The Digital Operational Resilience Act (DORA) came into force on January 2025, reshaping the regulatory landscape for financial entities across the European Union. While the UK isn’t directly bound by EU law, the FCA and PRA are closely aligned with European standards. This means firms in London, Dublin, Paris, Frankfurt, and beyond can expect consistent enforcement. Crucially, any UK business operating in Europe must achieve DORA compliance.
The regulation sets out requirements for ICT risk management, incident reporting, resilience testing, and critical third-party ICT provider oversight. But the big unanswered question is: how will enforcement work in practice?
We’ve spoken to regulators, auditors, and industry leaders, and while the European Supervisory Authorities (ESAs) have yet to publish detailed audit playbooks, here are six audit questions we fully expect regulators to ask across the EU—and in the UK’s parallel supervision landscape.
-
Can you demonstrate continuous ICT risk monitoring?
In Brussels and Frankfurt, regulators are signalling that spreadsheets and point-in-time reviews will no longer be acceptable. Firms in both the EU and UK should expect to show real-time monitoring data, along with workflows that escalate risks quickly and prove that remediation has taken place.
-
How do you classify and report ICT incidents?
With ESMA and the ECB driving tighter reporting, firms will be expected to notify major incidents within 24 hours. UK supervisors like the FCA are likely to mirror this. Auditors may ask:
- What’s your process for determining if an incident qualifies as “major” under DORA?
- Can you evidence the full reporting chain—who was notified, when, and how the issue was resolved?
-
What evidence do you have of resilience testing?
DORA requires regular penetration testing, scenario analysis, and threat-led resilience testing. Auditors in EU hubs like Paris or Madrid may ask for test logs, remediation actions, and evidence that testing covers critical assets and third-party integrations. The FCA is already piloting similar testing under CBEST, meaning UK firms won’t escape scrutiny either.
-
How do you manage and monitor third-party ICT providers?
This is where regulators in both the EU and UK are expected to focus most aggressively. DORA places critical ICT providers—including major cloud platforms—under direct regulatory oversight.
Auditors may ask:
- Who are your critical ICT service providers, and how are they classified?
- Can you show visibility of their resilience controls beyond paper-based SLAs?
- How do you continuously monitor their security, compliance, and availability?
- What contingency arrangements do you have if one fails?
Expect outsourcing arrangements in Luxembourg, Dublin, and London to face closer scrutiny than ever before. Vendor questionnaires alone won’t cut it—firms must show real-time oversight and board-level accountability.
-
Can you map controls across frameworks?
Whether your firm operates in Germany under BaFin, France under ACPR, or in the UK under FCA/PRA supervision, auditors will expect to see how your existing frameworks (ISO 27001, NIS2, FCA operational resilience rules) map to DORA’s requirements. Gaps must be clearly identified and documented.
-
Are you audit-ready—at any time?
The European Banking Authority has already hinted that audits could be unannounced. Firms in both the EU and the UK must be prepared for a regulator to say: “Show me now.”
That means proving compliance with live evidence, automated reporting, and a centralised view of your operational resilience posture—not scrambling for documentation once an audit begins.
Preparing for Enforcement in the EU and UK
While the European Supervisory Authorities will drive audits across the EU, UK regulators will continue to apply parallel resilience requirements. For firms operating across both jurisdictions, the reality is clear: a fragmented or manual approach won’t scale.
Regulators are expected to:
- Demand real-time evidence rather than static reports
- Drill deeply into third-party ICT and outsourcing arrangements
- Test 24-hour incident reporting readiness
- Cross-check framework mapping across borders
Start Preparing Your Answers Today
The question isn’t whether DORA will be enforced—but how quickly regulators in Brussels, Frankfurt, Paris, Dublin, and London will expect you to prove resilience.
Because when January 2026 arrives, regulators won’t accept excuses—they’ll expect evidence.
Transform compliance complexity into operational resilience.Access the Digital Operational Resilience White Paper 👉 Download it now.
