DORA263 - Audit frequency limitations
Question ID
DORA263
Receiving ESA
ESMA
Final publishing date
Question
As DORA requires financial entities to pre-determine the frequency of audits and inspections on the basis of a risk-based approach, are financial entities not permitted to agree on a maximum audit frequency (e.g. once per year) with their ICT third-party service providers?
Topic
Subject matter
Audit frequency limitations