Scribd
Upload
13 views1 page

BCM Audit Work Program Overview

The document outlines an audit work program for Business Continuity Management (BCM), focusing on governance, business impact assessment, and business continuity plan (BCP) implementation. It details objectives, audit procedures, and evidence required to assess the alignment and effectiveness of BCM policies, risk assessments, and recovery procedures. The goal is to ensure that the BCM framework supports organizational resilience and operational readiness during disruptions.

Uploaded by

Cik Suri
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
13 views1 page

BCM Audit Work Program Overview

The document outlines an audit work program for Business Continuity Management (BCM), focusing on governance, business impact assessment, and business continuity plan (BCP) implementation. It details objectives, audit procedures, and evidence required to assess the alignment and effectiveness of BCM policies, risk assessments, and recovery procedures. The goal is to ensure that the BCM framework supports organizational resilience and operational readiness during disruptions.

Uploaded by

Cik Suri
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

Business Continuity Management (BCM) – Audit Work Program

Scope Objective Audit Procedures Evidence / Method

1. Review BCM policy for alignment with objectives, ISO 22301,


- Approved BCM policy
and communication to stakeholders.
To assess whether the BCM governance framework, including
2. Verify BCM roles, responsibilities, and senior management
policies, leadership involvement, and strategic planning, is - Communication records (intranet, memos)
A. BCM Governance involvement.
adequately established, aligned with business objectives, and
3. Assess rollout plans, resource allocation, and monitoring
supports long-term scalability across the organization. - Organizational charts, TORs, appointment letters
mechanisms for BCM expansion.
- Meeting minutes/approvals
- Budget and resource plans

1. Review BIA reports for critical processes, RTOs/RPOs,


- BIA reports & templates
quantified impacts, and dependency mapping.

To verify that the organization has a structured and reliable process 2. Evaluate risk assessments, including identified threats and
- Dependency mapping (IT, suppliers, utilities)
B. Business Continuity for identifying critical services, conducting business impact mitigation measures (backups, redundancies).
Assessment analysis, and assessing risks, ensuring these form a solid
3. Confirm validation of BIA and risk assumptions with process
foundation for developing and maintaining the BCM program. - Risk registers/assessment reports
owners and management approvals.
- Evidence of mitigation controls
- Signed-off management reviews
- Interview notes with process owners

1. Review BCP manual for completeness (emergency response,


- BCP manual and approval records
crisis communications, IT/system recovery, roles, contacts).

2. Assess recovery procedures for alignment with RTOs/RPOs,


- Recovery strategy documents
and review recovery testing evidence.
To determine whether the BCP is documented, implemented, and
3. Review records of BCP exercises, confirm lessons learned
C. BCP Implementation & operationally ready, with adequate recovery procedures, testing, - Test/exercise reports & post-mortem actions
and corrective actions, and verify scheduled updates.
Operational Readiness and staff preparedness to ensure timely restoration of critical
business functions during disruptions. 4. Evaluate staff training records, interview personnel on
recovery roles, and confirm availability of quick reference - Training attendance records
materials.
- Interview results
- Awareness materials (guides, checklists, pocket
cards)

You might also like