--- title: "ESMA Q&A 2646 — Q&A — Audit frequency limitations [Answer Published]" shortTitle: "ESMA Q&A 2646 — Q&A — Audit frequency limitations [Answer Published]" answer_id: ESMA_QA_2646 topic: "ICT third-party risk management" status: "Answer Published" type: qa instrument_type: qa authority: ESMA binding: false binding_character: non_binding legal_status: in_force regulation: "DORA" dora_level3: true mica_level2: false legal_basis: "28(6), 30(3)(e)" date: 18 September 2025 source_link: https://www.esma.europa.eu/publications-data/questions-answers/2646 lifecycle: "Answer Published" text_version: "ESMA Q&A register, 18 September 2025" source_url: "https://www.esma.europa.eu/publications-data/questions-answers/2646" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the ESMA publication" source: prepared_by: "ESMA" published_by: "ESMA" published_in: "ESMA Q&A tool" evidence: prepared_by: "ESMA Answer" locator: "ESMA Q&A entry ESMA_QA_2646: field 'ESMA Answer', no 'Answer provided by' line" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2025-09-18" question_submitted_on: "2025-09-18" locators: published_on: "ESMA Q&A Excel export ESMA_QA_2646, column 'Esma responses', date line" question_submitted_on: "ESMA Q&A Excel export ESMA_QA_2646, column 'Date of submission'" lifecycle_label: "Answer Published" --- **Answer by ESMA, published in its Q&A tool · not legislation · published 18 Sep 2025 [Answer Published]** *Answer Published · ESMA Q&A register, 18 September 2025 · Checked against the ESMA publication on 26 Oct 2026 · [Official source](https://www.esma.europa.eu/publications-data/questions-answers/2646)* | | | |---|---| | **Full title** | ESMA Q&A 2646 — Q&A — Audit frequency limitations \[Answer Published\] | | **Prepared by** | ESMA | | **Published by** | ESMA, in the ESMA Q&A tool | | **Reference** | ESMA_QA_2646 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 18 September 2025; question submitted 18 September 2025 | | **Legal basis** | 28(6), 30(3)(e) | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the ESMA publication | **Audit frequency limitations** ### Question As DORA requires financial entities to pre-determine the frequency of audits and inspections on the basis of a risk-based approach, are financial entities not permitted to agree on a maximum audit frequency (e.g. once per year) with their ICT third-party service providers? *** ### Answer DORA does not limit the financial entities in the way to implement the relevant audit requirements, including regarding the audit frequency. In case the contracts between the financial entities and their ICT third-party service providers would refer to a (maximum) audit frequency, the frequency shall be agreed by the financial entities (i.e., not imposed by the ICT third-party service providers) and shall not prevent the financial entities to implement the DORA audit requirements on a risk-based approach. Therefore, financial entities shall also ensure that the contractual arrangements grant them the ability to carry out an audit on an ad-hoc basis when they find it necessary to comply with the DORA requirements (for example, in the event of doubts regarding the proper performance of the contract), without the clause on the audit frequency preventing it. If such conditions are met, the financial entities and their ICT third-party service providers may agree on an audit frequency in their contracts. *** **Source:** [ESMA original document](https://www.esma.europa.eu/publications-data/questions-answers/2646)