CENTRAL BANK OF JORDAN

البنك المركزي الأردني

Governing Instructions and Management of Information and Associated Technology

No. (2016/65)

---

Contents

Subject	Page
Introduction	(3)
Article (1): Legal Basis	(4)
Article (2): Definitions	(4)
Article (3): Scope of Application and Stakeholders	(5)
Article (4): Guide to Governance and Management of Information and Associated Technology	(7)
Article (5): Publication of the Guide to Governance and Management of Information and Associated Technology	(7)
Article (6): Objectives of Governance and Management of Information and Associated Technology	(8)
Article (7): Committees	(9)
Article (8): Objectives and Processes of IT Governance	(12)
Article (9): Internal and External Audit	(16)
Article (10): Principles, Policies, and Frameworks	(15)
Article (11): Organizational Structures	(15)
Article (12): Information and Reporting	(15)
Article (13): IT Services, Software, and Infrastructure	(16)
Article (14): Standards, Skills, and Expertise	(16)
Article (15): Values, Ethics, and Behaviors System	(18)
Appendices	(18)

---

Introduction

Information technology resources are of significant importance in terms of relative size and their impact on the institution's ability to conduct its operations and thus achieve its objectives. They also play a crucial role in influencing the competitiveness of the institution's products and services, as well as decision-making mechanisms and risk management. This highlights the massive investments in the information technology sector by banking institutions.

However, institutions in general, and banks in particular, must follow sound principles and standards in managing information technology resources according to accepted international practices in this regard to reduce risks and avoid entering into unprofitable investments and unjustified expenses that translate into substantial losses extending over years, which may sometimes affect the institution's reputation. In light of the Jordanian Central Bank's interest in applying corporate governance principles and standards, it was necessary to issue specific instructions on the governance and management of information and associated technology that align with and complement Instructions No. (2014/58) dated 2014/9/30 and Instructions No. (2015/61) dated 2015/5/12. The subject of IT governance has witnessed positive global development, resulting in general frameworks for a number of principles and standards at a high level of clarity, headed by the (COBIT) framework of the Information Systems Audit and Control Association (ISACA) in the United States of America.

The general framework for the governance and management of information and associated technology consists of a set of fundamental principles and standards, the first of which is Strategic Alignment, which must be achieved through the strategic objectives of information technology and must lead to the achievement of the institution's strategic objectives. The institution must utilize its information technology resources within the available options that maximize added value, measured primarily by the contribution of information technology to achieving the institution's strategic objectives. It must also manage information technology risks in an integrated manner consistent with the institution's overall risk management processes, according to sound procedures and practices that lead to sound, risk-based decision-making mechanisms, and ensure added value at the lowest costs while mitigating expected losses and risks, reflecting the Bank's vision in this regard within acceptable risk limits as much as possible. Senior management (the Board and Senior Executive Management) must assume the processes of institutional planning and organization by drawing up strategies, policies, and action plans, and by building and developing software and internal organizational structures (i.e., in the form of committees) to achieve strategic objectives. They must also build mechanisms, tools, and standards capable of measuring the added value of information technology, enabling the Board and Senior Executive Management to monitor institutional operations to ensure the soundness of planning, organization, and utilization of information technology resources, with the aim of taking feedback for continuous improvement and development. All of this is within the context of relying on the principle of separation of tasks and roles and distributing them properly between the Board on one hand and Senior Executive Management on the other.

---

Article (1): Legal Basis

These instructions were issued pursuant to Article (4/b) and Article (65/b) of the Jordanian Central Bank Law No. (23) of 1971 and its amendments, and Articles (21, 99, b, 92) of the Banks Law No. 28 of 2000 and its amendments. They become effective after eighteen months from their date, unless otherwise specified in their context.

