Sequencing a nine-month DORA programme at a mid-sized bank

The dependency chain decides the sequence, not visibility.

1. Weeks 1-3: governance. The management board formally appoints an executive sponsor and names the ICT risk management function as owner of the framework (Art. 6). An interim programme manager is engaged, because three FTE cannot absorb this alongside business as usual. Each workstream gets a named accountable owner and a direct reporting line to the board. Without this, the deadline fails for organisational rather than technical reasons.
2. Weeks 2-8: register of information and criticality assessment. The register under Art. 28(3) is the input to almost everything downstream: which contracts fall under Art. 30, which providers are designated critical, what enters the testing plan, and what the supervisor inspects first. The COO is right that it comes early, but the reason is dependency, not visibility.
3. Weeks 4-10: incident classification and reporting procedure. Cheap, fast and high-exposure. A classifiable event in month two with an unrehearsed procedure produces a late or missing notification. Run a tabletop on two scenarios and replace duration-only classification with multi-criteria decision rules.
4. Weeks 6-16: contract remediation, tiered. Only once criticality is known can the 41% be prioritised. Start with the core banking outsourcer and the card bureau; the hyperscaler needs the standard clause set plus a concentration and exit analysis. Build a clause library and remediate by criticality band, handling the long tail with amendment letters rather than 260 parallel negotiations.

Contract remediation cannot lead because remediating a non-critical contract while an unremediated critical one sits untouched spends money in the wrong place and produces a file that looks thorough but is misprioritised. The nine-month ask should also be reframed: not a claim of compliance, but demonstrable risk reduction against the regulation's outcomes.

Proportionality scales sophistication, not obligation. Under the proportionality principle the bank may use simpler arrangements, but it must still classify and report major incidents correctly. The relevant criteria are not negotiable, only the machinery around them.

Practical build, roughly 15 person-days:

• Convert the classification criteria into a decision tree with thresholds: clients and counterparts affected, value at risk, duration and downtime, data integrity impact, geographic spread, economic and reputational impact. Integrity events and repeat occurrences should weight heavily; duration alone must not be the trigger.
• Define a single on-call path: who classifies, who confirms, who notifies, what the four-hour clock from classification means in practice, and the 24-hour outer limit from detection.
• Rehearse quarterly with a tabletop, and keep the record. One rehearsal costs a day and produces precisely the evidence a supervisor asks for.
• Give classification authority to a named role with a deputy, not to a committee that meets weekly.

Sequencing. This sits in weeks 4-10 under the incident workstream. It only competes with the register of information if the same two people sit on both critical paths, which is common in a bank this size; if so, escalate to the programme board and stagger the workstreams explicitly.

Second-order point. If the bank has a history of similar events, corrective-action tracking is itself a finding. Ask internal audit to test the new procedure after the first rehearsal rather than waiting for the annual plan, and treat the rehearsal output as evidence in the supervisory file.

Board reporting should be decision-useful, not comprehensive. Five to eight indicators with thresholds, each tied to a decision the board can take (accept a risk, fund remediation, escalate a provider, delay a change), plus a narrative on the top three risks and overdue actions.

Suggested content:

• Register completeness: percentage of arrangements reconciled, number of unowned systems.
• Percentage of critical or important contracts with Art. 30 clauses, by remediation wave.
• Major incidents, classification accuracy, and reporting timeliness against the four-hour and 24-hour clocks.
• Testing coverage of critical functions versus plan, and open findings by severity and age.
• Third-party concentration exposure and overdue exit plans.
• Overdue improvement actions with owner and escalation date.

Supervisory evidence at first review is about traceability, not documents. The supervisor will want to see that the register fed the criticality assessment, that criticality drove contract prioritisation and test scoping, that incidents were classified and notified on time, and that the management body actually took decisions. Keep a decision log from the programme board and dated versions of the framework, risk appetite statement and testing plan. Where a deadline slipped, show the compensating action rather than a silently restated plan.

Reframe the message. The credible month-nine position is: framework documented and approved, critical scope identified, X per cent of critical contracts remediated with dated plans for the rest, reporting rehearsed, testing under way. A credible trajectory survives supervisory challenge; a claim of completeness that internal audit will contradict does not.