Our DORA session covered three topics:
1. Exit strategy and plans
Under the Digital Operational Resilience Act (DORA), financial institutions must ensure business continuity even when critical third-party ICT providers fail or contracts are terminated. This session explored how to design and implement effective exit strategies and exit plans that meet regulatory expectations while maintaining resilience and minimizing disruption.
Through practical insights and case examples, we discussed:
- Key DORA requirements and supervisory expectations on exit planning
- Governance, testing, and documentation best practices
- Integration with outsourcing and third-party risk frameworks
- Lessons learned from regulatory reviews and market practices
2. Practical insights on DORA contract review
DORA requires financial entities to include specific provisions in their contracts with ICT third-party service providers. Consequently, financial entities must review and, where necessary, update their existing contractual arrangements with these providers. In this session, we explored practical challenges in the review process, focusing particularly on its scope, complexity, and potential costs.
3. DORA assurance
Under DORA, financial institutions seek assurance over the quality of operations performed by their critical third parties and their alignment with the legislation.
But how can financial institutions leverage existing assurance reports (ISAE) or certificates (SOC) to reduce the monitoring activities required? Where do ISO/ISAE standards align with DORA, and where do they not? In this session, we explored how financial institutions can leverage existing assurance products to determine what they can—and cannot—do under DORA.