MODULE 1
DORA gap analysis & risk assessment
Comparison of governance, processes, systems and contracts with DORA Art. 5 to 15, focusing on critical functions and ICT assets.
Result: prioritised roadmap, integrated into risk management.
Home / DORA-Ready Audit & Assurance
DORA-READY AUDIT & ASSURANCE
Your digital stability is no accident.
Under DORA, supervisors no longer only check whether measures are documented, but whether they work. I make banks, insurers and IT service providers audit-proof: independently, with technical and legal depth.
ON-SITE INSPECTIONS (OSI)
What supervisors look at in DORA examinations
An end-to-end view is required: from critical functions to ICT assets to service providers, and always effectiveness rather than documentation alone.
01
Critical or important functions
Identification methodology, link to process and ICT inventories, dependency on service providers.
02
Measures by criticality
Security measures traceably derived from criticality.
03
Three lines of defence
A functioning internal control system with adequate resources.
04
Core technical measures
Encryption, backup and recovery including tests, network segmentation.
05
Achievable recovery times
Evidence that calculated recovery times can be achieved, including with service providers.
06
Effectiveness, not paper
Demonstrable effect of the measures, not just their description in policies.
AUDIT MODULES
Six modules, bookable individually or as a package
Fixed-price entry: Readiness Check →MODULE 2
On-site simulation & examination readiness
Simulation of a BaFin or ECB inspection with interviews, document review and effectiveness tests.
Result: weaknesses identified early, teams trained, evidence presented confidently.
MODULE 3
ICT risk management assessment
Governance, incident response, monitoring, BCM and integration with operational risk under DORA Art. 10, auditable under IDW PS 340 (new version).
Result: transparency and an early-warning system based on risk indicators.
MODULE 4
Third-party risk management (TPRM)
Review of outsourcing and cloud contracts and of governance along the supply chain.
Result: compliant outsourcing, better negotiating position.
MODULE 5
Evidence audit & control testing
Effectiveness tests for backup, network security, logging, data integrity, recoverability and incident management.
Result: report under IDW PS 951 / ISAE 3000.
MODULE 6
Risk aggregation & management reporting
All results in one risk dashboard with key figures, traffic-light logic and audit trail, connected to GRC or operational risk systems.
Result: complete overview and measurable progress.
YOUR BENEFITS
Technical precision meets regulatory certainty
- Audit-proof through review with an auditor’s eye
- Risk-based along DORA, operational risk and MaRisk
- Effectiveness before documentation, with quick wins
- Reports under IDW PS 951, ISAE 3000 and DORA
- Experience from DORA, BAIT and MaRisk projects
NETWORK EXPERTISE
Consulting and audit from a single source
Reserved services and attestations under IDW PS 951, ISAE 3000 or ISA [DE] 315 are provided by the partner firms WPNO AG and Dürkop Möller und Partner mbB.
WPNO AG
Dürkop Möller und Partner mbB
“His expertise in implementing DORA ensured that our bank met all new regulatory requirements in an audit-proof and practicable way.”
Start your DORA readiness
In the initial consultation we clarify which modules you need and when your next examination is due.
Arrange an appointmentFREQUENTLY ASKED QUESTIONS
Good to know
Who does DORA apply to?
Since 17 January 2025 for almost all financial entities in the EU, for example credit institutions, payment and e-money institutions, investment firms, insurers, management companies and crypto-asset service providers. ICT service providers are indirectly affected through their financial customers’ contracts.
What do supervisors focus on in a DORA examination?
On effectiveness, not just documentation: critical or important functions and their ICT dependencies, a functioning ICT risk management framework, incident classification and reporting, resilience testing, achievable recovery times and the management of ICT third-party providers including the Register of Information.
Can I book individual modules?
Yes. All six modules can be booked individually or as a package. The fastest way in is the DORA Readiness Check at a fixed price: in five days you know where you stand and which modules you really need.
Do you also issue attestations or certificates?
Reserved services such as attestations under IDW PS 951, ISAE 3000 or ISA [DE] 315 are provided by the partner firms WPNO AG and Dürkop Möller und Partner mbB. This gives you consulting, audit and attestation from a single network.
We are an ICT service provider to a bank. What lies ahead?
Your financial customers must contractually oblige you to meet the requirements of Art. 30 DORA: security level, participation in testing, audit rights and exit arrangements. With the Supplier Portal you provide your evidence once and share it with every customer via link.