DORA Audits at JDA Advisory – Comprehensive Digital Resilience and Regulatory Compliance Assessment

The dynamic regulatory environment in the financial sector requires organizations to not only meet legal requirements but, above all, demonstrate real resilience to ICT incidents, operational disruptions, and supply chain risks. DORA (Digital Operational Resilience Act) introduces uniform, rigorous standards that apply to all financial institutions and ICT providers. At JDA Advisory, we conduct audits that not only verify compliance but, above all, strengthen an organization’s digital resilience and competitive advantage.

Our DORA audits are designed to provide management and operational teams with a clear, measurable, and actionable picture of the organization’s maturity status. We combine regulatory knowledge, operational experience, and technological expertise to provide comprehensive support in preparing for DORA, RTS/ITS, and supervisory audits.

Why is a DORA audit from JDA Advisory a premium service?

Unlike standard compliance audits, our approach focuses on real operational resilience. By assessing processes, technology, documentation, organizational culture, and supplier relationships, we deliver reports that are:

• precise and granular,
• understandable to the management,
• feasible for operational teams,
• tailored to the scale and risk profile of the organization,
• ready for presentation to regulators, auditors, and supervisory committees.

Każdy audyt jest realizowany zgodnie z zasadą proporcjonalności, ale bez kompromisów w zakresie jakości i rzetelności.

Scope of DORA audit at JDA Advisory

1. Assessment of compliance with DORA and implementing acts (RTS/ITS)

We analyze all areas required by DORA, including:

• ICT risk management,
• incident classification and handling,
• digital resilience testing,
• business continuity and disaster recovery management,
• oversight of ICT providers and outsourcing,
• reporting, documentation, and governance requirements.

We identify gaps, risks and areas requiring immediate intervention.

2. ICT Risk Analysis and Operational Resilience

We verify:

• ICT risk identification, assessment, and monitoring processes,
• adequacy of technical and organizational controls,
• incident response preparedness,
• resilience of critical infrastructure, systems, and services,
• effectiveness of business continuity plans and DRPs.

Our analysis covers both a strategic and operational perspective.

3. ICT Supplier and Supply Chain Audit

DORA introduces the most stringent requirements in the EU for the oversight of ICT providers. As part of the audit:

• We evaluate contracts, SLAs, OLAs, and security provisions,
• analyze supplier monitoring processes,
• verify compliance with outsourcing requirements,
• assess concentration and dependency risks,
• prepare recommendations regarding governance and control.

4. Digital resilience testing and readiness for TIBER‑EU / TLPT

We verify:

• Test scope and quality,
• scenario adequacy,
• test results management processes,
• readiness for advanced testing (TLPT),
• compliance with DORA testing requirements.

5. Management reports and implementation recommendations

After each audit we provide:

• A management report with key findings,
• a detailed gap analysis with a maturity assessment,
• an ICT risk map,
• implementation priorities,
• a corrective action plan,
• operational materials for the IT, security, compliance, and operations teams.

Reports are prepared in a transparent, professional manner and ready for presentation to management, external auditors and regulators.

How does a DORA audit work at JDA Advisory?

The audit process is transparent and effective:

1. Initial analysis and kick-off workshops – understanding the organization, processes, and risk context.
2. Compliance and maturity assessment – ​​detailed analysis of documentation, processes, technologies, and evidence.
3. Operational interviews and reviews – discussions with key teams, analysis of practices and controls.
4. ICT vendor assessment – ​​review of contracts, governance, and oversight.
5. Reporting and recommendations – management report, gap analysis, and action plan.
6. Post-implementation support – optional support in implementing recommendations.

Who is the DORA audit for?

• Banks, fintech companies, payment institutions,
• insurance companies and insurance intermediaries,
• investment firms, investment funds, brokerage houses,
• ICT service providers for the financial sector,
• SaaS providers, hosting, software houses, integrators,
• organizations subject to the supervision of the Polish Financial Supervision Authority (KNF) or cooperating with the financial sector.

JDA Advisory – Your Partner in Building Digital Resilience

DORA audits conducted by JDA Advisory go beyond compliance verification. They provide strategic support in building digital resilience, operational security, and competitive advantage. We operate quickly, precisely, and with complete confidentiality, delivering value that goes beyond standard audit approaches.