Top risks and controls for Information Technology

From the Doorstep International risk register, curated by Ahmer Nehal. Last updated 17 Oct 2026.

The Information Technology register lists 35 key risks and 95 best-practice controls across 6 units: Application Development, Business Intelligence and Analytics, Digital Innovation, Information Security, Infrastructure and Operations, Project Management. Use it to identify risks, benchmark your existing controls or start a risk and control self-assessment (RCSA).

Get the RCSA workbook Run it in the software

AI-era lens: IT functions now run AI services, cloud platforms and the integrations that AI agents use, so system failures, vendor outages and insecure changes can spread faster than before. The FSB's October 2026 sound practices call for AI-related ICT and cyber risk and third-party AI dependencies to be managed inside existing frameworks. Use the controls below with the operational resilience guide.

An important part of a modern bank's operations is information technology.

The bank's operations, reputation, and financial stability could be severely harmed by cyber-attacks, data breaches, and other security concerns as a result of the increased reliance on technology.

Therefore, conducting regular risk assessments is crucial for the information technology department of a bank.

The bank can implement the necessary actions to mitigate potential risks, improve its security posture, and guarantee compliance with regulatory obligations by detecting potential threats.

Risk evaluations also assist the bank in making wise choices about technological and cybersecurity investments, ultimately resulting in a more secure and resilient business.

Application Development: key risks and controls

Accountable for creating and maintaining all software utilised by bank workers, including the internet banking platform, smartphone apps, and other software.

Risk	What can go wrong	Best-practice controls
Integration Risks	Banks use multiple systems to manage their operations, and new applications developed may need to integrate with existing systems. Integration risks include incompatibility issues, data consistency, and integrity issues, and performance issues.	Develop a comprehensive integration strategy: Establish a strategy that outlines the approach to be used to integrate new applications with existing systems, including how to ensure data consistency, integrity, and compatibility. Perform a thorough risk assessment: Conduct a risk assessment to identify potential integration risks and evaluate their potential impact on operations. This assessment should be conducted before integrating any new application with existing systems. Use standard protocols: Use standard protocols such as API, SOAP, or REST to facilitate data exchange and integration between systems. These protocols ensure that the data is exchanged in a secure, consistent, and reliable.
Project Management Risks	Application development projects are complex and involve multiple stakeholders, such as developers, project managers, and end-users. Project management risks include inaccurate requirements gathering, poor project planning, resource constraints, and poor communication.	Robust Requirement Gathering Process: Implementing a thorough and well-defined requirement gathering process is crucial to mitigate the risk of inaccurate requirements. This includes engaging all relevant stakeholders, conducting comprehensive interviews, workshops, and documenting requirements in a structured manner. Clear and concise requirements help ensure that the project team understands the project objectives and deliverables accurately. Effective Project Planning and Management: Proper project planning is essential to mitigate various project management risks. This control involves developing a detailed project plan, setting realistic timelines, and defining clear project milestones.
Regulatory Compliance	Commercial banks operate in a highly regulated environment, and any applications developed must comply with various regulations such as the Sarbanes-Oxley Act (SOX), Payment Card Industry Data Security Standard (PCI DSS), and General Data Protection Regulation (GDPR). Failure to comply with these regulations can lead to penalties, fines, and reputational damage.	Regulatory Compliance Framework: Implementing a robust regulatory compliance framework is essential for ensuring adherence to relevant regulations. This control involves establishing policies, procedures, and controls that align with the requirements of SOX, PCI DSS, GDPR, and other applicable regulations. The framework should address data security, privacy, financial reporting and internal controls. Data Governance and Privacy Policies: Establishing strong data governance practices and privacy policies is crucial for complying with regulations such as GDPR. This control involves defining data classification, access controls, data retention policies, and data handling procedures. Implementing privacy policies that outline how personal data is collected, processed, stored, and shared can help ensure compliance with GDPR and other data protection regulations.
Security Risks	Applications developed by banks may contain sensitive information such as customer data, financial information, and intellectual property. If the application is not developed with appropriate security measures, it could be vulnerable to hacking, unauthorized access, and other security breaches.	Secure Development Lifecycle (SDL): Implementing a secure development lifecycle is crucial to ensure that applications are built with security in mind from the very beginning. This approach involves incorporating security practices at each stage of the development process, including requirements gathering, design, coding, testing, and deployment. By integrating security measures into the development process, potential vulnerabilities can be identified and addressed early on, reducing the risk of security breaches. Access Control and Authentication: Implement strong access control mechanisms to restrict unauthorized access to sensitive information within the application. This includes using robust authentication mechanisms such as multi-factor authentication and strong password policies.
Vendor Management Risks	Banks may engage third-party vendors to develop their applications. Vendor management risks include poor vendor performance, communication issues, and vendor non-compliance with contractual agreements.	Conduct a thorough risk assessment of the third-party vendor to determine their level of risk and how to manage it. Perform due diligence on the vendor's reputation, history, and references before signing any agreements. Establish a clear and detailed contractual agreement that outlines the expectations, roles, and responsibilities of the vendor, including service level agreements (SLAs) and performance metrics. Monitor the vendor's compliance with the contractual agreement and SLAs on a regular basis, including periodic reviews and assessments.

