---
sourceDocument: Australia Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/governance-risk-compliance
Release :
- australia
ft:locale :
- en-US
ft:publication_title :
- Australia Governance, Risk, and Compliance
ft:clusterId :
- grc
bundleId :
- grc
workflow :
- Technology
---
# Register of information regulatory packages
# Register of information regulatory packages {#ariaid-title1}
Release version: Australia
Updated September 10, 2026
 3 minutes to read
Summarize
 Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
## Summary of Register of information regulatory packages
The Register of Information (RoI) is a regulatory reporting requirement under the Digital Operational Resilience Act (DORA) for financial entities.
It requires submitting structured data packages to regulators demonstrating compliance with DORA, including details about legal entities, third-party service providers, contracts, and functions.
The Digital Resilience Third-party Information Register application within the Vendor Management Workspace supports RoI management and reporting.
Show full answer Show less
## Key Features
* **RoI Package Generation:** Third-party assessors can generate regulator-ready RoI packages in a Plain-CSV report format starting with version 21.1.x. These ZIP files include metadata and reports structured to meet European Banking Authority specifications, aiding compliance and automated validation workflows.
* **Download Options:** Users can download an Excel master template for data preparation and internal review, or use the Plain-CSV option for regulator submission and compliance validation.
* **Validation and Configuration:** The framework includes business validation rules, configuration files, and properties accessible to third-party risk administrators for maintaining validation logic and ensuring consistent reporting. Decimal precision for monetary values can be configured specifically for downloads.
* **Automated Validation Notifications:** After validation, the system emails the request initiator with attached reports if errors or warnings occur.
* **Data Capture and Reporting Support:** The application supports capturing data on entities, contracts, functions, and third parties. It provides CSV report generation aligned with regulator requirements, ZIP packaging, and validation workflows including Level 4 LEI validation against the GLEIF database.
* **Terminology Definitions Module:** Allows organizations to define internal terms for indicator options used in RoI templates, enhancing clarity in exports.
* **Role-Based Access:** RoI-related actions are managed in the Vendor Management Workspace's Digital resilience third-party registers section, providing controlled access to download/upload requests, validation tools, and templates.
* **Currency Conversion and Expense Aggregation:** Optional features enable standardizing currency and aggregating third-party expenses in reporting packages without altering source data.
* **Quarterly Automated Report Generation:** An inactive-by-default scheduled job can be activated to automatically generate quarterly RoI CSV reports based on the latest configuration, reducing manual effort.
## Practical Benefits for ServiceNow Customers
* Ensures compliance with DORA regulatory requirements through structured, validated reporting aligned with European standards.
* Streamlines the creation and submission of RoI packages with automated report generation, validation workflows, and clear guidance on permissions and procedures.
* Enables risk administrators to maintain and customize validation rules and reporting configurations, promoting data quality and consistency across submissions.
* Supports efficient management of third-party risk data and regulatory communications via role-based access and automated notifications.
* Facilitates currency standardization and expense aggregation to simplify financial reporting within RoI packages without impacting underlying data.
The Register of Information (RoI) is a regulatory reporting requirement under the Digital Operational Resilience Act (DORA) and is supported by the Digital Resilience Third-party Information Register application in the Vendor Management Workspace.
## RoI overview
The RoI is a structured data package that financial entities must submit to regulators to demonstrate compliance with DORA. It includes information about legal entities, third-party service
providers, contracts, and functions.
Starting with version 21.1.x, third-party assessors (sn_vdr_risk_asmt.vendor_assessor) can generate regulator-ready RoI packages using the Plain-CSV Report Package option on the download
page. The ZIP file includes metadata and report folders structured to regulator specifications, with file names containing LEI, entity ID, and release version. This enhancement supports EU
DORA compliance and automated validation workflows. You can follow the guide provided in the Instructions section on the Download/Upload request page for step-by-step instructions
and required permissions.
Note:
You can use the Excel master template option to download a document to use for data preparation and internal review and the Plain-CSV reporting package option to download a document to use for regulator submission and compliance validation. For more information, see [Create a Microsoft Excel download request](https://www.servicenow.com/docs/mSgZh3NSKhCO0W33CsxeMA "Create a Microsoft Excel download request to download the records from the Digital resilience third-party registers using Third-party Risk Management for auditing purposes.").
The RoI framework aligns with DORA's five
pillars, particularly ICT third-party risk management and incident reporting. TPRM contributes third-party risk data that is included in RoI packages generated by Digital Operational Resilience capabilities. These RoI packages follow the European Banking Authority's
structure and validation requirements.
The RoI framework includes DPM business validation rules, properties, and additional configuration files such as report.json, reportPackage.json, decimalsMonetary, and FrameworkCodeModuleVersion. These components enable third-party risk administrators (sn_vdr_risk_asmt.vendor_risk_admin) to view and maintain validation logic and configuration settings for CSV reporting and automated validation workflows, helping maintain consistency across regulatory submissions. TPR admins can access these properties by navigating to AllDigital Operational Resilience ManagementProperties and can access DPM business validation rules by navigating to AllDigital Operational Resilience ManagementDPM business validation rules.
