Panorays Guide for DORA ROI

In 2024, the EU regulators provided a 17-tab spreadsheet template for assembling this data. They are not supporting this template for the actual submission of the Register of Information report, so organizations obligated by DORA must implement (or enhance existing) tooling to aggregate and prepare the report.

Panorays’ solution enables collaboration between many users, both internal to the entity and within the suppliers. It is axiomatic that the contract owner is the most informed about a given arrangement and, correspondingly, the supplier about their corporate information. These users may work in parallel, and the Panorays platform elegantly aggregates all this data.

Data for the 10 output files about suppliers and contracts is entered into 3 primary and 2 secondary Panorays questionnaires. The questionnaires are friendly and intelligent, perform all translations from options phrased in English and the required coding, and use conditional logic to expose only the questions as are necessary for each specific case. The questionnaires inform about any specific format and data type for each element, helping the user along.

Data about the usage of a given supplier contract by an organization can directly reference multiple organizational functions and types of service. Each permutation of such usage must be documented by its record in a Register of Information table (B_02.02 or “Contractual arrangements – Specific information”). Similarly, documentation of subcontractors for a given supplier contract can reference multiple types of service, and each of these permutations must be represented by its record in another Register of Information table (B_05.02 or “ICT service supply chains”). Panorays enables a single data entry for each of these, with all the permutations identified, and will generate the required multiple records in the final output format. This is a significant time-saver for the organization obligated to report in the Register of Information format.

Finally, Panorays’ Register of Information “Export Wizard” outputs the final results in the regulator-required format.

Process Overview

Once you select this, you will be prompted to edit the title of the questionnaire, add a template description, and click “create”. The questionnaire titles must include specific terms somewhere in the name, as specified below:

Once you select this, you will be prompted to edit the title of the questionnaire, add a template description, and click “create”. The template description is optional.

After creating the questionnaire, it will be available to send as an internal questionnaire to the appropriate contact.

Please refer to Step #2 for sending the questionnaire to the designated contact.

Send the List of Branches questionnaire(s) to the internal users who will complete them.

You can review all collected and entered information for the DORA 'Register of Information' in one place. The report presents the information in an easily understandable format and question order before creating the zipped file to be sent to the regulator in their required complex format.

This allows full visibility into the data entered across the 9 completed questionnaires with 8 comprehensive reports, ensuring all fields are accurately completed. This will allow you to save time and effort by reviewing a single dashboard that summarizes your inputs in a clear and easy-to-read format with a per-topic view and adds an extra layer of validation by circulating these reports internally or to relevant stakeholders.

Functions must be unique to a given entity. For example, you may not duplicate Function “F1” across two or more entities.

In the Supplier Data questionnaire, locations for the following services are entered:

These same questions are asked in the Service Usage & Supply Chn questionnaire.

The answers in Supplier Data are the default. When overriding values are entered in Service Usage & Supply Chn, the latter will be included in the exported Register of Information Zip file.

The contract and usage of the contracted service by a particular entity (specified by an LEI) come together in the Service Usage & Supply Chn questionnaire.

Rank 2 subcontractors, and Rank 3 suppliers to subcontractors, are associated with the given service through the same Service Usage & Supply Chn questionnaire.

We suggest creating sufficient copies of the Service Usage & Supply Chn questionnaire to cover the maximum number of subcontractors identified for your contracts and suppliers. You could name them this way:

In the Panorays Supplier you are identifying subcontractors for, send yourself (as internal questionnaires) these subcontractor questionnaires. It’s crucial that the entire “supply chain” represented by the Service Usage questionnaires for ranks 1, 2, 3 and on all be in the Panorays “Supplier” represented by Rank 1. The Export Wizard will not include data from Service Usage questionnaires for a given subcontract chain unless all of them are in this top-level supplier.

You’ll see that when you identify the questionnaire as Rank 2, only a few questions are needed. See the image below.

Please remember to add a Panorays Supplier for each subcontractor, and to send and complete a Supplier Data questionnaire for the subcontractors.

Usually, when we are dealing with a Rank 2 subcontractor, we do not know the locations of processing and storage. When completing Supplier Data for such a subcontractor, you may choose the option “Not applicable” for the following questions:

Answer the following question “No”:

The system will total up the amounts entered in each Contractual Arrangement questionnaire as follows:

No currency conversions are reported, so if you enter more than one currency code for multiple contracts with the same ICT Third-party may not be totalled correctly. We recommend you enter the annual cost for each contract in the same currency as you entered for each supplier.

Identifying Linked Contracts and Documenting Branch Usage of Contracts

A single questionnaire called Branch Usage & Lnkd Cntrcts enables documenting both linked contracts and the specific usage of a contract by a branch of the entity.

Panorays will automatically detect when a contract has been signed by one legal entity and used by another entity in the group. It’s only necessary to use the Branch Usage & Lnkd Cntrcts questionnaire when a contract is used by a specific branch of a legal entity, or when two contracts are linked together.

Before addressing these questions, it’s important to document contracts and usage, as explained previously.

After this, send an internal questionnaire Branch Usage & Lnkd Cntrcts in the relevant supplier. The questionnaire adjusts to support either linking contracts or branch usage.

The export wizard delivers the compiled report in Zip form in your computer’s “Downloads” folder. The file will be named DORA - Register of Information.zip.

You must rename it according to the regulator’s requirements, which can be found at https://www.eba.europa.eu/sites/default/files/2025-03/b90dc121-77cd-47cc-a8c7-ceebda33e381/20250319%20-%20DORA%20RoI%20reporting%20FAQ%20%28updated%29.pdf

The document referenced indicates that the files should be reported to the ESAs in .zip file names in according with the following convention:

ReportSubject.CON/.IND_Country_FrameworkCodeModuleVersion_Module_ReferenceDate_CreationTim estamp.zip where:

Example: DUMMYLEI123456789012.CON_IT_DORA010100_DORA_2025-03-31_20250421141632000.zip

* This module is not open to all; if you are interested, please contact us.