Business Continuity Management Audit

(1)

(2)

ISACA®

With 95,000 constituents in 160 countries, ISACA (www.isaca.org) is a leading global provider of knowledge, certifications, community, advocacy and education on information systems (IS) assurance and security, enterprise governance and management of IT, and IT-related risk and compliance. Founded in 1969, the nonprofit, independent ISACA hosts international conferences, publishes the ISACA®_{Journal, and develops international IS auditing and} control standards, which help its constituents ensure trust in, and value from, information systems. It also advances and attests IT skills and knowledge through the globally respected Certified Information Systems Auditor®_(CISA®_),

Certified Information Security Manager®_(CISM®_{), Certified in the Governance of Enterprise IT}®_(CGEIT®_{) and}

Certified in Risk and Information Systems Control™ (CRISC™) designations. ISACA continually updates COBIT®_,

which helps IT professionals and enterprise leaders fulfil their IT governance and management responsibilities, particularly in the areas of assurance, security, risk and control, and deliver value to the business.

Disclaimer

ISACA has designed and created the Business Continuity Management Audit/Assurance Program (the “Work”) primarily as an informational resource for audit and assurance professionals. ISACA makes no claim that use of any of the Work will assure a successful outcome. The Work should not be considered inclusive of all proper

information, procedures and tests or exclusive of other information, procedures and tests that are reasonably directed to obtaining the same results. In determining the propriety of any specific information, procedure or test, audit and assurance professionals should apply their own professional judgment to the specific circumstances presented by the particular systems or information technology environment.

Reservation of Rights

© 2011 ISACA. All rights reserved. No part of this publication may be used, copied, reproduced, modified, distributed, displayed, stored in a retrieval system or transmitted in any form by any means (electronic, mechanical, photocopying, recording or otherwise) without the prior written authorization of ISACA. Reproduction and use of all or portions of this publication are permitted solely for academic, internal and noncommercial use and for consulting/advisory engagements, and must include full attribution of the material’s source. No other right or permission is granted with respect to this work.

ISACA

3701 Algonquin Road, Suite 1010 Rolling Meadows, IL 60008 USA Phone: +1.847.253.1545

Fax: +1.847.253.1443 E-mail: info@isaca.org Web site: www.isaca.org

ISBN 978-1-60420-186-4

Business Continuity Management Audit/Assurance Program

Printed in the United States of America

CRISC is a trademark/service mark of ISACA. The mark has been applied for or registered in countries throughout the world.

(3)

ISACA wishes to recognize:

Author

Norm Kelson, CISA, CGEIT, CPA, CPE Interactive Inc., USA, Jeff Kalwerisky, CISA, CA (SA), CPE Interactive Inc., USA Subject Matter Expert

Harvey Betan, CPCB, Riskmasters Inc., USA Expert Reviewers

Sunil Bakshi, CISA, CISM, CGEIT, CRISC, AMBCI, BS25999LI, CFE, CISSP, ISO 27001 LA, MCA, PMP, National Stock Exchange, India

Diane D. Bili, USCI, Canada

Bok Hai Suan, CISM, CGEIT, PM, Singapore

Michael D. Hansen, CISA, CFE, Public Employees Retirement Association of New Mexico, USA Le Thi Mai Huong, CISA, BNP Paribas PF, France

Gary Langham, CISA, CISM, CGEIT, CISSP, CPFA, Australia

Lucio Augusto Molina Focazzio, CISA, CISM, CRISC, ITIL, Colombia Vipin Sehgal, CISA, Sun Life Financial, Canada

Tariq Shaikh, CUISA, Tim Hortons Inc., Canada ISACA Board of Directors

Kenneth L. Vander Wal, CISA, CPA, Ernst & Young LLP (retired), USA, International President Christos K. Dimitriadis, Ph.D., CISA, CISM, INTRALOT S.A., Greece, Vice President

Gregory T. Grocholski, CISA, The Dow Chemical Co., USA, Vice President

Tony Hayes, CGEIT, AFCHSE, CHE, FACS, FCPA, FIIA, Queensland Government, Australia, Vice President Niraj Kapasi, CISA, Kapasi Bangad Tech Consulting Pvt. Ltd., India, Vice President

Jeff Spivey, CRISC, CPP, PSP, Security Risk Management, Inc., USA, Vice President

Jo Stewart-Rattray, CISA, CISM, CGEIT, CSEPS, RSM Bird Cameron, Australia, Vice President Emil D’Angelo, CISA, CISM, Bank of Tokyo-Mitsubishi UFJ Ltd., USA, Past International President

Lynn C. Lawton, CISA, FBCS CITP, FCA, FIIA, KPMG Ltd., Russian Federation, Past International President Allan Neville Boardman, CISA, CISM, CGEIT, CRISC, CA, CISSP, J.P. Morgan Chase, UK, Director

Marc Vael, Ph.D., CISA, CISM, CGEIT, CISSP, Valuendo, Belgium, Director Knowledge Board

Marc Vael, Ph.D., CISA, CISM, CGEIT, CISSP, Valuendo, Belgium, Chairman Michael A. Berardi Jr., CISA, CGEIT, Nestle USA, USA

John Ho Chi, CISA, CISM, CFE, CBCP, Ernst & Young LLP, Singapore Phil Lageschulte, CGEIT, CPA, KPMG LLP, USA

Jon Singleton, CISA, FCA, Canada

Patrick Stachtchenko, CISA, CGEIT, Stachtchenko & Associates SAS, France Guidance and Practices Committee

Phil Lageschulte, CGEIT, CPA, KPMG LLP, USA, Chairman

Ramses Gallego, CISM, CGEIT, CCSK, CISSP, SCPM, 6 Sigma, Quest Software, Spain Meenu Gupta, CISA, CISM, CBP, CIPP, CISSP, Mittal Technologies, USA