Article (2): Definitions

The words and phrases contained in these instructions have the meanings specified hereinafter, unless the context or circumstances indicate otherwise. Reference shall be made to the Banks Law regarding any other definitions appearing in these instructions that are not included in this Article:

a. Governance and Management of Information and Associated Technology: The distribution of roles and responsibilities and the characterization of relationships between different parties, entities, and stakeholders (such as the Board and Senior Executive Management) with the aim of maximizing the institution's added value by adopting the optimal approach that ensures a balance between risks and expected benefits, through adopting the necessary rules and foundations for decision-making, determining strategic directions and objectives in the Bank, and monitoring and examining the extent of compliance with their achievement, thereby ensuring the Bank's continuity and development.

b. Management of Information and Associated Technology: A set of continuous activities falling under the responsibility of Senior Executive Management, including planning to achieve strategic objectives (including approval and organization), construction and development activities (including procurement and implementation), operation activities (including service delivery and support), and monitoring activities (including measurement and evaluation), thereby ensuring the continuous achievement of the Bank's objectives and strategic directions.

c. IT Governance Processes: A set of practices and activities emanating from institutional policies and necessary to achieve the objectives of governance and management of information and associated technology.

d. Objectives of Information and Associated Technology: A set of main and sub-objectives related to the governance and management activities of information and associated technology, necessary to achieve institutional objectives.

e. Institutional Objectives: A set of objectives related to corporate governance and management, necessary to achieve stakeholder needs and the objectives of these instructions.

f. Board: The Bank's Board of Directors.

g. Senior Executive Management: Includes the Bank's General Manager or Regional Director, Deputy General Manager or Deputy Regional Director, Assistant General Manager or Assistant Regional Director, Chief Financial Officer, Chief Operating Officer, Chief Risk Officer, Treasury (Investment) Manager, Compliance Manager, as well as any Bank employee who has executive authority parallel to any of the aforementioned and is functionally linked directly to the General Manager.

h. Stakeholders: Any interested party in the Bank, such as shareholders, employees, creditors, customers, external suppliers, or relevant regulatory authorities.

i. On-site: The location of the process in the same building as the Bank's Head Office (Regional) in Jordan.

j. Off-site: The location of the process in a closed building separate from the Bank's Head Office (Regional) building in Jordan but in the same governorate.

k. Near-site: The location of the process in a different governorate from the one where the Bank's Head Office (Regional) is located in Jordan.

l. Off-shore: The location of the process in a country different from the country of the Bank's Head Office (Regional).

Article (3): Scope of Application and Stakeholders

a. Subject to what is stated in paragraph (b) of this Article, these instructions apply to all licensed banks without exception.

b. Branches of foreign banks operating in the Kingdom must comply with these instructions to the extent applicable to them, or with the governance and management guidelines and policies for information and associated technology issued by the Parent Bank or the supervisory authority in the home country, whichever achieves the objectives of our instructions more effectively. If the latter is more effective, this branch must provide evidence to the Central Bank, ensuring no conflict with legislation. In case of conflict, the branch must inform the Central Bank and the Parent Company, provide necessary clarification regarding this conflict, and obtain the Central Bank's approval on how to address this conflict.

c. When banks sign outsourcing agreements with third parties to provide human resources for IT services, software, and infrastructure to facilitate the Bank's operations, they must ensure that the third party complies with the provisions of these instructions, fully or partially, to the extent appropriate to the importance of the nature of the banking services, software, and infrastructure provided, before and during the contract period. This does not exempt the Board and Senior Executive Management from the ultimate responsibility for meeting the instructions' requirements, including audit requirements stipulated in Article (9) below. The effective period of the instructions or the contract period is the timeframe within which the status of currently contracted companies must be harmonized.

d. The scope of application of these instructions includes all IT-dependent Bank operations across all branches and departments. All parties, as stakeholders, are concerned with applying the instructions according to their role and position. To facilitate application, it is recommended to start with a project/program (a group of related projects) managed by the Bank to create and provide the necessary environment and meet our instructions' requirements. We specifically mention the following parties and their main responsibilities in this regard:

1. Chairman and Board Members and External Experts: Assume responsibilities for the general guidance of the project/program, approve tasks and responsibilities within the project, and provide support and necessary funding.
2. General Manager, Deputies, Assistants, Operations Managers, and Branch Managers: Assume responsibilities for appointing suitable, experienced persons from Bank operations to represent them in the project and characterize their tasks and responsibilities.
3. IT Director, IT Steering Committee, and Project Managers: Assume responsibilities for managing, directing, and supervising the project/program directly, recommending the provision of necessary resources to complete it, and ensuring correct understanding by all parties of the instructions' requirements and objectives.
4. Internal Audit: Assumes its responsibilities as organized by the instructions directly, participates in the project/program representing the role of internal audit as an independent advisor and monitor to facilitate and complete the project/program.
5. Risk, Information Security, Compliance, and Legal Departments: Assume responsibilities for participation in the project/program representing those departments' roles, and ensure the project/program is represented by all concerned parties.
6. Specialists and Holders of Technical and Professional Certifications (COBIT 5 Foundation, COBIT 5 Assessor, COBIT 5 Implementation, CGEIT) from within and outside the Bank: Assume the role of guides in disseminating knowledge of the standard and facilitating the application process.

e. These instructions aim to reach Maturity Level 3.2: Established within eighteen months – Deployment at the latest from their date, and reach Maturity Level 5.2: Optimization after three years from their date, fully for both periods according to the maturity scale in the (COBIT 5) standard.

f. The instructions' requirements, once implemented, are considered a first step and starting point towards continuous development and improvement of the governance and management of information and associated technology. Therefore, Bank departments must keep pace with future self-issued versions and updates regarding the general framework relied upon in drafting these instructions (COBIT 5) and other international standards contained within this framework.

g. When applying and entering into details of the seven enablers (pillars), appendices, processes, and sub-objectives, banks must tailor all of this to align with the data of each bank individually to serve the objectives and requirements of the instructions and the (COBIT 5) standard, working to create the required changes to provide and prepare the necessary environment for application.

h. Follow a gap analysis approach between the current situation and comparison with the instructions' requirements and the standard as a precursor to the application process.

i. Banks must send a compliance achievement report related to meeting our instructions' requirements every six months from the date of the instructions, detailing the achievement level of each provision of the instructions.

Article (4): Guide to Governance and Management of Information and Associated Technology

The Bank must develop a specific guide for the governance and management of information and associated technology, which may be part of the corporate governance guide. The guide must consider these instructions as a minimum, aligning with its needs and policies, and be approved by the Board. The Bank must provide it to the Central Bank within a maximum period of (150) days from the date of these instructions. This guide should reflect the Bank's specific view on the governance and management of information and associated technology regarding its concept, importance, and basic principles, while respecting legislation and international best practices in this regard. The Bank must, through the IT Governance Committee emanating from the Board, review and update this guide as needed.

Article (5): Publication of the Guide to Governance and Management of Information and Associated Technology

Each bank must publish its specific guide on its website and by any other suitable method for public awareness. The Bank must disclose in its annual report the existence of a specific guide for the governance and management of information and associated technology or a corporate governance guide containing it. It must also disclose information relevant to stakeholders, including the guide, and the extent of its compliance with its implementation.

Article (6): Objectives of Governance and Management of Information and Associated Technology:

These instructions aim to achieve the following:

a. Meet stakeholder needs and achieve the Bank's directions and objectives by achieving the objectives of information and associated technology, thereby ensuring:

1. Providing high-quality information as a foundation supporting decision-making mechanisms in the Bank.
2. Prudent management of IT resources and projects, maximizing the benefit from those resources and reducing waste.
3. Providing distinguished technological infrastructure and support enabling the Bank to achieve its objectives.
4. Elevating various Bank operations through utilizing an efficient technological system with distinguished reliability.
5. Prudent management of IT risks ensuring necessary protection for the Bank's assets.
6. Assisting in compliance with legal, regulatory, and instructional requirements, as well as strategic, policy, and internal procedural compliance.
7. Improving the internal control and audit system.
8. Maximizing user satisfaction with information technology by meeting business needs efficiently and effectively.
9. Managing external parties entrusted with executing operations and service/product tasks.

b. Achieve comprehensiveness in the governance and management of information and associated technology by considering not only technology itself but also providing seven enabling elements (pillars) accompanying and complementing IT services, consisting of:

1. Principles, Policies, and Frameworks,
2. IT Governance Processes,
3. Organizational Structures,
4. Information and Reporting,
5. IT Services, Software, and Infrastructure,
6. Knowledge, Skills, and Expertise,
7. Values, Ethics, and Behaviors System.