Business Intelligence and Analytics: key risks and controls

Accountable for offering the bank data analysis and reporting services. They might be in charge of creating dashboards and reports, analysing customer data, and offering business units insights and recommendations.

Risk	What can go wrong	Best-practice controls
Compliance Risks	Commercial banks operate under various regulations and laws that govern data privacy and security. The information technology department must ensure that their business intelligence and analytics practices comply with these regulations to avoid legal and reputational risks.	Access Control Measures: Implementing robust access control measures is crucial to safeguard sensitive information. This control includes strict user authentication, authorization protocols, and role-based access controls (RBAC). By limiting access to authorized personnel and assigning specific roles and privileges, banks can reduce the risk of unauthorized access and potential data breaches. Encryption and Data Protection: Utilizing strong encryption techniques for data at rest and in transit is essential. Encryption converts sensitive data into unreadable formats that can only be deciphered with the appropriate encryption keys.
Data Quality Risks	The accuracy and completeness of data used for business intelligence and analytics is critical to the success of these initiatives. Poor quality data can lead to erroneous insights and decisions that can negatively impact the bank's operations and reputation.	Data Governance Framework: Develop and implement a formal data governance framework that defines data standards, policies, and procedures for data quality management, data security, data lineage, and data lineage, to ensure data accuracy and completeness. Data Quality Management: Establish and implement a data quality management program to monitor, measure, and improve the quality of data, including data profiling, data cleansing, and data enrichment. Data Validation and Verification: Implement automated data validation and verification checks to ensure that the data used in business intelligence and analytics is accurate and complete, and meets predefined quality standards.
Data Security Risks	The information technology department must ensure that sensitive data used for business intelligence and analytics is secured from unauthorized access. This includes implementing strong authentication mechanisms, access controls, encryption, and other security measures to safeguard against data breaches.	The information technology department must ensure that sensitive data used for business intelligence and analytics is secured from unauthorized access. This includes implementing strong authentication mechanisms, access controls, encryption, and other security measures to safeguard against data breaches. Access Controls: Implementing robust access controls is essential for protecting sensitive data. Access controls involve defining user permissions, roles, and privileges based on the principle of least privilege.
Human Error Risks	Business intelligence and analytics systems rely on the accuracy and completeness of the data entered by users. Human errors, such as data entry mistakes or misinterpretation of data, can lead to incorrect insights and decisions.	Data validation checks: Implement automated checks to verify the accuracy and completeness of the data entered by users, including checking for missing or incorrect values, formatting, and data type. User training: Provide adequate training and support to users on how to properly input and interpret data. This can include training on data entry best practices, data quality standards, and how to use data visualization tools. Data governance: Establish clear data governance policies and procedures that govern the entire data lifecycle, from data collection to reporting. This includes setting standards for data quality, accuracy, and completeness.
Operational Risks	The use of business intelligence and analytics systems can introduce new risks into the bank's operations. This includes issues related to data governance, data ownership, system scalability, and change management.	Robust Data Governance Framework: Establishing a strong data governance framework is crucial to ensure proper management, quality, and security of data. This control involves defining clear roles and responsibilities, implementing data policies and procedures, enforcing data standards, and establishing data quality controls. By having a well-defined governance framework, banks can minimize risks associated with data integrity, accuracy, and privacy. Comprehensive Change Management Processes: Implementing effective change management processes is essential to address the risks associated with system changes and upgrades.
System Availability Risks	The information technology department must ensure that the business intelligence and analytics systems are always available to the users. Downtime or system outages can result in delays or disruption of critical banking operations.	Redundant System Architecture: Implementing redundant system architecture is the most effective control to ensure high availability. This involves setting up duplicate hardware, databases, and network components in parallel to the primary system. Redundancy ensures that if one component fails, the backup takes over seamlessly, minimizing downtime and disruption of critical operations. Fault Tolerant Infrastructure: Deploying a fault-tolerant infrastructure is another crucial control. This involves utilizing technologies and systems that can automatically detect and recover from failures.

