The short answer
A certificate of completion can show that a named person met a provider’s recorded criteria for a particular course version. It does not, by itself, establish the financial entity’s DORA compliance or imply an EU-approved qualification. Evaluate the underlying syllabus, assessment and learning record as well as the document’s title.
1. Separate completion from organisational compliance
A director can complete a relevant course while the organisation still has an untested recovery dependency, an overdue audit finding or an inadequate supplier exit arrangement. Training can help the director recognise and challenge those problems. It does not make the problems disappear. The certificate should describe the educational achievement without converting it into a conclusion about all of the entity’s controls.
DORA’s training provisions focus on knowledge, skills, appropriate learning and the responsibilities of the relevant roles. Articles 5(4) and 13(6) do not prescribe a named accreditation scheme or a universal exam and pass mark. A provider may choose an assessment and issue a certificate of completion, but it should present those criteria as programme design. Do not infer regulatory approval from an EU flag, an official-looking seal or the word certified on a marketing page.
For a financial entity using the general framework, board learning should support the ability to understand and assess ICT risk and its operational consequences. Entities eligible for Article 16’s simplified framework have different provisions, including their own staff and management training requirement. A certificate should not claim that Article 5(4) is the applicable basis for every customer. Establish scope and framework separately, with the people responsible for the entity’s legal and compliance assessment.
2. Identify exactly who completed what
A useful completion document identifies the learner, organisation, course title, course version, completion date, issuer and a unique certificate identifier. The professional role provides context for why the learning was assigned. Where an assessment forms part of the criteria, the record should show its result and the provider’s passing threshold. Avoid a document that merely says the holder attended DORA training with no description of what that means.
Keep the certificate understandable after the catalogue changes. A future reviewer may need to know whether the learner completed a short introductory sample or an eight-module leadership programme. Both can produce a record, but they are not interchangeable. A title alone is a weak historical reference because marketing names can change. The version should identify a stable syllabus and assessment design that the provider can explain.
Separate identity from authority. The fact that someone completed a board course does not prove that they are a management-body member, have authority to approve risk or hold an externally verified professional status. At BlueTeam Academy, the professional role is supplied by the learner and preserved in the completion snapshot; it is not an independent credential check. Companies should use their own governance records to confirm who has which duties and why a particular programme was assigned.
3. Look behind the certificate at the learning evidence
The stronger question is not whether the provider produces an attractive PDF, but whether the evidence explains the learning. Ask for the assigned modules, learning objectives, version, module completion dates, assessment attempts and result. Where written decisions or scenarios are part of the programme, understand how they are retained and whether anybody reviewed their quality. The record should make that distinction explicit.
A page-completion event can show an attestation that content was read. A decision check can show whether a participant selected a supported response to a defined situation. A scenario assessment can sample the ability to apply concepts across several decisions. A facilitated workshop can reveal disagreements and assumptions. These are different signals. None should silently be described as a comprehensive independent assessment of professional competence.
Consider a recovery scenario: the primary service and recovery environment share the same cloud identity provider. A learner who merely recalls an article number has not demonstrated that they can challenge the recovery estimate. A more useful exercise asks which shared dependencies, reconciliation steps and evidence must be considered before accepting management’s claim. Retaining the learner’s reasoning supports a discussion of that judgement. If the reasoning is stored but not graded, the certificate and evidence record should say so.
4. Preserve versions, attempts and refresher history
Learning records should survive normal changes to the course and the learner’s account. A new programme edition should not overwrite an earlier assessment or turn an introductory completion into a more substantial qualification. Preserve the course version, criteria and relevant identity details as they stood when the certificate was issued. If the learner changes role later, the original certificate should remain an intelligible historical record.
Retain unsuccessful attempts as learning evidence rather than showing only the best score with no context. A later pass demonstrates that the participant subsequently met the programme’s criteria. It does not make the earlier difficulty irrelevant to learning support. Company administrators may want to discuss repeatedly missed topics or arrange an additional exercise. The report should show the result accurately without using a failed first attempt as a judgement about the person’s wider professional ability.
Refreshers should have their own version and completion history. A suggested review date is a planning tool, not an automatic legal expiry date for a certificate. Material changes may call for learning sooner. Workshop records should remain distinct from assessed course completions, and corrections should retain an audit trail. See how often DORA training is required for the relationship between a regular cycle, role needs and change-driven updates.
5. Give the corporate buyer a report of gaps
A company buyer needs to know more than how many certificates were downloaded. The report should identify who was assigned which version, what remains unfinished, the due date and the result. Include module gaps so that a learner who has not reached continuity or supplier oversight is distinguishable from someone who has completed those modules but still needs to take the assessment. Keep cancelled assignments and inactive memberships understandable in the history.
Link the certificate identifier to a recorded passing attempt rather than letting a browser generate a success claim from local page state. The evidence must be scoped to the organisation: one company’s administrator should not be able to retrieve another company’s certificates or written responses. Learners should be able to obtain their own records without gaining access to colleagues’ private learning evidence.