It is necessary to provide them with specific specifications and dimensions to meet the requirements and objectives of information and associated technology not only in IT operations but in all Bank operations dependent on information and technology.

c. Adopt work practices, rules, and organization according to the best international standards as a launch point to rely on and build upon in the fields of governance and management of IT resources operations and projects.

---

Article (7): Committees

a. IT Governance Committee

The Board must form an IT Governance Committee from among its members. This committee must consist of at least three members and should include individuals with expertise or strategic knowledge in information technology. The committee may, when necessary and at the Bank's expense, enlist external experts in coordination with the Board Chairman to compensate for deficiencies in this area and to enhance objective opinion. The committee may invite any Bank managers to attend its meetings to consult their opinions, including those concerned with internal audit, members of Senior Executive Management (such as the IT Manager), or those concerned with external audit. The Board determines its objectives and delegates powers to it, according to a charter clarifying this. The committee must submit periodic reports to the Board. It is noted that the Board's delegation of powers to this committee or any other committee does not absolve the Board of its responsibilities in this regard. The committee must meet at least quarterly, keep temporary meeting minutes, and assume the following tasks:

1. Approve IT strategic objectives and appropriate organizational structures, including steering committees at the Senior Executive Management level, specifically the (IT Steering Committee), ensuring the achievement and fulfillment of the Bank's strategic objectives and achieving the best added value from IT resources projects and investments. Use necessary tools and standards to monitor and verify achievement, such as using the IT Balanced Scorecard system and calculating Return on Investment (ROI), and measuring the impact of contribution to increasing financial and operational efficiency.

2. Approve the general framework for managing, controlling, and monitoring IT resources and projects according to best accepted international practices in this regard, specifically (COBIT) (Control Objectives for Information and related Technology), which aligns with and fulfills

3. The objectives and requirements of our instructions by achieving the institutional objectives stated in Appendix No. (1) sustainably, and achieving the matrix of objectives for information and associated technology stated in Appendix No. (2), and providing IT governance processes stated in Appendix No. (3). Approve the matrix of institutional objectives stated in Appendix No. (1), and the associated objectives stated in Appendix No. (2), and consider their data as a baseline, and characterize the sub-objectives necessary to achieve them.

4. Approve the Responsibility Assignment Matrix (RACI Chart) regarding the main IT governance processes in Appendix No. (3) and the sub-processes emanating from them in terms of: The entity or entities or person or parties primarily responsible (Responsible), those ultimately responsible (Accountable), those consulted (Consulted), and those informed (Informed) regarding all processes in the mentioned appendix, guided by the (COBIT 5) standard in this regard (Enabling Processes).

5. Ensure the existence of a general framework for IT risk management that aligns and integrates with the Bank's overall general risk management framework, taking into account and fulfilling the IT governance processes stated in Appendix No. (3).

6. Approve the budget for IT resources and projects in alignment with the Bank's strategic objectives.

7. General commitment to and review of the progress of IT operations, resources, and projects regarding their sufficiency and active contribution to meeting the Bank's requirements and operations.

8. Review IT audit reports and take necessary measures to address deviations.

9. Recommend to the Board to take necessary measures to correct any deviations.

b. IT Steering Committee:

Senior Executive Management must form the necessary steering committees to ensure the strategic alignment of information technology to achieve the Bank's strategic objectives sustainably. Therefore, a committee called the IT Steering Committee must be formed, chaired by the General Manager and composed of Senior Executive Management officials, including the IT Manager, Chief Risk Officer, and Information Security Manager. The Board elects one of its members to be an observer in this committee, in addition to the Internal Audit Director. It may invite third parties as needed to attend its meetings. The committee must document its meetings with formal minutes. Meetings must be periodic, at least once every three months. The committee specifically assumes the following tasks:

1. Develop annual plans capable of reaching the strategic objectives proposed by the Board, supervise their implementation to ensure achievement, and continuously monitor internal and external factors affecting them.

2. Link the matrix of institutional objectives to the matrix of objectives for information and associated technology, as stated in Appendix No. (2), approve them, and continuously review them to ensure the achievement of the Bank's strategic objectives and the instructions' objectives. Consider defining a set of measurement criteria and review them or assign relevant Senior Executive Management officials to monitor them continuously and inform the committee of this.

