-
Aviation Advisory
Our dedicated Aviation Advisory team bring best-in-class expertise across modelling, lease management, financial accounting and transaction execution as well as technical services completed by certified engineers.
-
Consulting
Our Consulting team guarantees quick turnarounds, lower partner-to-staff ratio than most and superior results delivered on a range of services.
-
Business Risk Services
Our Business Risk Services team deliver practical and pragmatic solutions that support clients in growing and protecting the inherent value of their businesses.
-
Deal Advisory
Our experienced Deal Advisory team has provided a range of transaction, valuation, deal advisory and restructuring services to clients for the past two decades.
-
Forensic Accounting
Our Forensic and Investigation Services team have targeted solutions to solve difficult challenges - making the difference between finding the truth or being left in the dark.
-
Financial Accounting and Advisory
Our FAAS team designs and implements creative solutions for organisations expanding into new markets or undertaking functional financial transformations.
-
Restructuring
Grant Thornton is Ireland’s leading provider of insolvency and corporate recovery solutions.
-
Risk Advisory
Our Risk Advisory team delivers innovative solutions and strategic insights for the Financial Services sector, addressing disruptive forces, regulatory changes, and emerging trends to enhance risk management and foster competitive advantage.
-
Sustainability Advisory
Our Sustainability Advisory team works with clients to accelerate their sustainability journey through innovative and pragmatic solutions.
![Is your business sufficiently protected against cyberattack?](/globalassets/1.-member-firms/ireland/insights/2024/listing-images/is-your-business-sufficiently-protected-against-cyberattack-464x422.jpg)
-
Corporate Accounting and Outsourcing
At Grant Thornton we have extensive knowledge and experience in providing tailored solutions to our clients, whether on a short-term or long-term basis.
-
Financial Services Audit
Our Financial Services Audit team offers expertise and knowledge along with a horizontal approach to solving clients’ problems and queries.
-
Global Statutory Audit
Our Global Statutory Audit team ensures your statutory audit process follows a well-defined project plan, with no surprises, to maintain compliance across multiple jurisdictions. We invest time to understand your finance function and develop bespoke solutions built on the premise of central effort to remove duplication.
-
Pension Audit
The Grant Thornton Pension Audit team has vast experience in managing schemes and preparing annual reports on them for clients.
![Asset management of the future](/globalassets/1.-member-firms/ireland/insights/2024/listing-images/asset-management-of-the-future-listing.jpg)
-
Corporate Tax
Our Corporate Tax team is made up of more than 40 highly experienced senior partners and directors who work directly with a wide range of domestic and international clients; covering Corporation Tax, Company Secretarial, Employer Solutions, Global Mobility and Tax Incentives.
-
Financial Services Tax
The Grant Thornton team is made up of experts who are fully up to date in terms of changing and evolving tax legislation. This is combined with industry expertise and an in-depth knowledge of the evolving financial services regulatory landscape.
-
Indirect Tax Advisory & Compliance
Grant Thornton’s team of indirect tax specialists helps a range of clients across a variety of sectors including pharmaceuticals, financial services, construction and property and food to navigate these complexities.
-
International Tax
We develop close relationships with clients in order to gain a deep understanding of their businesses to ensure they make the right operational decisions. The wrong decision on how a company sells into a new market or establishes a new subsidiary can have major tax implications.
-
Private Client
Grant Thornton’s Private Client Services team can advise you on all areas of financial, pension, investment, succession and inheritance planning. We understand that each individual’s circumstances are different to the next and we tailor our services to suit your specific needs.
![Investing in Ireland 2024](/globalassets/1.-member-firms/ireland/insights/2024/listing-images/investing-in-ireland-464x422.jpg)
![insight featured image](/globalassets/1.-member-firms/ireland/insights/2024/featured-banners/countdown-to-compliance-1000x500.jpg)
Receive the latest insights, news and more direct to your inbox.
The Digital Operational Resilience Act (DORA) contains rules designed to strengthen the operational resilience of financial entities operating in the European Union. The legislation takes effect on 17 January 2025. Below, our DORA experts provide an overview of the regulation, the organisations it affects and the penalties for noncompliance.
What is DORA?
A comprehensive regulatory framework, DORA aims to safeguard the financial services sector and its customers against Information and Communication Technology (ICT)-related incidents by enhancing how organisations mitigate, document and react to potential threats and vulnerabilities.
