DORA stiller skærpede krav til den finansielle sektors digitale operationelle modstandsdygtighed. Virksomhederne skal kunne forebygge, opdage, håndtere og genetablere driften efter IKT-relaterede hændelser. Kravene omfatter blandt andet ledelsesansvar, IKT-risikostyring, hændelsesrapportering, test af digital operationel modstandsdygtighed og styring af IKT-leverandører. RSM hjælper jer med at forstå, hvilke krav der gælder, identificere gaps og omsætte reguleringen til processer og kontroller, som fungerer i praksis.

Er I omfattet – eller møder I kravene gennem jeres kunder?

DORA gælder direkte for en bred række finansielle virksomheder, herunder banker, betalingsinstitutter, forsikringsvirksomheder, pensionsselskaber, investeringsselskaber og visse virksomheder inden for kryptoaktiver. 

IKT-leverandører kan også blive berørt, selv om de ikke selv er direkte omfattet. Finansielle virksomheder skal stille konkrete krav til deres IKT-leverandører, risikovurdere leverancerne og have overblik over deres kontraktuelle IKT-arrangementer. Det kan medføre nye krav til blandt andet kontrakter, dokumentation, hændelsesrapportering, auditadgang, kontinuitet og exitplaner. 

Sådan hjælper vi jer

Overblik over krav og ansvar

Vi afklarer, hvordan DORA påvirker jeres organisation, systemer, leverandører og kundeaftaler.

Det omfatter typisk:

  • Ledelsesansvar og governance
  • IKT-risikostyring
  • Håndtering og rapportering af hændelser
  • Beredskab, kontinuitet og genetablering
  • Test af digital operationel modstandsdygtighed
  • Risikostyring af IKT-tredjeparter
  • Kontraktkrav og leverandøropfølgning
  • Register over IKT-leverandører

DORA placerer det overordnede ansvar for IKT-risici hos ledelsesorganet og kræver en dokumenteret ramme, som indgår i virksomhedens samlede risikostyring. 
 

GAP-vurdering og roadmap

Vi vurderer jeres nuværende setup op imod de relevante DORA-krav og identificerer, hvor der mangler processer, kontroller eller dokumentation.

I får et prioriteret roadmap med:

  • Identificerede gaps og risici
  • Anbefalede aktiviteter
  • Ansvarlige funktioner
  • Prioritering og tidsplan
  • Nødvendige dokumentationskrav

Målet er ikke blot at udarbejde nye politikker, men at skabe et operationelt setup, som kan anvendes og dokumenteres i den daglige drift.

Implementering og opfølgning

Vi hjælper efter behov med at etablere eller forbedre de nødvendige processer og kontroller.

Det kan eksempelvis være styring af IKT-risici, hændelsesprocesser, beredskabsplaner, testprogrammer, leverandørregistre, kontraktkrav og ledelsesrapportering.

Skal I dokumentere DORA-relaterede kontroller over for kunder?

IKT-leverandører til den finansielle sektor oplever i stigende grad krav om at dokumentere, hvordan de understøtter kundernes efterlevelse af DORA.

Det kan medføre gentagne spørgeskemaer, kundeaudits og krav om dokumentation for blandt andet:

  • Informationssikkerhed og adgangsstyring
  • Hændelseshåndtering
  • Beredskab og genetablering
  • Sårbarheds- og sikkerhedstest
  • Styring af underleverandører
  • Overvågning og rapportering
  • Kontraktuelle DORA-forpligtelser

Hvis kunderne efterspørger uafhængig dokumentation, kan en ISAE 3000 DORA erklæring være relevant. En ISAE 3000 DORA erklæring kan målrettes de kontroller, der understøtter leverandørens DORA-relaterede forpligtelser, og give relevante kunder indsigt i, hvilke kontroller der er omfattet, hvordan de er testet, og hvilke resultater testen har givet. 

Et enkelt og målrettet forløb

  1. Afklaring: Vi fastlægger, hvordan DORA påvirker virksomheden og jeres leverancer.
  2. GAP-vurdering: Vi identificerer mangler i processer, kontroller og dokumentation.
  3. Roadmap: I får en prioriteret plan med tydelige aktiviteter og ansvar.
  4. Implementering: Vi hjælper med at etablere de nødvendige løsninger.
  5. Dokumentation: Ved kundekrav kan en særskilt ISAE 3000-erklæring være næste skridt.