3. Recommend the allocation of necessary financial and non-financial resources to achieve the objectives and IT governance processes stated in Appendices Nos. (2) and (3) respectively. Utilize qualified and suitable human resources in the right place through organizational structures that include all necessary processes to support objectives, respecting the separation of tasks and avoiding conflicts of interest. Develop technological infrastructure and other related services to serve objectives, and assume supervision over the progress of implementing IT governance projects and processes.

4. Prioritize IT projects and programs.

5. Monitor the level of technical and technological services and work to raise their efficiency and improve them continuously.

6. Submit necessary recommendations to the IT Governance Committee regarding the following matters: a. Allocating necessary resources and mechanisms capable of fulfilling the IT Governance Committee's tasks. b. Any measures that may negatively affect the achievement of strategic objectives. c. Any unacceptable risks related to information technology, security, and protection. d. Assessing performance and compliance with the general framework requirements for managing, controlling, and monitoring IT resources and projects.

7. Provide the IT Governance Committee with its meeting minutes promptly and obtain acknowledgment of receipt.

Article (8): Objectives and Processes of IT Governance

a. The objectives and processes of IT governance, according to Appendices Nos. (2) and (3) respectively, and their data, are a baseline that Senior Bank Management must comply with and achieve continuously. The IT Steering Committee is primarily responsible for ensuring compliance with meeting their requirements. The IT Governance Committee assumes the Board's ultimate responsibility in this regard. All Bank departments, particularly the IT Department, Information Security Department, and Project Management Department, must define and rephrase their operations to reflect and organize the requirements of all IT governance processes stated in Appendix No. (3).

b. The Board assumes direct responsibility for the five Evaluate, Direct, and Monitor (EDM) processes stated in Appendix No. (3).

c. The Board and the Risk Management Department assume direct responsibility for the "Ensure Exclusive Management of IT Risks" (EDM 03) process and the "Manage Risk" (APO 12) process stated in Appendix No. (3) respectively.

Article (9): Internal and External Audit

a. The Board must monitor sufficient budgets and allocate funds and necessary resources, including qualified human resources through specialized IT audit departments. It must ensure that both the Bank's Internal Audit Department and the External Auditor are capable of reviewing and auditing IT resource and project utilization and management operations, and Bank operations dependent on them, through specialized technical IT Audit according to paragraph (d) of this Article, by qualified and internationally certified personnel holding valid professional certification such as (CISA) from international associations qualified under the International Standards for Qualification of Professional Certification Granting Bodies (ISO/IEC 17024) or any other parallel standards.

b. The Audit Committee emanating from the Board and the External Auditor must respectively provide the Jordanian Central Bank with an annual internal audit report and an external audit report. These reports must include Senior Executive Management's response and the Board's review and recommendations regarding them, according to paragraph (d/2) of this Article and according to the IT Information and Associated Technology Audit Report (Risk-Control) model in Appendix No. (4), during the first quarter of each year. These reports replace any previous or overlapping reports required under previous instructions.

c. The Audit Committee must include IT audit responsibilities, powers, and scope of work within the Audit Charter on one hand, and within agreed procedures with the External Auditor on the other, in alignment with and covering these instructions.

d. The Board must ensure, through the Audit Committee emanating from it, that the Bank's Internal Auditor and External Auditor, when executing specialized IT and associated technology audit operations, comply with the following:

1. IT audit standards according to the latest update of the International Standard issued by the Information Systems Audit and Control Association (ISACA) (ITAF) (Technology Assurance Framework), including: a. Executing audit tasks within an approved plan considering the relative importance of operations, risk level, and degree of impact on the Bank's objectives and interests. b. Providing and committing to continuous training and education plans by the specialized staff in this regard. c. Committing to professional and organizational independence standards and ensuring no current or future conflicts of interest. d. Committing to objectivity standards, exercising due care, and maintaining a continuous level of competitiveness and professionalism in the knowledge and skills they must possess. They must have deep knowledge of the Bank's various IT-dependent operations and mechanisms, and other audit and review reports (financial, operational, and legal), and the ability to provide evidence appropriate to the situation, and common sense in detecting unacceptable practices and violations of laws, regulations, and instructions.

