Sovereignty & Control
DORA in PracticeWe translate your interpretation of the DORA requirements into specific instructions, so that your employees know what to do and you can document this for the Danish Financial Supervisory Authority.
The Policies Are in Place, But Are They Being Followed?
The majority of financial institutions have DORA policies in place. However, a policy stating that ‘backups must be tested periodically’ does not specify who is responsible for doing so, when, in which system, or where the evidence is stored.
The focus will shift from ‘do you have the documentation?’ to ‘are they being followed, and can you demonstrate this?’. The first DORA injunctions from the Danish Financial Supervisory Authority do not only concern policies, but also tasks that have not been carried out adequately in day-to-day operations: impact assessments, testing of contingency plans, exit plans for suppliers, and the classification of incidents. When the Danish Financial Supervisory Authority inquires, you must be able to demonstrate that these tasks are being carried out.
From Interpretation to Practice
We base our approach on the interpretation of DORA that you or your adviser has drawn up. For each requirement, we ensure four things:
- Demand: how have you interpreted the demand, e.g. frequency, scope, and threshold?
- Instruction: what exactly does the employee do, step by step?
- Role: who carries out a task, and who is accountable for it, even when it is outsourced?
- Evidence: what proves that the task is completed, and where lies the evidence?
The result is concise instructions in Danish, tailored to your systems and suppliers, and which can be traced back to the DORA requirement.
How it Works
1. Operational Gap Analysis
We will hold a workshop with you, during which you will provide us with your policies, procedures and existing guidelines. We do not assess whether you comply with DORA. We examine whether your own interpretation is being implemented and documented in practice. You will receive a comprehensive overview highlighting any gaps in instructions, roles or evidence, together with a project plan and a quote for the next steps.
2. Operationalisation
We update existing instructions, draft new ones, and specify the supporting evidence. Where possible, this evidence is sourced from the systems you already have, so that you can avoid having to produce new manual reports. Finally, we set up a procedures library and hand it over to your procedure owner.
3. Maintenance
DORA requires that the framework be reviewed at least once a year. We conduct the annual review, update the instructions in line with new requirements or organisational changes, and perform spot checks on the supporting documentation.
A Living Library of Instructions
We build the library on your existing platform or provide a completed SharePoint solution at a fixed price, including version control, ownership, approval workflow, and reminders of review.
Option: Automated Evidence. Instead of having employees sign off manually, workflow and AI bots can retrieve status updates from your systems, document the checks, and create a case when something is amiss.
Are You Already Working With a Compliance Advisor?
Good. We do not assess compliance or provide legal interpretation. We pick up where the adviser leaves off and ensure that the requirements are implemented in the day-to-day operations.
Get started on an Operational Gap Analysis from 30.000 DKK
Free, no-obligation preliminay meeting.
Meeting with Strator is free, no strings attached, and doesn't come with any obligations or expectations. It is simply a way to familiarise yourself with our services and processes.
