PwC · Tech Consulting · Medium · 25-35 min

EU Bank Getting Ready for DORA

EU Bank Getting Ready for DORA is a medium PwC tech consulting case interview that runs 25-35 min. A euro-area bank — €90B assets, retail and SME — relies on 160 ICT vendors and runs payments and digital banking on a single US hyperscaler region pair. A strong answer works through 5 phases: Translate DORA into artifacts the supervisor will ask to see: function list, incident taxonomy, test evidence, ICT register; Identify critical or important functions and the vendors; Design the concentration and exit story: what can fail over, what cannot, and the contractual clauses still missing; Set a testing cadence (including threat-led testing if in scope) that produces evidence, not a slide; Spend the €12M on the gaps in the register, contracts, and failover.

Last updated 2026-09-05

The brief

A euro-area bank — €90B assets, retail and SME — relies on 160 ICT vendors and runs payments and digital banking on a single US hyperscaler region pair. DORA is in force: ICT risk management, incident classification and reporting, resilience testing, and the register of contractual arrangements with ICT providers. The supervisor's last letter asked for the critical-or-important function list and evidence of an exit plan for the cloud provider. The CISO has a €12M program budget and wants to buy a GRC tool. You are the lead. The board meets in eight weeks.

How to approach it

  1. Translate DORA into artifacts the supervisor will ask to see: function list, incident taxonomy, test evidence, ICT register
  2. Identify critical or important functions and the vendors — especially the hyperscaler — that support them
  3. Design the concentration and exit story: what can fail over, what cannot, and the contractual clauses still missing
  4. Set a testing cadence (including threat-led testing if in scope) that produces evidence, not a slide
  5. Spend the €12M on the gaps in the register, contracts, and failover — and say what the GRC tool does not fix

What a strong answer does

  • Starts from the supervisory letter, not from a tool shortlist
  • Names cloud concentration as the board-level risk and proposes a real exit or portability test
  • Builds the register of ICT arrangements as a controlled list with owners, not a spreadsheet dump
  • Ties incident classification to the reporting clock
  • Tells the board which functions are untested and what €12M will evidence by the next visit

Red flags interviewers score down

  • Buys a GRC platform and calls the program done
  • Claims multi-AZ in one provider is an exit plan
  • Omits the contractual register because architecture is more interesting
  • No owner for a major incident on a Sunday

Cases are written in each firm's style, written and reviewed by working consultants; they are not the firms' own published cases.

More PwC cases