Yongdeok Kim, CISA, IBM Korea Inc., Korea Perry Menezes, CISM, CRISC, Deutsche Bank, USA

Mario Micallef, CGEIT, CPAA, FIA, Advisory in GRC, Malta Salomon Rico, CISA, CISM, CGEIT, Deloitte Mexico, Mexico Nikolaos Zacharopoulos, Geniki Bank, Greece

ISACA and IT Governance Institute®_{Affiliates and Sponsors} American Institute of Certified Public Accountants

(4)

The Center for Internet Security

Commonwealth Association for Corporate Governance Inc. FIDA Inform

Information Security Forum

Institute of Management Accountants Inc. ISACA chapters

ITGI Japan

Norwich University

Solvay Brussels School of Economics and Management

Strategic Technology Management Institute (STMI) of the National University of Singapore University of Antwerp Management School

ASI System Integration Hewlett-Packard IBM SOAProjects Inc Symantec Corp. TruArx Inc.

I. Introduction

Overview

ISACA has developed the IT Assurance FrameworkTM_(ITAFTM_{) as a comprehensive and} good-practice-setting model. ITAF provides standards that are designed to be mandatory and are the guiding principles under which the IT audit and assurance profession operates. The guidelines provide information and direction for the practice of IT audit and assurance. The tools and techniques provide methodologies, tools and templates to provide direction in the application of IT audit and assurance processes.

Purpose

The audit/assurance program is a tool and template to be used as a road map for the completion of a specific assurance process. ISACA has commissioned audit/assurance programs to be developed for use by IT audit and assurance professionals with the requisite knowledge of the subject matter under review, as described in ITAF section 2200—General Standards. The audit/assurance programs are part of ITAF section 4000—IT Assurance Tools and Techniques.

(5)

Control Framework

The audit/assurance programs have been developed in alignment with the ISACA COBIT framework— specifically COBIT 4.1—using generally applicable and accepted good practices. They reflect ITAF sections 3400—IT Management Processes, 3600—IT Audit and Assurance Processes, and 3800—IT Audit and Assurance Management.

Many organizations have embraced several frameworks at an enterprise level, including the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control Framework. The importance of the control framework has been enhanced due to regulatory requirements by the US Securities and Exchange Commission (SEC) as directed by the US Sarbanes-Oxley Act of 2002 and similar legislation in other countries. Enterprises seek to integrate control framework elements used by the general audit/assurance team into the IT audit and assurance framework. Since COSO is widely used, it has been selected for inclusion in this audit/assurance program. The reviewer may delete or rename these columns to align with the enterprise’s control framework.

Governance, Risk and Control of IT

Governance, risk and control of IT are critical in the performance of any assurance management process. Governance of the process under review will be evaluated as part of the policies and management oversight controls. Risk plays an important role in evaluating what to audit and how management approaches and manages risk. Both issues will be evaluated as steps in the audit/assurance program. Controls are the primary evaluation point in the process. The audit/assurance program will identify the control objectives and the steps to determine control design and effectiveness.

Responsibilities of IT Audit and Assurance Professionals

IT audit and assurance professionals are expected to customize this document to the environment in which they are performing an assurance process. This document is to be used as a review tool and starting point. It may be modified by the IT audit and assurance professional; it is not intended to be a checklist or questionnaire. It is assumed that the IT audit and assurance professional has the necessary subject matter expertise required to conduct the work and is supervised by a professional with the Certified Information Systems Auditor (CISA) designation and/or necessary subject matter expertise to adequately review the work performed.

II. Using This Document

This audit/assurance program was developed to assist the audit and assurance professional in designing and executing a review. Details regarding the format and use of the document follow.

Work Program Steps

The first column of the program describes the steps to be performed. The numbering scheme used provides built-in work paper numbering for ease of cross-reference to the specific work paper for that section. The physical document was designed in Microsoft®_{Word. The IT audit and assurance}

professional is encouraged to make modifications to this document to reflect the specific environment under review.

Step 1 is part of the fact-gathering and prefieldwork preparation. Because the prefieldwork is essential to a successful and professional review, the steps have been itemized in this plan. The first level steps, e.g., 1.1, are shown in bold type and provide the reviewer with a scope or high-level explanation of the purpose for the substeps.

(6)

Beginning in step 2, the steps associated with the work program are itemized. To simplify the use of the program, the audit/assurance objective—the reason for performing the steps in the topic area—is described. The specific controls follow. Each review step is listed below the control. These steps may include assessing the control design by walking through a process, interviewing, observing or otherwise verifying the process and the controls that address that process. In many cases, once the control design has been verified, specific tests need to be performed to provide assurance that the process associated with the control is being followed.

The ISACA audit/assurance programs have adopted a maturity assessment process as documented in the IT Assurance Guide: Using COBIT. This audit/assurance program is technical in scope and does not lend itself to the maturity assessment. Accordingly, the maturity assessment will not appear in this document. The audit/assurance plan wrap-up—those processes associated with the completion and review of work papers, preparation of issues and recommendations, report writing, and report clearing—has been excluded from this document because it is standard for the audit/assurance function and should be identified elsewhere in the enterprise’s standards.

COBIT Cross-reference

The COBIT cross-reference provides the audit and assurance professional with the ability to refer to the specific COBIT control objective that supports the audit/assurance step. The COBIT control objective should be identified for each audit/assurance step in the section. Multiple cross-references are not uncommon. Processes at lower levels in the work program are too granular to be cross-referenced to COBIT. The audit/assurance program is organized in a manner to facilitate an evaluation through a structure parallel to the development process. COBIT provides in-depth control objectives and suggested control practices at each level. As professionals review each control, they should refer to COBIT 4.1 or the IT Assurance Guide: Using COBIT for good-practice control guidance.

