DORA Management Body Requirements: Board Obligations

Most governance frameworks recommend board involvement in risk oversight. DORA mandates it, with named obligations, an explicit knowledge requirement, and supervisory examination rights that extend to individual board members.

DORA entered into force on 16 January 2023 and became applicable on 17 January 2025. It applies directly across EU member states without national transposition, and its scope covers banks, investment firms, insurance undertakings, payment institutions, electronic money institutions, crypto-asset service providers, and a range of other regulated financial entities. In the UK, the Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA) are developing aligned operational resilience requirements; UK boards in internationally active firms face both regulatory regimes.

The principle running through DORA's governance architecture is accountability without delegation. Article 5(2) is explicit: the management body is responsible for defining, approving, overseeing, and taking accountability for the implementation of all arrangements related to the ICT risk management framework. That accountability sits with the board. A Chief Information Security Officer, a risk committee, or an external consultant can support the work, but the obligation remains with the management body.

DORA's definition of management body follows the existing EU supervisory framework. It refers to the board of directors, administrative body, or supervisory body, as determined by the entity's governance structure. In a two-tier board structure, this means the supervisory board. In a unitary structure, it means the board of directors.

The management body sits above the executive layer. Article 5(1) draws this distinction explicitly: senior management and the CEO are responsible for implementing the ICT risk management framework; the management body defines, approves, and holds that implementation to account. These are distinct functions with distinct accountability.

For firms with complex group structures, DORA applies at the level of the regulated entity. Each regulated entity's management body carries its own Article 5 obligations. Regulated subsidiaries must meet their own Article 5 duties through their own governance, regardless of group-level oversight arrangements.

Article 5(2) sets out 9 enumerated obligations, lettered (a) to (i), that sit with the management body. Each is a potential supervisory examination point. The table below unpacks each one into its practical components for governance purposes.

The breadth of this list is significant. It touches budget, audit, incident response, third-party risk, training, and culture. A board that engages with DORA only at the level of annual framework approval falls short of the standard Article 5 sets.

Article 5(4) introduces an obligation that goes beyond institutional compliance: management body members must maintain adequate knowledge and skills to understand and assess ICT risk. The Florence School of Banking and Finance has noted that this provision represents a significant shift from the traditional model of institutional accountability toward individual board member responsibility.

This obligation is enforceable. Under DORA's supervisory framework, national competent authorities, including the FCA and PRA in the UK, and the ECB and national regulators within the EU, have the power to examine management body members directly. The Joint Committee of the European Supervisory Authorities (ESAs) has issued guidance on supervisory convergence that reinforces this expectation.

DORA Article 50(5) requires member states to confer on competent authorities the power to apply administrative penalties to individual management body members responsible for a breach, subject to the conditions set out in national law. The precise scope of personal exposure depends on the national implementing legislation in the member state where the entity is regulated. In all cases, competent authorities, including national regulators and, for significant institutions, the EBA, EIOPA, and ESMA, have the right to examine management body members directly.

Article 5(4) sets the requirement without specifying the curriculum. In practice, supervisors and regulators will assess this through a combination of board minutes, training records, and direct examination.

A credible board-level ICT risk competency programme should address:

1. ICT risk taxonomy: the board should understand the categories of risk DORA addresses, including availability, integrity, continuity, and security, and be able to discuss them in terms of business impact rather than technical detail.
2. Threat landscape awareness: sufficient understanding of major risk trends, including ransomware, supply chain attacks, and cloud concentration, to challenge management on the entity's exposure.
3. Framework literacy: the board should be able to read and interrogate an ICT risk management framework, understanding risk appetite statements, tolerance thresholds, and control effectiveness reporting.
4. Regulatory obligations: board members should understand what DORA requires of the entity, including the major incident reporting timelines under Article 19 (initial notification within 4 hours of classifying an incident as major, intermediate report within 72 hours, final report within one month per the implementing technical standards under Article 20).
5. Third-party risk: given DORA's extensive Chapter V on ICT third-party risk management, the board should understand the entity's critical ICT third-party dependencies and the concentration risks they represent.

Training records serve an evidential function. They demonstrate that the board has been exposed to relevant content and given the opportunity to develop competency. Supervisors can and do probe beyond records: the board must be able to demonstrate understanding in direct examination.

The gap between board accountability on paper and demonstrable board engagement in practice is where supervisory examination risk concentrates. Evidence of genuine engagement takes several forms.

Board minutes

Record substantive discussion alongside approvals. Minutes that capture only 'the board approved the ICT risk management framework' are weaker than minutes showing the board asked specific questions about risk appetite thresholds, challenged management on a control gap, or requested further information before approving.

Reporting cadence and content

Regular ICT risk reports to the full board, rather than exclusively to an audit or risk committee, demonstrate ongoing oversight. Reports should be in language accessible to non-technical board members and should address risk appetite utilisation alongside operational metrics.

Risk appetite statements

A board-approved ICT risk appetite statement that is specific, measurable, and connected to the entity's business model is strong evidence of genuine ownership. Generic statements that could apply to any firm are a supervisory red flag.

Training records

Document who attended, what was covered, when, and how comprehension was assessed. External training from recognised sources adds credibility.

Escalation records

Evidence that the board has received and acted on ICT incident escalations, including major incidents reported to competent authorities under Article 19, demonstrates that the accountability chain is functioning.

Third-party oversight

Board-level visibility of the Critical ICT Third-Party Provider (CTPP) register, key concentration risks, and exit strategies for critical providers demonstrates the breadth of engagement DORA requires.

Many in-scope firms have existing risk committee or audit committee structures. DORA leaves the choice of committee configuration to the entity. What the regulation requires is that the full management body retains the obligations Article 5 assigns to it. Delegation to a committee reduces the board's operational workload; the accountability remains with the management body.

A workable structure for most firms:

1. Dedicated board agenda item for ICT risk. At least quarterly, with a standing paper covering risk appetite utilisation, major incidents, third-party risk concentration, and framework changes.
2. Annual framework review. A formal board resolution approving the ICT risk management framework, with documented substantive discussion.
3. Incident escalation protocol. A defined process for escalating major ICT incidents to board level, aligned with DORA Article 19 reporting timelines.
4. Annual competency assessment. A structured review of board-level ICT risk knowledge, with training delivered by qualified practitioners.
5. Supervisory examination preparation. A periodic exercise in which board members respond to likely supervisory questions, stress-testing their ability to articulate risk appetite, explain framework governance, and describe incident response oversight.

The evidence burden Article 5 creates is real, but it is manageable when governance infrastructure, processes, and reporting are properly aligned. The firms that struggle under supervisory examination are those that built their DORA response as a documentation exercise rather than a governance one