Disaster Recovery.com

business continuity plan audit

By Erin Sullivan

A business continuity plan audit is a formalized method for evaluating how business continuity processes are being managed. The goal of an audit is to determine whether the plan is effective and in line with the organization's objectives.

A business continuity plan (BCP) audit can be performed internally or with the assistance of a third-party audit firm. Audit objectivity is critical to reviewing and updating the plan, so an outside firm might seem preferable, but an internal audit team offers a deeper familiarity with the business continuity planning process. It's up to each organization to determine whether an internal or external audit is the right choice.

A BCP audit should support corporate resiliency efforts and critical business functions. An internal BCP audit defines the risks or threats to the success of the plan and tests the controls in place to determine if those risks are acceptable. An audit should also quantify the effect of weaknesses of the plan and offer recommendations for business continuity plan improvements.

Business continuity audits benefit from a structured audit framework such as those outlined in the British Standards Institution's BS 25999 or the International Organization of Standardization's ISO 22301. Auditing a business continuity plan and its documentation against an established benchmark ensures that it's consistent with industry practices and controls.

BCP audit objectives

The primary objectives of a business continuity plan are to limit downtime during a business interruption, protect personnel in the event of a disaster, minimize financial losses due to a disruptive incident and restore critical business functions and infrastructure following an incident.

With a BCP audit, the main goal is to ensure that the plan is up to completing these critical tasks. Corporate resiliency efforts vary, based on the organization's objectives and requirements, so the audit team must take those requirements into account. However, there are some general goals to aim for with an audit.

A BCP audit should validate an organization's business continuity plan and ensure that all moving parts are working correctly. An audit should examine the performance of activities in the plan and ensure that the business continuity and disaster recovery (BC/DR) processes meet organizational standards. It should also call to attention any maintenance or updates that should be performed, if there are any clear gaps.

Benefits of a BCP audit

Although an organization can try to mitigate and avoid potential risks, the size and scope of potential threats such as cyberattacks and natural disasters are often unpredictable. The more preparation and planning an organization can do, the better. Business continuity management efforts are bolstered by performing an audit, which gives feedback as to what is working in the plan and what needs improvement.

A comprehensive BCP audit provides objective feedback that can improve a business continuity plan with actionable changes and updates. Reviewed against both general industry best practices and the expectations of management, a business continuity plan's sufficiency and success can be determined with a thorough audit.

When it comes to BC/DR, a general rule of thumb is the more testing, the better. Technology and threats are constantly changing and auditing a business continuity plan is one more step to take to ensure that a plan is up to date and won't flop when faced with disaster.

Considerations

There are some key elements to consider with a BCP audit:

• Scope: Does your audit cover both business continuity and disaster recovery plans? Are all mission-critical systems covered in the plan, or are there specific systems that are going to be checked? Ideally, a business continuity plan involves all aspects of an organization, even its reputation. However, it's likely that with most organizations, certain areas take precedence depending on the industry or threats that have the biggest effect. Know what the business continuity plan encompasses and covers when preparing an audit.
• Management: Along with knowing who is involved in the business continuity plan, ensure that roles and responsibilities are clearly defined. Who is held accountable for the success or failure of the plan? Who needs to be involved with developing, training and testing? This is an area that an organization should periodically revisit, as responsibilities might change over time.
• Accuracy: When performing an audit, the team should be clear about the requirements of the business continuity plan. Reports such as a business impact analysis (BIA) and risk assessment should be up to date and on hand. If the plan must meet any compliance standards, those parameters must be included in the audit. Along with accuracy, BCP audit objectivity is critical. The audit must present unbiased results, especially if it's performed internally.
• Maintenance: Business continuity planning isn't a one-and-done procedure, it's an ongoing process. The business continuity plan and, by association, the BCP audit, must be updated as frequently as the organization undergoes changes. Annual updating might be the rule of thumb for some organizations, but frequency can differ. If the company changes hardware or software, or staffing or location, these can all affect a business continuity plan. To maintain the integrity of the plan and the audit, they must be updated regularly to reflect changes.
• Confidentiality: Although it's important to keep required personnel informed about BC/DR planning, company vulnerabilities shouldn't be made readily available outside the organization. As cyberattacks increase and information security becomes a critical concern, the results of a BCP audit should be adequately protected.

Creating a BCP audit

A business continuity audit can be as simple or as complex as an organization wants it to be. One organization might just be interested in reviewing and testing a BC/DR plan and checking in with the team involved to see if the plan has any notable flaws or needs updates. The following 10 steps can serve as a solid starting point for building a business continuity plan audit suited to a specific organization:

1. Prepare the audit plan. This includes outlining the scope, approach and schedule of the BCP audit.
2. Review and summarize documentation information for the audit, such as BC/DR plans, BIAs, risk assessments and emergency communications plans. If gaps in this documentation exist, update the information as needed.
3. Review and apply relevant standards, regulations, legislation and good practice documents to validate preliminary findings and prepare audit paperwork.
4. Identify audit controls and prepare work papers that reflect established business continuity metrics defined by standards groups, regulators and legislators.
5. Conduct business continuity audit interviews with relevant personnel across the organization.
6. Following audit interviews and discovery, prepare a draft audit opinion report for discussion with interested parties in your organization.
7. Complete a final audit report and communicate the findings to relevant personnel. These findings can include interview results, documentation notes and recommended actions to improve the business continuity plan.
8. Complete an action plan and time frame to remediate the BCP according to your audit findings.
9. Ensure that the action plan is implemented in the set time frame.
10. Schedule the next BCP audit.