DORA ICT third-party risk audit program.
How to audit whether a financial entity manages the risks arising from ICT service providers: strategy, register of information, pre-contract assessment, contract terms and exit.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether the financial entity manages the risk from using ICT service providers as part of its ICT risk management and remains responsible for complying with its obligations. The focus is on strategy, register of information, selection, contract design, ongoing monitoring and exit planning.
Scope
- All contractual arrangements for ICT services, with emphasis on services supporting critical or important functions
- Procurement, contract management, information security, business units and management as participants in the process
- Entities within the scope of Regulation (EU) 2022/2554; clarify applicability and proportionality beforehand
- Out of scope: oversight of critical ICT third-party providers by the European supervisory authorities
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | Responsibility for third-party risk remains with the financial entity and is part of the ICT risk management framework. | DORA Art. 28(1) | Read the framework and responsibilities and establish the roles for steering, monitoring and escalating provider relationships. | ICT risk management framework, role descriptions, organisation chart |
| 2 | A strategy for ICT third-party risk exists, includes a policy on services supporting critical or important functions and is reviewed regularly; the management body regularly reviews the risks arising from the contracts. | DORA Art. 28(2) | Check strategy and policy for approval, currency and content, and trace how the management body dealt with them. | Strategy, policy, decisions and minutes of the management body |
| 3 | A register of information on all contractual arrangements for ICT services is maintained and complete. | DORA Art. 28(3) | Compare the register with the contract inventory, the creditor list and procurement data and identify missing providers. | Register of information, contract inventory, creditor master data |
| 4 | Contracts for critical or important functions are traceably identified in the register. | DORA Art. 28(3) | Read the classification method and re-perform the classification for a sample of services. | Classification method, register with flags, assessment documents |
| 5 | The register is kept up to date, provided on request, and new or changed arrangements for critical functions are reported to the supervisor in time. | DORA Art. 28(3) | Review the maintenance process, the latest update and the reports to the supervisor, and compare deadlines with the requirements. | Process description, change history of the register, reports to the supervisor |
| 6 | Before a contract is concluded, the entity assesses whether a critical or important function is affected, what risks exist and whether conflicts of interest arise. | DORA Art. 28(4) | Select a sample of contracts from the last year and go through the pre-contract assessment and due diligence. | Assessments before signing, due diligence results, approvals |
| 7 | Concentration risks arising from single providers or from linked providers are assessed. | DORA Art. 28(4), Art. 29 | Review the assessment method and the latest analysis and check whether dependencies on single providers and locations are identified. | Concentration analysis, dependency overview, results for management |
| 8 | Contracts are concluded only with providers that meet appropriate information security standards. | DORA Art. 28(5) | For a sample, inspect the provider evidence, such as certificates or audit reports, and review the assessment of that evidence. | Certificates, audit reports, assessment of the evidence |
| 9 | Contracts contain the minimum elements required for all ICT services. | DORA Art. 30(2) | Derive a checklist from Art. 30(2) and compare a sample of contracts against it. | Contracts with annexes, completed checklist |
| 10 | Contracts for services supporting critical or important functions contain the additional provisions. | DORA Art. 30(3) | Check the sample against the additional requirements for these contracts, including service levels, contingency plans and exit arrangements. | Contracts, service level agreements, checklist for critical functions |
| 11 | Access, information and audit rights are agreed; the frequency and scope of audits at the provider follow the risk. | DORA Art. 28(6); Art. 30(3)(e) | Review the provider audit plan and trace the audits performed and their results. | Provider audit plan, reports, follow-up of actions |
| 12 | Termination rights for the cases provided for are agreed in contracts and their exercise is organised. | DORA Art. 28(7) | Check termination clauses in the sample and ask who decides on exercising them. | Contract clauses, decision process |
| 13 | For services supporting critical or important functions, exit strategies are documented, tested and reviewed regularly. | DORA Art. 28(8) | Read the exit plans and check test evidence and transition plans for data and services. | Exit plans, test records, transition concepts |
| 14 | Performance and security incidents at providers are monitored and reported on an ongoing basis. | DORA Art. 30(3)(a) and (b) | Review regular reports and service level evaluations of the last twelve months and follow up the response to deviations. | Performance reports, incident notifications, action lists |
Documents to request
- Strategy and policy for ICT third-party risk
- Register of information with change history
- Contract inventory, creditor list and list of providers for critical or important functions
- Sample of contracts with annexes and service level agreements
- Pre-contract assessments, due diligence and concentration analyses
- Audit plan and audit reports on providers
- Exit plans with test evidence
- Reports and decisions of the management body on the topic
Typical findings
- The register is incomplete because contracts were concluded outside central procurement.
- The classification of critical or important functions is not justified or not consistent.
- Pre-contract assessments are missing for existing contracts and were not made up for at renewal.
- Existing contracts lack some minimum elements, for example on subcontractors or return of data.
- Exit plans exist on paper but have never been tested.
- Concentration risks are not evaluated even though several services run with the same provider.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing