Business Continuity and Disaster Recovery Management Audit Program/Checklist

Business continuity management (BCM) is the capacity by an organization to maintain its critical/essential business services, operations and infrastructures such that they are continually available/accessible to stakeholders (e.g. customers, users, employees, service providers, investors or owners) who may need them in the event of emergency situations or unplanned service disruptions. This requires putting in place necessary frameworks, policies, procedures and resources to achieving same. In some cases, regulation and laws applicable to specific industries mandate the adoption of business continuity measures that will ensure continuity of essential business services in the face of disruptions or emergencies. This has become part of corporate strategy to ensure survival of any business and realization of stakeholders' objectives. On the other hand, disaster recovery management are action, processes or procedures that are adopted by an organization to effectively and efficiently recover from disaster or unplanned service disruption within reasonably defined period of time such that will have minimal impact on business operations and service delivery. Disaster recovery plans (DRP) are documented and routinely tested by stakeholders for its suitability, feasibility and resilience to ensure that they remain relevant to the business and effectively recover given processes from disaster or service disruption. To ensure the suitability and relevance of an organization's business continuity and disaster recovery management capabilities, they ought to be audit so as to provide reasonable assurance to stakeholders/management of its suitability for the business. As such, it is imperative that the internal audit team or persons/department saddle with this assurance function to be apprised with relevant policies, procedures, frameworks, regulations and laws relating to BCM and DRP to assure its adequacy. The audit team must therefore ensure that they development an effective audit work program or checklist that will captures all aspects of the organizations business continuity management frameworks and policies as well as applicable laws/regulations to be able to perform its duties. It is the responsibility of the audit team to review the implementation of business continuity management frameworks, policies, procedures and regulations in addition to disaster recovery procedures for their adequacy and relevance in the event of disaster. Also, the determination of business services and operations to be recovered first based on risk assessment and business impact analysis are reviewed for its adequacy and effectiveness.

The PDF document below detailed the audit work program or checklist that can be used to successfully perform audit of an organization's Business Continuity and Disaster Recovery readiness. The Controls specified therein are general controls, which can be adopted and used within the context of the users'/organizations' operating environments, regulatory policies as well as applicable laws/jurisdictions.