicted ICT risk function
Northbridge Credit Union is a 320-person institution with €4.8 billion in assets. Its board approved a risk appetite statement saying it has 'low tolerance for operational disruption', but in the same meeting cut the ICT budget by 15% and deferred a disaster-recovery site refresh. The CISO resigned three months ago; the ICT risk function now reports to the head of IT operations, who also owns change management. The last ICT risk assessment was 20 months ago and did not cover the new mobile onboarding app. The internal audit report notes five overdue high-risk findings, including untested backups. Management wants the board to approve the ICT risk management framework next week so the annual report can state DORA compliance. The company secretary asks what the board must actually do before approving.
1. Advise the board on whether it can approve the framework as presented. Focus on management-body accountability and the separation of the ICT risk function.
Read the worked answer
The board should not approve the framework as presented. DORA places ultimate responsibility on the management body to approve and oversee the ICT risk management framework, define risk appetite, and ensure adequate resources. Three facts undermine approval: the risk assessment is 20 months old and omits a new channel; five high-risk findings are overdue, including untested backups; and the ICT risk function reports to the same head of IT operations who owns change management, creating a conflict. The board can approve a framework only with a credible remediation plan, not a paper statement for the annual report.
Before approval, require: an updated risk assessment covering the mobile onboarding app; a dated remediation plan for audit findings with owners and budget; a governance review that separates ICT risk and control from IT operations, or at least provides independent challenge and escalation to the board; and confirmation that the 15% budget cut does not breach recovery objectives. Approval should be conditional and minuted, with a follow-up date. That is stronger evidence of oversight than unconditional approval.
2. How should 'low tolerance for operational disruption' be translated into measurable ICT risk tolerance and appetite?
Read the worked answer
A risk appetite statement is not measurable until it is expressed as impact tolerances and limits. The board should define which services are critical - for a credit union, payments, account access, lending decisions and regulatory reporting - then set maximum tolerable downtime, recovery time and recovery point objectives for each. It should also set thresholds for incident severity, data loss, customer harm and regulatory breach, plus key risk indicators such as backup restoration success, patch latency and unresolved high findings.
The budget decision should then be tested against those limits: if the DR site refresh is deferred, can the stated recovery objectives still be met? If not, the board is accepting a risk outside its stated appetite, which must be explicitly recorded and remediated. The framework should require periodic reporting against the tolerances, not just annual review. This translates 'low tolerance' into decisions the board can monitor and challenge.
3. What evidence should the board minute to demonstrate oversight?
Read the worked answer
Minutes should show active challenge, not just approval. Record: the updated risk assessment and its gaps; the overdue audit findings and management's remediation commitments; the governance conflict and the decision to address it; the budget cut and its effect on recovery objectives; the conditions attached to approval; assigned owners and deadlines; and the next review date. Also record that the board received the risk appetite metrics and asked for evidence of backup testing.
DORA supervision looks for whether the management body actually directs and monitors ICT risk. A minute saying 'framework approved' with no conditions is weak. A minute showing that the board refused unconditional approval, required a remediation plan, and scheduled follow-up is stronger. The board should also ensure that the framework is reviewed after major incidents and material changes, not only once a year. The company secretary should keep the supporting papers that substantiate the minutes.