There’s a particular kind of discovery that happens during regulatory preparation, one that has less to do with the regulation and more to do with the organisation doing the preparing. Teams set out to build a DORA-compliant register of ICT third-party arrangements, and along the way discover something a little uncomfortable: nobody had actually been looking at the whole picture before.
Risk had a view of supplier risk. Procurement had a view of contracts and spend. Legal had a view of the terms actually negotiated. None of these views fully agreed with each other, not through negligence, but because nobody had ever needed them to. Each function’s version of the truth was good enough for its own purposes, right up until a regulator asked a question that required all three to say the same thing at the same time.
This is, in a strange way, the most useful thing DORA has done for a lot of financial services organisations. It didn’t just create a new compliance obligation. It exposed a structural gap that had been there all along, quietly, without ever causing a visible problem, until the moment it suddenly mattered.
The lesson that’s easy to learn from this and the lesson that’s actually useful are different things. The easy lesson is: build the register, satisfy the auditor, move on. The useful lesson is that the underlying gap, disconnected supplier, contract and risk information, doesn’t go away once the register exists. It just stops being visible again the moment nobody’s actively looking for it, which is exactly the condition that created the problem in the first place.
Organisations that treated DORA preparation as a one-off project tend to end up back where they started within a year or two. Organisations that treated it as a prompt to build something more durable came out the other side with something more valuable than compliance: an answer they could trust on any given Tuesday, not just the day the auditor visited.
