What are the key components of a BCP and DRP audit checklist?

BCP and DRP plans are drawn up and tests are to be conducted as per plans. Hence, scope of audit should cover the BCP and DRP plans. The audit should include checks on whether the plans are complete and relevant to the business area. It should also include checks that the tests are carried out as per the plans, issues are followed up and resolved.

A BCP and DRP audit checklist starts with clear objectives and scope, aligning with business continuity goals. In my role, aligning audit goals with agile methodologies has been key, ensuring all aspects of disaster recovery, from policies to technology, are covered comprehensively. This includes establishing measurable criteria based on best practices and regulatory standards, akin to sprint goals in Scrum. Such precision in defining scope and objectives ensures that the audit not only assesses compliance but also identifies areas for improvement, driving continuous enhancement of disaster preparedness. This approach mirrors the agile principle of regular reflection and adaptation, crucial for maintaining an effective and responsive plan.

At the outset, it's crucial to verify existence of documented BCP and DRP policy approved by Sr. management. Check that roles, responsibilities, and authorities for BCP and DRP are clearly defined & shared. Ensure BCP & DRP meet industry regulations, standards, and legal requirements. Verify Risk assessment conducted to identify threats and vulnerabilities. Review BIA to ensure critical business functions and their impact to prioritize. Also, Ensure RTO & RPO's are defined. Confirm the existence of an internal and external communication plan for crisis. Check that contact lists for key personnel, vendors, stakeholders, and customers are up-to-date. Map policy & procedure documents with implementation as a comprehensive audit checklist.

While this may not work in every organization, embedding with a team prior to a a formal review helps pull more information than the formal audit itself. It also helps you identify who may be a “champion” on that team to ease any tensions and push forward continuous improvement plan objectives.

My TopTips for BCM (and all other) Audits are: 1.The auditee, as well as the auditor, must understand that the person on the other side of the table is a human being. 2.The auditee as well as the auditor must be trained in audits (I have never seen an auditee being trained or there is no training in the world for the Auditees). 3.The purpose of the audits is to see compliance i.e. whether you are doing what you said you would be doing, and how effectively you are doing that. 4.The objective of the audit is to find improvements (not the mistakes, faults, or shortcomings). 5.The responsibility to close the findings is upon the auditee (do not even expect or ask for tips from the auditor, not even in friendly way). 6.Track findings to closure.