1 Introduction

1.1 Scope and Purpose

2. DIP Assurance

2.1 DIP Assurance Risk Register

1. risk descriptions, including who would be impacted if a risk was to occur;

2. probability, proximity, impact and risk assessments to create a risk score

3. the risk owner and details of any mitigating actions to be taken by the risk owner or other party

4. review dates based on current risk scores and proximity; and

5. the methodology to determine next review dates.

2.2 DIP Assurance Strategy

1. the DIP Risk Register;

2. the quantity and nature of non-compliance incidents (including security breaches) over the previous DIP Year;

3. the potential for non-compliance in the forthcoming DIP Year based on:

1. patterns of non-compliance;

2. whether new rules due to be introduced could increase incidents of non-compliance;

3. information received from Code Bodies, the Authority, or other interested persons;

4. any other information the DIP Manager deems relevant;

4. the number of assurance analyses to be undertaken per DIP User type, and the type of analysis;

5. the number of audits per DIP User type and whether they will be site audits or desktop;

6. where the DIP Manager proposes to conduct audits, the minimum scope applicable to audits generally (additional scope can be added to specific audits);

7. any assurance activity to be carried out against DIP Manager that is due in the DIP Year for which the DIP Assurance Strategy will cover e.g. is the DIP Manager due their bi-annual external audit in the next DIP Year (in this context, the DIP Assurance Strategy shall reflect the DIP Manager’s internal assurance framework);

8. any assurance activity to be carried out against the DIP Service Provider that is due in the DIP Year for which the DIP Assurance Strategy will cover, and whether any service incidents over the previous year would lead to additional assurance activity;

9. any planned assurance activity in support of Code Bodies’ assurance of their respective Industry Code;

10. any planned assurance activity in support of the Authority or other interested persons;

11. the type, periodicity and content of DIP performance reports to be published;

12. assurance activity identified in DSD002 Annex 3 ‘The DIP-PKI (Public Key Infrastructure) Policy’ and reviews of said policy and associated processes; and

13. any other matters that the DIP Manager deems to be required to seek assurance that DIP Participants are complying with the DIP Rules and/or obligations under Industry Codes to which use of the DIP is a requirement.

2.3 DIP User Assurance

2.4 Assurance of DIP Service Provider

1. the systems, system specifications and other systems documents used by the DIP Service Provider in connection with performing its obligations and functions as DIP Service Provider; and

2. its premises, personnel, data, information and records.

2.5 Assurance of DIP Manager

1. at least annually (save that where an external audit is performed under paragraph 2.5.3 then this may replace the annual internal audit);

2. following a material DIP Change (see DSD004 ‘DIP Change and Document Management’);

3. where more than half of the DIP Manager’s personnel have changed since the last audit;

4. following the introduction of new obligations on the DIP Manager which will cause the DIP Manager to amend their business processes (if in doubt, the DCAB shall confirm where action is required).

2.6 DCAB’s Assurance role

1. number of DIP User analyses undertaken per DIP User type;

2. number of Audits undertaken per DIP Participant type;

3. number of assurance rectifications complete;

4. number due in the next month;

5. any rectifications outstanding;

6. any lessons learned from assurance activity and/or incidents, and details of how they will be actioned;

7. any appeals raised against the DIP Manager in relation to DIP Assurance activity; and

8. any other matters that the DIP Manager considers relevant.

3. Reporting

3.1 DIP performance reports

1. number of MPANs per DIP Payee for funding purposes (see DSD005 ‘Funding and Budget’);

2. faults that have been detected and whether they have been rectified;

3. periods of unplanned down-time and time to rectify;

4. API Activity – requests, who, when, what;

5. number of messages held in dead-letter queue;

6. data latency – end-to-end transaction times between the time messages arrive via the incoming API call and the time the corresponding HTTP response code was sent;

7. volume of messages per message type (e.g. IF002) broken down multiple ways e.g. per DIP User or per DIP Role; and

8. anything further required by the DIP Manager.

3.2 Sharing DIP Performance Reports

1. Code Bodies;

2. auditors appointed by Code Bodies to undertake audits of Industry Codes;

3. the Authority;

4. government departments;

5. industry regulatory bodies; and

6. auditors appointed by the DIP Manager.

3.3 Sharing of Message Contents

1. is the Authority and they are requesting the content of a Message;

2. has shown there is a legitimate regulatory need to see the contents of a Message; or

3. has demonstrated that the controls the requester will place around the data are equivalent to or better than the DIP Manager’s data controls, and is willing to be audited by the DIP Manager (or their representative).

4 Compliance and enforcement

4.1 Compliance monitoring and reporting

1. the number of incidents of non-compliance and any actions taken;

2. the names of non-compliant DIP Users;

3. details of audits undertaken and themes in findings (including DIP Manager and DIP Service Provider if applicable);

4. any themes identified through report analysis;

5. the number and details of service incidents effecting DIP availability and/or integrity;

6. where the DIP Manager was unable to achieve the DIP Assurance Strategy; and

7. anything else relating to DIP Assurance.

4.2 Compliance Stakeholder Engagement

Amendment Record