DORA audit for financial entities and ICT providers
A DORA audit shows which requirements of Regulation (EU) 2022/2554 your organization already meets and where the gaps are. It's for banks, insurers, investment and payment firms, and for ICT providers whose financial-sector clients pass DORA requirements on to them. You get a compliance matrix, a prioritized list of gaps and a remediation plan.
- All five DORA pillars assessed against evidence from your organization
- A review of your register of information and ICT provider contracts
- A prioritized remediation plan, ready to discuss with your board
Your contact:Bartosz MachnikUpdated:
What is a DORA audit
A DORA audit assesses compliance with Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, better known as the Digital Operational Resilience Act. DORA has applied directly in every EU member state since 17 January 2025 and covers banks, insurers, investment firms, payment institutions and e-money institutions, among others. ICT providers are mostly affected indirectly, because DORA requirements end up in their contracts with financial-sector clients.
In practice, a DORA audit is usually a gap analysis. We compare the requirements of the five DORA pillars with what actually works in your organization. We look at documents, the register of information and provider contracts, as well as the evidence left by recent incidents and tests.
A financial entity that isn't a microenterprise and doesn't use the simplified framework under Article 16 of DORA must have its ICT risk management framework audited internally on a regular basis, by auditors with sufficient knowledge of ICT risk and appropriate independence (Article 6(6)). It may outsource the verification of compliance with ICT risk management requirements to an external firm, but it remains fully responsible for that verification (Article 6(10)). Our audit is not a certification: you get an assessment and a list of gaps, and decisions and contact with your supervisor stay in your hands.
When to order a DORA audit
- You've been applying DORA since January 2025 and want to check that your procedures work in practice before your supervisor looks at them
- You provide ICT services to banks or insurers, and a client has sent a DORA questionnaire, a contract addendum or notice of an audit
- You hold ISO 27001 certification and want to know what's missing for DORA
- You're preparing the annual review of your ICT risk management framework or your internal audit plan and need an outside assessment
A DORA audit assesses processes, documents and evidence, but it isn't a technical test. If the supervisor (in Poland, the KNF) has designated your entity for TLPT, you need a test run by a red team, and we deliver that test as part of our attack simulation service. If you only want to check business continuity, choose an ISO 22301 audit, and if your company neither operates in nor serves the financial sector, start with an ISO 27001 audit.
Which DORA requirements we assess
The audit covers all five DORA pillars. We split ICT third-party risk into two parts, because the register of information and the contracts are different documents, usually owned by different people. If you're an ICT provider, we focus on what your financial-sector clients require of you.
ICT risk management
We go through the framework set out in Chapter II of DORA: management body accountability, ICT security policies, asset classification, backups and ICT business continuity plans. We also check that the continuity plans are tested at least once a year.
ICT incidents and reporting
We look at how you classify ICT incidents and whether your team can deliver the initial notification, the intermediate report and the final report to the supervisor on time. The initial notification is due within 4 hours of classifying an incident as major and, as a rule, no later than 24 hours after you become aware of it.
Digital operational resilience testing
We review your testing programme: vulnerability scanning, penetration tests, scenario-based tests and whether the weaknesses found get fixed. TLPT applies only to entities designated by the supervisor (in Poland, the KNF), and we run the test itself as part of our attack simulation service.
Register of information
The register of information has to cover every contract for ICT services and distinguish those covering services that support critical or important functions. We check that it does and that it's up to date, because your supervisor can request the full register.
Contracts with ICT providers
We compare your contracts with the provisions required by Article 30 of DORA, such as data locations, assistance during incidents and termination rights. For critical or important functions, audit rights, the provider's participation in TLPT and an exit strategy are required as well.
Threat information sharing
DORA encourages financial entities to share cyber threat information within trusted communities such as ISACs. If your entity belongs to one, we check the sharing rules and how the data you exchange is protected.
How the audit works
Scope and your role under DORA
We establish whether the audit covers a financial entity or an ICT provider, which companies and services are in scope and which functions you treat as critical or important.
Document review
We read your ICT policies, incident procedure, testing programme, register of information and provider contracts. We map each DORA requirement to the document that covers it, or note that no such document exists.
Interviews and evidence
We talk to people in IT, risk management, compliance and procurement. We ask for evidence, such as the report from the last continuity plan test or an incident notification, because a procedure that leaves no trace proves nothing.
Report and remediation plan
We assess every requirement and record the gaps. The report ranks them by risk and proposes an order of work.
