# Why Risk, Control and Contract Are Rarely a Seamless Fit > The article explains why risk register, control evidence and contract terms often diverge and how a shared identifier links them. It addresses financial entities subject to DORA and FINMA rules. It is published by SwissGRC, whose TPRM module links contract, risk and control data. - URL: https://swissgrc.com/ar/risk-control-contract-handover/ - الناشر: SwissGRC® - تاريخ النشر: 2026-09-14 - آخر تحديث: 2026-09-16 ## معلومات أساسية - According to a study by the Diligent Institute, only 19 percent of organisations have fully integrated their governance, risk and compliance functions. - Article 28 of Regulation (EU) 2022/2554 (DORA) obliges financial entities to maintain a register of information on all contractual arrangements with ICT third-party service providers and to link it to risk assessment and monitoring. - Under Article 728a of the Swiss Code of Obligations, the auditor examines only whether an internal control system exists, not whether it functions permanently and without deficiencies. - FINMA Circular 2023/1 'Operational risks and resilience: banks' has been in force since 1 January 2024 and requires an exchange of information between ICT risk, business continuity, outsourcing management and contingency planning. - The Three Lines Model assigns responsibility for risk, control and assurance but does not prescribe a technical solution or replace the technical linkage of register and contract. - SwissGRC names a unique identifier for every contractual control obligation as the first step, used identically in the risk register, the control evidence and the contract document. A risk register assigns an assessment to a supplier relationship, control evidence confirms that this assessment is covered, and a contract records what the third party has committed to. According to a study by the Diligent Institute, only 19 percent of organisations have fully integrated their governance, risk and compliance functions. In practice, the three layers often sit in separate systems, maintained by different functions with their own update cycle. It is precisely at the handover points between them that the gaps arise which a supervisory review or a loss event brings to light. In short Risk assessment, control evidence and contract terms only stay consistent when a shared identifier links contract, risk position and control test. DORA requires exactly this: a complete register of information on ICT contracts, the Swiss Code of Obligations separates the existence test from the functioning test of the internal control system, and the FINMA circulars require an exchange of information between outsourcing, ICT risk and continuity. The Three Lines Model assigns responsibilities for this, but it does not replace technical integration. 19% Organisations with fully integrated governance, risk and compliance functions Diligent Institute 5years Transitional period for existing outsourcing contracts under FINMA Circular 2018/3 Infoguard, 29 March 2018 ## What does DORA require for the link between contract and risk? Article 28 of Regulation (EU) 2022/2554 obliges financial entities to maintain a register of information on all contractual arrangements with ICT third-party service providers and to link this register without gaps to risk assessment and monitoring. The register must be maintained at entity level and, where applicable, at sub-consolidated and consolidated level. According to [Article 28 of the DORA Regulation](https://www.springlex.eu/en/packages/dora/dora-regulation/article-28/), it covers the entire lifecycle: from pre-contractual due diligence through ongoing monitoring and audit rights to a documented exit strategy. Under Article 28(3), the register must be submitted to the competent authority annually and additionally upon request, as the Luxembourg supervisory authority CSSF notes. Implementing Regulation (EU) 2024/2956 sets out the standard templates according to which the register must be structured. The Regulation also makes clear that outsourcing ICT services does not transfer regulatory responsibility: financial entities remain fully responsible. A register of this kind requires the risk register and the contract documentation to reference the same supplier identifier, as a consistent approach to third-party risk governance describes. ## What does the auditor actually confirm about the internal control system? Under Article 728a of the Swiss Code of Obligations, the auditor only examines whether an internal control system exists, not whether it functions permanently and without deficiencies. Under Article 728a paragraph 1 number 3 of the Swiss Code of Obligations, the auditor examines, as part of the ordinary audit, whether an internal control system exists; paragraph 2 requires the auditor to take this into account when determining the scope and conduct of the audit. Swiss Auditing Standard 890, in force since 1 January 2008, specifies this, according to the accounting law course materials of the Handschin chair: what is examined is the