Compared to last year, we have made some changes to the format of this self-assessment. This year, institutions can also use existing independent audit reports to demonstrate their adequate management of IT risks. The questionnaire is also better aligned with the EBA Guidelines on ICT and security risk management (EBA/GL/2019/04) and outsourcing (EBA/GL/2019/02). We discussed the changes to the format to improve the clarity of the assessment with a number of institutions.
Not all licensed institutions will have to complete this self-assessment: institutions that recently obtained their license or were recently subjected to a more in-depth IT examination will not be asked to participate.
We will share the key observations from the assessment with the sector in the second half of this year.