DORA and Model Risk Push QA/QC into Continuous Control Testing

Regulatory pressure is turning QA/QC into a continuous assurance function focused on live control effectiveness, model monitoring, and audit-ready evidence.

Updated

What is this trend?

QA/QC is shifting from one-time release checks to continuous control testing that proves resilience, model governance, and compliance in live operations.

  • DORA pushes QA/QC to prove controls keep working under stress, not just at release.
  • Model risk guidance now requires ongoing validation and monitoring for AI and external models.
  • Evidence generation, audit trails, and remediation tracking are becoming core QA/QC work.
  • Teams must test cloud, third-party, and operational dependencies continuously.
  • QA/QC roles are moving from defect detection to lifecycle control assurance.

What’s the latest?

EU DORA now makes the next requirement explicit for banks and fintechs: QA/QC must support ongoing ICT resilience testing, remediation of findings, and proof that controls stay effective under stress,

DORA, continuous control testing, and ICT resilience reshape QA/QC priorities

How it developed

  1. QA/QC Becomes Lifecycle Control, Inspection and Lab Testing Unite, Manual Re-entry Disappears

Go deeper

Curated long-form picks on this trend — podcasts, videos, and analysis, by seniority.

Stay ahead in Quality Assurance / Quality Control

Get the weekly Quality Assurance / Quality Control brief in your inbox — the developments, what they mean by seniority, and what to do next.