Information Technology Governance Framework

Risk Treatment Principle IT risks associated with the Member Organization's information assets should be adequately treated based on the applicable criteria (i.e. accepted, avoided, transferred or mitigated). Control Requirements 1. IT risk treatment plan should be defined, approved and communicated. 2. IT risk treatment plan should be implemented and periodically evaluated. 3. IT risks should be treated according to the Member Organization's risk appetite defined by the relevant governance function owner and approved by the ITSC. 4. IT risk treatment plan should include detail design and implementation of required controls to mitigate the identified risks. 5. IT risk treatment plan should ensure that the list of risk treatment options are formally documented (i.e. accepting, avoiding, transferring or mitigating risks by applying IT controls). 6. Risk acceptance should be least preferred over risk mitigation through implementation of primary controls. 7. Accepting IT risks should be formally documented, approved and signed-off by the business owner and reported to the risk committee, ensuring that: a. risk acceptance should be provided with detail justification including but not limited to the following: 1. impact (i.e. operational, financial and reputational) of not implementing the primary control(s); and 2. compensating control(s) in place of primary control(s) for risk mitigation. b. the accepted IT risk should be within the risk appetite of the Member Organization; c. the accepted IT risk should not contradict with the SAMA regulations; d. a separate exception should be documented for each unique risk; e. risk acceptance should be renewed periodically; and f. Risk acceptance should be presented and reported to the risk committee. 8. Avoiding IT risks should involve a decision by a business owner and risk committee to cancel or postpone a particular activity or project that introduces an unacceptable IT risk to the business. 9. Transferring or sharing the IT risks should: a. involve sharing the IT risks with relevant (internal or external) providers; and b. be accepted by the receiving (internal or external) provider(s). 10. Applying IT controls to mitigate IT risks should include: a. identifying appropriate IT controls; b. evaluating the strengths and weaknesses of the IT controls; c. selection of adequate IT controls; and d. documenting and obtaining sign-off for any residual risk by the business owner and risk committee. 11. IT risk treatment actions should be documented in a risk treatment plan. 3.2.4 Risk Reporting/ Monitoring, and Profiling Principle IT risks should be treated according to the defined treatment plans and should be effectively reviewed, monitored and reported. Control Requirements 1. IT risk assessment results should be formally documented and reported to the relevant business owners and senior management. 2. IT risk assessment results should include risks, impact, likelihood, mitigations, and remediation status. 3. IT risks should be monitored, including but not limited to: a. tracking progress in accordance to the risk treatment plan; and b. the selected and agreed IT controls are being implemented. 4. The design and operating effectiveness of the revised or newly implemented IT controls should be monitored and reviewed periodically. 5. The relevant business owners should accept the IT risk assessment results. 6. IT risk assessment results should be endorsed by the risk committee. 7. IT key risk indicators (KRIs) should be defined, implemented and monitored. 8. IT risk profile and related data should be provided as an input to operational risk department to formulate an organization level risk profile. 9. IT risk profile should be formulated and presented to the senior management, IT Steering Committee and board of directors on periodic basis.