Projects that pass the audit
DORA has applied to banks and most other financial entities in the EU since 17 January 2025. It sets uniform rules across Europe for ICT risk management, incident reporting and the management of IT service providers. We run projects so that the evidence for this is produced while the work is being done.
Regulation (EU) 2022/2554 requires ICT risk management, reporting of major ICT-related incidents, digital operational resilience testing and the management of ICT third-party service providers. BaFin has therefore gradually withdrawn its national IT circulars. According to its announcement, the BAIT will be phased out completely at the end of 2026.
Anyone working for an institution is audited along with it. Under Art. 30 DORA, contracts with ICT service providers must contain certain minimum content, and institutions keep a register of information on these arrangements. Documentation, evidence and responsibilities must therefore be set up from the start so that they can be presented.
The business unit, IT, compliance and internal audit are involved, and sometimes the outsourcing officer as well. A project that has only been aligned with IT fails at acceptance.
When a legacy system reaches end of life or an audit is coming up, the date is fixed. That is why the scope is usually adjusted rather than the timing.
What we do not take on: legal advice, the binding interpretation of DORA and MaRisk for your institution, and audit support in the narrow sense. That assessment lies with your compliance function, your internal audit and specialist firms.
Setup and introduction of a new ITSM solution in close cooperation with the bank. We supported the project from implementation and go-live through to operation.
Result: Twelve months from project start to go-live, followed by close support in operation.
For a regulated institution that is a realistic timeframe. Projects here fail more often because of overly optimistic plans than because of the technology.
FAQ
DORA requires documented ICT risk management covering protection, detection, contingency plans and recovery. On top of that come reporting of major ICT-related incidents, regular testing and the management of ICT third-party service providers. In practice, much of this comes down to permissions, logging and documentation, and that is where we start.
In many cases yes, but Art. 16 DORA provides a simplified ICT risk management framework for small and non-interconnected entities. Your compliance function determines which rules apply to your institution, and we align the technology accordingly.
As a rule yes, as soon as we provide ICT services to your institution on an ongoing basis. We then belong in your register of information, and the contract must contain the minimum content under Art. 30 DORA. Whether the service is also an outsourcing arrangement within the meaning of MaRisk depends on its scope and classification and is decided case by case.
Yes, from project work and from consulting on DORA. The binding interpretation for your institution lies with your compliance function and internal audit, and we align the implementation with it.
We deliver what internal audit asks for and document during the project instead of afterwards. Any auditor can spot documents that were produced after the fact.
Yes. In banking, several parties almost always work on one project, and we are used to that.
In our banking project with 250 users it took twelve months to go-live. The duration depends mainly on how many processes are mapped and how many stakeholders have to sign off. We draw up a reliable schedule after the initial assessment.
Banking & Financial Services
Describe your project to us in a short call. We will tell you honestly whether we are the right fit.
