On 17 December 2025, the Joint Committee of the European Supervisory Authorities (ESAs) issued a report setting out its response to the European Commission’s request under Article 58(3) of Regulation (EU) 2022/2554 (DORA) to assess whether statutory auditors and audit firms should be subject to strengthened digital operational resilience requirements by means of its inclusion in the scope of DORA or by means of amendments to Directive 2006/43/EC.

The report concludes that while the ESAs acknowledge that the current regulatory framework applicable to statutory auditors and audit firms include only high-level, indirect and limited reference to digital operational resilience, the identified implications of the application of DORA to the statutory auditors and audit firms appear to outweigh the potential benefits. The ESAs therefore consider that including statutory auditors and audit firms within DORA’s scope is not warranted at this stage.