The gap most DORA assessments miss

Most DORA gap assessments I’ve seen focus on policy. Do you have an ICT risk policy? Yes. Does it name a third-party risk owner? Yes. Box ticked.

What they don’t check is whether anyone would actually recognise a breach of impact tolerance in real time — not in the register, in the moment, on a Tuesday afternoon, when a payments processor goes down and someone has to decide, fast, whether this counts.

That’s the gap that costs firms in a real incident. Not the paperwork behind it — the paperwork usually reads fine. It’s the distance between what the policy says and what would actually happen if it were tested for real, under pressure, without warning.

A DORA Sprint is built to find that distance specifically — not just confirm the policy exists, but pressure-test whether the organisation would recognise and respond to a real event the way the policy assumes it would.