Rich Archer
Partner, Risk Advisory Services
KPMG LLP
Auditing Business Continuity Plans
• Introduction
• Basis for auditing BCP (why should we care?)
• Objectives of a good plan
• Auditing BCP
• Key areas for consideration
• Where to start
• Audit steps
• What to look for
• Conclusion
Agenda
The dependence of today’s enterprises on IT is significant. For an organization that uses IT extensively for its operations, not just recording of transactions, the non-availability of its information systems could mean the end of its existence.
Introduction
The confidentiality, integrity and availability of information systems must be ensured to protect the business from the risks relating to information technology.
An IT audit helps to identify areas where these are vulnerable or inadequately protected through systematic examination and evaluation.
Introduction (cont…)
In addition, business function availability is one of the major criteria for IT audit. Availability is ensured through various means, technologies and processes—all broadly covered under the umbrella of business continuity and disaster recovery.
Introduction (cont…)
HIPAA Security Standards: HIPAA Security Standards: Physical SafeguardsPhysical Safeguards
The Security Rule defines physical The Security Rule defines physical safeguards as: safeguards as:
“ “ physical measures, policies, and physical measures, policies, and procedures to protect a covered procedures to protect a covered entity’s electronic information entity’s electronic information systems and related buildings and systems and related buildings and equipment, from naturalequipment, from natural
and environmental hazards, and and environmental hazards, and unauthorized intrusion.”unauthorized intrusion.”
TelecomTelecomTL9000 Section 7.1.C.3TL9000 Section 7.1.C.3
"The organization shall establish and "The organization shall establish and maintain methods for disaster maintain methods for disaster recovery to ensure the organization's recovery to ensure the organization's ability to recreate and service the ability to recreate and service the product throughout its life cycle."product throughout its life cycle."
IRS Procedure 86-19IRS Procedure 86-19
Requires off-site protection, as well as Requires off-site protection, as well as documentation of computer records documentation of computer records maintaining tax information. These maintaining tax information. These records must be available in the event records must be available in the event that the primary facility is not. that the primary facility is not.
Standards and RegulationsStandards and Regulations ISO 9000 ISO 9000 FEMA Circular FPC 65 FEMA Circular FPC 65 Computer Security ActComputer Security Act Security Industry: ISO 17799 Security Industry: ISO 17799 NIST SP800-34NIST SP800-34 Office of Management and Budget Office of Management and Budget
(OMB) Circular A-13 (OMB) Circular A-13
What are the Objectives of What are the Objectives of a Good BCP Plan?a Good BCP Plan?
Protect employeesProtect employees Restore critical business processes Restore critical business processes
or functions to minimize the or functions to minimize the financial impact of a disasterfinancial impact of a disaster
Restore related infrastructure, Restore related infrastructure, operating systems and applications operating systems and applications to support the critical functionsto support the critical functions
What are the Objectives of What are the Objectives of a Good BCP Plan (cont…)a Good BCP Plan (cont…)
Prevent or mitigate the effects of a Prevent or mitigate the effects of a disaster from occurring wherever disaster from occurring wherever possiblepossible
Protect corporate assets Protect corporate assets Minimize legal exposureMinimize legal exposure
An audit of business continuity is essentially an audit of this plan with reference to:
• The adequacy, completeness and appropriateness of the plan;
• Availability of the processes and people to implement the plan;
What Is An Audit of Business Continuity?
• Its testing;
• The verification of the various day-to-day functions that need to be performed to make the plan effective and ready at all times.
What Is An Audit of Business Continuity?
(cont…)
The audit of business continuity can be broken into three major components:
1. Validating the business continuity plan
2. Scrutinizing and verifying preventive and facilitating measures for ensuring continuity
3. Examining evidence about the performance of activities that can assure continuity and recovery
Three Major Components
The IT auditor should be familiar with the business, the information systems in use and the extent of the business’ dependence on IT. The auditor’s focus should be on validating the plan against this knowledge.
Validating the Business Continuity Plan
The following points are written with this objective and are not meant to be a comprehensive description of everything that should be in the business continuity plan:
Validating the Business Continuity Plan
Verifying Preventive Measures for Ensuring ContinuityThe verification of the physical facilities, equipment and environment that ensure availability and recovery after a disaster include the following:
Verifying Preventive Measures for Ensuring Continuity (cont..)
The scrutiny of the disaster recovery site as to its location (i.e., distance from primary site, accessibility, vulnerability to similar threats) and the general controls and security relating to it should be an essential part of the audit.
Verify the contracts entered into by the SLAs and whether the periodic testing and drills are being performed as agreed.
Verify that supporting equipment and supplies, such as fuel for the power generators, are maintained to enable usage of the redundant equipment when required.
Verifying Preventive Measures for Ensuring Continuity (cont…)
Verify whether there are facilities for alternate routes to overcome network failures. Check the availability of the network at the DR site and the facilities for switchover from the primary site during recovery to enable all users to access the systems from the DR site.
Verifying Preventive Measures for Ensuring Continuity (cont…)
Effective recovery is not completed by merely acting on the day of the disaster, but by sustained activities that are completed in due course with the objective of remaining in a state of preparedness for a disaster.
Examining Evidence About Performance of Activities
Verification of maintenance and testing logs of all equipment, such as power generators, air conditioners, UPS systems and fire control equipment, can give the IT auditor clues as to the effectiveness of these controls.
Examining Evidence About Performance of Activities
The IT auditor should not ignore the people part of the BCP. Training programs and awareness campaigns are essential, especially in large organizations, to ensure that the plans actually work on the day when disaster strikes.