Digital Innovation: key risks and controls

Tasked with examining and adopting new technologies that can enhance the client experience and operational effectiveness of the bank. They can be in charge of executing pilot projects, learning about new technologies, and working with other business divisions to put innovative digital solutions into practice.

Risk	What can go wrong	Best-practice controls
Cybersecurity Risks	Digital innovation creates new vulnerabilities and attack vectors that can be exploited by cybercriminals. The information technology department must implement robust cybersecurity measures to safeguard against data breaches, malware attacks, and other cyber threats.	Employee Education and Awareness: The most effective control measure is to educate and raise awareness among employees about cybersecurity best practices. This includes training them on how to identify and respond to potential threats, such as phishing emails, suspicious links, or social engineering attempts. By making employees more vigilant and informed, organizations can significantly reduce the risk of cyber attacks. Network Security: Implementing robust network security measures is crucial for protecting against cyber threats. This includes firewalls, intrusion detection and prevention systems, and secure network configurations. By controlling and monitoring network traffic, organizations can detect and prevent unauthorized access, malware infections, and other malicious activities.
Data Privacy Risks	Digital innovation often involves the collection and processing of sensitive customer data. The information technology department must implement appropriate controls to protect this data and ensure compliance with applicable data privacy regulations.	Access Control Measures: Implementing strong access control measures is crucial to protect sensitive customer data. This involves ensuring that only authorized individuals have access to the data based on their job roles and responsibilities. Access controls can include strong authentication mechanisms, role-based access controls, and regular access reviews to minimize the risk of unauthorized access. Data Encryption: One of the most effective controls to mitigate the risk of sensitive customer data is data encryption. Encryption transforms the data into an unreadable format, ensuring that even if unauthorized access occurs, the data remains protected. By encrypting data at rest (when stored) and in transit (during transmission), organizations can significantly reduce the likelihood of data exposure and maintain compliance with data privacy regulations.
Operational Risks	Digital innovation can introduce new operational risks into the bank's processes, such as issues related to system scalability, data governance, and change management. The information technology department must be prepared to address these risks to ensure that the bank's operations remain efficient and effective.	Robust Change Management Processes: Implementing strong change management processes is crucial to address the risks associated with digital innovation. This control involves establishing formal procedures for assessing, approving, and implementing changes to the bank's systems and processes. It ensures that any changes are thoroughly tested, properly documented, and implemented with minimal disruption to operations. Comprehensive Data Governance Framework: A solid data governance framework is essential to mitigate risks related to data management in digital innovation. This control involves defining clear data ownership and establishing data quality standards.
Reputation Risks	A data breach or other cyber incident can have a significant impact on a bank's reputation. The information technology department must take steps to prevent such incidents and be prepared to respond quickly and effectively if they do occur.	Robust Cybersecurity Infrastructure and Controls: Implementing a comprehensive cybersecurity infrastructure and controls is the most effective measure to prevent data breaches and cyber incidents. This includes deploying firewalls, intrusion detection and prevention systems, encryption, secure network architecture, and regular security assessments. The bank should follow industry best practices, use strong security frameworks, and stay up to date with emerging threats and vulnerabilities. Employee Awareness and Training: Promoting a culture of cybersecurity awareness among bank employees is vital in mitigating the risk of data breaches and cyber incidents. By providing comprehensive training and fostering an understanding of cybersecurity risks, best practices, and individual responsibilities, employees can become active participants in preventing and responding to security incidents. Regular training sessions, awareness campaigns, and simulated phishing exercises should be conducted to reinforce security protocols, educate employees on identifying potential threats, and empower them to adopt secure practices throughout their work.
Technology Obsolescence Risks	As new technologies emerge, existing systems may become outdated or obsolete. The information technology department must stay abreast of the latest trends and technologies to ensure that their systems remain current and effective.	Conduct regular technology assessments and reviews to identify new technologies and trends that may impact the organization's systems. Develop and maintain a comprehensive technology roadmap that outlines the planned upgrades, replacements, and retirements of existing systems. Establish a budget and funding model that supports technology upgrades and replacements, and ensures that sufficient resources are available to keep systems current and effective. Engage with industry associations, vendor forums, and peer organizations to stay informed about emerging technologies and best practices. Establish a process for evaluating new technologies and conducting proof-of-concept testing before deploying them in production environments.
Third-Party Vendor Risks	Many digital innovations rely on third-party vendors to provide software, hardware, or services. The information technology department must ensure that these vendors are trustworthy and reliable, and that their products and services meet the bank's security and compliance requirements.	Conduct thorough due diligence on third-party vendors to ensure they meet the bank's security and compliance requirements. Establish clear contractual agreements with vendors that clearly outline the expectations for security and compliance. Perform regular audits and assessments of third-party vendors to ensure they are meeting their contractual obligations. Implement technical controls to monitor vendor activity and detect any unauthorized access or data breaches. Implement policies and procedures that govern how third-party vendors are granted access to the bank's systems and data.

