The severity of this cannot be underestimated.

← Back to Blog

The severity of this cannot be underestimated.

The Bank of England has fined Vocalink, a Mastercard company £11.9 million of failure in governance and risk management. The bank highlighted failures by the company to properly understand, monitor and share risks across the three lines of defence (and external assurance providers) and by extension govern, oversight and assure risk. The BoE found failures to escalate key risks and information to senior committees, undermining the firm’s ability to fully comply with directions made by the Bank of England.

Issues with Vocalink were required to have been remediated by February 2022. But it failed to comply in full with the deadline.

“Vocalink fell short of its obligation to have adequate risk management and governance arrangements when responding to the Bank’s Direction. Its failure to comply with that Direction in full has resulted in a significant fine.”

This raises questions about VocaLinks compliance with the EU Digital Operational Resilience Act (DORA). Vocalink is an Critical provider of banking and ICT services the EU. A core requirement under DORA is for Financial institutions, ICT and infrastructure providers to demonstrate their governance and risk management of ICT risks.

DORA requires covered entities implement governance, and a risk management framework that is integrated across an organisations Enterprise Wide Risk Management. With a robust 3 Lines of Defence to provide oversight and assurance of ICT risk. DORA also allows for the introduction of individual and corporate civil and criminal penalties for non-compliance.

One now wonders what the next steps are for Vocalink and their compliance under DORA and the view of both the European Central Bank and EU State Financial Regulators.

@Thaddeus Dziekanowski Brian D. McCarthy Faisal Khan Bryan Foss

Veritas GRC

#cybersecurity #cyberriskmanagement #ictrisk

https://lnkd.in/egSgTuet

https://lnkd.in/ebnGS_9e

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7349349079727964161

Categories

Cyber Risk Management, Governance & ESG, Regulation & Compliance

Tags