-
Aviation Advisory
Our dedicated Aviation Advisory team bring best-in-class expertise across modelling, lease management, financial accounting and transaction execution as well as technical services completed by certified engineers.
-
Consulting
Our Consulting team guarantees quick turnarounds, lower partner-to-staff ratio than most and superior results delivered on a range of services.
-
Business Risk Services
Our Business Risk Services team deliver practical and pragmatic solutions that support clients in growing and protecting the inherent value of their businesses.
-
Deal Advisory
Our experienced Deal Advisory team has provided a range of transaction, valuation, deal advisory and restructuring services to clients for the past two decades.
-
Forensic Accounting
Our Forensic and Investigation Services team have targeted solutions to solve difficult challenges - making the difference between finding the truth or being left in the dark.
-
Financial Accounting and Advisory
Our FAAS team designs and implements creative solutions for organisations expanding into new markets or undertaking functional financial transformations.
-
Restructuring
Grant Thornton is Ireland’s leading provider of insolvency and corporate recovery solutions.
-
Risk Advisory
Our Risk Advisory team delivers innovative solutions and strategic insights for the Financial Services sector, addressing disruptive forces, regulatory changes, and emerging trends to enhance risk management and foster competitive advantage.
-
Sustainability Advisory
Our Sustainability Advisory team works with clients to accelerate their sustainability journey through innovative and pragmatic solutions.
![Is your business sufficiently protected against cyberattack?](/globalassets/1.-member-firms/ireland/insights/2024/listing-images/is-your-business-sufficiently-protected-against-cyberattack-464x422.jpg)
-
Corporate Accounting and Outsourcing
At Grant Thornton we have extensive knowledge and experience in providing tailored solutions to our clients, whether on a short-term or long-term basis.
-
Financial Services Audit
Our Financial Services Audit team offers expertise and knowledge along with a horizontal approach to solving clients’ problems and queries.
-
Global Statutory Audit
Our Global Statutory Audit team ensures your statutory audit process follows a well-defined project plan, with no surprises, to maintain compliance across multiple jurisdictions. We invest time to understand your finance function and develop bespoke solutions built on the premise of central effort to remove duplication.
-
Pension Audit
The Grant Thornton Pension Audit team has vast experience in managing schemes and preparing annual reports on them for clients.
![Asset management of the future](/globalassets/1.-member-firms/ireland/insights/2024/listing-images/asset-management-of-the-future-listing.jpg)
-
Corporate Tax
Our Corporate Tax team is made up of more than 40 highly experienced senior partners and directors who work directly with a wide range of domestic and international clients; covering Corporation Tax, Company Secretarial, Employer Solutions, Global Mobility and Tax Incentives.
-
Financial Services Tax
The Grant Thornton team is made up of experts who are fully up to date in terms of changing and evolving tax legislation. This is combined with industry expertise and an in-depth knowledge of the evolving financial services regulatory landscape.
-
Indirect Tax Advisory & Compliance
Grant Thornton’s team of indirect tax specialists helps a range of clients across a variety of sectors including pharmaceuticals, financial services, construction and property and food to navigate these complexities.
-
International Tax
We develop close relationships with clients in order to gain a deep understanding of their businesses to ensure they make the right operational decisions. The wrong decision on how a company sells into a new market or establishes a new subsidiary can have major tax implications.
-
Private Client
Grant Thornton’s Private Client Services team can advise you on all areas of financial, pension, investment, succession and inheritance planning. We understand that each individual’s circumstances are different to the next and we tailor our services to suit your specific needs.
![Investing in Ireland 2024](/globalassets/1.-member-firms/ireland/insights/2024/listing-images/investing-in-ireland-464x422.jpg)
![insight featured image](/globalassets/1.-member-firms/ireland/insights/2024/featured-banners/countdown-to-compliance-5-steps-1000x500.jpg)
Receive the latest insights, news and more direct to your inbox.
This wide-reaching legislation aims to strengthen the digital operational resilience of the financial services sector. Built upon five pillars, it contains rigorous requirements for ICT-risk management, incident reporting, testing, third-party risk management and information sharing.
Implementing DORA’s requirements can be overwhelming, and knowing where to begin can be difficult. Below are five practical steps that firms can take to become DORA ready.
Understand the principle of proportionality
Because of the diverse nature of the financial services sector, DORA employs the principle of proportionality. This challenging but critical aspect of compliance means that entities’ regulatory requirements will differ depending on their size and risk profiles and the scale, nature and complexity of their businesses.
For example, large institutions providing multiple services, such as Ireland’s three pillar banks, must establish a fully-fledged ICT risk management framework that addresses all appropriate areas from DORA’s Level 1 and Level 2 texts. However, smaller entities, such as boutique trading firms, can avail of a simplified ICT-risk management framework covering only the areas relevant to their function, services and industry.
