Joint Examination Teams Explained

A joint examination team is a team assembled to carry out examination work on a designated critical ICT third-party provider under DORA's oversight framework. It brings together staff from the European Supervisory Authorities and, where relevant, from national competent authorities, under the coordination of the Lead Overseer for that provider. Its task is to examine the provider's arrangements in depth, to assess risks to financial entities, and to support recommendations where weaknesses or concerns are found.

The joint character of the team is deliberate. A provider serving firms across the EU cannot be understood fully from one national perspective, and its services may touch banking, insurance, and securities markets at once. A team drawn from across the authorities can combine those perspectives, share specialist knowledge, and produce a picture that reflects the provider's sector-wide role, rather than a fragment of it.

An examination focuses on the provider's arrangements as they affect financial entities. That can include its ICT risk management, its resilience and recovery arrangements, its security practices, its dependencies on sub-providers, and its ability to support customers during an incident. The precise focus depends on the provider, on prior oversight findings, and on information from firms and supervisors about where risk appears greatest. An examination is therefore targeted, not a general audit of everything the provider does.

The team gathers information through documents, interviews, and technical work, as appropriate to the focus. It may look at policies and procedures, at how those procedures work in practice, and at evidence from incidents and tests. The aim is to understand not only what the provider says it does, but how its arrangements operate under pressure. That practical focus distinguishes examination from a paper review, and it is why examination findings can be valuable to firms even when they are not published in full.

A single authority examining a cross-border provider would face limits in specialist knowledge, in information, and in perspective. Banking, insurance, and securities supervisors each see different parts of the provider's customer base, and national supervisors each see different parts of its footprint. A joint team pools those views, so that a weakness affecting one sector or one country is not mistaken for an isolated issue, and a strength in one area is not mistaken for strength everywhere.

The joint approach also helps consistency. A provider should receive coherent expectations, rather than conflicting requests from different authorities. By working as one team under a Lead Overseer, the authorities can agree on findings and recommendations, and can track follow-up in a coordinated way. That coherence benefits the provider, which can respond to one set of priorities, and it benefits firms, which can expect a more consistent supervisory approach to a shared dependency.

After examination work, findings are assessed and, where appropriate, recommendations are made to the provider. Recommendations identify areas where arrangements should be improved, and they are followed up to see whether the provider has acted on them. The follow-up is part of the oversight process, not an afterthought. A recommendation without follow-up would leave the risk unchanged, while follow-up creates an incentive and a record of improvement over time.

Financial entities do not normally receive examination reports in full, and they should not expect to. What they may see, over time, is change in the provider's arrangements, communication, or transparency as recommendations are addressed. Firms can also use their own engagement with the provider to ask about areas that oversight has highlighted in general terms, where that information is available. The firm's own monitoring remains the primary source of information about the service it receives.

Consider an illustrative provider that supplies a card processing component used by banks and payment firms across several member states. A joint examination team might focus on the component's resilience, its incident response, and its dependencies on a hosting sub-provider. Staff from different authorities could contribute perspectives from banking and payments, from the countries where the component is most used, and from technical knowledge in resilience and security.

The examination might reveal, for example, that incident communication to customers is slower than the provider's own procedures intend, or that recovery arrangements depend heavily on one operations team. Recommendations could address communication timelines, staffing resilience, or testing of recovery. For a firm using the component, those improvements, if implemented, would matter in a real incident, even though the firm did not see the examination itself. That indirect benefit is a central purpose of sector-level oversight.