How DORA compliance is audited and why there is no DORA certification

Is there a DORA certification?

No. DORA has no certification scheme like ISO/IEC 27001, under which an accredited body issues a certificate to a firm. The regulation, the level 2 texts and the BaFin guidance we have read contain no procedure for certifying financial entities or ICT service providers under DORA. Whether a financial entity meets the requirements is checked by internal audit, the statutory auditor and the supervisors. Training records, provider attestations and audit reports evidence individual measures, but they are not an official certificate of conformity.

Certification appears in DORA in two places, and both concern third parties:

• Testers for TLPT: For threat-led penetration testing, financial entities only use testers who, among other things, are certified by an accreditation body in a Member State or adhere to formal codes of conduct or ethical frameworks (Article 27(1)(c)). According to BaFin, the German financial supervisor, there is no accreditation body for this in Germany and no list of approved testers.
• Certifications of providers: Under the full framework, a financial entity may also use third-party certifications and the provider’s audit reports for contracts on critical or important functions, but only under conditions and not solely over the longer term (Delegated Regulation 2024/1773, Article 8(2) and (3)). More on the page Managing ICT third-party risk.

People searching for “DORA certificate” sometimes also mean the digital certificates of the ICT infrastructure. For these, Article 7(4) of Delegated Regulation 2024/1774 requires a register under the full framework, described on our company page certificate register under RTS Article 7(4). How an ISO 27001 certificate relates to DORA is shown on the page DORA and ISO 27001, and for cloud providers with a C5 attestation on the page C5 attestation and DORA (in German).

What are personal certificates, and what do they show?

Training and examination providers issue personal certificates to participants who have completed a DORA course or passed an exam. According to our review, there is no state certificate for individuals and none provided for by DORA. Such certificates are private, and each provider sets its own content and requirements.

In our assessment, they can evidence knowledge that DORA requires: training of the management body under the full framework (Article 5(4)), training programmes for staff and management (Article 13(6) under the full framework, Article 16(1)(h) under the simplified framework) and the ICT expertise of the auditors (Article 6(6), RTS Article 28(5)). They say nothing about the firm’s framework. Training of the management body as a service is described on the page DORA training.

Who audits DORA, and on what basis?

What is often called a “DORA audit” is one of these reviews:

In addition, financial entities review their ICT service providers through the contractual rights of access, inspection and audit (Article 28(6), Article 30(3)(e)). How providers prepare for this is set out on the page DORA for ICT providers.

What does the statutory auditor review?

When auditing the annual financial statements, an institution’s statutory auditor determines whether the institution has met the requirements of Articles 5 to 14, 16 to 19, 23 to 25, 28 to 30 and 45(3) DORA, also in conjunction with the delegated regulations under Articles 15, 16, 20, 28 and 30 (Section 29(1) sentence 2 no. 2(m) KWG). This applies for the first time to financial years beginning after 31 December 2024 (Section 65a(2) KWG). For investment firms, insurers, fund management companies and payment and e-money institutions, corresponding lists are found in the respective supervisory act. For fund management companies, Article 16 is missing, because they do not apply the simplified framework.

For factoring and leasing institutions, DORA applies only with incident reporting until the end of 2026. On our reading, the statutory auditor until then only reviews the obligations that actually apply to the institution, that is Chapter III, and from the 2027 financial year also Article 16 and Articles 28 to 30. How the auditor handles this in the individual case is something to clarify with them.

If the auditor comes across facts that may lead to a qualified audit opinion, or across material breaches, they report this to BaFin and the Bundesbank without delay (Section 29(3) KWG). BaFin can set requirements for the content of the audit (Section 30 KWG). The audit report is governed by the Audit Report Regulation (PrüfbV). It has long required an assessment of the IT systems and the emergency concept (Sections 11, 13 PrüfbV). We did not find a specific DORA provision in the unofficial version on gesetze-im-internet.de on 6 November 2026.

How do BaFin, Bundesbank and ECB audit?

BaFin can require institutions to provide information and documents and can carry out audits even without special cause. It can delegate the audits to the Deutsche Bundesbank. For material outsourcing, this also applies to the outsourcing provider (Section 44(1) KWG). Under DORA, competent authorities have at least the power to access documents and data and to carry out on-site inspections (Article 50(2)(a) and (b)). The ECB supervises significant credit institutions. Responsibilities and penalties are covered in the section Supervision in Germany.

Independently of an audit, the authority can request the report on the review of the ICT risk management framework (Article 6(5) under the full framework, Article 16(2) under the simplified framework). Content and format are set by Delegated Regulation 2024/1774, for Article 16 institutions in Article 41: searchable electronic format, date of approval by the management body (where applicable), reasons for the review, review period, person responsible, findings and remedying measures with dates.

What does internal audit review?

Under the full framework, internal audit regularly audits the ICT risk management framework in line with the audit plan. The auditors need sufficient knowledge, skills and expertise in ICT risk and appropriate independence, and the frequency and focus depend on the ICT risks (Article 6(6)). For the findings, a formal follow-up process must be established, including rules for the timely verification and remediation of critical ICT audit findings (Article 6(7). The German version says “Überprüfung und Auswertung”, verification and evaluation). Microenterprises are exempt from paragraph 6.

Under the simplified framework, comparable obligations are set out in RTS 2024/1774 Article 28(5) and (6): audit in line with the audit plan by independent auditors with ICT expertise, and the timely verification and remediation of critical ICT audit findings (the German version again says “Auswertung”, evaluation). The wording there names no exemption for microenterprises. Paragraph 4 requires appropriate segregation and independence of control functions and internal audit functions. Who takes on which role is described on the page Article 16, and for the full framework on the page ICT risk management.

Preparation list for a DORA audit

The list applies equally to internal audit, statutory audit and supervisory audit. It names the documents we would have ready, the legal basis for each framework and who typically provides them. Which audit areas are actually requested is decided by the auditor.

Example: Muster-Factoring GmbH plans its audits for 2027

Fictitious example, not a client. Muster-Factoring GmbH (23 staff, EUR 61 million total assets) applies the simplified framework from 1 January 2027. In November 2026, the management board decides how the first DORA year will be audited:

• Annual financial statements 2026 (audit in spring 2027): It agrees with the statutory auditor that incident reporting is the focus for 2026. It presents rows 9 and 14 of the preparation list, plus the record of the latest reporting exercise.
• Internal audit (third quarter of 2027): The outsourced internal audit reviews the simplified framework for the first time. The audit plan gets three ICT audit areas: function list and BIA, access control with logging, restoration tests.
• Annual financial statements 2027 (audit in spring 2028): For the first full DORA audit, it sets up a filing structure with the 15 rows in December 2027, each with a contact person.

Information security keeps open findings from internal audit in the same list as row 6 until they are closed. This way, the statutory auditor sees in spring 2028 what was found and what was fixed.

Three typical gaps in audit preparation

How we help

We do not audit on behalf of BaFin and do not replace internal audit or the statutory auditor. We help set up the documents so that an auditor can follow them. The starting point is the DORA gap analysis, for institutions under the simplified framework as the Article 16 gap analysis. Institutions of the KWG group moving from BAIT on 1 January 2027 find the matching service in our transition from BAIT.