The DORA register of information in 30 minutes: a walkthrough of the checklist

Who is in the room

The register of information (DORA Article 28(3)) touches four teams, which is why it stalls. For the walkthrough you need three people, not four: procurement or vendor management (who holds contracts), IT architecture or operations (who knows which provider delivers which service), and the person accountable for DORA (who decides criticality and owns the register). Business continuity’s input — which functions are critical or important — should exist already; if it does not, that is the first “No” and the meeting is shorter.

Print or open the register-of-information checklist — six sections, eighteen questions — and set a timer.

Minutes 0–5 — Providers (section A)

Open whatever list of ICT providers exists: the vendor master, the contract register, the accounts-payable export. Ask three things per provider: legal name and country, whether an LEI is on file, whether the provider is intra-group. Do not clean the list; count it. “We have 40 vendors, 22 are ICT, 3 are intra-group, LEIs for 9” is the answer — everything else is section A’s homework.

Partly here almost always means: the list exists in procurement’s tool and nowhere the register can read it.

Minutes 5–12 — Services (section B)

This is where most rooms slow down, so hold the format tight. For the five providers that matter most (start with the ones under payments, customer data, core banking or trading), name the ICT service each delivers as its own thing: “hosting for the payment gateway”, “managed identity”, “core-banking SaaS”. One provider, several services, is normal — and the register lists services, not contracts. If the service exists only as a line in a contract and nowhere in the architecture, mark B1 “Partly” and write down which provider.

Minutes 12–18 — Functions and criticality (section C)

Take the same five services and ask: which business function depends on each, and is that function critical or important under your written criterion? If the criterion is not written down, that is C2’s “No” and it outranks everything else on the sheet — criticality drives which arrangements go in the flagged part of the register and which get exit plans. If it is written down, walk it: provider → service → function → critical? Three links; if any of the three is missing, the register cannot be produced for that arrangement.

Minutes 18–23 — Contracts (section D)

Now, and only now, open the contracts — for the arrangements that landed on a critical or important function. Reference, dates, governing law: usually a “Yes”. The Article 30 provisions (audit and access rights, incident cooperation, exit and termination): usually a “Partly”, and the gaps are findings, not paragraphs — one per missing clause, with an owner. Cost per arrangement: “Yes” if procurement can export it, otherwise “Partly”, never “No” — the number exists somewhere.

Minutes 23–28 — Concentration, substitutability, exit (section E)

Three questions, and the answers are risk statements: is one provider under several critical functions (count it from section C), does each critical service have a substitutability assessment, does each have an exit plan that was ever tested. Most rooms score one “Yes” here. Do not argue; record it — this is the section the yearly review will show moving.

Minutes 28–30 — Producing it (section F)

Can the register be produced from the records you just walked, at entity level and, if applicable, sub-consolidated and consolidated? Can the yearly report of new critical arrangements be produced from it? Is a change to a provider or a service reflected the same day? Honest answers at this point are usually “Not yet, and now we know why”: section B or C.

Reading the result

Count the “No” per section. In practice the shape is almost always the same: A “Partly”, B “No/Partly”, C “Partly”, D “Yes/Partly”, E “No”, F “No”. That shape says: the contracts are fine; the links are missing. The remediation is not a document — it is making the provider, the service and the function records exist and pointing them at each other. Once they do, D attaches, E becomes queries, and F is an export.

Repeat the half hour before each yearly report; keep the previous sheet. Section E moving from three “No” to two “Partly” is the sentence your management body wants to hear.

In Secantra

The walkthrough maps onto the third-party registry (provider record with legal name, country, type, LEI, criticality and the critical-function flag) linked to IT services and business solutions in the CMDB, with criticality carried by the function; concentration and substitutability as risk register entries linked to the provider; exit plans as governance documents; contract copies as evidence items on the provider record. The register itself is a projection of those records — the template is yours to fill from them.

Checklist

• Three people, one printed checklist, thirty minutes — do not clean data during the walk
• Providers counted, not cleaned; services named per provider; functions and criticality walked as three links
• Contracts opened last, only for arrangements on critical or important functions; Article 30 gaps become findings
• Section E recorded as risks and documents, not debated
• The sheet kept and repeated before every yearly report