Asset Management | DORA/ICT | Key DORA inspection report: Finanstilsynet’s findings for asset managers
On 14 October, Finanstilsynet published a key DORA inspection report. The inspection was carried out at a Norwegian investment firm, but the findings will be relevant for all Norwegian asset managers subject to DORA. The report offers concrete insights into what Finanstilsynet expects to see documented under DORA. Below we set out the seven areas where Finanstilsynet found deficiencies, with the legal basis, what Finanstilsynet found and the documentation it accepted as remediation. The accepted documentation can serve as a checklist for a self-assessment before an inspection is announced. Our comments follow at the end.
Why this matters, and for whom
Authorised AIFMs, UCITS management companies and investment firms are subject to the Norwegian Act on Digital Operational Resilience of 2025, which implements DORA in Norway. The findings track DORA Articles 5 to 11 and Article 28, so a fund manager would be asked the same questions as the investment firm in Finanstilsynet’s inspection.
Findings and remediation
1. ICT strategy
Asset managers shall have an internal governance and control framework that ensures the effective and sound management of ICT risks, in order to achieve a high level of digital operational resilience (cf. DORA Article 5(1)). The board approves the digital operational resilience strategy and sets the firm’s tolerance level for ICT risk (cf. DORA Article 5(2)). DORA Article 6(8) sets out substantive requirements for the undertaking’s strategy for digital operational resilience.
Finanstilsynet’s findings
What Finanstilsynet accepted
Finanstilsynet found an ICT strategy that did not:
explain how the ICT risk management framework supports the business strategy,
set risk tolerance,
contained information security objectives with indicators and reporting requirements,
sufficiently link to overarching objectives or strategies, or
entail associated key performance indicators and reporting requirements
Board-approved ICT strategy (meaning the digital operational resilience strategy) linked to the business strategy.
Framework to ensure consistency between the ICT strategy and underlying governing documents (including document responsibility and annual plan).
2. Internal control
Responsibility for managing and controlling ICT risk must be assigned to a control function with an appropriate level of independence (cf. DORA Article 6(4)).
Finanstilsynet’s findings
What Finanstilsynet accepted
Finanstilsynet found that the firm:
carried out controls of its own ICT operations and of services delivered under ICT service agreements only to a limited extent,
based its follow-up mainly on deviation reporting, without systematic controls of whether the requirements in its own governing documents were complied with,
had not operationalised its board-approved ICT governing documents through an established control regime, and
had not established sufficient independent control of compliance with ICT requirements.
A control routine naming each control activity, the responsible line of defence, the frequency and the documentation required.
A first documented round of controls.
Periodic reporting of the status of controls to management and the board.
3. The business impact analysis
Asset Managers shall carry out a business impact analysis (BIA) to assess the business consequences of ICT disruptions, using quantitative and qualitative criteria, internal and external data and scenario analysis (cf. DORA Article 11(5)).
Finanstilsynet’s findings
What Finanstilsynet accepted
Finanstilsynet found that:
the firm had not carried out a business impact analysis,
the list of critical ICT systems was not based on a systematic analysis of the business consequences of ICT disruptions (but mainly on experience),
the firm had no routines for carrying out and maintaining such an analysis, and
the firm had business continuity and crisis management plans that were not designed on the basis of documented business priorities and dependencies.
A business impact analysis owned by the business side and considered by the board.
A system portfolio stating criticality and acceptable downtime per system.
Results communicated to the relevant providers.
A routine for annual update.
4. Change management
Asset managers must have documented policies, procedures and controls for managing ICT changes (cf. DORA Article 9(4)(e)). This includes changes to software, hardware, hardware components, systems or security parameters.
Finanstilsynet’s findings
What Finanstilsynet accepted
Finanstilsynet found that the firm:
had not established documented change management policies in accordance with DORA Article 9(4)(e),
let changes initiated by ICT service providers be handled through the providers’ own processes,
relied on clearance with the CEO and/or Head of ICT and on contractual requirements for notification and consent, but had no separate, documented change management routine, and
therefore, lacked a comprehensive, documented framework ensuring governance and control of all changes affecting its ICT operations, including changes made by service providers.