Note:
The decimalsMonetary property controls decimal precision for monetary values in Master Template and CSV downloads only. You can set decimal precision to -6,
-3, 0, or 2 for monetary value fields. It doesn't affect UI display, upload and validation, individual table downloads, or database storage.
After validation completes, the system automatically notifies the request initiator by email and attaches the validation report when errors or warnings are detected.
## Digital Resilience Third-party Information Register support for RoI
The Digital Resilience Third-party Information Register provides the following capabilities to support RoI compliance:
* Data capture for entities, contracts, functions, and third parties
* CSV report generation aligned with regulator specifications
* ZIP packaging with metadata and report folders
* Validation workflows for technical, schema, and business rule checks
* Level 4 LEI validation against the GLEIF database, with a downloadable `Level4_LEI_Validation_Report.csv` included in `Consolidated_Reports.zip`. For more information, see [Validate Legal Entity Identifier codes for DORA reporting](https://www.servicenow.com/docs/PQXkTi5bEbCNKzjDx9WUgg "Review and resolve Legal Entity Identifier (LEI) validation results for DORA Register of Information reporting. LEI validation runs automatically during Plain-CSV Reporting Package generation and Microsoft Excel upload to verify that LEI codes in the digital resilience registers exist in the GLEIF database and have an active and issued status.").
* A Terminology Definitions module for providing your organization's internal definitions of the closed-set indicator options used across RoI templates, so the B_99.01 export includes your terminology. For more information, see [Define terminology for the Register of Information export](https://www.servicenow.com/docs/6R4XdW__~_aLw22lphLT~g "Define your organization's internal definitions for the closed-set indicator options used across the Register of Information, so the B_99.01 export includes your terminology rather than empty values.").
* Role-based access for managing RoI requests
Note:
All RoI-related actions are performed in the Digital resilience third-party registers section of the Vendor Management Workspace. This workspace provides access to download/upload requests, validation tools, and master
templates.
For more information, see [Generate a register of information package](https://www.servicenow.com/docs/BXu5Th2kmaD1K~KI3jouMg "Use the CSV report option in the download page to generate regulator-ready Register of Information (RoI) packages.")
## Currency conversion and aggregation {#tprm-dora-roi__section_z3w_jmz_13c}
During report generation, you can enable optional currency conversion and third‑party total expense aggregation. These options standardize or combine annual expense values in the reporting package. These options affect only the
generated reporting package and don't modify source records in the digital resilience registers.
For more information, see [Currency conversion and third-party expense aggregation](https://www.servicenow.com/docs/wCCuA_CfAvFcvS0K4_DNAw "During report generation, the Register of Information (RoI) converts contract annual expenses to a base currency. It then aggregates totals per eligible third-party provider or engagement. The RoI is a regulatory reporting requirement under the Digital Operational Resilience Act (DORA) and is supported by the Digital Resilience Third-party Information Register application in the Vendor Management Workspace application.").
## RoI validation checks {#tprm-dora-roi__section_dora_roi_validation_checks}
Business-rule checks for RoI validation generate data quality warnings for contracts and third-party service providers without blocking Plain-CSV reporting package generation. For the complete list of these checks, see [Validation framework for Register of Information](https://www.servicenow.com/docs/xu3iRieHwR4nigy87uEaAw "The validation framework helps ensure that RoI packages meet regulatory requirements defined by the DORA.").
## Quarterly RoI CSV generation {#tprm-dora-roi__section_dora_roi_scheduled_csv}
A quarterly scheduled job (DORA: Quarterly CSV download) generates the CSV Register of Information report for the previous quarter automatically, so you don't have to trigger the download manually each quarter. The job is inactive by
default; a TPR admin \[sn_vdr_risk_asmt.vendor_risk_admin\] can navigate to AllSystem DefinitionScheduled Jobs and activate it before it runs.
When the job runs, it uses the most recently created CSV download request record as its configuration template, regardless of that record's state. It copies the entity, competent authority, base currency, currency
conversion, and third-party total expense aggregation settings to the new request. No email notification is sent for the generated report, because the job runs under the system account rather than a specific user.
**Related concepts**
* [Validation framework for Register of Information](https://www.servicenow.com/docs/xu3iRieHwR4nigy87uEaAw "The validation framework helps ensure that RoI packages meet regulatory requirements defined by the DORA.")
**Related tasks**
* [Generate a register of information package](https://www.servicenow.com/docs/BXu5Th2kmaD1K~KI3jouMg "Use the CSV report option in the download page to generate regulator-ready Register of Information (RoI) packages.")
* [Define terminology for the Register of Information export](https://www.servicenow.com/docs/6R4XdW__~_aLw22lphLT~g "Define your organization's internal definitions for the closed-set indicator options used across the Register of Information, so the B_99.01 export includes your terminology rather than empty values.")
**Related reference**
* [Terminology and definitions fields](https://www.servicenow.com/docs/lBUuH_3FQm1sL92VeoctKQ "Field descriptions and the full set of closed-set options for the Terminology and definitions list, used to populate the DORA B_99.01 Register of Information export.")
*[\>]: and then