documentation of the design and implementation, not the ongoing functioning of the internal control system. Responsibility for building and operating it remains with the board of directors, as a specialist article by Michael Annen in TREX magazine notes. This separation is the reason why a confirmed internal control system in the audit report says nothing about whether an individual, contractually agreed control actually works in day-to-day operations. ![Views from the TPRM module of the SwissGRC Platform: risk dashboard, service catalogue and criticality rating](https://swissgrc.com/wp-content/uploads/sites/2/2026/09/Isometric-screenshots-net-background-1024x572.png) Views from the TPRM module of the SwissGRC Platform: risk dashboard, service catalogue and criticality rating ## How do the FINMA circulars connect outsourcing, ICT risk and continuity? FINMA Circular 2023/1 requires an appropriate exchange of information between ICT risk management, business continuity management, outsourcing management and contingency planning, without prescribing a specific technical implementation. On 5 December 2017, FINMA published the revised Circular 2018/3 ‘Outsourcing: banks and insurers’, which entered into force on 1 April 2018 and replaced the previous regulation from 1999. For existing outsourcing arrangements at banks and securities dealers, a five-year transitional period then applied, as Infoguard reported on 29 March 2018. On 13 December 2022, FINMA published the fully revised [Circular 2023/1](https://www.finma.ch/de/~/media/finma/dokumente/dokumentencenter/myfinma/rundschreiben/finma-rs-2023-01-20221207.pdf) ‘Operational risks and resilience: banks’, which entered into force on 1 January 2024, as Lexology described on 19 January 2023. The circular, dated 7 December 2022, also requires operational risks to be categorised consistently across institutions and recorded in an inventory together with key controls. ## Who is responsible for which handover in the Three Lines Model? The Three Lines Model assigns risk steering and control implementation to the first line, oversight of these activities to the second line, and independent assurance to the board of directors to the third line. The Institute of Internal Auditors introduced the model as a position paper in 2013 and updated it to the Three Lines Model in July 2020, as the publication Diligent described on 19 December 2025. The term ‘defense’ was deliberately removed to broaden the focus beyond pure protective measures towards governance and value creation. For the handover between risk register, control evidence and contract, the model means that the first line complies with the contractual obligation in day-to-day operations, the second line examines how this obligation is reflected in the risk register, and the third line independently confirms whether this chain holds up as a whole. The model itself does not prescribe a technical solution; it describes responsibility, not tooling. ## The many-to-many problem A single contract clause, a data processing addendum, a service-level commitment, a limitation of liability, can act as the control that mitigates several risks at once: vendor outage risk, data breach risk, regulatory risk. A single control, such as an annual vendor security assessment, can satisfy obligations spread across dozens of contracts and several compliance frameworks simultaneously. And a single risk, such as critical vendor concentration, might be partially addressed by a contract clause, partially by an internal control, and partially left as accepted residual exposure. That is a many-to-many relationship running in every direction, but most registers are still built around hierarchical taxonomies: a risk rolls up to a category, a control rolls up to a framework requirement, a contract rolls up to a vendor or business unit. Hierarchies are good at producing tidy reports; they are poor at representing a mesh. Every GRC tool that has tried to bolt contract data onto a risk-and-control model ends up either duplicating data across three registers, or building a many-to-many join table that nobody fully trusts because nobody has the mandate to keep it current. ## What first step closes the gap between register and contract? The first step is to define a unique identifier for every contractual control obligation, used identically in the risk register, in the control evidence and in the contract document. Responsibility for this lies with the function that maintains the contract register, in coordination with risk management and the control function. Without a shared identifier, any statement about consistency remains a claim that cannot be traced during an audit. The scale of the impact that gaps in ICT risk controls can have is shown by a loss event amounting to EUR 89 million. Within the next audit cycle, reconcile a sample of high-risk-rated contracts against the risk register and the control evidence. Where the identifier or the update status diverges, the correction belongs with the function that maintains the respective register, not