DORA Audit Readiness Check

DORA establishes a binding and comprehensive supervisory framework for managing ICT risks across financial entities. Supervisory audits under DORA assess whether institutions are capable of preventing, detecting, responding to and recovering from ICT-related disruptions, while maintaining the continuity of critical and important functions.

A DORA audit does not focus solely on the existence of policies and procedures. Instead, it applies a two-layer assessment logic:

• Design Effectiveness: Whether governance, frameworks, policies, processes and controls are appropriately designed, complete and proportionate to the institution’s risk profile.
• Operating Effectiveness: Whether these arrangements are actually implemented, consistently applied and demonstrably effective in day-to-day operations.

This DORA Audit Readiness Check provides a structured, audit-oriented walkthrough of all DORA audit areas, enabling institutions to assess their level of supervisory readiness.

---

ICT Risk Management (Articles 5–14 DORA)

Governance and Organisation (Article 5 DORA)

Design Effectiveness
The institution has a clearly defined ICT governance structure embedded into its overall governance and risk framework. Responsibilities for ICT risk management are explicitly assigned to the management body, senior management, and all lines of defence. Decision-making powers, escalation paths, and accountability mechanisms are formally documented. Governance arrangements include structured reporting, defined review cycles, training requirements and adequate allocation of financial and human resources.

Operating Effectiveness
Governance is actively exercised in practice. The management body regularly receives ICT risk reports, makes documented decisions, and oversees remediation activities. Committees function as intended, escalation mechanisms are used where required, and staff training is conducted and evidenced. Resource allocation aligns with defined responsibilities and risk exposure.

---

ICT Risk Management Framework (Article 6 DORA)

Design Effectiveness
An institution-wide ICT risk management framework exists, fully integrated into the overall risk management system. It covers the full risk lifecycle, including identification, assessment, mitigation, monitoring and reporting of ICT risks. The framework is supported by policies, standards and procedures, and includes independent control and internal audit functions. A documented digital operational resilience strategy defines objectives, priorities and governance.

Operating Effectiveness
The framework is reviewed regularly and updated when material changes occur. Risk assessments are performed consistently, controls are implemented as designed, and internal audit provides independent assurance. Identified deficiencies are tracked, escalated and remediated in a timely manner.

---

ICT Systems, Protocols and Tools (Article 7 DORA)

Design Effectiveness
Rules governing the use, operation and development of ICT systems are defined and proportionate to the institution’s complexity and risk profile. Systems are designed to ensure reliability, scalability, resilience and security under normal and stressed conditions. Capacity planning, system lifecycle management and dependency management are formally addressed.

Operating Effectiveness
Systems and tools operate reliably in practice. Performance, capacity and resilience are monitored and tested, weaknesses are identified early and remediated, and changes are controlled and documented. Evidence demonstrates that systems can support critical functions even under adverse conditions.

---

Identification (Article 8 DORA)

Design Effectiveness
The institution maintains comprehensive inventories of ICT-supported business functions, ICT assets, data flows, dependencies and roles. Critical and important functions are clearly identified, including dependencies on ICT systems and third-party providers. Risk assessments are triggered by significant changes and explicitly cover legacy systems.

Operating Effectiveness
Inventories and risk assessments are kept up to date and reflect the actual ICT landscape. Significant changes trigger reassessments, dependencies are accurately mapped, and legacy systems are periodically reviewed. Documentation is consistent, complete and traceable.

---

Protection and Prevention (Article 9 DORA)

Design Effectiveness
Preventive controls and security measures are defined to protect confidentiality, integrity and availability. This includes access controls, authentication mechanisms, network segmentation, change management, vulnerability management, patching and secure configuration standards.

Operating Effectiveness
Controls are implemented and function as intended. Access rights are reviewed, changes are authorised, vulnerabilities are remediated and patches are applied. Monitoring evidence demonstrates that security measures effectively prevent or limit incidents.

---

Recognition (Article 10 DORA)

Design Effectiveness
Detection and monitoring mechanisms are established to identify anomalies, incidents and vulnerabilities in a timely manner. Thresholds, escalation criteria and alerting processes are clearly defined, supported by adequate tools and staffing.

Operating Effectiveness
Monitoring operates continuously and effectively. Alerts are generated, investigated and escalated as required. Detection mechanisms are tested and refined, ensuring timely recognition of relevant events.

---

Reaction and Restoration (Article 11 DORA)

Design Effectiveness
Business continuity, incident response and crisis management frameworks are defined to ensure continuity of critical and important functions. Plans cover containment, recovery, internal coordination and external communication.

Operating Effectiveness
Plans are tested and applied in practice. Exercises, simulations and real incidents demonstrate that the institution can respond swiftly, restore services and manage crises effectively.

---

Backup, Recovery and Restoration (Article 12 DORA)

Design Effectiveness
Backup and recovery policies define scope, frequency, storage, separation and restoration objectives based on criticality and risk. Responsibilities and testing requirements are clearly assigned.

Operating Effectiveness
Backups are performed consistently and tested regularly. Restoration processes function within defined objectives, and integrity of restored data is verified.

