Company: INGVF
Filing Date: 2025-03-06
Form Type: 20-F
Source: 0001628280-25-010764
Chunk: 227

Company: ING GROEP NV
Filing Date: 2025-03-06
Form: 20-F
Item: Item 16K
Chunk 227
---
 the 2nd LoD which objectively challenges the execution in the 1st LoD and 3rd LoD Corporate Audit Services (CAS) provides an independent assessment of the internal controls.
For operational reporting of the risks, the 1st line of defence (LoD) uses dashboard tooling and IT Risk Measurement Platform (ITRMP), enabling continuous management of its own control state. Material deviations found by the 1st LoD or by 2nd LoD (through second-line monitoring, i.e. quality assurance, risk 

assessments, etc.) or by the 3rd LoD (internal IT audits), are monitored by 2nd LoD and 3rd LoD to ensure adequate mitigation of issues and risks by 1st LoD.
The Risk monitoring processes, as described, report the cybersecurity risks to the Bank non-financial risk Committee on a quarterly basis. The 3LoD reports quarterly (CAS reports) to the Management Board Banking, Executive Board and Audit Committee including relevant results, details of the key reports issued during the quarter and the follow-up of reported findings. The 3LoD Annual Report to the Management Banking Board, Executive Board and Audit Committee provides the relevant results of the CAS activities and a CAS’ view on the adequacy and effectiveness of ING’s processes for controlling its activities and managing its risk in all the areas of ING.
The Management Board Banking (MBB) and Executive Board (EB) of ING is informed of key IT / cybersecurity risks on a quarterly basis via Non-Financial Risk updates, and IT risks are included as well in regular Integrated Risk updates. In addition, the MBB is immediately informed of any material cybersecurity incident after it occurred. The Risk Committee (RiCo) of ING’s Supervisory Board (SB) receives the aforementioned Non-Financial Risk (NFR) update as well. Whenever a larger cyber incident occurs, this is in principle also discussed in the RiCo and SB on an ad hoc basis.
Those quarterly reports are pre-discussed by the Bank Non-Financial Risk Committee, in which senior NFR/Risk management is represented, before they are shared with the MBB/EB and RiCo.
Relevant expertise
To ensure that the entire Workforce have appropriate competences and capabilities to fulfil their assigned tasks and responsibilities, ING developed Global Job Profiles which are embedded in the Global Job Architecture. These profiles describe in detail and regularly assess the maturity of the workforce on required competences and