Every TRM Duty, Cited and Ready.

The Board of Directors and senior management of the Bank ensure that internal controls and risk management practices are effective and are implemented, so that the Bank's information technology (IT) operating environment achieves security, reliability and resilience. Both bodies include members who hold the knowledge needed to understand and manage technology risks, including the risks posed by cyber threats. The Board of Directors and senior management set the tone from the top. They cultivate a strong culture of technology risk awareness and management at every level of staff. They also ensure that a technology risk management strategy is established and implemented, and that key IT decisions are made in accordance with the Bank's risk appetite.

The Bank appoints a Chief Information Officer (CIO), Chief Technology Officer (CTO) or Head of IT, and a Chief Information Security Officer (CISO) or Head of Information Security, each with the requisite expertise and experience. The Board of Directors and senior management ensure these appointments are made, and the Chief Executive Officer (CEO) approves them as a minimum. The CIO, CTO or Head of IT holds principal responsibility for establishing and implementing the overall information technology strategy. That role also oversees day-to-day information technology operations and manages the technology risks of the Bank. The CISO or Head of Information Security holds principal responsibility for the Bank's information security strategy and programme. That responsibility covers information security controls, the management of information security, and the information security policies and procedures that safeguard information assets.

The Board of Directors, or a committee it delegates, is accountable for the following. (a) A robust and sound risk management framework for technology risks is established and maintained. (b) A technology risk management function exists to oversee that framework and the strategy, and to provide an independent view of the technology risks the Bank faces. (c) Senior executives responsible for executing the technology risk management strategy are given sufficient authority, resources and access to the Board of Directors. (d) The risk appetite and risk tolerance statement, articulating the nature and extent of technology risks the Bank is willing and able to assume, is approved. (e) The technology risk management strategy is reviewed regularly for continued relevance. (f) Management competencies for managing technology risks are assessed. (g) An independent audit function is established, and it assesses the effectiveness of the Bank's controls, risk management and governance.

Senior management is accountable for the following. (a) Establishing the technology risk management framework and strategy. (b) Managing technology risks on the basis of that established framework and strategy. (c) Policies, standards and procedures for managing technology risks are sound and prudent, established and maintained, and the standards and procedures are implemented effectively. (d) Delineating clearly the roles and responsibilities of staff in managing technology risks. (e) Apprising the Board of Directors, in a timely manner, of salient and adverse technology risk developments and incidents likely to have a major impact on the Bank. The Bank may define and track these roles and responsibilities using a Responsibility Assignment Matrix, also known as RACI, which outlines who is responsible and accountable for the functions and who is consulted or informed.