---

2. Examination, submission, and review of IT resource management and central bank operations (Reasonable Overall Audit Assurance) and providing a general opinion on the overall risk level of the associated information and technology within an audit program that includes at least the axes mentioned in Annex No. (5), with the audit frequency for the cost of the axes or part of them being at least once a year in case of risk assessment.

Form (1/1/09/0) 13

CENTRAL BANK OF JORDAN البنك المركزي الأردني

degree (5 or 4) according to the risk assessment scale mentioned in Annex No. (4), and once every two years at least in case of risk assessment with degree (3), and once every three years at least in case of risk assessment with degree (2 or 1), taking into account the continuous change in the risk level and taking into account the fundamental changes that occur in the information and technology environment associated with it during the mentioned audit periods, with the requirement to provide us with audit reports for the first time regardless of the risk assessment degree, and with the requirement that the evaluation processes for the mentioned axes include the bank's mechanisms in terms of strategic planning, policy drawing, principles, written and approved work procedures, and mechanisms for employing various resources including IT resources and human resources, and mechanisms and tools for monitoring, improvement, and development, and working to document and evaluate audit results based on the importance of discrepancies and weaknesses (observations) in addition to the implemented controls and evaluating the level of residual risk related to each of them using a methodological standard for risk analysis and measurement, including the agreed corrective actions and intended to be followed by the bank management by a specific date for correction, with a special table indicating the rank of the bank official responsible for each observation.

3. Regular procedures to follow up on audit results to ensure the processing of observations and discrepancies mentioned in the auditor's reports within the specified deadlines, and working to gradually escalate the importance and risk in case of non-response and bringing this to the attention of the Council as required.

4. Including annual performance evaluation mechanisms for IT staff with objective measurement standards that take into account everything mentioned in item (d) above, and with the evaluation processes being conducted by the Council represented by the audit committee emanating from it and according to the organizational administrative sequence of audit departments, or whoever replaces them in foreign banks.

e. The role of the internal auditor for information and technology associated with it (Outsource) can be outsourced to a specialized external party completely independent of the external auditor certified for this purpose, provided that all requirements of these instructions and any other related instructions are met and the audit committee emanating from the Council and the Council itself retain their role regarding examining compliance and ensuring the fulfillment of these requirements as a minimum.

Form (1/1/09/0) 14

CENTRAL BANK OF JORDAN البنك المركزي الأردني

in Annex No. (3) and the requirements of these instructions in general, and ensuring putting the right man in the right place.

b. The bank management must employ qualified and trained human resources of people with experience in the fields of IT resource management, risk management, information security management, and IT audit management based on academic and professional knowledge standards and practical experience recognized by qualified international associations under international accreditation standards for institutions granting professional certificates (ISO/IEC 17024) or/and any other parallel standards each according to its specialization, with the requirement to requalify and arrange currently employed staff to meet the mentioned requirements within two years from the date of these instructions.

c. The executive management in the bank must continue to equip its employees with continuous training and education programs to maintain a level of knowledge and skills that meets and achieves governing operations for information technology mentioned in Annex No. (3).

d. The executive management in the bank must design annual performance evaluation mechanisms for staff with objective measurement standards that take into account the contribution through the functional center in achieving the bank's goals.

Article (15): System of Values, Ethics, and Behaviors:

a. The Council or those delegated by its committees must adopt an institutional professional ethical system that reflects accepted international professional behavioral rules regarding dealing with information and technology associated with it, clearly defining the desired and undesired behavioral rules and their implications.

b. The internal auditor and external investigator must comply with the ethical system and professional practices adopted by the Council, which must include at least the professional ethical system mentioned in the international standard issued by the (ITAF) (Information Technology Assurance Framework) and auditing and controlling information systems and their updates (ISACA).

c. The Council and senior executive management must employ various mechanisms to encourage the application of desired behaviors and avoid undesired behaviors by following methods of barriers and penalties, for example, not limited to.

