DORA Audit
A DORA auditis an independent examination that verifies a financial entity's compliance with DORA's requirements and the effectiveness of its ICT risk controls. Unlike a gap assessment, an audit tests and evidences that controls actually operate as designed.
What an audit examines
Auditors review the ICT risk-management framework, governance and board oversight, the register of information, incident-handling procedures, and the resilience-testing programme. They sample evidence, interview staff, and report findings with severity ratings.
Who performs DORA audits
Internal audit functions, external assurance firms, and specialist consultancies all perform DORA reviews. DORA also requires that the ICT risk-management framework itself be subject to internal audit on a risk-based schedule. Browse ranked providers or see the full directory.
Will statutory auditors themselves be pulled into DORA's scope?
DORA's own text left this question open. Article 58(3) required the European Commission, after consulting the ESAs and the Committee of European Auditing Oversight Bodies, to review whether statutory auditors and audit firms should be brought within DORA directly, or through amendments to the Audit Directive. On 4 December 2025 the three ESAs published their joint response (JC 2025-85): weighing the benefits against the compliance burden on audit firms, especially mid-tier and smaller ones, they concluded that extending DORA's scope to statutory auditors is not warranted at this stage. The Commission's own report to the European Parliament and Council, due by 17 January 2026, is expected to follow that recommendation. For now, the auditors DORA actually requires are the ones described above, reviewing the entity's own ICT risk-management framework, not the firm's statutory financial-statement auditor.
Frequently asked questions
Does DORA require an external audit?
DORA requires the ICT risk-management framework to be audited by auditors with sufficient ICT knowledge, on a risk-based schedule. It does not mandate a specific external certification.
How often should a DORA audit happen?
On a risk-based frequency set by the entity, with more frequent review for higher-risk or recently changed areas.
What happens if an audit finds non-compliance?
Findings feed a remediation plan. Unaddressed gaps can attract supervisory measures and penalties if authorities identify them.
Are statutory auditors themselves regulated under DORA?
Not directly. A December 2025 ESAs report concluded that bringing statutory auditors and audit firms into DORA's scope is not warranted at this stage; DORA's own audit requirement targets the entity's ICT risk-management framework instead.