DORA has introduced rigorous responsibilities for financial institutions and their essential third-party providers. It makes an organisation's management body—boards, executive leaders and senior stakeholders—responsible for ICT management by requiring that they define appropriate risk-management frameworks, assist in the execution and oversight of these strategies and stay abreast of the evolving ICT risk landscape.
How does DORA affect businesses?
Unlike previous regulations, DORA applies to all companies operating in the financial services sector, including traditional and digital banks, e-money and payment institutions, insurance and reinsurance, asset managers, credit institutions and private equity houses. It also holds these organisations accountable for detailing the oversight and management process of critical third-party providers within their ICT risk management frameworks.
Institutions are increasingly dependent on the services of third parties, such as cloud services and SaaS providers, to deliver digital offerings, which creates new risks for financial institutions and the market more broadly.
As seen during the July 2024 CrowdStrike outage, which affected airlines, banks, professional services firms and a wide array of other companies, incidents at third-party providers have wide-reaching implications. DORA aims to enhance financial institutions’ processes and policies for managing third-party providers, conducting due diligence and responding should a third-party incident occur.
How does DORA differ from other operational resilience regulations?
Operational resilience has been at the forefront of regulators’ agendas for the past few years. For instance, the Central Bank of Ireland brought in guidelines for operational resilience that took effect in December 2023. DORA, however, is more ambitious in terms of both the requirements for firms and the timeline for implementation.
For instance, DORA contains specific requirements for how firms should identify, react, report and classify major ICT-related incidents—all of which brings an enhanced level of risk management practice to the sector. Another good example is DORA’s requirements for digital operational resilience testing.
Currently, many financial services firms conduct testing; however, they do not necessarily have strong documentation, processes and controls around these tests. Once DORA takes effect, institutions must show an appropriate level of oversight, management and governance of testing and other critical components for operational resilience.
What are the five pillars of DORA?
DORA compartmentalises digital operational resilience into five key pillars.
This pillar aims to transform ICT-risk management from a reactive process to a proactive one. It involves the development and implementation of regular risk assessments, evaluation practices, mitigation strategies, incident response plans and processes for raising risk awareness throughout an organisation.
This pillar standardises the process for incident reporting within financial entities throughout the EU. It requires that institutions implement systems that monitor, detect, describe, report and analyse significant incidents.
Because DORA stresses the importance of transparency, the incident reporting framework must include procedures for reporting incidents to internal and external stakeholders.
This pillar ensures that financial institutions can survive cyber threats. It requires that organisations conduct periodic testing to evaluate their cyber vulnerabilities and responses and then improve their practices based on the results.
This pillar strengthens the relationship between financial institutions and their critical third-party providers. By mandating that institutions have detailed contracts with their ICT providers, conduct ongoing due diligence and have a robust process for offboarding, DORA aims to ensure that third-party relationships don’t compromise operational resilience.
This pillar seeks to raise operational resilience awareness and increase the sharing of practices/lessons learned throughout the sector. Organisations must share information securely to increase collaboration and resiliency among financial institutions.
What’s the penalty for noncompliance?
The European Supervisory Authorities (ESAs) have the power to impose fines for noncompliance. Firms that violate DORA’s requirements face fines of up to two percent of their total annual worldwide turnover, and an individual faces a maximum fine of 1,000,000 euro.
Third-party providers designated as critical by the ESAs face even higher fines for noncompliance— up to 5,000,000 euro or, for an individual, a maximum fine of 500,000 euro. If a financial entity fails to report a major ICT-related incident or threat, the ESAs can also impose a fine.
How Grant Thornton can help with DORA compliance
At the outset, implementing DORA requirements can be daunting. The depth and breadth of requirements across areas such as incident reporting and third-party risk management require action, and knowing where to begin can be tricky.
We support institutions of all sizes in their ongoing journey to DORA compliance. Our first-hand experience, bolstered by our involvement with our EU network of firms, brings strength to our service offerings, and our clients attest that by clarifying the scope and key dependencies, we have helped them avoid potential pitfalls and ensured compliance to the standard required.
We can provide differing combinations of services to create a best-fit model for DORA implementation that meets your organisation’s specific needs and ensures compliance by the January 2025 deadline.