COSO Components

As noted in the introduction, COSO and similar frameworks have become increasingly popular among audit and assurance professionals. This ties the assurance work to the enterprise’s control framework. While the IT audit/assurance function uses COBIT as a framework, operational audit and assurance professionals use the framework established by the enterprise. Since COSO is the most prevalent internal control framework, it has been included in this document and is a bridge to align IT audit/assurance with the rest of the audit/assurance function. Many audit/assurance organizations include the COSO control components within their report and summarize assurance activities to the audit committee of the board of directors.

For each control, the audit and assurance professional should indicate the COSO component(s) addressed. It is possible, but generally not necessary, to extend this analysis to the specific audit step level.

The original COSO internal control framework contained five components. In 2004, COSO was revised as the Enterprise Risk Management (ERM) Integrated Framework and extended to eight components. The primary difference between the two frameworks is the additional focus on ERM and integration into the business decision model. ERM is in the process of being adopted by large enterprises. The two

(7)

Figure 1—Comparison of COSO Internal Control and ERM Integrated Frameworks Internal Control Framework ERM Integrated Framework Control Environment: The control environment sets the tone of an

organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure. Control environment factors include the integrity, ethical values, management’s operating style, delegation of authority systems, as well as the processes for managing and developing people in the organization.

Internal Environment: The internal environment encompasses the tone of an organization, and sets the basis for how risk is viewed and addressed by an entity’s people, including risk management philosophy and risk appetite, integrity and ethical values, and the environment in which they operate.

Objective Setting: Objectives must exist before management can identify potential events affecting their achievement. Enterprise risk management ensures that management has in place a process to set objectives and that the chosen objectives support and align with the entity’s mission and are consistent with its risk appetite.

Event Identification: Internal and external events affecting achievement of an entity’s objectives must be identified, distinguishing between risks and opportunities. Opportunities are channeled back to management’s strategy or objective-setting processes.

Risk Assessment: Every entity faces a variety of risks from external and internal sources that must be assessed. A precondition to risk assessment is establishment of objectives, and, thus, risk assessment is the identification and analysis of relevant risks to achievement of assigned objectives. Risk assessment is a prerequisite for determining how the risks should be managed.

Risk Assessment: Risks are analyzed, considering the likelihood and impact, as a basis for determining how they could be managed. Risk areas are assessed on an inherent and residual basis.

Risk Response: Management selects risk responses—avoiding, accepting, reducing or sharing risk—developing a set of actions to align risks with the entity’s risk tolerances and risk appetite. Control Activities: Control activities are the policies and procedures

that help ensure management directives are carried out. They help ensure that necessary actions are taken to address risks to achievement of the entity's objectives. Control activities occur throughout the organization, at all levels and in all functions. They include a range of activities as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets and segregation of duties.

Control Activities: Policies and procedures are established and implemented to help ensure the risk responses are effectively carried out.

Information and Communication: Information systems play a key role in internal control systems as they produce reports, including operational, financial and compliance-related information that make it possible to run and control the business. In a broader sense, effective communication must ensure information flows down, across and up the organization. Effective communication should also be ensured with external parties, such as customers, suppliers, regulators and shareholders.

Information and Communication: Relevant information is identified, captured and communicated in a form and time frame that enable people to carry out their responsibilities. Effective

communication also occurs in a broader sense, flowing down, across and up the entity.

Monitoring: Internal control systems need to be monitored—a process that assesses the quality of the system’s performance over time. This is accomplished through ongoing monitoring activities or separate evaluations. Internal control deficiencies detected through these monitoring activities should be reported upstream and corrective actions should be taken to ensure continuous improvement of the system.

Monitoring: The entirety of enterprise risk management is monitored and modifications are made as necessary. Monitoring is accomplished through ongoing management activities, separate evaluations or both.

Information for figure 1 was obtained from the COSO web site, www.coso.org/aboutus.htm.

The original COSO internal control framework addresses the needs of the IT audit and assurance professional: control environment, risk assessment, control activities, information and communication, and monitoring. As such, ISACA has elected to utilize the five-component model for these audit/

assurance programs. As more enterprises implement the ERM model, the additional three columns can be added, if relevant. When completing the COSO component columns, consider the definitions of the components as described in figure 1.

Reference/Hyperlink

Good practices require the audit and assurance professional to create a work paper for each line item, which describes the work performed, issues identified and conclusions. The reference/hyperlink is to be used to cross-reference the audit/assurance step to the work paper that supports it. The numbering system

(8)

of this document provides a ready numbering scheme for the work papers. If desired, a link to the work paper can be pasted into this column.

Issue Cross-reference

This column can be used to flag a finding/issue that the IT audit and assurance professional wants to further investigate or establish as a potential finding. The potential findings should be documented in a work paper that indicates the disposition of the findings (formally reported, reported as a memo or verbal finding, or waived).

Comments

The comments column can be used to indicate the waiving of a step or other notations. It is not to be used in place of a work paper describing the work performed.

III. Controls Maturity Analysis

One of the consistent requests of stakeholders who have undergone IT audit/assurance reviews is a desire to understand how their performance compares to good practices. Audit and assurance professionals must provide an objective basis for the review conclusions. Maturity modeling for management and control over IT processes is based on a method of evaluating the enterprise, so that it can be rated from a maturity level of nonexistent (0) to optimized (5). This approach is derived from the maturity model that the Software Engineering Institute (SEI) of Carnegie Mellon University defined for the maturity of software development.

