The next audit is knocking on the door?

DORA (Digital Operational Resilience Act) requires financial companies to have a risk-based, documented and traceable approach to ICT risks - and this explicitly includes testing. Specifically, this means that their test processes must take into account the criticality of applications and business processes, include third-party providers and cloud services, cover resilience and security tests and document acceptances, defects and management decisions in an audit-proof manner. In addition, there are extended requirements for ICT resilience tests that go far beyond traditional functional tests. We systematically compare your existing test and QA structures with these requirements and show you where specific improvements need to be made.

This depends heavily on your starting position. Our Quick Check delivers a reliable assessment of the current situation with a gap analysis and prioritized roadmap in two weeks - the fastest way to clarity. The subsequent optimization and development phase typically takes three to nine months, depending on the scope. If an audit is due at short notice, we prioritize the critical gaps and prepare you specifically for the audit - including a dress rehearsal and support on the day of the audit. The decisive factor is not maximum perfection, but a comprehensible structure and reliable documentation.

No. We are an advisory and implementation partner, not an audit or certification body. Official BaFin audits are carried out by the supervisory authority itself or by commissioned auditors. It is precisely this separation that is important: we can prepare you for an audit independently and without any conflict of interest, set up your test structures pragmatically and support you during the audit - without becoming dependent on the subsequent audit body. We also do not offer legal advice, but work closely with your legal advisors or external law firms if required.

DORA has applied throughout Europe since January 2025 and sets the overarching framework for digital operational resilience. MaRisk and BAIT are national BaFin regulations that are partly overlaid and partly supplemented by DORA - particularly with regard to the requirements for ICT risk management, outsourcing and test processes. In practice, this means that your test and QA structures must now comply with several sets of regulations at the same time, without resulting in parallel documentation. We rely on an integrated approach: a structure that is DORA-compliant and at the same time fulfills MaRisk/BAIT requirements - so that your teams do not have to answer the same question three times.

Our work is designed to relieve internal auditing and ICS, not to replace them. We set up test and QA structures in such a way that they meet the requirements of internal audit and ICS from the outset - with clear roles, escalation paths, test KPIs and audit-proof documentation. Where appropriate, we coordinate with your internal audit department at an early stage so that auditability and the control environment are considered from the outset. The aim is for the results of our work to flow directly into your existing reporting to the Executive Board, Supervisory Board and BaFin - without an additional layer of translation.