Board debrief
We present the results to your management body, because in a financial entity it is responsible for ICT risk (Article 5 of DORA). If you want, we then help close the gaps, for example through our vCISO service.
What the audit is based on
- Regulation (EU) 2022/2554 (DORA) and its technical standards (RTS and ITS), including those on incident reporting, the register of information and TLPT
- ISO/IEC 27001:2022 and ISO 22301:2019 as reference points for security controls and ICT business continuity
- Your financial-sector clients' contract terms and questionnaires, when we audit an ICT provider
- The independence DORA requires of auditors of the ICT risk management framework (Article 6(6)): auditors don't assess their own work
- A team holding ISO 27001 Lead Auditor and ISO 22301 Lead Auditor (TÜV NORD Polska) and CISA (ISACA) certifications. We don't issue certificates or attestations of DORA compliance
What you get after the audit
- A compliance matrix from the DORA gap analysis: every requirement with our assessment and the evidence behind it
- A list of gaps ranked by risk, with a proposed order of work
- Findings on your register of information and a list of ICT contracts missing provisions that DORA requires
- For ICT providers: your clients' requirements set against what you already meet
- A summary for your management body and a walkthrough of the results with your team
Frequently asked questions
Who does the Digital Operational Resilience Act apply to?
The Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, applies to financial entities, including banks, insurers, investment firms, fund managers, payment institutions, e-money institutions and stock exchanges. It has applied in every EU member state since 17 January 2025. Critical ICT third-party service providers, designated by the European Supervisory Authorities (EBA, ESMA, EIOPA), are also directly overseen by those authorities. Other providers meet DORA requirements through their contracts with financial-sector clients.
Do ICT providers to banks have to meet DORA requirements?
In practice, yes. Only critical ICT third-party service providers, designated by the European Supervisory Authorities (EBA, ESMA, EIOPA), are directly overseen under DORA. Every other provider to a bank, insurer or investment firm is reached through its contracts: the financial entity has to include the provisions of Article 30 of DORA, such as data locations, assistance during incidents and termination rights, and for services supporting critical or important functions also audit rights, participation in TLPT and an exit strategy. A DORA audit shows a provider which of these requirements it already meets.
How is a DORA compliance audit different from TLPT?
A DORA compliance audit reviews processes, documents and evidence across the five pillars of the regulation, including ICT risk management and provider contracts. TLPT (threat-led penetration testing) is a test in which a red team attacks production systems using scenarios built on threat intelligence, to see whether your defenses detect and stop the attack. Only entities designated by the supervisor (in Poland, the KNF) have to carry out TLPT, at least every 3 years. At PWNONE, we run TLPT as part of our attack simulation service.
Is ISO 27001 certification enough for DORA compliance?
No, but it helps a lot. The ICT risk management framework in Chapter II of DORA follows an approach similar to ISO 27001, so the policies, risk assessment and controls from your ISMS stay in use. ISO 27001 doesn't cover, among other things, reporting major incidents to the supervisor within DORA deadlines, the register of information, the contract provisions of Article 30 of DORA or TLPT. A DORA gap analysis shows what you need to add to your existing ISMS.
How often do you need a DORA audit?
DORA doesn't set a single frequency. A financial entity reviews its ICT risk management framework at least once a year and after major ICT incidents (Article 6(5)), and has it audited internally on a regular basis, in line with its audit plan and at a frequency proportionate to its ICT risk (Article 6(6)). Microenterprises and entities using the simplified framework under Article 16 of DORA have lighter rules. ICT providers have no such obligation, but a DORA audit is useful before a client audit or before signing a contract with a new bank.
How much does a DORA audit cost?
The cost of a DORA audit depends on scope: whether we audit a financial entity or an ICT provider, how many companies and services are covered, how many contracts are in the register of information and whether all five DORA pillars are in scope. We don't publish a price list, because no two audits look quite the same. We prepare a quote after a call in which we agree these details.
Talk to Bartosz Machnik about your DORA audit
Bartosz Machnik, CBDO at PWNONE and an ISO/IEC 27001 Lead Auditor certified by TÜV NORD Polska, works on ISO 27001, NIS2 and DORA compliance audits. He'll work out with you whether the audit covers a financial entity or an ICT provider and which DORA areas it should include. If a smaller scope, such as a review of your provider contracts alone, is enough, he'll tell you so.
Book a call about a DORA audit