Information Security: key risks and controls

Accountable for defending the bank's information assets from online dangers like malware, phishing, and hacking. They might be in charge of creating and putting into effect security policies and procedures, managing security incidents, and doing audits and assessments of security.

Risk	What can go wrong	Best-practice controls
Data breaches	Data breaches can occur due to cyber attacks, system vulnerabilities, or human error. These breaches can result in the theft or exposure of sensitive customer information.	Access Control and User Authentication: Implementing strong access control mechanisms and user authentication measures is crucial to prevent unauthorized access to sensitive customer information. This control includes measures such as strong passwords, multi-factor authentication, and role-based access controls. By ensuring that only authorized individuals have access to sensitive data, organizations can significantly reduce the risk of data breaches. Regular Security Patching and System Updates: Keeping all software, operating systems, and applications up to date with the latest security patches is essential. Regularly applying security updates and patches helps to address known vulnerabilities and weaknesses in the system. By promptly patching vulnerabilities, organizations can minimize the risk of cyber attacks exploiting these weaknesses to gain unauthorized access to customer data.
Distributed denial-of-service (DDoS) attacks	These attacks overload a bank's network, causing it to become unavailable to legitimate users.	DDoS Mitigation Services: Deploying dedicated Distributed Denial of Service (DDoS) mitigation services is a highly effective control to combat network overload attacks. These services are specifically designed to detect and mitigate DDoS attacks, allowing legitimate traffic to reach the bank's network while blocking malicious traffic. DDoS mitigation services typically involve sophisticated traffic analysis, rate limiting, and traffic diversion techniques to maintain network availability. Redundant Network Infrastructure: Establishing a redundant network infrastructure is a crucial measure to mitigate the risk of network overload attacks. By implementing duplicate routers, switches, and network connections with failover mechanisms, the bank ensures that even if one component or link is targeted or experiences a failure, the network remains available to legitimate users. Redundancy enhances the resilience of the network, safeguarding against disruptions caused by malicious attacks.
Insider threats	This refers to the risk posed by employees or contractors who have access to sensitive information or IT systems and may intentionally or unintentionally cause harm to the bank's IT infrastructure.	Access control: Limit access to sensitive information and IT systems to authorized personnel only. This can be achieved by using strong passwords, two-factor authentication, and regular access reviews. User training and awareness: Conduct regular training and awareness sessions to educate employees and contractors about the importance of information security and the consequences of violating security policies. Segregation of duties: Ensure that no single individual has access to all sensitive information or IT systems. This can be achieved by separating duties and responsibilities among different individuals.
Malware	Malware, such as viruses and trojans, can infect computer systems, compromise sensitive information, and cause significant damage to a bank's IT infrastructure.	Antivirus Software: Implementing robust antivirus software is essential to detect, prevent, and remove malware from computer systems. Antivirus software scans files and programs for known malware signatures and suspicious behavior, providing real-time protection against viruses and trojans. Regular updates to the antivirus software are crucial to ensure it remains effective against emerging threats. Employee Awareness and Training: Educating bank employees about safe computing practices and the risks associated with malware is critical. Conduct regular training sessions to teach employees how to identify phishing emails and suspicious links.
Social engineering	Social engineering attacks, such as phishing, vishing, and smishing, target individuals with the aim of obtaining sensitive information or access credentials.	Security Awareness Training: Train employees on how to recognize and report social engineering attacks. Use Two-Factor Authentication (2FA): Implement 2FA for access to sensitive information, systems, and networks. Strong Passwords: Require employees to use strong, complex passwords and change them regularly. Anti-Phishing Tools: Implement anti-phishing tools that can detect and block suspicious emails, websites, and messages.
Unauthorized access	This refers to the risk of unauthorized individuals gaining access to sensitive information. This can occur due to weak passwords, inadequate access controls, or phishing attacks.	Strong Password Policies and Practices: Implementing strong password policies and promoting good password practices is crucial to mitigating the risk of unauthorized access. This includes enforcing password complexity requirements, regular password changes, and educating employees about creating strong passwords. Additionally, organizations can employ multi-factor authentication (MFA) to add an extra layer of security. Robust Access Control Mechanisms: Implementing and maintaining a robust access control system is essential to prevent unauthorized individuals from gaining access to sensitive information.

Infrastructure and Operations: key risks and controls

Accountable for overseeing the server, network, and data centre management for the bank's IT infrastructure. They might be in charge of overseeing vendor relations, keeping an eye on system performance, and making sure the system is always available.

