What breaks when DORA documentation exists but evidence is missing?

When DORA documentation exists but evidence is missing

Written documentation is necessary, but it is not enough on its own. Under DORA, the break occurs when a firm cannot show that controls were operating in practice, because supervisors will look for records that prove detection, classification, response, and recovery happened in sequence. A policy set without a verifiable trail becomes a paper control.

That gap matters because operational resilience is assessed through evidence, not intention. If ownership is unclear or the timeline has to be reconstructed after the fact, the firm may still look compliant on paper while failing to demonstrate that incidents were handled consistently, promptly, and with accountable decision-making.

Evidence is part of the control, not an appendix to it. For DORA-style examinations, the proof usually needs to show who noticed the event, when it was classified, what actions were taken, and how recovery was validated. DORA Guide is useful here because the compliance question is not only whether a process exists, but whether incident reporting, resilience testing, and third-party handling are evidenced end to end.

One common failure mode is that teams can describe the workflow but cannot produce dated artefacts from the workflow itself. That includes incident tickets, alert records, approvals, comms logs, test results, and post-incident reviews that line up with the chronology. Identity Security Regulatory Map helps frame that evidentiary burden across regulatory obligations, while Financial Services Identity Security Guide is especially relevant where access decisions, privileged actions, and third-party dependencies must be provable as part of resilience.

Why missing evidence weakens compliance even when the policy is sound

DORA is designed to test operational reality. A policy can define roles, escalation paths, and recovery expectations, but if the firm cannot show contemporaneous records, the examiner has no reliable basis to trust that the control worked when pressure was real. That is why missing logs, ambiguous timestamps, and undocumented handoffs are treated as substantive weaknesses, not clerical issues.

The practical implication is that controls need traceability from the moment of detection through the closeout of recovery. If any stage is undocumented, the chain of assurance is broken. In a resilience review, the missing record often becomes evidence of one of three problems: the control did not run, the control ran but nobody captured it, or the ownership model is too weak to sustain auditability.

For a financial entity, that is not merely an administrative problem. The EU Digital Operational Resilience Act (DORA) makes operational evidence central to supervision, so a firm that cannot produce a time-ordered trail may lose credibility even if the underlying response was technically competent. Documentation without proof may support internal memory, but it rarely satisfies external examination.

That is also why recovery evidence matters as much as incident evidence. A firm should be able to show not only that it responded, but that it returned services to a known state and validated the outcome. Without that, the examiner is left with assertions rather than demonstrable resilience.

What to do before the examiner asks for the record

Preparation should focus on whether the firm can reconstruct an incident or test from source artefacts, not from recollection. The most useful question is whether the organisation can produce a clean sequence of events from detection to closure using logs, case records, and approvals that match across systems.

What to verify: Confirm that each material incident or test has an owner, timestamps, classification rationale, response actions, and recovery validation that can be matched across records. If those elements live only in narrative write-ups, the control is still fragile.

Decision rule: If the evidence cannot be produced without manual reconstruction, treat the control as operationally weak and remediate the recordkeeping path first. If the evidence exists but is scattered, standardise the minimum artefact set and the retention discipline before the next supervisory review.

What good looks like: A supervisor can sample an event and see a consistent chain of evidence, from alerting and triage through response, sign-off, and recovery confirmation, with no gaps in ownership or timing.

Practitioner takeaway: For DORA, the question is not whether the control was written down, but whether the organisation can prove the control lived through the event with a defensible timeline and accountable records.

Related resources from NHI Mgmt Group

• What breaks when AI SOC triage cannot distinguish missing evidence from clean evidence?
• What breaks when monitoring exists but prevention is missing for agentic workflows?
• What breaks when remediation evidence is missing in regulated healthcare environments?
• What breaks when organisations try to manage CMMC evidence with spreadsheets and ad hoc documentation?