DORA Final Sprint: Saving Something Before the End of 2025

Why Boards, IT Leadership and Control Functions Are About to Learn What Can — and Cannot — Still Be Saved

As 2025 approaches its end, a familiar mood is spreading across financial institutions.
It is not confidence.
It is salvage thinking.

The unspoken question in boardrooms, steering committees and risk functions is no longer “Are we DORA-ready?”
It is:

“What can we still save before the auditors arrive?”

This question reveals more than anxiety.
It reveals a late-stage shift from governance to damage control.

---

The Final Sprint Is Not a Programme Phase — It Is a Narrative Phase

In the final months before inspection, many institutions stop building resilience and start building stories.

Stories about:

• why certain things were delayed,
• why priorities shifted,
• why “phase two” is planned,
• why maturity will come “after the audit”.

Auditors understand this instinct well. They have seen it across every major regulatory wave.

The problem: DORA does not assess intention. It assesses traceable action.

---

What Cannot Be Saved Anymore

Let us be explicit.

By the end of 2025, the following cannot be retroactively repaired:

• A year of missing governance decisions
• Absent or empty board discussions on DORA
• Risk acceptance that was never documented
• Control instability that was tolerated in silence
• Delegation of accountability without oversight

No sprint can recreate historical evidence.

Auditors will reconstruct:

• what you knew,
• when you knew it,
• and what you chose not to do.

---

Why Everyone Suddenly Wants to “Accelerate”

Boards

Boards want reassurance:

“Show me that we are in control.”

IT Leadership

IT leadership wants containment:

“Let us stabilise enough to avoid escalation.”

Risk and Compliance

Second-line functions want defensibility:

“Let us at least document the gaps.”

These goals are not aligned — and time exposes that misalignment brutally.

---

The Dangerous Illusion of the Late Clean-Up

The most common mistake in the final sprint is cosmetic consolidation:

• harmonising documents,
• aligning terminology,
• repackaging frameworks.

This creates visual coherence, not resilience.

Auditors do not test beauty.
They test behaviour under pressure.

---

What Can Still Be Saved — If Leadership Is Honest

Despite the provocation, not everything is lost.

Three things can still be meaningfully influenced:

Decision Discipline

Even late decisions are better than none — if they are explicit.

Auditors respect:

• late clarity,
• documented prioritisation,
• conscious trade-offs.

They punish silence.

Explicit Risk Acceptance

Weaknesses that cannot be fixed in time must be owned in writing.

Implicit acceptance is interpreted as:

• lack of awareness, or
• lack of control.

Explicit acceptance is interpreted as governance.

Stabilisation Over Completion

Trying to “finish” DORA is futile.

Stabilising:

• classifications,
• ownership,
• escalation paths,

is far more credible than claiming completeness.

---

The Personal Exposure No One Talks About

As the end of 2025 approaches, accountability concentrates.

Auditors will not ask:

• how complex the regulation was,
• how stretched teams were.

They will ask:

• who decided,
• who signed,
• who accepted risk.

For boards and senior management, this is no longer abstract governance.
It is individual exposure.

---

The Only Credible End-of-2025 Strategy

There is only one defensible posture going into the first full DORA audit cycle:

“We know exactly where we are weak, we have decided what to tolerate, and we can show how we govern those weaknesses.”

Anything else is hope masquerading as control.

---

Final Thought

The final sprint is not about saving face. It is about saving credibility.

Institutions that use the remaining time to manufacture narratives will fail the audit logic — even if they pass individual checks.

Those that use it to demonstrate late, honest, documented governance may not look perfect — but they will look in control.

And under DORA, control beats completeness every time.