DORA Audit & Supervisory Review: Navigate Internal and External DORA Examinations

A DORA audit doesn't just check technical IT controls; it verifies whether the processes required across all five DORA pillars actually work: risk management, incident reporting, resilience testing, third-party management, and information sharing. A classic IT audit usually checks a narrower set of technical controls without this supervisory framing and without the documentation depth DORA requires.

Before the actual audit, an internal review against the real DORA requirements is worthwhile, not just against an internal policy, since internal policies can drift from the regulatory baseline. It's especially important that all evidence, such as logs of completed tests or the third-party register, actually exists and isn't just documented as an intention, since that's exactly what supervisors check first.

Threat-Led Penetration Testing (TLPT) is mandatory for certain, typically larger, financial entities and simulates real attack scenarios against critical systems under the oversight of an accredited tester. A DORA audit checks whether such tests were performed at the required frequency, whether results are documented, and whether identified weaknesses were actually remediated rather than just logged.

Scope should be driven by the criticality of the systems and processes being reviewed rather than treating all areas with equal depth. A first-time audit usually covers more ground to surface baseline gaps; follow-up audits can focus more on previously identified weaknesses and particularly critical third-party relationships.

Since ICT risk responsibility stays with the financial entity, the effectiveness of outsourced controls must also be verified, either through contractually secured audit rights at the provider or through the provider's certifications and audit reports, provided these are sufficiently substantive. For particularly critical providers, a certificate alone is often not enough; independent audit rights should be contractually secured.

Findings should be prioritized by risk relevance and tied to concrete, time-bound actions with clear ownership. A tracking process that checks implementation status at fixed intervals is essential; unresolved findings carried over from a prior audit are a particularly strong red flag for supervisors at the next review.