Acquisition, sale and merger of companies

Buying and selling a business can be a complicated affair. Therefore, it requires a solid coverage of the company's strengths and weaknesses, both on the part of the buyer and the seller. 

 

Advice in the event of a change of ownership 

At RSM Denmark we can help you with your change of ownership. We specialize in consulting when buying and selling companies. 

 

Acquisition of business  

Have you just taken over a business, or are you merely thinking of buying an existing business? Then you are in good hands at RSM. We provide qualified advice, help and guidance for all types of business acquisitions - from start to finish. 

 

Sale of business 

Certainly, it is not only the acquisition of a business that we can advise you about - we can of course also help when you as a business owner is sitting at the other side of the table intending to sell. At RSM Denmark, we have great respect for the effort required to build and manage a company, and we always work hard to ensure that the entire transfer process runs as smoothly and satisfactorily as possible. 

 

Advice when buying a business 

  • We help you with valuation of the company, so you are guaranteed a fair purchase price. 
  • We advise you in all aspects of the business acquisition, including:
    • Help in preparing the financing structure so that you achieve financial balance. 
    • Review of the company's tax conditions and positions.
    • Thorough consideration of all matters in connection with the takeover, ethical as well as business related.
    • Review of the time frame of your investment, both in the short and long term. 
    • Assistance in the event of a divestment of parts of the company after takeover.
    • Preparation of exit model so that you are well prepared when you want to resell.
  • We participate in purchase negotiations with the seller alongside you, so you always have a competent advisor by your side. 
  • We perform due diligence on taxes and other financial matters in the company, so you both avoid unpleasant surprises as well as achieve the optimal tax position.
  • We act as a coordinator throughout the entire acquisition process. 
  • We obtain all the necessary guarantees and assurances from the seller so that you do not take on unnecessary financial risks.
  • We prepare the purchase agreement for you and close all legal gaps.
  • We help you raise a loan, if necessary, and ensure you the optimal loan conditions.

 

Advice when selling a business

  • Utfylling av MVA-oppgaver
  • We review and map out the company's financial conditions. 
  • We make sure to prepare an overall plan for the sales process. 
  • We help you prepare your business for sale. 
  • We create an overview of all the company's investments. 
  • We carry out risk management and perform due diligence. 
  • We help to develop a detailed takeover model. 
  • We help you with the company's financial management and budgeting. 
  • We optimize and streamline the company's financial conditions, including tax.
  • We make the complicated and necessary calculations, so that you do not have to. 
  • We ensure proper valuation of the business so you can demand the right selling price. 
  • We help you identify potential buyers. 
  • We help prepare for the transfer of the company when the next generation is ready behind the scenes.

Due diligence - when buying a business 

Due diligence is the process that ensures and controls the actual preconditions for the transfer of companies. It also includes a similar process of merger and establishment of collaboration between companies. 

The process is carried out to a greater or lesser extent, regardless of whether assets, activities or companies are transferred. The work includes a review of legal, financial and other matters relevant to a planned or intended transfer or transfer of rights and obligations. 

The process is carried out in collaboration with you and by further agreement between you and the company's other advisers - usually a lawyer. 

RSM Denmark has extensive experience in due diligence inquiries prior to several mergers and acquisitions and is happy to make experience and knowledge available to you. RSM Denmark is thus your assurance of correct insight into the conditions that are crucial for correct and safe assessment of what is to be taken over, determination of the preconditions for carrying out the takeover negotiation as well as structuring and integration of the company after the takeover.

Alexander Petersen
IT Audit l Head of IT Risk & Compliance
View profile
33 37 60 15
Andreas Moos
IT Audit l Head of IT Risk Assurance
View profile
33 37 60 20

Er du i tvivl om, hvor I skal starte?

Vi starter med en uforpligtende afklaring, hvor vi hjælper jer med at skabe overblik, prioritere indsatsen og lægge en konkret plan.