with an overarching coordination function. Related ### Contract, risk and control in one data set Third-Party Risk Management links contract data, risk assessment and control evidence through a shared supplier identifier. It makes the handover between the three layers traceable, not merely asserted. [Third-Party Risk Management](https://swissgrc.com/en/tprm-software/) For practice ## Key points - Article 28 of the DORA Regulation requires a complete register of information on all ICT contracts, which must be linked to risk assessment and monitoring. - Under Article 728a of the Swiss Code of Obligations, the auditor only confirms the existence of the internal control system, not its permanent functioning. - Since 1 January 2024, FINMA Circular 2023/1 has required an exchange of information between outsourcing, ICT risk and continuity planning. - The Three Lines Model assigns responsibility for risk, control and assurance, but it does not replace the technical linkage of register and contract. - Risk, control and contract sit in a many-to-many relationship; a shared identifier makes this structure traceable, but does not fully resolve it. FAQ ## Frequently asked questions What is a DORA register of information for ICT contracts? Article 28 of Regulation (EU) 2022/2554 obliges financial entities to document all contractual arrangements with ICT third-party service providers without gaps and to link them to risk assessment and monitoring. The register covers the entire lifecycle, from due diligence to the exit strategy, and must be submitted to the competent authority annually and upon request. Does the auditor examine whether the internal control system actually functions? Under Article 728a of the Swiss Code of Obligations, the auditor confirms, as part of the ordinary audit, only that an internal control system exists and is documented. Whether it functions permanently and without deficiencies is not examined. Responsibility for building and operating it remains with the board of directors. What FINMA requirements apply to outsourcing and ICT risk? FINMA Circular 2023/1 ‘Operational risks and resilience: banks’, in force since 1 January 2024, requires an appropriate exchange of information between ICT risk management, business continuity management, outsourcing management and contingency planning. It does not prescribe a specific technical implementation. What is the Three Lines Model and who bears which responsibility? The Three Lines Model, updated by the Institute of Internal Auditors in 2020, assigns risk steering and control implementation to the first line, oversight of these activities to the second line, and independent assurance to the board of directors to the third line. It describes responsibility, not a technical solution. How can the gap between risk register and contract be closed? The first step is a unique identifier used identically for every contractual control obligation in the risk register, in the control evidence and in the contract document. Without this shared reference, any statement about consistency cannot be traced during an audit. Sources 1. [Article 28 of Regulation (EU) 2022/2554](https://www.springlex.eu/en/packages/dora/dora-regulation/article-28/)Springlex 2. [Circular 2023/1 Operational Risks and Resilience](https://www.finma.ch/de/~/media/finma/dokumente/dokumentencenter/myfinma/rundschreiben/finma-rs-2023-01-20221207.pdf)FINMA ## الأسئلة الشائعة ### What is a DORA register of information for ICT contracts? Article 28 of Regulation (EU) 2022/2554 obliges financial entities to document all contractual arrangements with ICT third-party service providers and to link them to risk assessment and monitoring. The register covers the lifecycle from due diligence to the exit strategy and must be submitted to the competent authority annually and upon request. ### Does the auditor check whether the internal control system actually works? No. Under Article 728a of the Swiss Code of Obligations, the auditor confirms in the ordinary audit only that an internal control system exists. Responsibility for building and operating it remains with the board of directors. ### What do FINMA circulars require for outsourcing and ICT risk? FINMA Circular 2023/1, in force since 1 January 2024, requires an appropriate exchange of information between ICT risk management, business continuity management, outsourcing management and contingency planning. It does not prescribe a specific technical implementation. ### Who is responsible for what in the Three Lines Model? The first line handles risk steering and control implementation, the second line oversees these activities, and the third line provides independent assurance to the board of directors. The model describes responsibility, not tooling. ### How can the gap between risk register and contract be closed? The first step is a unique identifier for every contractual control obligation, used identically in the risk register, the control evidence and the contract document. Without it, statements about consistency cannot be traced during an audit.