Separate change management procedure for both internal and provider-initiated changes, including: (i) requirements for a change log, (ii) segregation of duties, (iii) testing, (iv) rollback and (v) the handling of emergency changes.
Fixed notification procedure with the service provider.
5. Third-party ICT risk
Asset managers shall continuously identify ICT risk sources and at least annually review risk scenarios (cf. DORA Article 8(2)). Article 28(2) requires a strategy and policy for ICT services supporting critical or important functions.
Finanstilsynet’s findings
What Finanstilsynet accepted
Finanstilsynet found that the firm:
had deficient assessments of ICT risk and of risk related to the use of ICT service providers,
recorded probability and consequence in its annual risk analysis without describing the basis for the assessments,
lacked sufficient information about the services delivered by its ICT service providers to make more detailed assessments, and
therefore, did not have a sufficient basis to identify and assess ICT risk related to services delivered by third parties.
A routine for provider risk analysis with documented reasoning.
A register of ICT service agreements.
Documented exit strategies.
New risk assessments based on documentation obtained from the ICT service providers.
6. ICT security
Asset managers must have robust security mechanisms in place to protect ICT systems and data (cf. DORA Art. 9). Specifically, this requires procedures securing confidentiality, integrity and availability (Article 9(2)), and restriction of access to ICT systems to what is necessary for legitimate and authorised functions and activities.
Finanstilsynet’s findings
What Finanstilsynet accepted
Finanstilsynet found that the firm:
did not control whether ICT service providers complied with the firm’s ICT security requirements, including access management,
had an overview of ICT service providers’ access to its production environment that Finanstilsynet questioned, and
had not established sufficient control routines to verify that the confidentiality, integrity and availability of critical systems and data were safeguarded.
Internal management of user rights to systems with sensitive customer information with access for suppliers only after prior approval.
Fix controls over access and authorisations.
7. Continuity testing must use severe scenarios and start from the analysis
Asset Managers must have robust and documented contingency and business continuity plans to ensure the continuity of operations in the event of serious ICT incidents (cf. DORA Article 11(1)). Article 25 of the technical standards adds that plans must take account of the business impact analysis, that testing must use plausible and severe scenarios including ICT service deliveries, and that results must be documented and deficiencies reported to management.
Finanstilsynet’s findings
What Finanstilsynet accepted
Finanstilsynet found that the firm:
had not tested its contingency and continuity solutions,
documented annual assessments of its operating solution, but these were not based on incident scenarios that could cause severe operational disruptions, and
had no documentation showing that the tests were based on the firm’s business impact analysis.
A documented scenario-based test using plausible and severe scenarios.
Measures following the test reported to the board.
Continuity plans revised on the basis of the business impact analysis.
BAHR comments
The inspection was initiated on 17 September 2025 and the final report is dated 28 September 2026. Within that period the firm had to essentially rebuild its ICT strategy, control framework, business impact analysis, change management routine, provider risk assessments and continuity testing, alongside its ordinary compliance work. A remediation programme of that scope, run against the supervisor’s deadlines, occupies management, compliance and ICT resources for the better part of a year. Revising and strengthening the DORA governance framework before a potential inspection is announced costs less and leaves the firm in control of its own sequencing.
Our recommendation therefore is to put more effort into DORA integration. Finanstilsynet’s expectations are further shaping the DORA governance framework adding further practical aspects to adopt. This need not constrain business operations; it can strengthen them, as the same controls decide whether the firm can adopt new technology safely, such as AI tools. Finanstilsynet made the same connection in its 2026 Risk and Vulnerability Report, which flagged the use of generative AI outside established governance frameworks.
The exposure is not limited to a supervisory action. Attacks on the financial sector continue to increase, and the assets that matter most to an asset manager are client data, transaction data and investor registers.
The full inspection report is published on Finanstilsynet’s website.