The IT Assurance Guide Using COBIT, Appendix VII—Maturity Model for Internal Control, in figure 2,

provides a generic maturity model showing the status of the internal control environment and the

establishment of internal controls in an enterprise. It shows how the management of internal control, and an awareness of the need to establish better internal controls, typically develops from an ad hoc to an optimized level. The model provides a high-level guide to help COBIT users appreciate what is required

for effective internal controls in IT and to help position their enterprise on the maturity scale. Figure 2—Maturity Model for Internal Control

Maturity Level Status of the Internal Control Environment Establishment of Internal Controls

0 Non-existent There is no recognition of the need for internal control. Control is not part of the organization’s culture or mission. There is a high risk of control deficiencies and incidents.

There is no intent to assess the need for internal control. Incidents are dealt with as they arise.

1 Initial/ad hoc There is some recognition of the need for internal control. The approach to risk and control requirements is ad hoc and disorganized, without communication or monitoring. Deficiencies are not identified. Employees are not aware of their responsibilities.

There is no awareness of the need for assessment of what is needed in terms of IT controls. When performed, it is only on an ad hoc basis, at a high level and in reaction to significant incidents. Assessment addresses only the actual incident. 2 Repeatable but

Intuitive Controls are in place but are not documented. Their operationis dependent on the knowledge and motivation of individuals. Effectiveness is not adequately evaluated. Many control weaknesses exist and are not adequately addressed; the impact can be severe. Management actions to resolve control issues are not prioritized or consistent. Employees may not be aware of their responsibilities.

Assessment of control needs occurs only when needed for selected IT processes to determine the current level of control maturity, the target level that should be reached and the gaps that exist. An informal workshop approach, involving IT managers and the team involved in the process, is used to define an adequate approach to controls for the process and to motivate an agreed-upon action plan.

3 Defined Controls are in place and adequately documented. Operating effectiveness is evaluated on a periodic basis and there is an average number of issues. However, the evaluation process is not documented. While management is able to deal predictably with most control issues, some control weaknesses persist and impacts could still be severe. Employees are aware of their responsibilities for control.

Critical IT processes are identified based on value and risk drivers. A detailed analysis is performed to identify control requirements and the root cause of gaps and to develop improvement opportunities. In addition to facilitated workshops, tools are used and interviews are performed to support the analysis and ensure that an IT process owner owns and drives the assessment and improvement process. 4 Managed and

Measurable

There is an effective internal control and risk management environment. A formal, documented evaluation of controls

IT process criticality is regularly defined with full support and agreement from the relevant business process owners.

(9)

Figure 2—Maturity Model for Internal Control

Maturity Level Status of the Internal Control Environment Establishment of Internal Controls

occurs frequently. Many controls are automated and regularly reviewed. Management is likely to detect most control issues, but not all issues are routinely identified. There is consistent follow-up to address identified control weaknesses. A limited, tactical use of technology is applied to automate controls.

Assessment of control requirements is based on policy and the actual maturity of these processes, following a thorough and measured analysis involving key stakeholders. Accountability for these assessments is clear and enforced. Improvement strategies are supported by business cases. Performance in achieving the desired outcomes is consistently monitored. External control reviews are organized occasionally.

5 Optimized An enterprisewide risk and control program provides continuous and effective control and risk issues resolution. Internal control and risk management are integrated with enterprise practices, supported with automated real-time monitoring with full accountability for control monitoring, risk management and compliance enforcement. Control evaluation is continuous, based on self-assessments and gap and root cause analyses. Employees are proactively involved in control improvements.

Business changes consider the criticality of IT processes and cover any need to reassess process control capability. IT process owners regularly perform self-assessments to confirm that controls are at the right level of maturity to meet business needs and they consider maturity attributes to find ways to make controls more efficient and effective. The organization benchmarks to external best practices and seeks external advice on internal control effectiveness. For critical processes, independent reviews take place to provide assurance that the controls are at the desired level of maturity and working as planned.

The maturity model evaluation is one of the final steps in the evaluation process. The audit and assurance professional can address the key controls within the scope of the work program and formulate an

objective assessment of the maturity levels of the control practices. The maturity assessment can be a part of the audit/assurance report and can be used as a metric from year to year to document progression in the enhancement of controls. However, it must be noted that the perception as to the maturity level may vary between the process owner and the auditor. Therefore, an auditor should obtain the concerned

stakeholder’s concurrence before submitting the final report to management.

At the conclusion of the review, once all findings and recommendations are completed, the professional assesses the current state of the control framework, using the main topics of the program, and assigns it a maturity level using the six-level scale. Some practitioners utilize decimals (x.25, x.5, x.75) to indicate gradations in the maturity model. To provide further value to the client/customer, the professional can also obtain maturity targets from the client/customer. Using the assessed and target maturity levels, the professional can create an effective graphic presentation that describes the achievement or gaps between the actual and targeted maturity goals. A graphic is provided as the last page of the document (section VIII), based on sample assessments.

IV. Assurance and Control Framework

ISACA IT Assurance Framework and Standards

This audit program is not IT-focused. The ITAF section most relevant to Business Continuity

Management is 3630.9 Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP). The scope of this audit/assurance program is significantly wider than the IT Continuity Plan. ITAF’s focus should not limit the scope of this audit/assurance program

ISACA Control Framework

COBIT is a framework for the governance of IT and supporting tool set that allows managers to bridge the gap among control requirements, technical issues and business risks. COBIT enables clear policy development and good practice for IT control throughout enterprises.

Utilizing COBIT as the control framework from which IT audit/assurance activities are based aligns IT audit/assurance with good practices as developed by the enterprise.

