ICT Risk Management Frameworks - Progress, Blind Spots and Priorities

The IT Risk Questionnaire reveals a perception of reduced risk, but also increasing operational threats. Banks should focus on improving the practical effectiveness of ICT risk frameworks – and on resourcing strong second lines able to provide robust challenge.

At a time of rising global concern over cyberthreats, the ECB’s IT Risk Questionnaire (ITRQ) plays a more important role than ever in shaping SREP scores and follow-up supervisory enquiries. 2026 represents the second iteration of the revised, fully DORA-aligned ITRQ, with new sections on “Gross costs and losses” and “Information sharing agreements”.

Our conversations with a wide range of European banks indicate that assessments of ICT risks have reduced slightly, and reported control effectiveness has improved modestly. At the same time, some operational indicators of ICT risk have moved in the opposite direction, more frequent confidentiality breaches, and increased activation of disaster recovery plans pointing to elevated underlying ICT risk.

While ICT risk management frameworks and controls have improved overall, remaining control inefficiencies suggest that they are not yet sufficiently mature to fully mitigate this increased risk exposure.

Notable areas of weakness in the digital and operational resilience of SIs appear to include:

Persistent flaws in third party risk management

Third party risk management frameworks have strengthened, for instance via improved governance and contractual arrangements. But controls still show room for improvement. This applies first and foremost to concentration risk assessments and exit planning or testing.
Further growth in third party dependencies

ICT accounts for a rising share of third-party spending, with an increasing focus on non-cloud services. This means that SIs’ reliance is increasing in the exact area where their controls are least mature - although third party risks are increasingly embedded in monthly oversight cycles and board agendas.
Inadequate asset inventories

Asset registers and data architecture related to Critical or Important Functions (CIFs) are foundational for many controls and need to be improved. Full CIF ‘golden source’ coverage has declined. A reliable inventory, appropriate continuity planning, third-party assessment and incident classification all require a solid basis.
Information- and cybersecurity issues

Continued reliance on unsupported critical legacy systems increases cybersecurity risk. Patch management and network segmentation are identified as key weaknesses, but broadly stable levels of ICT spending on security suggest this area is receiving limited prioritisation.
Resilience exercised, not tested

Third-party, annual, and CIF-specific continuity testing rank among the least mature controls. Recovery capability is rarely validated in advance, and critical systems downtime has declined only moderately.

If there is a consistent theme underpinning these issues, it is one of insufficient ICT risk expertise and staffing in the second and third lines of defence. Despite a slight shift towards risk and governance functions, ICT staffing continues to be overwhelmingly concentrated on the first line. Second and third line capabilities are only expanding slowly, but the ICT perimeter they must oversee – fuelled by rising third part dependency – is growing exponentially. This is not just another finding. It is the structural driver behind the contradiction between SIs’ assessments of risks and their operational reality. The credibility of ITRQ responses depends on robust, independent challenge. Without strong, deep technical resources in the second line, self-assessments represent optimistic aspiration, not validated reality.

The need to address this shortfall is made more urgent by the approach, from 2027, of an ITRQ reporting period aligned with the SREP cycle’s June year-end. This is a logical change, but one that requires new methodologies for allocations and estimates to be documented and defended. Reporting calendars and processes should be altered and tested now, not during the submission window itself, with a focus on:

Strengthening ICT operating models, skills profiles, technical expertise, and challenge processes in the second line.
Assessing whether first-to-second-line resource ratios still match the complexity and external dependency of ICT landscapes.
Establishing complete, consolidated ICT asset and dependency inventories, including CIF golden source coverage.
Making concentration and exit risk assessments evidence-based, with tested exit plans for CIFs.
Accelerating vulnerability and patch management, strengthening network segmentation, and aligning security investments with reported risk levels.
Extending continuity testing explicitly to third-party services and CIFs on a defined annual cycle.
Acting early to reset reporting processes and estimation methodologies for the new ITRQ reporting period.

Cybersecurity is becoming increasingly urgent in light of the ECB’s July 2026 Dear CEO Letter on AI-enabled cybersecurity threats. Emerging AI models can identify vulnerabilities and generate functioning exploits at unprecedented speed, shrinking the window between vulnerability discovery and exploitation.

This increases the consequences of weaknesses in patch and vulnerability management and reinforces the need for clear visibility of assets, software components and externally exposed systems requiring priority remediation.

At the same time, the AI-enabled threat landscape puts additional pressure on the ICT operating model, potentially requiring management bodies to revisit ICT investment, resource allocation and ICT risk tolerance.

Supervisors increasingly view favourable self-assessments from SIs with under-resourced second lines as a warning sign, not a comfort. At a time of rising cyberthreats and supervisory expectations, firms that can use the ITRQ as a lever to strengthen ICT risk management stand to benefit.