Risk	What can go wrong	Best-practice controls
Cybersecurity breaches	Commercial banks are a prime target for cybercriminals due to the large amount of sensitive financial information they store. A cybersecurity breach can result in the loss or theft of customer data, financial loss, and reputational damage.	Implementing robust access controls: The bank should have strict controls over who can access sensitive information and systems, and the level of access should be based on an individual's job requirements. This can help prevent unauthorized access and reduce the risk of insider threats. Conducting regular security awareness training: All employees should receive regular training on cybersecurity best practices, including how to recognize and respond to phishing attacks, social engineering, and other common threats. This can help reduce the risk of human error and improve the overall security posture of the bank. Enforcing strong password policies: The bank should require employees and customers to use strong, unique passwords.
Data privacy violations	Banks are subject to strict data privacy regulations, and failure to comply with these regulations can result in significant penalties and reputational damage.	Data Encryption and Access Controls: Implementing strong encryption measures to protect sensitive customer data is crucial. Encryption ensures that even if unauthorized individuals gain access to the data, it remains unreadable and unusable. Access controls should also be in place to restrict data access to authorized personnel only. Robust Compliance Monitoring and Auditing: Banks should establish a comprehensive compliance monitoring program that regularly reviews data privacy practices and ensures adherence to regulations. This involves conducting periodic audits, internal assessments, and using monitoring tools to identify any potential compliance gaps.
Operational errors	Human error, such as accidentally deleting or mismanaging data, can lead to significant losses and reputational damage.	Employee Training and Awareness: One of the most effective controls is providing comprehensive training to employees regarding data management best practices, emphasizing the importance of accuracy and caution when handling data. Regular awareness campaigns and refresher training sessions can help reinforce these practices and reduce the likelihood of human error. Access Controls and Permissions: Implementing strict access controls and permissions ensures that only authorized personnel can access and modify critical data. By limiting access to sensitive information, organizations can minimize the potential for accidental deletion or mismanagement. User access should be granted on a need-to-know basis.
System failures and downtime	Banks rely heavily on their IT systems to conduct transactions and store sensitive customer data. Any system failure or downtime can disrupt bank operations and result in significant financial losses.	Regular backups and disaster recovery plans to ensure that critical data is not lost in the event of a system failure or downtime. Implementing redundant systems and failover mechanisms to ensure continuity of operations in case of system failure. Conducting regular IT system maintenance and testing to identify and address potential system failures before they occur. Implementing strong access controls to ensure that only authorized personnel can access and modify sensitive customer data. Ensuring that all IT systems are up-to-date with the latest security patches and software updates to prevent vulnerabilities and exploits.
Third-party vendor risks	Many banks rely on third-party vendors to provide IT services, such as cloud computing or data storage. These vendors can pose risks to the bank's operations and customer data if they experience a breach or fail to meet contractual obligations.	Vendor Due Diligence and Selection: Thoroughly vetting and selecting vendors is crucial in mitigating risks. Establish a comprehensive due diligence process that assesses potential vendors' security practices, financial stability, reputation, and compliance with relevant regulations. Prioritize vendors with strong security controls, certifications (such as ISO 27001), and a proven track record of reliability. Contractual Agreements and SLAs: Clearly define the expectations and responsibilities of both parties in a legally binding contract. Include specific clauses related to data protection, breach notification, incident response, and liability. Establish robust service level agreements (SLAs) that outline performance metrics, uptime guarantees, and penalties for non-compliance.

Project Management: key risks and controls

Responsible for overseeing the strategy, design, execution, and maintenance of IT initiatives. They might be in charge of creating project plans, controlling project budgets, and making sure projects are finished on schedule and under budget.

