We could not find an official, ranked list of the most common DORA audit findings, and we will not invent one. What the regulation text gives you is a set of concrete, checkable obligations. The areas where an audit can most easily show a gap are asset inventories, the register of third-party arrangements, testing, incident reporting and contracts.
What is DORA, briefly?
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, entered into force on 16 January 2023 and applies from 17 January 2025. The European supervisory authorities describe it as strengthening ICT security for financial entities so the sector stays resilient through a severe digital disruption. It covers ICT risk management, third-party risk, resilience testing, incident reporting, information sharing and oversight of critical third-party providers.
The sections below follow the Official Journal text. Treat them as audit test points, not as a record of what supervisors have actually reported.
Gap 1: is the inventory complete and current?
Article 8 requires financial entities to identify, classify and document ICT supported business functions, information assets and ICT assets, including remote sites, and to map critical ones with their configuration and interdependencies. It requires a review of the classification at least yearly and inventories updated after every major change.
An auditor can test this in an hour: pick a critical function, ask for the assets behind it, then check one asset against reality. If the CMDB says one thing and the network says another, you have a finding. Software components belong in this picture, which is where SBOMs help as one input.
Gap 2: is the register of information whole?
Article 28(3) requires a register of all contractual arrangements for ICT services from third-party providers, kept at entity level and, where relevant, at consolidated levels. It must distinguish arrangements that support critical or important functions from those that do not, and entities report at least yearly to authorities on the number and categories of arrangements.
The easy misses are shadow IT, subcontractors and renewals that never reached procurement. A good test is to compare the register against accounts payable for recurring software and cloud spend.
Gap 3: does testing meet the yearly floor?
Article 24 requires a testing programme, tests by independent parties, procedures to prioritize and remedy issues, and validation that weaknesses are fully addressed. Article 24(6) requires appropriate tests at least yearly on all ICT systems and applications supporting critical or important functions.
Typical weak points follow from the wording. Testing exists but is not independent, findings are logged but not validated as closed, or a critical system sits outside the test scope.
Gap 4: can you report a major incident on the clock?
Article 19 requires reporting major ICT incidents to the competent authority using templates, with an initial notification and further reports. The detailed timing and classification criteria sit in other legal texts that we did not fetch, so read the current technical standards before you build your playbook. What an auditor can check now is whether you have a classification procedure, named roles, templates ready, and a rehearsal record.
Gap 5: do contracts say what the law needs?
Article 30 sets key contractual provisions for ICT services, with stricter ones for functions that are critical or important. Auditors will sample contracts. Contracts signed before the rules applied are worth sampling first.
What to do
- Run an Article 8 test: trace one critical function to its assets and verify them live.
- Reconcile the register of information against finance records for software and cloud spend.
- Confirm every critical system is in the yearly test scope and that testers are independent.
- Write a closure check for test findings, not just a ticket status.
- Rehearse major incident classification and the report templates.
- Sample ten supplier contracts against Article 30 and list the gaps.
- Read the current technical standards for incident timing and TLPT before you finalize procedures.
Quick check
Does DORA apply to every company?
No. It applies to financial entities in the scope of the European supervisory authorities, and it sets rules for the critical ICT providers they use. Check the scope in the regulation or ask your legal team.
Can a software vendor be DORA compliant?
The obligations fall on the financial entity. A vendor can be a third-party provider, supply evidence and meet contract terms, but we would not describe any vendor as certified for DORA.
Sources
- Regulation (EU) 2022/2554 (DORA), Official Journal text on EUR-Lex
- ESMA: Digital Operational Resilience Act overview
- EIOPA: Digital Operational Resilience Act
Last reviewed: 18 October 2026.