(10)

Business Continuity Management aligns with DS4, Ensure Continuous Service. However, the scope is wider and does not lend itself to a direct comparison on a specific control objective level. The COBIT cross-reference is indicated where applicable.

V. Executive Summary of Audit/Assurance Focus

A business continuity plan is an enterprisewide group of processes and instructions to ensure the

continuation of business processes – including, but not limited to, Information Technology - in the event of an interruption. It provides the plans for the enterprise to recover from minor incidents (e.g., localized disruptions of business components) to major disruptions (e.g., fire, natural disasters, extended power failures, equipment and/or telecommunications failure). The plan is usually owned and managed by the business units and a disaster management or risk prevention function in the enterprise. Functional continuity plans are subsets of the enterprise business continuity planning and support the delivery of essential business services

The business continuity plan must ensure that:

 Risks are appropriately identified and evaluated by focusing on the impact of known and potential risks on business processes

 The costs of implementing and managing continuity assurance are less than the expected losses and within management’s risk tolerance

 The business priorities are addressed: critical applications, interim processes, restoration activities and mandated deadlines

 Manual interfaces to automated processes are identified, personnel are trained and practice drills are conducted

 Expectations are managed with realistic goals

Business Impact and Risk

Business reliance on automated solutions, employee knowledge and manual process are tightly woven into the DNA of the enterprise. The risks and potential impacts to the enterprise of failure to establish a good-practice continuity plan and align it with the business continuity plan include inability of the enterprise to conduct normal business functions after a disruption due to:

 Failure of plans to reflect changes to business needs, applications portfolio, compliance requirements or technology

 Inadequate planning and consideration of significant enterprise risk

 Failure to plan for or inability to assess the situation and implement alternate processes to fit unforeseen situations

 Inappropriate or incomplete recovery plans and processes, resulting in delayed restoration of business functions

 Incomplete or untested interim logistics plans

 Inadequate training and/or staff not prepared to execute the plan effectively and quickly

 Inadequate or unavailable staffing resources to restore business processes to meet Recovery Time or Recovery Point objectives (RTOs, RPOs)

 Lack of plan change control, resulting in out-of-date continuity plans

 Regulatory violations resulting in fines or censure

 Reputational risk resulting in loss of customer confidence

(11)

 Increased costs for continuity management due to ineffective focus on risks and costs or failure to prioritize services recovery based on business need

 Lack of development of realistic threat scenarios that may potentially disrupt business processes

 Lack of consideration of all possible threat scenarios based upon potential circumstances and events

Objective and Scope

Objective—The continuity planning audit/assurance review will:

 Provide management with an evaluation of the enterprise’s preparedness in the event of a major business disruption

 Identify issues that may limit interim business processing and restoration of same

 Provide management with an independent assessment of the effectiveness of the business continuity plan and its alignment with subordinate continuity plans

Scope—The review will focus on the enterprise business continuity plan, policies, standards, guidelines,

procedures, laws and regulations that address maintaining continuous business services. This will include:

 Development, maintenance and testing of the business continuity plan

 Ability to provide interim business services and the effective and timely restoration of same

 Risk management and costs related to the business continuity plan

Minimum Audit Skills

The audit and assurance professional should have an understanding of good-practice systems business continuity management framework and processes. In addition, a solid understanding of the enterprise’s business functions and industry risks is necessary to perform the review. The business continuity management audit/assurance review is best performed as an integrated audit, by professionals with business, operational, and technology skill sets.

(12)

VI. Audit/Assurance Program

Audit/Assurance Program Step COBIT

Cross-reference COSO Reference Hyper-link Issue Cross-reference Comments C on tr ol E nv ir on m en t R is k A ss es sm en t C on tr ol A ct iv it ie s In fo rm at io n an d C om m un ic at io n M on it or in g

1. PLANNING AND SCOPING THE BUSINESS CONTINUITY AUDIT 1.1 Define Audit/Assurance Objectives

The audit/assurance objectives are high level and describe the overall audit goals.

1.1.1 Review the audit/assurance objectives in the introduction to this business continuity management (BCM) audit/assurance program.

1.1.2 Modify the audit/assurance objectives to align with the audit universe, annual plan and charter.

1.2 Define Boundaries of Review

The review must have a defined scope. The reviewer should understand the operating environment and prepare a proposed scope, subject to a later risk assessment.

1.2.1 Obtain BCM policy documentation.

1.2.2 Obtain and review the enterprise BCM plans.

1.2.3 Determine if the BCM audit will include the enterprise or be limited to specific business units.

1.2.4 Identify limitations and/or constraints affecting the ability to audit specific departments, locations or entities.

1.3 Identify and Document Audit Risks

The risk assessment is necessary to evaluate where audit resources should be focused. In most enterprises, audit resources are not available for all processes. The risk-based approach assures the most effective utilization of audit resources.

1.3.1 Determine if the risk assessment rating assigned by the audit department is reasonable. 1.3.2 Evaluate the overall risk profile for performing the review.

1.3.3 Determine if BCM audits have been performed previously. If yes then determine the following.

1.3.3.1 Determine the status of issues previously identified.

1.3.3.2 Determine if the status of previously identified issues requires adjustment to the audit risk rating and priority of the audit.

1.3.4 Based on the audit risk assessment, identify changes to the scope.

(13)

Audit/Assurance Program Step COBIT Cross-reference COSO Reference Hyper-link Issue Cross-reference Comments C on tr ol E nv ir on m en t R is k A ss es sm en t C on tr ol A ct iv it ie s In fo rm at io n an d C om m un ic at io n M on it or in g

1.4 Define the Audit Change Process

The initial audit approach is based on the reviewer’s understanding of the operating environment and associated risks. As further research and analysis are performed, changes to the scope and approach will result.