Risk	What can go wrong	Best-practice controls
Budget Overruns	IT projects can be expensive, and managing budgets is crucial. Without proper planning and monitoring, the project can go over budget, leading to financial losses.	Detailed Project Planning: Thorough project planning is crucial to establish a solid foundation for budget management. It involves defining project objectives, scope, deliverables, timelines, and resource requirements. By conducting a comprehensive planning phase, you can identify potential risks and allocate sufficient resources and funds accordingly, minimizing the chances of cost overruns. Continuous Monitoring and Reporting: Implementing a robust monitoring and reporting mechanism allows you to track the project's financial performance regularly. This includes monitoring actual expenses against the budget, identifying any deviations, and addressing them promptly. Regular reports help stakeholders stay informed about the project.
Change Management	IT projects can bring significant changes to the organization, which can be challenging for employees to adapt to. Change management is critical to ensure a smooth transition and minimize disruption.	Develop a comprehensive change management plan that includes stakeholder engagement, communication, training, and support. Conduct a thorough impact analysis to identify potential risks and challenges associated with the project's implementation. Engage with employees and stakeholders early in the process to gather feedback, address concerns, and build support for the project. Create a project team with diverse skills and experience to help drive the change, identify potential roadblocks, and provide support. Provide targeted training and support to employees to help them understand the changes and how to adapt to them.
Integration Issues	IT projects may require integration with existing systems or platforms. Integration issues can arise if the new system is not compatible with the existing systems, leading to data loss, downtime, and reduced productivity.	Thorough Compatibility Assessment: Before implementing any IT project, conduct a comprehensive compatibility assessment between the new system and existing systems. This assessment should identify potential integration challenges, such as incompatible data formats, protocols, or interfaces. By understanding compatibility issues beforehand, you can proactively address them and minimize the risk of data loss, downtime, and reduced productivity. Prototyping and Testing: Develop a prototype or conduct thorough testing of the new system's integration with existing systems before full-scale implementation. Prototyping and testing allow you to identify and rectify any compatibility issues.
Resource Constraints	IT projects often require specialized skills, which may not be readily available in the organization. This can lead to delays or the need to hire expensive external consultants.	Succession Planning and Skills Development: Implement a comprehensive succession planning program to identify key positions within the organization and develop a pipeline of internal talent capable of fulfilling those roles. Provide training and development opportunities to enhance the skills of existing employees, enabling them to handle specialized tasks. This reduces the reliance on external consultants and minimizes delays by ensuring a competent workforce. Cross-Training and Knowledge Sharing: Encourage cross-training and knowledge sharing among employees to increase their versatility and expertise in different areas. By facilitating the exchange of knowledge and skills, the organization can create a pool of employees who can handle various specialized tasks. This reduces the dependency on specific individuals and mitigates the risk of delays caused by skill gaps.
Scope Creep	This is when the project's scope increases beyond its original definition. It can happen due to changing requirements, client demands, or unclear objectives.	Clearly define and document project scope, objectives, and deliverables at the outset of the project. Establish a formal change control process to evaluate and approve all scope changes. Conduct regular project status reviews to ensure the project stays on track and within its original scope. Involve stakeholders in the change control process and obtain their buy-in before making any scope changes. Develop a communication plan to ensure everyone involved in the project is aware of the scope, objectives, and any changes made to them. Set realistic timelines and budget for the project and monitor them regularly.