Examining Evidence About Performance of Activities
Where to StartWhere to Start
Obtain the following documentationObtain the following documentation
Organizational Charts and Organizational Charts and Business Process AnalysisBusiness Process Analysis
Overall Recovery Plan StructureOverall Recovery Plan Structure Plan Coordinator ListPlan Coordinator List
Where to Start (cont…)Where to Start (cont…)
Business Impact AnalysisBusiness Impact Analysis Risk Assessment Risk Assessment Recovery Plan DocumentationRecovery Plan Documentation Third Party Review (if available)Third Party Review (if available)
Business Process AnalysisBusiness Process Analysis
Was a high level business process Was a high level business process analysis performed?analysis performed?
Has the Plan Unit organization structure Has the Plan Unit organization structure been identified and documented?been identified and documented?
Is the organization and location Is the organization and location structure current, change structure current, change management?management?
Have business impact criteria been Have business impact criteria been defined?defined?
Business Impact AnalysisBusiness Impact Analysis Was a BIA performed and Was a BIA performed and
documented in alignment with the documented in alignment with the criteria established?criteria established?
Was there an established Was there an established methodology used to perform the BIA methodology used to perform the BIA and document the results of the and document the results of the analysis?analysis?
Is there adequate documentation for Is there adequate documentation for assumptions and impact scoring assumptions and impact scoring rationale?rationale?
Business Impact Analysis Business Impact Analysis (cont…)(cont…) Were the final BIA results approved Were the final BIA results approved
by senior management?by senior management? Do recovery strategies align with Do recovery strategies align with
the results of the BIA?the results of the BIA? Have Recovery Time Objectives Have Recovery Time Objectives
and Recovery Point Objectives and Recovery Point Objectives been identified?been identified?
Risk Assessment and Risk Assessment and Mitigation Life SafetyMitigation Life Safety
Has an emergency Coordinator Has an emergency Coordinator been appointed?been appointed?
Has a review been conducted to Has a review been conducted to determine potential risks of natural determine potential risks of natural disasters and other building disasters and other building emergencies?emergencies?
Have mitigation strategies been Have mitigation strategies been identified and implemented?identified and implemented?
Risk Assessment and Mitigation Risk Assessment and Mitigation Facility/Technology/Business Facility/Technology/Business OperationsOperations
Was a facility, Technology and Business Was a facility, Technology and Business Operations Risk Assessment conducted that:Operations Risk Assessment conducted that: Identifies control weaknesses and single Identifies control weaknesses and single
points of failurepoints of failure Identifies one or more countermeasuresIdentifies one or more countermeasures Have mitigation strategies been selected and Have mitigation strategies been selected and
implemented?implemented?
Risk Assessment and Risk Assessment and Mitigation Third PartiesMitigation Third Parties Have all critical third parties been Have all critical third parties been
identified and link to the business identified and link to the business process and related process and related infrastructure/technology identified in infrastructure/technology identified in the BIA?the BIA?
Have third party review criteria been Have third party review criteria been established?established?
Was a third party risk assessment Was a third party risk assessment performed by vendor?performed by vendor?
Recovery PlansRecovery Plans
Are Recovery roles identified?Are Recovery roles identified? Has an individual and a backup been Has an individual and a backup been
identified who can declare a disaster?identified who can declare a disaster? Is the plan documentation current Is the plan documentation current
and has it been distributed to all and has it been distributed to all personnel?personnel?
Recovery Plans Recovery Plans (cont…)(cont…)
Are Emergency Notification Are Emergency Notification Procedures clear and accurate?Procedures clear and accurate?
Are Communication procedures in Are Communication procedures in place and current (who talks to place and current (who talks to who)?who)?
Are recovery requirements and data Are recovery requirements and data current?current?
Exercise, Maintenance and Exercise, Maintenance and TrainingTrainingHas a program been developed, Has a program been developed, implemented and communicated that implemented and communicated that includes?includes? Key elements to be maintainedKey elements to be maintained Key elements to be exercisedKey elements to be exercised An exercise and maintenance calendarAn exercise and maintenance calendar Specific exercises conductedSpecific exercises conducted Recommendations and follow-up for Recommendations and follow-up for
improvementimprovement
Change ControlChange Control Are there change control procedures?Are there change control procedures? Are changes formally approved Are changes formally approved
before implementation?before implementation? Is there document version control Is there document version control
procedures established?procedures established? Are there procedures for Are there procedures for
incorporating changes and incorporating changes and notification?notification?
•Check whether the plan covers all mission-critical systems or is only for other, selected systems.
•Ascertain whether the plan is based on a systematic business impact analysis that clearly understands the impact of non-availability of the systems on the business
The IT Auditor Should…
•Examine the plan to determine whether the plan has a good combination of preventive controls and recovery controls.
•Verify whether the BCP is updated periodically and reflects the current business and IT environment accurately.
The IT Auditor Should…
•Evaluate the requirement of testing the plans or disaster recovery drills.
•Verify whether the plan addresses not just recovery after a disaster but also restoration back to the primary site when normalcy returns.
The IT Auditor Should…
Evaluate other elements, like
•notifications,
•call trees,
•the response teams,
•updating the contact information, and
•the step-by-step procedures for recovery and for appropriateness.
The IT Auditor Should…
The nature, complexity and cost of the business continuity program are related to the nature of the business’ dependence on information technology.
Conclusion
While the testing of business continuity plans with various testing techniques and drills is the best possible way to ensure that the plans and the expensive systems deployed really work on the day of disaster, such tests have some limitations as they often need to be planned in advance.
Conclusion (cont…)
An effective audit review by the IT auditor can help uncover many deficiencies and operational lapses that may not come up in testing and points that have been overlooked in the design of the plan.
Conclusion (cont…)
“Well, thank God we all made it out in time …‘Course, now we’re equally out of luck.”
Recommended