1 2 3 4 5

1.4.1 Identify the senior assurance resource responsible for the review. 6 7 8 9 10

1.4.2 Establish the process for suggesting and implementing changes to the BCM audit/assurance

program and the authorizations required. 11 12 13 14 15

1.5 Define Assignment Success

The success factors need to be identified. 16 17 18 19 20

1.5.1 Identify the drivers for a successful review. (This should exist in the assurance function’s

standards and procedures.) 21 22 23 24 25

1.5.2 Communicate success attributes to the process owner or stakeholder, and obtain agreement. _{26 27 28 29 30} 1.6 Define Audit Resources Required

The resources required are defined in the introduction to this BCM audit/assurance program. 31 32 33 34 35

1.6.1 Determine the audit skills necessary for the review. 36 37 38 39 40

1.6.2 Consider how the audit/assurance process will integrate internal audit resources based on

subject matter expertise. 41 42 43 44 45

1.6.3 Estimate the total audit resources (hours) and time frame (start and end dates) required for the

review. 46 47 48 49 50

1.7 Define Deliverables

The deliverable is not limited to the final report. BCM is also not limited to a single stakeholder. Communication between the audit/assurance team and the various stakeholders is essential to assignment success.

51 52 53 54 55 1.7.1 Determine the interim deliverables, including initial findings, status reports, draft reports, due

dates for responses or meetings and the final report. 56 57 58 59 60

1.7.2 Determine who are the key representatives of each affected organization and identify their

participation in the status and final reporting process. 61 62 63 64 65

1.8 Communications

The audit/assurance process must be clearly communicated to the organization. 66 67 68 69 70

1.8.1 Identify the recipients of status reports and other communications. 71 72 73 74 75

(14)

2. BUSINESS CONTINUITY PLAN MANAGEMENT 2.1 Business Continuity Management Organization

Audit/Assurance Objective: The business continuity management plan team must be organized to represent all appropriate business functions.

Business Continuity Management Organization

Control: The BCM team has a designated leader, reporting to a senior executive with cross-organization responsibilities. Membership of the BCM team includes the major segments of the enterprise’s business units, as well as critical support functions such as legal, human resources, public relations, supply and logistics chain management, manufacturing, information security, IT operations, internal and external auditors.

PO4.6

DS4.1 X X

2.1.1.1 Obtain an organization chart describing the BCM job descriptions, reporting relationships, level of authority, and incumbent and back-up personnel assigned to each position and determine whether all personnel are active in the enterprise. 2.1.1.2 Obtain the documents relating to the processes and procedures to be followed by

the BCM group in the event of a contingency, the composition of the group, frequency of meetings, and communications requirements.

2.1.1.3 Determine if the following functions are represented on the BCM team:  Team management  Finance  Human resources  Facilities  Legal  Public relations  Technology  Operations

 Supply and logistics chain management  Communications

 Critical third parties, e.g., contractors, technology vendors  Internal and external audit

2.1.1.4 Determine if the representatives regularly participate in or are consulted on strategic and operational issues affecting business continuity.

(15)

2.1.1.5 Obtain minutes of meetings, organization charts and other documentation as evidence of participation.

2.1.1.6 Determine if the team manager reports to an appropriate senior level (C-suite) executive with cross-organization responsibilities

2.1.1.7 Identify the form and process for the reporting relationship.

3.

BCM POLICY, STANDARDS AND PROCEDURES X X X

3.1 Policy and Standards

Audit/Assurance Objective: Policies affecting business continuity are implemented to ensure completeness and appropriate coverage for business risks.

Policy Definition

Control: Determine if the BCM function is actively involved in the establishment of business continuity policy.

PO6.3 DS4.1

DS4.2 X X

3.1.1.1 Obtain corporate policies and standards.

3.1.1.2 Determine if BCM is based upon recognized standards or frameworks, e.g., BS 25999 Guideline for Incident Preparedness and Operational Continuity Management or NIST SP800-34 Contingency Planning Guide for Federal Information Systems

3.1.1.3 Obtain minutes of BCM meetings to verify involvement in, and familiarity with, corporate policies and standards.

3.1.1.4 Determine if the BCM documentation reflects appropriate reports, dashboards, etc., to ensure BCM governance as per corporate policies 3.1.1.5 Determine if the BCM team is involved in the development of policies

and standards.

3.1.1.6 Review policy approval procedures for inclusion of BCM in the process. 3.2 BCM Procedures Audit/Assurance

Objective: BCM procedures are defined, implemented and monitored. Procedures

Control: The BCM procedures include a charter or scope and objectives. X

3.2.1.1 Obtain the BCM charter or scope and objectives.

(16)

Audit/Assurance Program Step COBIT Cross-reference COSO Reference Hyper-link Issue Cross-reference Comments C on tr ol E nv ir on m en t R is k A ss es sm en t C on tr ol A ct iv it ie s In fo rm at io n an d C om m un ic at io n M on it or in g Personnel Policies

Control: Personnel policies are established and include skills assessment and training programs for the BCM function.

PO7 DS4.3

DS7 x

3.2.1.3 Determine if resources assigned to the BCM function have appropriate skills to perform their duties.

3.2.1.4 Determine if resources assigned to the BCM function have requirements, training schedules and monitoring of training completion.

3.2.1.5 Obtain training records for BCM resources.

3.2.1.6 Evaluate training records; determine if they address the identified skills assessment deficiencies.

Incident Response

Control: Incident response responsibilities are clearly defined and exercises are routinely executed. DS4.1 DS8.3 DS8.4 DS10 X X

3.2.1.7 Obtain the incident response policies and procedures. 3.2.1.8 Determine if incident responsibilities are clearly identified.

