Information and communication technology (ICT) risk management: range of practices

What it contains

It is part of the Committee’s 2025-26 work programme and complements its earlier work on cyber resilience by focusing on non-malicious ICT incidents, that is, failures that do not come from an attack but that affect the delivery of critical operations. The analysis covers global systemically important banks (G-SIBs), domestic systemically important banks (D-SIBs) and other banks of interest, such as digital-only banks, and draws on responses from 16 jurisdictions, case studies and an industry outreach event.

Among the most frequently reported root causes are gaps in change control, flaws in systems design, development and testing, capacity and performance problems, and operational failures of external dependencies. The five most frequently reported management practices are change management, third-party risk management, ICT continuity testing, incident and problem management, and project management and systems development. The report devotes a section to each of ten areas: governance, asset inventory, incident and problem management, continuity and recovery, change, capacity, software development, training, tools and third parties.

All surveyed jurisdictions have regulation or guidance on technology risk and, in most, supervision is proportionate and risk-based, with on-site inspections, thematic reviews or off-site assessments. The challenges they point to include maintaining traceability between business services and technology assets, completing dependency mapping and the asset inventory, the shortage of talent in cybersecurity, cloud and artificial intelligence, and limited visibility into the controls of technology providers.

Summary prepared by the Dominican Republic Risk Management Club from a reading of the original document, with the source verified on 7 October 2026. It does not replace reading the official text and is not advice.

See all publications