ICT Controls Under DORA: How Banks Turn Requirements into Reliable Processes

DORA has been in force since 17 January 2025. This means that banks and financial service providers must now place even greater emphasis on continuously demonstrating compliance with regulatory requirements and ensuring their long-term effectiveness. It is crucial that the measures defined function reliably in day-to-day operations and remain effective in the long term.

To achieve the best possible results, the company is actively involving customers in the development process, drawing on their experience and specific requirements. The new solution brings transparency, planning, cash positioning, reconciliation and automation together on a single platform, providing a solid foundation for informed liquidity decisions.

Share this post on...

DORA Is in Place: But Are the Controls Working in Practice?

DORA has applied since January 2025, and many financial institutions have already addressed the regulatory requirements in depth. The question now is how well the measures already in place perform in day-to-day operations, with the focus shifting from implementation projects to ongoing application.

Documented policies, processes and responsibilities alone are not enough. What matters is whether the ICT control process works in practice, with controls initiated, performed and documented on a regular basis. Where further action is required, the necessary steps also need to be followed up. This is where it becomes clear whether regulatory requirements have truly been translated into reliable operational processes.

The PwC FS Digital Risk Barometer 2026 shows that a gap can still exist between formal implementation and controls that work in practice. While 51.7 percent of respondents say they have fully aligned their documented policies and procedures with DORA, only 42 percent have specifically adapted their internal control system to the regulation. The figures underline an important point: updating policies to meet regulatory requirements does not automatically result in an effective control process.

Why ICT Controls Are an Ongoing Responsibility

DORA requires financial institutions to maintain, regularly review and further develop a documented ICT risk management framework. ICT controls are therefore an ongoing operational responsibility rather than a one-time compliance exercise.

In practice, this includes performing control activities, recording the results and documenting the required evidence, as well as addressing issues or findings and following up on outstanding items.

New findings may also require adjustments that institutions need to incorporate into subsequent control activities. This continuing need for controls spans numerous operational areas, including access rights, changes to ICT systems, logging, vulnerabilities and secure ICT operations.

Where the Control Process Can Stall in Day-to-Day Operations

ICT controls often span several functions within a financial institution, including the internal control system, information security, IT organization and internal audit. To turn these activities into a reliable control process, everyone involved needs to know which tasks they are responsible for and when action is due.

Information and supporting evidence may also be scattered across different applications, files or storage locations, making it difficult to get a consolidated view of the current status. This creates additional administrative work, particularly for controls that recur on a regular basis.

Further challenges arise when responsibilities change or someone else has to step in. Even then, it must remain clear what has already been completed, which steps are still outstanding and what the current status of a finding is. Ahead of audits or reviews, the teams involved may otherwise have to gather and prepare the relevant evidence first.

From a Control Catalog to a Managed Process

A robust control catalog provides the foundation for moving ICT controls into a structured operational workflow. For cooperative banks, Genossenschaftsverband Bayern (GVB), the Bavarian cooperative association, has compiled relevant ICT controls, which Foconis makes available for process-based management using the ZAK principle.

Once the catalog defines which control activities are required, the next step is to turn those requirements into a clearly managed workflow for day-to-day operations. Each task is assigned to the appropriate person and handled according to a defined process.

As work progresses, the results and individual process steps are documented, making the current status easy to track while ensuring that the required evidence is available for future audits and reviews. In this way, a collection of control requirements becomes a manageable operational process.

How System Support Changes ICT Controls in Practice

A system-supported process clarifies responsibilities and assigns tasks directly to the appropriate people, so institutions do not have to reorganize responsibilities for every control cycle, and everyone involved can see which tasks are assigned to them.

It also improves the traceability of individual controls. Process steps, results and current status remain visible throughout the workflow, making it clear which control activities are still outstanding and which have already been completed. The evidence needed for audits is created as the work is carried out, so documentation develops alongside each control activity instead of having to be reconstructed later. Internal audit and other functions involved can then use the same traceable information whenever needed.

When institutions manage a large number of control activities or recurring checks, a standardized workflow also makes organization easier and reduces manual coordination. Administrative effort decreases because the functions responsible for internal controls, information security, IT organization and internal audit can work within the same process framework. In this way, system support brings clear responsibilities, transparent status information and consistent documentation together in a single workflow.

ICT Controls Do More Than Strengthen Compliance

Systematic controls help financial institutions identify weaknesses and deviations at an early stage, strengthening the way they manage ICT risks overall.

A traceable control process also improves audit readiness by creating transparency across the functions involved and making the current status of individual controls easier to track.

This reduces the risk that a defined control is missed in day-to-day operations or is not documented sufficiently. Structured ICT controls therefore also contribute to digital operational resilience.

Conclusion

DORA has significantly strengthened the regulatory framework for managing ICT risks, but whether that framework works in practice is determined in day-to-day operations. Financial institutions therefore need to do more than define their controls: they must perform them regularly, manage responsibilities clearly, document results and ensure that implementation remains traceable at all times.

ICT controls should not be treated as a collection of individual checkpoints. Instead, they should form an ongoing process in which regulatory requirements, clear responsibilities and continuous documentation work together. This turns regulatory requirements into a reliable routine that reduces the workload for the teams involved, improves traceability and helps financial institutions maintain ongoing oversight of ICT risks.

Manage ICT Controls Systematically and Maintain Traceable Documentation

Foconis-ZAK^® turns ICT controls into a process-oriented workflow. Find out how task assignment, processing and traceable documentation can work together within a single process.

Get in Touch

FAQ to this article

What are ICT controls?

ICT controls are measures financial entities use to verify that they comply with requirements for the secure and proper use of information and communication technology. These controls can cover technical, organizational and process-related areas.

What role do ICT controls play under DORA?

DORA requires financial entities to maintain a comprehensive and documented ICT risk management framework. They must not only define measures and controls but also review them regularly, assess their effectiveness and take into account findings from reviews or incidents.

Is a documented control catalog sufficient?

A control catalog defines what needs to be checked, but an effective control process also requires clear rules: Who performs each control, and when? How are the results documented? And how are outstanding items followed up?

Which functions are involved in ICT controls?

Depending on the organization, ICT controls may involve several functions, including the internal control system, information security, IT organization and internal audit. Clearly defined responsibilities and shared processes are therefore particularly important.

Why should ICT controls be supported by a system?

A system-supported process can structure recurring control tasks, clarify responsibilities and make the current status transparent. Results and supporting evidence can be documented directly as part of the workflow, reducing the amount of manual coordination and documentation required.

How does Foconis support cooperative banks with ICT controls?

Foconis makes ICT controls available in Foconis-ZAK^® for structured, process-based management. Control activities can be systematically assigned, processed and documented, while their current status remains visible throughout the workflow.