3.2.1.9 Determine if alternate resources for key responsibilities are defined. 3.2.1.10 Determine if incident drills are regularly scheduled.

3.2.1.11 Determine if incident drills adequately consider foreseeable incidents and disaster scenarios.

3.2.1.12 Determine if the policies and procedures are up to date and are regularly reviewed

BCM Procedure Monitoring

Control: BCM processes are routinely monitored, and results are reported to and evaluated by responsible management.

ME1 ME2

ME4 X

3.2.1.13 Determine if BCM policies and procedures are monitored.

3.2.1.14 Determine if the monitoring reporting process includes the use of scorecards and self-assessments.

3.2.1.15 Obtain and review self-assessments for effectiveness.

3.2.1.16 Obtain and review scorecards. Determine if issue-monitoring procedures are in effect to ensure resolution of identified issues.

(17)

3.2.1.17 Determine how often reports are generated and the appropriateness of the individual(s) who receives the reports.

3.3 BCM Maintenance

Audit/Assurance Objective: The BCM policies and procedures are subject to routine review to ensure they address current business continuity issues.

BCM Maintenance Reviews

Control: Periodic reviews of the BCM policies and procedures are regularly scheduled, performed, and the results evaluated.

PO8 AI4

DS4.4 X X X

3.3.1.1 Obtain a list of all BCM documentation.

3.3.1.2 Determine if the BCM documentation has been updated regularly and changes or effective dates appear on each page of the documentation.

3.3.1.3 Determine if reviewers document completion of the review process with their initials or signature.

3.3.1.4 Determine if personnel reviewing documents are qualified.

3.3.1.5 Determine if a senior executive has formally approved all recent material changes to BCM policies procedures, and documentation.

3.3.1.6 Determine if BCM policies, procedures and documentation are available in appropriate form independent of the internal infrastructure, e.g., hard copy or electronic maintained off-site or in a cloud-based online version.

3.3.1.7 Determine if key business continuity, line of business and supporting staff all have access to the documentation.

4.

BUSINESS IMPACT ASSESSMENT (BIA)

4.1 BIA Defines Business Continuity Needs

Audit/Assurance Objective: A comprehensive Business Impact Analysis is the basis for business continuity decisions.

BIA Methodology Defined

Control: A BIA methodology is defined and implemented. DS4.1DS4.2 X

4.1.1.1 Obtain the BIA methodology.

4.1.1.2 Review the processes for implementing modifications to reflect changes in the business and processing environments and incident history.

(18)

4.1.1.3 Determine that the organization has determined RTOs (Recovery Time Objectives) and RPOs (Recovery Point Objectives) for each critical application.1

4.1.1.4 Assess that the RTOs and RPOs are practical and reasonable for each application and line of business or function.

BIA Supports BCM

Control: BIA justifies BCM alternatives.

DS4.1

DS4.2 X X

4.1.1.5 Obtain management reports, minutes of meetings, emails, etc., that formally document BIA communications and status reports.

BIA Continually Assesses Business Continuity Needs

Control: The BIA is updated, at least annually, by the business and support units. DS4.4 X X 4.1.1.6 Obtain management reports, minutes of meetings, etc., that document periodic

updates to the BIA.

4.1.1.7 Review the management reports to ensure all business and support units perform the annual assessment.

4.1.1.8 Select specific annual reports from high-risk functional units; determine that the annual updates for the selected units were performed as required and include a fresh assessment of the business continuity needs.

4.1.1.9 Determine that the business unit managers document the completion of an annual (or more frequent) BIA review.

4.1.1.10 Determine if BIAs are performed in response to significant business process change and when business units are acquired or sold.

Single Points of Failure

Control: The BIA includes a detailed analysis of all single points of failure in the business and support functions.

DS4.3

DS4.4 X

4.1.1.11 Obtain analyses of single points of failure within the business and support units, e.g., supply chain, logistics chain, financial reporting, technology stacks (all levels of technology supporting a business function from hardware through networks to application layers, databases, Web interfaces, etc.)

4.1.1.12 Determine that all single points of failure have either been fully remediated or the enterprise has formally accepted the risks or the risks have been laid off (typically

(19)

by purchasing suitable insurance cover.) 5. RISK ASSESSMENT

5.1 Integration With Enterprise Risk Management (ERM)

Audit/Assurance Objective: BCM is an integral component of the ERM program. 5.1.1 Risk Management

Control: Management must participate in an active risk management program. PO9 X X 5.1.1.1 Determine that the BCM team (or other appropriate team) performs annual or more

frequent risk assessments, based on current business conditions.

5.1.1.2 Determine if risk assessments included supply chain and logistics chain issues as well as mission-critical third party relationships.

5.1.1.3 Determine if identified hazards are being monitored.

5.1.1.4 Determine that BCM team prepares a residual risk profile identifying significant risks, and review the documents to determine management follow-up.

5.1.1.5 Obtain risk management meeting minutes and other documentation to determine the involvement of the BCM function.

5.1.1.6 Determine that the BCM function participates in the risk management function. Enterprise Risk Management (ERM)

Control: Business continuity management is a process within the ERM. PO9 X X

5.1.1.7 If the BCM risk assessments utilize the enterprise risk management process, perform the following:

5.1.1.8 Obtain and inspect risk assessment documentation.

5.1.1.9 Determine that risk assessment assigns reasonable probabilities to incidents affecting business continuity.

5.1.1.10 Review the risk assessment to determine if the risk assessment is performed in an impartial manner and is supported by fact or reasonable

management justification.

5.1.1.11 Determine that the risk management process assigns residual risk ratings 5.1.1.12 Determine how the residual risk ratings drive the decision of which

processes are included in the business continuity plans.

