Your Internal Audit team confirms: DORA compliance documentation is complete. ICT risk management framework? Documented. Incident response procedures? Documented. Third-party oversight protocols? Documented.
Then operational resilience testing begins.
Actual incident escalation time: 4 hours 17 minutes. Documented escalation target: 72 minutes. Gap: 365%.
What failed wasn't documentation—it was coordination. Your organisation passed the audit but failed the reality test.
The Documentation Paradox
The Digital Operational Resilience Act (DORA), effective January 2025 across EU financial institutions, mandates comprehensive ICT risk management, incident reporting, resilience testing, and third-party oversight. Most mid-market financial entities (insurance, investment, payment providers) respond by creating documentation.
The logic is simple: Regulators require documented procedures. Therefore, documenting procedures equals compliance.
This is the audit illusion—the belief that compliance exists in documentation rather than operational capability.
A French energy sector financial services provider (650 employees, €180M assets under management) discovered this gap during their Phase 1 DORA resilience testing. Their incident response playbook was exemplary: clear escalation paths, defined roles, comprehensive checklists.
The operational test: Simulate a ransomware attack affecting payment processing systems. Measure actual response versus documented procedures.
Results:
- Documented escalation time: 72 minutes to senior management
- Actual escalation time: 4 hours 17 minutes
- Root cause: Four handoffs between IT Operations, IT Security, Risk Management, and Executive Committee—each requiring manual intervention because systems didn't interoperate
The incident response playbook existed. But the Organisational Nervous System (Chapter 6, The Metacognitive Advantage) required to execute it did not.
Why 70% Documentation ≠ 70% Resilience
Research by the European Banking Authority indicates approximately 70% of financial institutions have documented compliance with DORA's core pillars. Yet operational resilience testing reveals significant gaps between documented procedures and actual capability.
The compliance gap appears in three forms:
1. Coordination Gaps
Documentation assumes seamless handoffs. Reality reveals manual translation layers at every functional boundary.
Example: Your third-party risk register lists 47 critical ICT providers. But when testing reveals a cascade failure (Provider A's outage triggers failures in Providers B, C, and D), no single department has visibility into the dependency chain. Risk Management owns the register. IT Operations manages the relationships. Procurement holds the contracts. Nobody coordinates across all three.
2. Escalation Gaps
Documentation specifies "immediate escalation" protocols. Reality reveals hierarchical barriers that slow decisions.
Example: DORA requires reporting major ICT incidents to supervisory authorities within 4 hours of classification. Your procedure documents this timeline. But "classification" requires sign-off from IT Security Manager, Risk Management Director, and Chief Risk Officer—three approval layers that add 180+ minutes to the escalation path.
3. Learning Gaps
Documentation captures lessons from past incidents. Reality reveals whether those lessons change behaviour.
Example: Post-incident review from 2024 Q2 incident identified communication breakdown between IT and Risk. Recommendation: implement shared dashboard. Status nine months later: recommendation documented but not implemented. Your Adaptive Immune System (Chapter 6) generated insight but didn't translate it into operational change.
The RESONANCE™ Diagnosis: Three Foundation Phases
DORA compliance exposes precisely where your organisation's cultural architecture enables or prevents coordination under pressure. The RESONANCE™ Framework (Chapter 7, The Metacognitive Advantage) provides structured methodology for closing documentation-reality gaps:
Phase 1: Audit
DORA application: Map actual coordination paths, not documented procedures.
During ICT incident response simulation:
- Measure actual escalation speeds (not documented targets)
- Identify manual translation layers between functions
- Assess whether cross-functional teams share common vocabulary
Deliverable: The operational resilience reality map showing where coordination breaks down
Critical insight: Your Organisational Nervous System either coordinates automatically or requires human intervention at every handoff. DORA testing reveals which you've built.
Phase 2: Scoping
DORA application: Define operational resilience as cross-functional capability, not IT project.
Unified programme covering:
- ICT risk management (IT Security + Enterprise Risk Management)
- Incident response (IT Operations + Communications + Legal)
- Third-party oversight (Procurement + Risk + IT)
- Resilience testing (Internal Audit + all operational functions)
Deliverable: The DORA programme charter with cross-functional governance
Critical insight: Scoping determines whether you build documented compliance or operational capability.
Phase 3: Boundaries
DORA application: Create psychological safety for honest escalation.
Establish protocols where:
- Teams escalate potential incidents without penalty (even false alarms)
- Cross-functional coordination is rewarded over departmental heroics
- Learning from failures carries no blame, only improvement expectations
Deliverable: The operational resilience behavioural charter
Critical insight: Your Pain Reflex (Chapter 6) determines whether teams escalate early (enabling coordinated response) or hide problems (guaranteeing coordination failure).
What You've Discovered
If DORA resilience testing reveals gaps between documented procedures and operational capability, you've diagnosed something fundamental about your organisation:
You have compliance documentation but no coordination architecture.
DORA doesn't create this gap—it exposes it. The regulation functions as organisational stress test, forcing diagnosis of whether your Organisational Nervous System connects under pressure or fragments into departmental silos.
Financial institutions that achieve genuine operational resilience don't simply document better procedures. They build the cultural capability that makes coordination automatic rather than heroic.
Take Action
Detailed methodology available:
The complete RESONANCE™ Framework with DORA-specific resilience applications is available in The Metacognitive Advantage: Your Compass for Transforming EU Digital Regulations into Strategic Capability.
Online assessment:
Evaluate your organisation's operational resilience across the Three Cultural Predictors (Organisational Nervous System, Pain Reflex, Adaptive Immune System) with our free diagnostic tool:
The critical question:
When the next major ICT incident occurs—will your organisation execute its documented procedures? Or will it discover that documentation compliance is not the same as operational capability?
Xavier Minali | Digital Transformation & Operations Consultant | 15+ years optimising complex operations