---

Learning Processes and Further Development (Article 13 DORA)

Design Effectiveness
Processes are in place for post-incident analysis, continuous improvement, staff training, monitoring of technological developments and regular reporting to senior management.

Operating Effectiveness
Incidents and tests lead to documented lessons learned and concrete improvements. Training programmes are delivered, and management oversight ensures continuous enhancement of resilience.

---

Communication (Article 14 DORA)

Design Effectiveness
Communication strategies define how information is shared internally and externally during incidents. Responsibilities, approval processes and disclosure principles are clearly set out.

Operating Effectiveness
Communication plans are followed in practice. Information is timely, accurate and appropriate for the respective audience.

---

Simplified ICT Risk Management Framework (Article 16 DORA)

Design Effectiveness
Eligible institutions apply a simplified but robust ICT risk management framework focused on critical functions, essential systems and key dependencies.

Operating Effectiveness
The simplified framework operates reliably, with effective monitoring, testing and incident handling.

---

Handling, Classification and Reporting of ICT-Related Incidents (Articles 17–19, 23 DORA)

ICT Incident Handling Process (Article 17 DORA)

Design Effectiveness
An end-to-end incident handling process is defined, covering detection, response, escalation, documentation and closure.

Operating Effectiveness
Incidents are handled consistently in line with defined procedures, supported by ticketing systems and evidence trails.

---

Classification of Incidents and Cyber Threats (Article 18 DORA)

Design Effectiveness
Clear criteria exist for classifying incidents and cyber threats based on impact, severity and scope.

Operating Effectiveness
Classification is applied correctly and documented for relevant cases.

---

Reporting of Serious Incidents and Cyber Threats (Article 19 DORA)

Design Effectiveness
Reporting obligations, timelines, authorities and content requirements are formally defined.

Operating Effectiveness
Reports are accurate, complete and timely, with appropriate follow-up actions.

---

Payment-Related Incidents (Article 23 DORA)

Design Effectiveness
Incident handling frameworks explicitly include payment-related operational and security incidents.

Operating Effectiveness
Such incidents are managed and reported consistently within the overall framework.

---

Testing Digital Operational Resilience (Articles 24–25 DORA)

General Testing Requirements (Article 24 DORA)

Design Effectiveness
A risk-based testing programme covers all critical ICT components, processes and controls.

Operating Effectiveness
Tests are executed as planned, findings are prioritised, and remediation is tracked to completion.

---

Testing of ICT Tools and Systems (Article 25 DORA)

Design Effectiveness
Test types and frequencies reflect system criticality and risk exposure.

Operating Effectiveness
Testing is performed and documented, demonstrating resilience in practice.

---

ICT Third-Party Risk Management (Articles 28–30 DORA)

General Principles (Article 28 DORA)

Design Effectiveness
A structured framework governs ICT third-party relationships, including oversight, audit rights, exit strategies and registers.

Operating Effectiveness
Third-party arrangements are actively monitored and enforceable.

---

ICT Concentration Risk (Article 29 DORA)

Design Effectiveness
Processes identify and assess concentration risk and subcontracting chains.

Operating Effectiveness
Risks are actively managed and mitigated.

---

Key Contractual Provisions (Article 30 DORA)

Design Effectiveness
Contracts include all mandatory DORA provisions and enhanced safeguards for critical services.

Operating Effectiveness
Contractual rights are effective in practice and support supervisory oversight.

---

Exchange of Information on Cyber Threats (Article 45(3) DORA)

Design Effectiveness
Rules and agreements enable secure, lawful exchange of cyber threat information.

Operating Effectiveness
Information sharing is conducted in line with defined rules and governance.

---

Request your DORA Audit Readiness Check NOW!

Are you confident that your organisation would withstand a supervisory DORA audit without material findings?

Leitner & Associates offers a DORA Audit Readiness Check completed within just one week. The assessment is structured along all DORA audit areas and focuses on what supervisors actually expect to see in terms of governance, implementation and evidence.

Our DORA Audit Readiness Check provides you with a clear, actionable view of:

• What must be remediated to avoid “Significant deficiencies” (Finding F3)
  An F3 finding describes a violation with significant effects on the effectiveness of a preventive measure or precaution. Such findings typically indicate that controls exist in principle, but are incomplete, inconsistently applied or insufficiently evidenced.
• What must be addressed immediately to avoid “Severe deficiencies” (Finding F4)
  An F4 finding describes a violation that significantly impairs or completely eliminates the effectiveness of a preventive measure or precaution. These findings signal fundamental weaknesses that may trigger intensified supervisory action.

Within one week, you will receive:

• A structured gap analysis across the (above mentioned) DORA audit areas
• A clear classification of potential F3 and F4 risk areas
• Specific, prioritised recommendations on what to fix, how urgently and why
• A management-ready summary supporting immediate decision-making

Do not wait for audit findings. Ensure your organisation is DORA-ready before the audit begins.

Request your DORA Audit Readiness Check NOW: offer@digital-operational-resilience.net