DORA, continuous control testing, and ICT resilience reshape QA/QC priorities

DORA and Model Risk Push QA/QC into Continuous Control Testing

EU DORA now makes the next requirement explicit for banks and fintechs: QA/QC must support ongoing ICT resilience testing, remediation of findings, and proof that controls stay effective under stress, with some firms also facing threat-led penetration testing. That moves the standard beyond the lifecycle traceability and reproducibility already in view to continuous evidence that critical services still hold across cloud, third-party, and operational dependencies. Updated model risk guidance from the Federal Reserve, FDIC, and OCC extends the same logic to AI and external models through lifecycle monitoring and ongoing validation, not one-time approval.

The operating model is widening across resilience, AI governance, medical devices, and GMP, with recurring demands for inventory tracking, logging, access restriction, incident response, human oversight, pre-production validation, drift detection, and rollback/version control. The emerging four-pillar AI agent framework captures the shift: identity and scope, authorization and escalation, observability and monitoring, and accountability and audit. Evidence generation is now as important as test execution.

For practitioners, this means more time on control instrumentation, exception handling, remediation tracking, and audit-ready evidence assembly. Teams built around release testing now need people who can prove control effectiveness in production and reconstruct what happened when stress, drift, or compliance failures surface.