dora ict register audit

The problem

EU financial entities face severe regulatory risk if their ICT registers are incomplete or internally inconsistent. Most firms struggle with "shadow SaaS" bought outside IT and legacy contracts that lack mandatory DORA clauses, leading to failed ESA submissions.

What it does

• Audits the register of information for relational integrity across all 15 ITS templates to find broken cross-references.
• Identifies missing arrangements, including sub-outsourcers, intra-group providers, and SaaS tools procured outside formal IT channels.
• Maps ICT contracts against Article 30 mandatory clause requirements, distinguishing between standard and critical/important functions.
• Flags legacy contracts signed before 2025-01-17 that require remediation to meet current standards.
• Verifies that the entity's own critical/important function determinations are documented and correctly reflected in the contract set.

Why this beats prompting it yourself

General LLMs treat registers as flat lists rather than the complex relational models required by ITS 2024/2956. This skill enforces the specific cross-template reconciliation logic that supervisors use to find failures, and it prevents the common mistake of assuming pre-2025 contracts are grandfathered.

Use cases

• Reviewing a draft register before the annual April ESA submission deadline.
• Conducting a gap analysis on legacy ICT contract portfolios to prioritize legal remediation.
• Verifying relational integrity between provider tables and supported function templates.
• Cross-checking internal "critical or important" determinations against required 30(3) enhanced clauses.

Known limitations

This skill cannot make binding critical/important function determinations or certify full DORA compliance. It does not cover the incident reporting, resilience testing, or governance pillars.