Chat with our experts on the Digital Operational Resilience Act (DORA)

Feeling overwhelmed with all the different DORA requirements? You’re not alone. The Digital Operational Resilience Act (DORA) introduces a wide range of new expectations for financial entities, from ICT risk management and incident reporting to third-party oversight and advanced resilience testing. But DORA isn’t just another regulation. It’s a major change in how the financial sector prepares for, withstands, and recovers from ICT disruptions. It impacts nearly every aspect of how organizations structure their operational resilience.

To help bring clarity, we sat down with our KPMG DORA specialists: Edouard de Schietere de Lophem and Victoria Boutros Ghali Jakobsen. In this edition, they break down what DORA really means in practice, explain how KPMG helps organizations build compliance strategies, and share their experience working on real world DORA readiness projects: from mapping critical functions to preparing for threat-led penetration testing.

Victoria: I have worked on quite a few DORA projects, and overall, DORA isn’t something completely new. It’s not a regulation that came out of nowhere. It builds on existing rules and guidelines that have been around for quite some time, particularly those from the European banking authority.

Many organizations already have elements like a risk management framework or an outsourcing register in place. In general, we see that entities that were already strong in these areas have a much easier time aligning with DORA.

That being said, DORA goes into much more detail than previous regulations. Even the most mature organizations still need to undertake some form of remediation to fully comply with DORA. The amount of work involved really depends on how far along they already were in terms of operational resilience.

Edouard: I’ve had the opportunity to work on multiple DORA-related projects, supporting both large and smaller banks, as well as insurance companies. These engagements have been particularly challenging and insightful, as they revealed significant differences in how various organizations are structured and how they have embedded resilience into their operations.

One of the most demanding experiences involved working with two clients simultaneously as the deadline approached for the mandatory registration of their Register of Information. Since this was the first time the process had to be completed - both for the organizations submitting and for the regulators receiving - it required extensive testing and coordination. This resulted in a few intense weeks for all parties involved. Nevertheless, through strong collaboration between our team, the clients, and the regulators, we successfully delivered everything on time.

Victoria Boutros Ghali Jakobsen, Sr. Advisor, Enterprise Risk Services

Edouard de Schietere de Lophem, Advisor, Enterprise Risk Services

Edouard: The most memorable project I’ve worked on was a full end-to-end implementation of DORA within an organization. We had previously conducted a comprehensive DORA gap assessment, which served as the foundation for the implementation roadmap. Working closely with the organization’s management, we developed the DORA strategy, compiled and submitted the Register of Information, and collaborated with their IT team to establish the necessary processes and documentation required for compliance.

It was a highly rewarding experience to support an organization throughout the entire journey: from initial assessment to full implementation. Additionally, since DORA awareness is essential at all levels of the organization, I had the opportunity to co-deliver an awareness session alongside a colleague for both management and employees. This holistic involvement made it a truly valuable and enriching experience.

Victoria: One of the most memorable projects was definitely relating to the Register of Information (RoI). It was a unique experience, both because of the complexity involved and because we had many KPMG teams working on the same challenge across different types of financial entities. It was great to see how we could learn from one another, exchanging insights on how to tailor the implementation for asset managers, banks, and other institutions.

It also highlighted the strength of our internal network. We collaborated closely across service lines, including with KPMG Law, to support clients from both the technical and legal angles. Despite the challenges, including some difficulties on the regulators’ side with submission platforms, it was a valuable learning opportunity and a true example of what we can achieve together. It felt like one big KPMG team effort.

Victoria: I have a legal background and have a master’s in law. I initially started working in privacy, which turned out to be my gateway into the world of cybersecurity. That eventually led me into broader information security topics, including DORA and NIS2, and ultimately brought me to the cyber team here in Belgium.

Even though my background is legal, I now work closely with technical experts, governance professionals, and colleagues with a wide range of specializations. It’s a great learning experience; I get to see the full picture: how regulations translate into technology, how they’re implemented in practice, and how they impact different sectors and business operations.

Edouard: I studied at ECAM Brussels Engineering School, where I developed a strong technical foundation. During my final year, I completed both my internship and thesis at KPMG. Following the internship, I was offered a permanent position, making the transition into the professional world quite seamless.

Although my background is highly technical, I adapted quickly to a more theoretical and strategic work environment. My technical expertise continues to be a valuable asset in my projects, allowing me to contribute practical insights and improvements. It also enables me to quickly grasp the broader organizational landscape and understand how systems and processes are interconnected.

Edouard: I’ve been working at KPMG for over a year. While it’s not always straightforward for individuals with a technical background to integrate into a Big Four environment, it offers a wealth of opportunities for growth and development.

The cybersecurity team at KPMG is a strong and diverse team, bringing together professionals from a wide range of educational, cultural, and gender backgrounds. This diversity fosters valuable insights and creates a collaborative environment that supports continuous learning and professional development.

Reflecting on the past year, I’m truly impressed by how broad and multifaceted the field of cybersecurity is. The work can be fast-paced and demanding at times, but the team is always supportive, and there is a strong culture of encouragement and knowledge-sharing. It’s an environment where you’re constantly learning and are actively supported in your growth.

Victoria: I have been with KPMG in Belgium for about two-and-a-half years now. I originally joined KPMG in Norway in 2023 and worked there for nearly two years before deciding to move to Belgium. I reached out to colleagues in Belgium to see if they needed someone with my background and that’s how I made the transition.

If you’re considering joining KPMG, one of the main advantages is the international nature of the work. Mobility is relatively straightforward if you want to take on international assignments, since cyber is inherently global and Europe-focused. Unlike tax and legal, which can be very country-specific, cybersecurity offers a broader, cross-border perspective.