When a firm's technology fails — a system goes down, data is lost, a supplier is breached — the damage lands on the business: clients can't be served, obligations are missed, the regulator asks questions. None of those consequences belong to the IT team. They belong to the board. That is the whole point of the phrase "technology risk doesn't sit with IT alone": the people who run the systems are not the people who own the firm's risk. On the Isle of Man, the regulatory framework already assumes as much.

The Financial Services Authority does not treat technology as a separate, technical category. It treats it as part of operational risk — defined, in the FSA's operational-risk guidance, as the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. Technology runs through all of that. The same guidance is explicit that a firm's use of technology exposes it to strategic, operational and reputational risk — risks the board is responsible for, under the Financial Services Rule Book 2016 requirement for an effective risk-management framework (rule 8.6).

What "technology risk" actually covers

Treating technology risk as a board matter starts with naming what it is. For most Isle of Man firms it comes down to a handful of related exposures:

• Availability and resilience — can the systems your clients and obligations depend on keep running, and recover if they don't?
• Security and cyber — are the firm's data and systems protected against compromise, inside and out?
• Change — do system changes, migrations and new tools get assessed before they go live, rather than breaking something after?
• Third parties and outsourcing — when a critical system is run by a supplier, the risk is still yours (the Rule Book requires the Authority's consent for material outsourcing, and responsibility is never transferred).
• Data integrity — can you trust the information your monitoring, reporting and decisions are built on?

Frameworks such as the NIST Cybersecurity Framework organise the response to these into a simple cycle — identify, protect, detect, respond, recover — that a board can understand without being technical. The point is not the framework; it is that someone accountable can see the whole picture.

Why it can't sit with IT alone

The IT function can run the systems and report on them, but it cannot set the firm's risk appetite, decide what level of disruption is tolerable, or answer to the regulator for the consequences. Those are governance decisions. When technology risk is left entirely inside IT, two things go wrong: the board loses sight of a risk it remains accountable for, and the people closest to the systems end up making business-risk judgements that aren't theirs to make.

This is exactly why the FSA's Supervisory Priorities 2025–2027 lead with culture, governance and risk management, and stress board and senior-management oversight across the firm's risks — including those introduced by digitisation and change. Strong IT governance is what puts technology risk where it belongs: visible to, and owned by, the board.

There is also a direct compliance link. The AML/CFT Handbook requires firms to carry out a Technology Risk Assessment of the systems they rely on — the formal recognition that the technology behind your compliance controls is itself a source of risk that has to be assessed and managed, not assumed. A firm that treats technology risk as IT's problem will struggle to produce a credible Technology Risk Assessment, because the people who own the risk were never in the room.

Putting it into practice

You do not need to turn technology risk into a project. You need a single, current view the board can actually use: what the firm's critical systems are, what could go wrong across the exposures above, what controls are in place, and what the residual risk is. Reviewed regularly, owned at board level, and recorded — so that when the regulator, an auditor or a major incident asks the question, the firm can answer it from its own file rather than from the IT manager's memory.

We help Isle of Man firms bring technology risk up to board level — a practical assessment mapped to the Rule Book, your operational-risk framework and your AML/CFT Technology Risk Assessment.

Frequently asked questions

What is technology risk in a regulated firm?

It is the risk that the technology a firm depends on causes loss or harm — through unavailability, a security breach, a failed change, a third-party failure or unreliable data. On the Isle of Man it is treated as part of operational risk, which the FSA's guidance defines as loss from failed internal processes, people and systems, or from external events.

Why isn't technology risk just the IT department's job?

Because IT runs the systems but does not own the firm's risk. Setting risk appetite, deciding tolerable disruption and answering to the regulator are board responsibilities. The Rule Book (rule 8.6) requires an effective risk-management framework, and the FSA's 2025–2027 priorities stress board oversight of all the firm's risks — technology included.

How does technology risk link to AML/CFT compliance?

The AML/CFT Handbook requires a Technology Risk Assessment of the systems you rely on. Your monitoring, screening and record-keeping all run on technology, so a weakness there is a compliance weakness. Owning technology risk at board level is what makes that assessment credible.