ProAuditMap

What NIS2 and DORA mean for internal audit planning in 2027.

BAIT is ending, DORA and the new German BSI Act bring their own structure. What follows for the audit universe, the audit cycle and follow-up.

As of 14 October 2026

Summary

With the turn of 2026 to 2027, IT audit planning in many audit functions loses its familiar frame of reference. This article shows which provisions address internal audit directly, which management duties are suitable audit subjects and which steps make sense for the 2027 audit plan.

Starting point

According to the Deutsche Bundesbank, the German supervisory requirements for IT in banks (BAIT) will be repealed completely with expiry of 31 December 2026 [1]. DORA has applied directly in Germany since 17 January 2025. The German Financial Market Digitalisation Act brings further institutions into scope, financial services institutions by 1 January 2027 [1]. Outside the financial sector, the German NIS2 implementation act introduced the new BSI Act, promulgated on 5 December 2025 [2]. According to the BSI, the registration deadline has passed [3].

Anyone drawing up the 2027 audit plan therefore no longer plans against a familiar circular, but against two legal acts with their own structure. Existing audit programs with BAIT references remain valid as documentation of earlier audits. Audits from 2027 onwards need new references.

DORA addresses internal audit directly

Article 6(6) DORA requires the ICT risk management framework of financial entities, other than microenterprises, to be subject to internal audit by auditors on a regular basis in line with the audit plan. The auditors need sufficient knowledge, skills and expertise in ICT risk and appropriate independence. The frequency and focus of ICT audits are commensurate to the ICT risk [4]. Article 6(7) requires a formal follow-up process based on the audit conclusions, including rules for the timely verification and remediation of critical ICT audit findings [4].

Four points follow for planning.

The framework is an audit object. Auditing individual systems is not enough. The audit universe should cover the ICT risk management framework as a whole and its components.

The audit cycle needs a reason. If frequency and focus follow the ICT risk, the risk assessment behind the cycle has to be documented and traceable for supervisors and external auditors.

Follow-up is a process, not a list. Deadlines, responsibilities, escalation and a separate treatment of critical findings should be set out in writing before the first audits of 2027 are closed.

Third parties become a standing audit area. Article 28(3) DORA requires a register of information on all contractual arrangements on the use of ICT services, at entity level and at sub-consolidated and consolidated levels. Arrangements covering critical or important functions are to be distinguished, and the competent authority receives a report at least yearly [4]. Auditable points include the completeness of the register against contracts and creditors, the classification of functions and how current the entries are.

In addition, entities identified by the authority carry out threat-led penetration testing at least every three years (Article 26(1) DORA) [4]. Internal audit should decide early whether it accompanies preparation and follow-up or audits the implementation of the results separately later.

NIS2: management duties as a starting point

Section 30(1) of the BSI Act requires essential and important entities to take appropriate, proportionate and effective technical and organisational measures and to document compliance [5]. Section 30(2) lists ten areas the measures cover at a minimum, from risk analysis through incident handling and supply chain security to multi-factor authentication. Number 6 requires policies and procedures to assess the effectiveness of the measures [5]. Under section 38(1), management has to implement the measures and oversee their implementation, and under section 38(3) attend training regularly [6]. Section 32 governs the reporting of significant incidents: an early warning within 24 hours, a notification within 72 hours and a final report no later than one month after that [7].

For planning this means:

The ten areas work as a grid. Placed next to the existing audit universe, they show gaps. Not every area has to be audited every year, but the plan should show when each area is due and why.

Documentation can be audited. Because the act requires compliance to be documented, it can be audited whether the documentation is complete, current and acknowledged by management.

Internal audit is part of the effectiveness assessment, not all of it. Number 6 requires policies and procedures. Internal audit can check whether they exist and work. It should avoid becoming the only procedure itself.

Oversight by management needs a basis. Reports from internal audit to management and the supervisory body can evidence part of the oversight under section 38. That argues for a report format that shows status, open findings and deadlines per area. Training records of management are a simple and often overlooked audit subject.

Reporting deadlines can be tested. An exercise or the file of a real incident shows whether the chain of detection, assessment and reporting works within the deadlines of section 32.

Groups under both regimes

Groups with financial and non-financial companies plan with both grids. Which provision governs which company should be clarified with legal and compliance before planning and noted in the audit plan. Otherwise audits are duplicated or gaps appear at the interfaces.

Steps for the 2027 audit plan

  1. Take stock: which audit programs and report templates cite BAIT references?
  2. Set up the grid: place DORA topics and the ten areas of section 30(2) BSI Act against the audit universe and mark gaps.
  3. Document risk assessment and audit cycle per audit object.
  4. Check capacity and expertise. DORA requires sufficient knowledge of ICT risk. If the team lacks it, co-sourcing belongs in planning, not only in fieldwork.
  5. Set out the follow-up process in writing, with a separate rule for critical findings.
  6. Explain the plan to the board on the new legal basis.

Conclusion

In 2027 the work of internal audit changes less than its frame of reference. DORA addresses internal audit directly and requires a risk-based audit cycle and a formal follow-up process. The BSI Act provides a usable grid with its ten areas and the duties of management. Translating both into the audit universe and the audit plan now means starting the year with well-founded audits instead of a changeover during operations.

Sample audit programs, among them NIS2 access management and DORA ICT third-party risk, are freely available: sample audit programs.

NIS2 and DORA scope check

Generate a draft audit plan

Sources (retrieved on 14 October 2026)

  1. Deutsche Bundesbank, BAIT and DORA: https://www.bundesbank.de/en/tasks/banking-supervision/individual-aspects/risk-management/bait
  2. Federal Law Gazette 2025 I No. 301 of 5 December 2025 (German NIS2 implementation act): https://www.recht.bund.de/bgbl/1/2025/301/VO.html
  3. BSI, entities regulated under NIS2 (German): https://www.bsi.bund.de/DE/Themen/Regulierte-Wirtschaft/NIS-2-regulierte-Unternehmen/nis-2-regulierte-unternehmen_node.html
  4. Regulation (EU) 2022/2554 (DORA), Articles 6(6) and (7), 26(1), 28(3): https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2554
  5. Section 30 BSI Act (German): https://www.gesetze-im-internet.de/bsig_2025/__30.html
  6. Section 38 BSI Act (German): https://www.gesetze-im-internet.de/bsig_2025/__38.html
  7. Section 32 BSI Act (German): https://www.gesetze-im-internet.de/bsig_2025/__32.html

This article gives an overview and is not legal advice. The wording of the provisions cited is authoritative.