Testing requirements also differ depending on proportionality. All entities must set up a general testing programme and comply with digital testing requirements, but through industry engagement with the Central Bank of Ireland (CBI) in recent months, the indication is that only about 10-15 institutions in Ireland will initially fall within scope of the advanced threat-led penetration testing requirements laid out in Articles 26 and 27.
The application of proportionality seeks to create a high standard for the sector as a whole, while protecting smaller organisations from unnecessary regulatory encumbrances. Since DORA does not take a one-size-fits-all approach to compliance, institutions should begin their compliance journey with a scoping exercise to confirm a right-sized approach to meet regulatory requirements without taking on needless regulatory burdens.
Perform a holistic gap assessment
DORA’s five pillars touch many components of business operations, so organisations should analyse their entire operating model to determine which groups and business functions the legislation affects.
They should bring together the stakeholders from each affected area to ensure that everyone understands their role in the compliance journey. Business as usual will continue throughout the implementation timeline, and having a collaborative approach to the planning stage helps stakeholders align on DORA-related priorities and responsibilities from the get-go.
When conducting the business-wide gap assessment, entities should also inspect existing processes to determine if they can be used for DORA compliance. All firms practice digital operational resilience to some extent, and with a comprehensive review, in many instances they’ll discover that they can enhance some of their existing procedures to satisfy DORA requirements.
Leveraging and improving existing procedures saves time and allows entities to focus their effort and resourcing on the areas where they’ll need to start from scratch to build practices that achieve compliance.
Be strategic about remediation activities
When building a remediation roadmap, entities should address the compliance areas that need the most work first. Drafting new frameworks, evaluating them against the legislation and scrutinising their effectiveness will take time. Areas with significant compliance gaps must be addressed thoroughly, and an imminent implementation deadline can create unnecessary pressure on employees.
Whenever possible, businesses should align their remediation plans with existing transformation roadmaps. To remain competitive, many organisations are already executing transformation roadmaps—digital, operational, environmental, etc. These businesses should ground DORA changes within their existing plans.
For instance, if a current transformation roadmap has a timeframe for updating contracts with third-party suppliers, the business should incorporate the additional contractual changes required by DORA as part of that review cycle.
![Digital Operational Resilience Act (DORA): Regulation Summary](/globalassets/1.-member-firms/ireland/insights/2024/listing-images/countdown-to-compliance-464x422.jpg)
Document decision-making
While the CBI expects firms to be compliant as possible by 17 January 2025, it has also recognised that “the regulation of digital operational resilience is not a once-and-done exercise and that is optimal to adopt a multi-year, multifaceted perspective”. When implementing largescale change programmes, certain business realities such as the lengthy process for updating third-party contacts, may prevent organisations from implementing all required changes within the timeframe in place.
The CBI will take such issues into account when evaluating compliance, but it has firm expectations that all entities must have established and begun work on an agreed implementation roadmap by the January deadline.
Firms should therefore be prepared to give an account of their DORA decision-making process. For instance, they should be able to explain the level of proportionality that they applied to their programme of work, show documentation of their framework development and remediation plan and provide evidence of just cause for any implementation delivery extending beyond the deadline along with a timeline for completion.
Ensuring oversight and alignment through risk and compliance functions (second line) and objective review and challenge from internal audit (third line) will show the application of a holistic delivery model to meet DORA requirements.
Plan to test digital operational resilience regularly
DORA requires that firms test digital operational resilience regularly (with the principle of proportionality determining the frequency of the review cycle), so DORA frameworks need to stay top of mind within organisations even after implementation projects stand down next year.
By increasing entity-wide awareness about maintaining digital operational resilience, businesses can help all employees understand that DORA frameworks shouldn’t exist in silos: they need to evolve alongside business practices. Any large-scale change—restructuring, operational changes, systems updates, etc.—should prompt an evaluation of the existing framework.
For instance, if a firm decides to overhaul its technology systems in 2026, then the DORA framework—despite only being a year old—may need updating to ensure continued compliance and meet the evolving business model of today.
How Grant Thornton can help with DORA compliance
At the outset, implementing DORA requirements can be daunting. The depth and breadth of requirements across areas such as incident reporting and third-party risk management require action, and knowing where to begin can be tricky.
We support institutions of all sizes in their ongoing journey to DORA compliance. Our first-hand experience, bolstered by our involvement with our EU network of firms, brings strength to our service offerings, and our clients attest that by clarifying the scope and key dependencies, we have helped them avoid potential pitfalls and ensured compliance to the standard required.
We can provide differing combinations of services to create a best-fit model for DORA implementation that meets your organisation’s specific needs and ensures compliance by the January 2025 deadline.