Stakeholder Management	IT projects often involve multiple stakeholders with different priorities, expectations, and interests. Managing these stakeholders and ensuring their buy-in is crucial to project success.	Stakeholder Engagement Plan: Developing a comprehensive stakeholder engagement plan is crucial. This plan should include identifying all stakeholders, assessing their expectations and interests, and determining the most effective ways to engage and communicate with each stakeholder. Regular meetings, updates, and clear communication channels should be established to ensure stakeholders are informed and their concerns are addressed throughout the project. Clear Project Scope and Objectives: Clearly defining the project scope and objectives is essential for managing stakeholder expectations. The scope should be well-documented, including specific deliverables, timelines, and success criteria. By having a clear understanding of what the project aims to achieve, stakeholders can align their expectations and priorities accordingly.
Technical Challenges	IT projects can be complex, and there may be technical hurdles that need to be overcome. If not addressed, these challenges can lead to delays, increased costs, or even project failure.	Robust Project Planning and Requirements Analysis: Thorough project planning and requirements analysis are crucial to identify potential technical challenges and develop strategies to address them. This control involves conducting a comprehensive assessment of the project scope, objectives, and technical requirements, as well as creating a detailed project plan with clear milestones and deliverables. By proactively identifying potential hurdles, project teams can allocate resources, plan contingencies, and address technical risks at an early stage, minimizing the chances of delays or failures. Skilled and Experienced Project Team: Having a competent and experienced project team is essential for successfully navigating complex IT projects. This control involves assembling a team with diverse expertise, including technical specialists who have experience in similar projects. A skilled team can effectively analyze and solve technical problems, identify potential risks, and implement appropriate solutions. Adequate training and knowledge sharing among team members further enhance their ability to handle project complexities and overcome technical hurdles.

This register is a starting point for risk identification and benchmarking against international practice. Adapt the risks and controls to your institution's size, products, jurisdiction and regulatory requirements.

Get the Information Technology register as an RCSA workbook

A spreadsheet-ready CSV with every risk and control on this page, plus blank columns for control owner, inherent likelihood and impact, control design, operating effectiveness, residual rating and actions. We confirm your email with a 6-digit code, then email you the download link.

Frequently asked questions

What are the key risks in Information Technology?

The main risk areas covered are Application Development, Business Intelligence and Analytics, Digital Innovation, Information Security, Infrastructure and Operations, Project Management. Each unit lists its key risks with a short explanation and the best-practice controls that mitigate them.

How do I use this register for a risk and control self-assessment?

Select the risks that apply to your units, map the listed controls to the controls you actually operate, rate inherent risk and control effectiveness, then agree actions for gaps. The free RCSA workbook on this page has the columns ready.

Put these controls to work this month

Start on the cloud risk management software within 24 hours, or ask for training or advice tailored to your institution.

Request a software demo Ask a question