(20)

5.1.1.14 Determine if key business units and support units are included in the ERM. 5.1.1.15 If an ERM system has not been established, perform the following.

5.1.1.16 Determine whether critical business units and support units required for inclusion in a risk assessment (i.e., risk dependent units) have been considered.

5.1.1.17 Determine whether these risk dependent units perform their own risk assessments.

5.1.1.18 Determine the processes used for the independent risk assessments.

5.1.1.19 Determine whether the individual unit residual risk ratings are in alignment with Internal Audit's annual risk assessment, identify any material differences, and obtain explanations.

Risk Management Issue Monitoring

Control: Identified risks are entered into an issue monitoring system for inclusion in a

business continuity plan. PO9 X X X

5.1.1.20 Review the process for including risks into an issue monitoring system for inclusion in the business continuity management program.

5.1.1.21 Obtain the most recent issue monitoring report.

5.1.1.22 Determine whether identified issues have been appropriately addressed by BCM.

5.1.1.23 Evaluate open items and assess risk rating associated with each item. Determine if the ratings are appropriate.

5.1.1.24 Determine the frequency of issue monitoring follow-up and assess its appropriateness.

6. DOCUMENTATION

6.1 Appropriate Documentation

Audit/Assurance Objective: The business continuity plan is adequately documented to conduct effective interim business activities and recovery procedures after a declared business interruption. Documentation is Adequate to Support Business Continuity

Control: The entire business continuity plan is documented and available during a declared emergency. PO8 AI4 DS4.4 DS4.7 X

(21)

6.1.1.2 Determine that the plan has been kept current and reflects changes in the business processes, environment, technology, third-party relationships, relevant contracts and regulatory and other compliance requirements.

6.2 Documentation is Adequate to Support Recovery Recovery Plan Documentation

Control: The entire business recovery plan is documented and available during a declared emergency.

DS4.4

DS4.7 X

6.2.1.1 Determine whether a recovery plan is in place. 6.2.1.2 Obtain recovery plan documentation.

6.2.1.3 Determine that the plan has been kept current and reflects relevant changes in the business processes, environment, third-party relationships, relevant contracts and regulatory and other compliance requirements.

6.2.1.4 Determine if contact information has been kept current.

6.2.1.5 Determine if it is available in an appropriate form independent of internal

infrastructure. X

6.2.1.6 Determine if key recovery personnel have access to the documentation. 7. PLAN TESTING

7.1 Plan Testing

Audit/Assurance Objective: The plan should be tested regularly, and the tests should include a comprehensive verification of continuity processes and situational drills to test the assumptions and alternate procedures within the plan.

DS4.5

DS4.6 X

Testing Policies

Control: Testing policies define test frequency, types of tests, use of situational drills and other recognized processes.

7.1.1.1 Obtain testing policies document.

7.1.1.2 Determine that the following policies are stated and documented: Minimum test frequency

Conditions requiring more frequent testing Types of scenarios to be tested

(22)

Audit/Assurance Program Step COBIT Cross-reference COSO Reference Hyper-link Issue Cross-reference Comments C on tr ol E nv ir on m en t R is k A ss es sm en t C on tr ol A ct iv it ie s In fo rm at io n an d C om m un ic at io n M on it or in g Testing Methods

Control: Testing includes both walkthroughs and full-scale drills of the interim process and recovery plans.

7.1.1.3 Determine that walkthrough tests are performed regularly and include all facets of the plan.

7.1.1.4 Determine that full-scale tests are performed regularly and include higher risks events.

7.1.1.5 Determine if an after-hours call list exists and is current.

7.1.1.6 Determine if a program of continuity awareness exists and is executed regularly. Analysis of Test Results

Control: The results from the plan tests are analyzed to identify issues that require BCP

revision, additional training or additional resources. DS4.10 X X X

7.1.1.7 Verify that changes to recovery plans have been made as a result of testing and lessons learned.

7.1.1.8 Determine if the results have been communicated to management.

7.1.1.9 Determine that stakeholders and assurance functions monitor and receive post-test analysis.

Testing Management

Control: BCM tests are documented and provide the structure for identifying lapses and gaps. DS4DS5 DS9

X 7.1.1.10 Obtain documentation of exercise performed.

7.1.1.11 Determine if the exercises had been effective in identifying possible shortcomings in the BCM.

7.2 Testing of Recovery Service Levels

Control: Plan testing includes verification that the tests were completed within the intervals established in the BIA and BCP.

DS4.5

DS4.8 X

7.2.1 Determine if test results are compared against test criteria (RTOs, RPOs, etc.). 7.3 Test Frequency

Control: The continuity plan is tested routinely, according to the policy. The tests address the requirements within the BCP and are documented.

DS4.6

DS4.8 X

(23)

requirements identified in the BIA. Plan Stress Testing

Control: The business continuity tests utilize situational drills where anticipated resources are not available for the test, or the circumstances of the test are modified unannounced to verify the recovery team’s ability to adapt to unplanned situations.

DS4.5 X

7.3.3 Verify that the tests include unannounced situations to stress test the recovery plan's assumptions and the staff’s ability to react to unplanned events.

(24)

VII. Maturity Assessment

The maturity assessment is an opportunity for the reviewer to assess the maturity of the processes reviewed. Based on the results of audit/assurance review, and the reviewer’s observations, the reviewer assigns a maturity level to each of the following control practices.

Control Practice _MaturityAssessed _MaturityTarget

Reference

Hyper-link

Comments

Business Continuity Plan Management BCM Policy, Standards, and Procedures Business Impact Assessment

Risk Assessment Documentation Plan Testing

(25)