THE CUSTODIAN d. Ziad Freiz

• Annexes No. (8)

Form (1/01/09) 17

CENTRAL BANK OF JORDAN البنك المركزي الأردني

Annexes Annex No. (1) Enterprise Goals Matrix

Goal Code	Goals	Standards for Measuring Goal Achievement (Examples)
01	Achieving added value from bank assets and investments	• Percentage of assets and investments that met stakeholder expectations regarding added value<br>• Percentage of products and services that met their intended positions<br>• Percentage of investments that met their intended positions
02	Competitive product and service station	• Percentage of products and services that met or exceeded expected goals, resources, and market health<br>• Percentage of products and services that met customer satisfaction<br>• Percentage of products and services that achieved a competitive advantage in the market
03	Overall enterprise risk management (asset protection)	• Percentage of main goals and services covered by risk assessment processes<br>• Share of main incidents not identified within risk assessment processes from the total incidents<br>• Periodicity of updating the risk profile
04	Compliance with laws and instructions	• Cost of non-compliance with laws and instructions, including fines and settlements<br>• Number of controversial topics regarding laws and instructions that caused a negative general opinion towards the bank or bad reputation<br>• Number of controversial topics regarding contracting terms with third parties
05	Financial reform and transparency	• Percentage of assets and investments for which specifications were determined regarding their balances and expected consequences<br>• Percentage of service costs that can be distributed among users<br>• Percentage of satisfaction surveys that met stakeholder expectations regarding financial transparency, accuracy, and understanding of financial data
06	Customer-oriented service institutional culture	• Number of service deduction incidents for banking and financial services due to IT-related incidents<br>• Percentage of stakeholder satisfaction with provided services and products<br>• Number of customer complaints

Form (1/01/09) 18

CENTRAL BANK OF JORDAN البنك المركزي الأردني

Annex No. (1) Enterprise Goals Matrix

Goal Code	Goals	Standards for Measuring Goal Achievement (Examples)
07	Service continuity and availability	• Time production of customer satisfaction surveys<br>• Number of main and critical service availability incidents<br>• Costs of process and service availability incidents<br>• Number of hours of process and service availability<br>• Percentage of complaints related to service and process availability
08	Change speed in response to work environment requirements	• Council's satisfaction level with the speed of response to new requirements<br>• Number of services and products from new elements<br>• Average time taken to start achieving approved strategic goals
09	Professional decision-making based on information	• Council and senior executive management satisfaction degree with decision-making processes<br>• Number of incidents resulting from wrong decisions due to reliance on inaccurate information<br>• Time taken to provide necessary information for decision-making
10	Reducing service and product costs	• Time production of costs compared to service level<br>• Periodicity of evaluating provided service costs<br>• Council and senior executive management satisfaction level regarding provided service costs
11	Maximizing functionality of provided services	• Periodicity of evaluating the maturity level of provided services<br>• Results and trends of the above evaluation<br>• Council and senior executive management satisfaction with bank operations capabilities
12	Reducing bank operation costs	• Periodicity of evaluating cost reduction for processes<br>• Time production of costs compared to service level

Form (1/01/09) 19

CENTRAL BANK OF JORDAN البنك المركزي الأردني

Annex No. (1) Enterprise Goals Matrix

Goal Code	Goals	Standards for Measuring Goal Achievement (Examples)
13	Managing business change programs	• Senior executive management satisfaction level with process costs<br>• Number of programs completed on time and within estimated budgets<br>• Percentage of satisfied stakeholders about completed programs<br>• Percentage of knowledge and awareness of business changes resulting from IT initiatives
14	Operational and functional productivity	• Number of programs/projects completed on time and within allocated budgets<br>• Cost and employed labor levels compared to targets
15	Compliance with internal policies	• Number of incidents resulting from non-compliance with internal policies<br>• Percentage of stakeholders with knowledge and awareness of internal policies<br>• Percentage of policies implemented in the bank
16	Skilled and stored employees	• Stakeholder satisfaction level with employee expertise and skills<br>• Percentage of employees employed with less than required skills, expertise, and knowledge<br>• Job satisfaction level
17	Excellence and creativity culture	• Knowledge and awareness level of imposing creativity and excellence<br>• Stakeholder satisfaction regarding the level of creativity and proposed ideas<br>• Number of products and services launched and approved resulting from creative initiatives and proposals

• For identity considerations, the use of the English language is allowed in writing the annex.

Form (1/01/09) 20