Independent DORA review
DORA compliance and ICT risk assessment
Get an independent assessment of your DORA compliance and ICT risk management. We evaluate technical and organisational controls, their effectiveness and proportionality, then provide findings and prioritised recommendations. Further advice on remediation is available.
Who this service is for
An assessment matched to your purpose
- You need an independent ICT audit under applicable requirements and your internal audit plan.
- Management wants to understand the organisation’s DORA compliance and remaining gaps.
- You need an expert review of whether security measures work and are proportionate to risk.
- A regulatory review or earlier audit has raised questions about your ICT risk management.
- Financial customers need an assessment of your IT services against their DORA-related requirements.
What the work achieves
Independent conclusions and practical recommendations
-
A substantiated view of compliance
Understand which requirements are met and where gaps remain within the agreed scope. Findings are supported by documents, interviews and examination of how controls operate.
-
Risks and control effectiveness assessed
See whether your technical and organisational controls address ICT risks appropriately and are proportionate to your activities and systems.
-
Clear priorities for improvement
You receive recommendations on what needs changing and why it matters. We explain the options and can advise your team on remediation.
What we cover
The DORA requirements we assess
Governance and ICT risk management
We assess responsibilities, the ICT risk management framework, risk assessments and the controls used to manage those risks.
Incident management and reporting
We assess incident detection, classification, response and reporting against the applicable DORA requirements.
Business continuity and recovery
We review continuity and recovery arrangements, backup practices and test results against your business needs and the applicable requirements.
ICT third-party risk
We review supplier risk management, contractual arrangements, oversight, exit planning and the DORA register of information.
Technical and organisational controls
We assess the design and operation of controls, using interviews and agreed samples of systems, configurations and records.
Digital operational resilience testing
We review the testing programme, coverage, results and treatment of findings. New penetration tests are separately scoped work.
How it works
An audit built around agreed objectives
-
01
Define the purpose and scope
We establish whether you need a compliance gap assessment, support for internal audit or a focused review. We agree criteria, scope, reporting and independence.
-
02
Assess requirements and controls
We review documentation, interview your team and examine agreed samples to assess compliance, control effectiveness and proportionality.
- 03
Present findings and recommendations
We explain findings, risks and recommended improvements to your team and management. If needed, we agree separate advice on remediation.
What we need from your team
- A contact who can find documents and set up interviews.
- Time with the people who own IT risk, incidents, recovery and suppliers.
- Access to your supplier register, recovery test results and samples of access approvals.
- Management time for the meeting where we present the findings.
DORA Compliance & ICT Risk Assessment
More companies and suppliers mean a larger audit
We price the audit on how many companies, services, systems and IT suppliers it covers, and how deeply we test samples. Your proposal shows each of these. Some smaller firms follow DORA’s simplified ICT risk management framework. We check whether it applies to you and size the audit to match.
We agree the work and price with you in writing before we start.
Common questions
Common questions
Related services
Free 30-minute call
Plan your next DORA review
In a free 30-minute call, we discuss the purpose of your DORA audit or assessment and recommend the scope that fits your needs.