For an assigned refresher, distinguish completion before the assignment from the new attempt expected after assignment. Otherwise an old pass can make a new learning obligation look finished immediately. At the same time, retain the earlier record rather than deleting it. A useful company report supports decisions about support, follow-up and overdue work. It should not convert an overall completion percentage into a claim that the organisation is DORA compliant.
6. Record company context and workshops honestly
A leadership programme becomes more relevant when the learner connects it to the entity’s financial services, dependencies and risk profile. A company can record a general service context and use it in decision exercises. Avoid placing customer personal data, credentials or detailed exploitable weaknesses into a learning note. The objective is to examine decisions and assumptions, not create another uncontrolled repository of sensitive operational material.
For an optional workshop, record the date, duration, facilitator, participants, objectives, service context and important decisions. Note unresolved questions, follow-up owners and the evidence expected later. If the record is entered by a company administrator, describe it as that person’s attestation. It should not automatically issue the Academy’s assessed course certificate or imply that the Academy independently observed the session.
Corrections need a clear history. If attendance was entered for the wrong person, preserve a reasoned correction or void record and create the accurate record through the normal process. Do not silently erase the discrepancy. A reviewer should be able to understand what happened without assuming that every change was misconduct. Similarly, completion of a workshop may reveal a control gap rather than close one; keep operational remediation separate from the evidence that people discussed it.
7. Questions to ask a DORA training provider
Ask the provider to demonstrate a real lesson, a scenario assessment and a sample evidence export before you buy. Check whether the learning addresses management-body decisions about risk, continuity, recovery, resources, audit and third-party arrangements. Generic employee awareness can contribute useful knowledge, but it is not the same learning objective as governing ICT risk. Understand which audience the product is designed for and which areas require additional company-specific work.
Ask how the provider describes duration and frequency. Three hours can be a study estimate that includes exercises; it should not be represented as a statutory minimum. An annual refresher can be a practical recommendation; it should not be sold as a universal legal interval. Ask how material changes lead to updated content and how the platform preserves older versions. If a provider claims accreditation, request the precise scheme and independently check what it covers rather than relying on a generic badge.
Finally, test the operational evidence flow. Can your administrators assign the right people, see unfinished modules, export results and identify the certificate version? Can learners retrieve their own record? Are workshop attendance and assessment distinguished? Does the provider explain the limits of automated grading? These questions help assess what the certificate means in practice and whether the product supports your governance, rather than merely adding another document to a folder.
8. What BlueTeam Academy records
DORA Board & Executive Training includes eight modules, a written decision exercise and decision check in each module, and a 16-question scenario assessment. Completion requires the module checks and submitted written exercises, followed by at least 80% in the assessment. These are Academy criteria. Approximately three hours is the guided-study estimate, including exercises and assessment, with individual pace varying.
The certificate of completion preserves the learner, organisation, declared professional role, version, objectives, module dates and assessment result at issue. Written responses are retained as evidence but are not automatically assessed for professional quality. The server creates the certificate after a passing attempt. The printable document can be saved as PDF from the browser, while the evidence export provides the underlying structured record for authorised users.
The company report also includes assigned modules, gaps, certificate identifiers, refresher history and workshop records. The separate refresher supports current knowledge; company-specific discussion supports relevance to actual services. This is the boundary of the claim: the record documents the Academy’s learning and completion criteria. It is not EU accreditation, a practitioner licence or a determination of the financial entity’s compliance with DORA.
Questions leaders ask
Is there an EU-approved DORA training certificate required by Articles 5(4) or 13(6)?
Those provisions do not name a mandatory accreditation scheme or prescribed certificate. A provider may issue a certificate of completion against its own disclosed criteria. The buyer should examine the syllabus, assessment, role relevance and evidence, and should not infer EU approval from the design or wording of the document.
Does a certificate expire after twelve months?
A programme may recommend a refresher or review interval, but that is different from claiming that DORA gives every training certificate a universal twelve-month legal expiry. Consider the applicable framework, supervisory expectations, role, risk and material changes. Preserve the original completion date and version, and record later learning as a separate activity.
Can workshop attendance replace the scenario assessment?
In the Academy programme, workshop attendance is separate from assessed completion and does not automatically issue a course certificate. A company can use workshops to deepen learning and review reasoning, but the record should identify what was observed, by whom and against which criteria. Do not relabel attendance as an independently assessed result.
Sources and further reading
Primary legislation and supervisory material. Practical examples and templates in this guide are suggestions, not prescribed regulatory forms.
- DORA: governance and training provisions
- EIOPA: Digital Operational Resilience Act
- EIOPA Q&A 250–3380: training proportionality
This guide is educational. Confirm your entity’s scope, applicable framework and supervisory requirements with your legal and compliance team.
