An expert-validated risk assessment framework for bank IT supply chain management

The growing dependence of banks on complex information technology (IT) vendor ecosystems has significantly increased exposure to third-party and IT supply chain risks. Grounded in principal–agent theory and transaction cost economics, this study develops and statistically validates a comprehensive risk assessment framework for bank IT supply chain management. A structured multidomain taxonomy of 108 risk factors is derived from the literature, regulatory guidance and domain risk practices, and is translated into a measurable questionnaire instrument. Expert data is collected from 200 banking and IT risk professionals across public and private sector institutions. Because the data is ordinal, nonparametric statistical methods are applied, including descriptive analysis, Shapiro–Wilk normality tests, one-sample Wilcoxon signed-rank tests, Friedman ranking tests and Kendall’s coefficient of concordance. The results show that all 108 identified risk factors are rated significantly above the neutral-importance benchmark (p < 0:001). Friedman ranking analysis indicates directional ranking differentiation across the full factor set (x2(107) = 132:12, p = 0:05), consistent with the narrow item-mean spread that characterizes a prefiltered expert-validated instrument. The framework’s nine risk domains are explicitly mapped to the Basel Committee’s operational risk event categories, supporting integration with banks’ regulatory capital measurement processes. These findings provide strong empirical support for the framework’s importance validity, discriminative validity and consensus validity. The study contributes a domain-specific, empirically validated and operationally usable IT supply chain risk model for banking institutions, advancing both principal–agent and transaction cost theoretical frameworks in the context of financial sector technology outsourcing governance.