Short answer
DORA requires financial entities to manage ICT risk, handle incidents, test resilience and oversee third parties. An audit is not a certification: it is an independent or internal review of evidence and operation. A good audit answers whether the control works when nobody is watching.
Audit scope
- Governance: roles, approvals, risk appetite and board oversight.
- ICT risk: assets, dependencies, risk register, controls and metrics.
- Register: providers, contracts, critical functions and exit plans.
- Incidents: detection, notification, handling and lessons learned.
- Resilience: backup, restore tests, crisis exercise and TLPT need.
- Third parties: due diligence, contract clauses, subcontractors and oversight.
Evidence to request
| Area | Evidence |
|---|---|
| ICT risk | Risk register, treatment plan, board decisions |
| Register | Contracts, provider list, critical-function mapping |
| Incidents | Incident log, notification history, tabletop record |
| Resilience | Restore test result, RTO/RPO, crisis plan test |
| Third parties | Due diligence, contract clauses, subcontractor list, exit plan |
A document without an owner, date and evidence link is weak evidence. Prefer a small number of verified artifacts over a large document dump.
Register, audit and TLPT
The register of information is one DORA evidence artifact describing ICT providers and contractual arrangements. TLPT is a threat-led resilience test for designated entities. A general DORA audit reviews the wider governance, risk, incident and evidence picture. They complement but do not replace each other.
How the audit runs
- Scope: entities, systems, processes and critical functions.
- Document review: policies, register, contracts and prior tests.
- Controls: sample-based evidence and operating checks.
- Interviews: owners, support, management and third parties.
- Report: findings, impact, fixes and retest.
Common gaps
- The register exists but does not match contracts and actual services.
- The incident process is written, but notification history is missing.
- Backups are tested, but restore results are not recorded.
- Every service is marked non-critical.
- Subcontractors are absent from the register.
- Board decisions and risk appetite are not traceable.
Frequently asked questions
Does DORA require one mandatory audit?
DORA does not prescribe one mandatory certificate or audit format. A financial entity must be able to evidence ICT risk management, incident handling, resilience testing, third-party oversight and governance.
What does a DORA audit cover?
Typically the ICT risk register, register of information, contracts, incident process, backup and restore testing, resilience testing plan, governance and evidence traceability.
Is the register of information a DORA audit?
No. The register is one evidence artifact showing ICT providers and contractual arrangements. An audit reviews the wider governance, risk and evidence picture.
Does a DORA audit replace TLPT?
No. TLPT is a specific threat-led resilience test for designated entities. A general DORA audit can support preparation but does not replace it.