Executive Accountability vs Technical Complexity

Business Context

DORA assigns clear accountability for ICT risk management and operational resilience to an organization's management body. However, modern ICT environments involve cloud computing, artificial intelligence, cybersecurity, distributed infrastructures, and complex third-party ecosystems that many senior executives do not fully understand from a technical perspective.

Conflict

Delegating technical decisions improves operational efficiency but may weaken executive oversight. Increasing executive involvement strengthens governance but may slow operational decision-making if technical expertise is limited.

Regulatory Obligations

Define ICT governance responsibilities

Assign accountability to the management body

Provide ICT risk reporting

Ensure executive training

Review ICT governance regularly

Monitor operational resilience performance

Business Risks

Poor strategic decisions

Weak executive oversight

Misaligned technology investments

Compliance Risks

Inadequate governance

Insufficient board oversight

Regulatory findings

Recommended Controls

Establish governance structures that translate technical risk into business language through dashboards, risk reporting, resilience metrics, and regular executive briefings. Training programmes should improve board understanding of ICT risks without requiring technical specialization.

Evidence Required

ICT Governance Framework

Board Reporting

Executive Training Records

ICT Risk Dashboards

Governance Committee Minutes

Audit Questions

Is the management body accountable for ICT risk?

Does executive management receive regular ICT reporting?

Are governance responsibilities documented?

Is executive ICT training performed?

Suggested Kpis

Percentage of executives completing ICT governance training

Number of ICT risks reviewed by the board

Frequency of executive ICT reporting

Number of governance findings