Review and continual improvement
This domain tests how DORA obligations are monitored, reviewed and improved over time, including how evidence from incidents, testing and third-party monitoring feeds back into the framework.
Core rules and concepts
- The ICT risk management framework is reviewed at least annually and after significant events or material changes. Reviews must be documented and approved by the management body.
- Post-incident reviews and lessons learned should change controls, business continuity plans, monitoring thresholds and training, not just produce a report.
- Testing results, including TLPT findings, must be remediated and tracked to closure. Repeated findings indicate a weak improvement loop.
- Third-party monitoring continues through the contract lifecycle: service levels, audit reports, subcontracting changes, exit readiness and concentration risk.
- Use metrics and key risk indicators, internal audit and management reporting to evidence continual improvement. Supervisory feedback should be incorporated into the roadmap.
Worked example
After a major incident, an insurer completes the final report but also updates its backup configuration, adds a provider escalation contact and changes its incident classification threshold. The reasoning: DORA's review cycle is not a documentation exercise. The incident revealed a control weakness, and the improvement must be evidenced through changed procedures, owners and follow-up testing.
Traps that cost marks
- Treating the annual review as a tick-box policy refresh with no management-body approval.
- Closing audit or testing findings without root-cause remediation and verification.
- Ignoring third-party changes such as new subcontractors or data locations.
- Failing to connect lessons learned to training, risk tolerance and future test scope.