Bcms form 09 4 internal audit checklist

Internal Audit Checklist

ISO22301 Toolkit Version 4 ©CertiKit

Implementation Guidance (The header page and this section must be removed from final version of the document)

Purpose of this document This is a checklist to be used as a prompter for questions during an internal audit.

Areas of the standard addressed The main areas of the ISO22301 standard addressed by this document are: 9. Performance evaluation 9.2 Internal audit

General Guidance When conducting an internal audit it can be useful to have a list of standard questions to ask, organized according to the sections of the ISO22301 standard.

This makes the audit more interesting than simply reading the requirements from a spreadsheet. It’s possible that any one audit will not cover all parts of the standard so you may need to edit this checklist to cover the areas you need. You may also like to add further questions to the lists, depending on the type of organization you are auditing.

At each stage, it is important that evidence is reviewed and recorded to prove that procedures etc. are in place.

Review Frequency We would recommend that this document is reviewed annually.

Toolkit Version Number ISO22301 Toolkit Version 4 ©CertiKit.

Copyright notice Except for any third party works included in this document, as identified in this document, this document has been authored by CertiKit, and is © copyright CertiKit except as stated below.

CertiKit is a trading name of Public I.T. Limited, a company registered in England and Wales with company number 6432088 and registered office at 5 Falcons Rise,

Page 1 of 13

BCMS-FORM-09-4

Belper, Derbyshire, DE56 0QN.

Licence terms This document is licensed on and subject to the standard licence terms of CertiKit, available on request, or by download from our website. All other rights are reserved. Unless you have purchased this product you only have an evaluation licence. If this product was purchased, a full licence is granted to the person identified as the licensee in the relevant purchase order. The standard licence terms include special terms relating to any third party copyright included in this document.

Disclaimer Please Note: Your use of and reliance on this document template is at your sole risk. Document templates are intended to be used as a starting point only from which you will create your own document and to which you will apply all reasonable quality checks before use. Therefore please note that it is your responsibility to ensure that the content of any document you create that is based on our templates is correct and appropriate for your needs and complies with relevant laws in your country. You should take all reasonable and proper legal and other professional advice before using this document. CertiKit makes no claims, promises, or guarantees about the accuracy, completeness, or adequacy of our document templates, assumes no duty of care to any person with respect its document templates or their contents, and expressly excludes and disclaims liability for any cost, expense, loss or damage suffered or incurred in reliance on our document templates, or in expectation of our document templates meeting your needs, including (without limitation) as a result of misstatements, errors and omissions in their contents.

Page 2 of 13

BCMS-FORM-09-4

[Replace with your logo]

ISO22301 Internal Audit Checklist Audit: Auditor(s):

Recommended Questions

Audit Scope: Date of Audit:

Audit Findings

Evidence Reviewed

4. Context of the Organisation 4.1 Understanding the organization and its context 1. What are the internal and external issues that are relevant to the BCMS? 2. How do they affect its ability to achieve its intended outcome?

3. What does the organization do and how might a disruptive incident affect its activities?

4. What is the organization’s risk appetite?

5. What is the purpose of the BCMS? 4.2 Understanding the needs and expectations of interested parties 1. Who are the interested parties?

2. What are their requirements?

Page 3 of 13

BCMS-FORM-09-4

Recommended Questions

Audit Findings

Evidence Reviewed

3. How have their requirements been established?

4. What are the main legal and regulatory requirements that the organization must meet with respect to business continuity?

5. How is the understanding of these requirements kept up to date?

4.3 Determining the scope of the business continuity management system 1.

2.

3.

4.

What is the scope of the BCMS? How is it defined?

Are any exclusions explained?

Does it consider the relevant issues and requirements?

5. Does it consider how the organization interacts with other organizations?

6. Is the scope documented?

4.4 Business continuity management system 1. How established is the BCMS? 2. How long has it been running for?

3. How much evidence has been collected so far e.g. records?

5. Leadership 5.1 Leadership and Commitment

Page 4 of 13

BCMS-FORM-09-4

Recommended Questions

Audit Findings

Evidence Reviewed

1. Who is defined as top management within the scope of the BCMS? 2. How does top management demonstrate leadership and commitment?

5.2 Management commitment 1. Are business continuity policies and objectives established?

2. Are enough resources allocated to the BCMS? 3. How does top management communicate to everyone involved in the BCMS? 5.3 Policy 1. Can I review the business continuity policy?

2. Is it appropriate and cover the required areas?

3. Does it include the required commitments?

4. How has it been communicated and distributed and to whom?

5. When was it last reviewed?

5.4 Organizational roles, responsibilities and authorities 1. What are the roles within the BCMS?

Page 5 of 13

BCMS-FORM-09-4

Recommended Questions

Audit Findings

Evidence Reviewed

2. Does everyone understand what their responsibilities and authorities are?

3. Who has the responsibility and authority for conformance and reporting?

6. Planning 6.1 Actions to address risks and opportunities 1. What are the risks to the BCMS? 2. What actions are or have been taken to address them?

3. How effective have these actions been?

6.2 Business continuity objectives and plans to achieve them 1. Are there documented business continuity objectives?

2. Do the objectives comply with section 6.2 a) to e)?

3. Is there a plan to achieve the objectives?

4. Does the plan include the who, what, when and how?

7. Support 7.1 Resources 1. How are the resources needed for the BCMS determined?

Page 6 of 13

BCMS-FORM-09-4

Recommended Questions

Audit Findings

Evidence Reviewed

2. Are the required resources provided?

7.2 Competence 1. Have the necessary competences been determined?

2. How has the competence of the people involved in the BCMS been established?

3. What actions have been identified to acquire the necessary competence?

4. Have they been completed and is there evidence of this?

7.3 Awareness 1. What approach has been taken to providing awareness of the business continuity policy, contribution to the BCMS and implications of not conforming?

2. Has everyone been covered?

7.4 Communication 1. How has the need for communication been established?

2. Is the approach to communication documented?

3. Do the procedures cover all areas in 7.4?

Page 7 of 13

BCMS-FORM-09-4

Recommended Questions

Audit Findings

Evidence Reviewed

7.5 Documented information 1. Is all of the documented information required by the standard in place?

2. Is the level of other documentation reasonable for the size of BCMS? 3. Are appropriate documentation standards in place e.g. identification, format?

4. Are the standards applied in a uniform way?

5. Are appropriate controls in place to address the activities listed in 7.5.3?

6. How are documents of external origin handled?

7. How is the documentation protected?

8. Operation 8.1 Operational planning and control 1. What processes are used to meet requirements?

2. What documented information is kept about them?

3. What planned changes have taken place recently and how were they controlled?

4. What processes are outsourced?

5. How are they controlled?

Page 8 of 13

BCMS-FORM-09-4

Recommended Questions

Audit Findings

Evidence Reviewed

8.2 Business impact analysis and risk assessment 1. Is there a documented business impact analysis and risk assessment process?

2. Does it meet the requirements of 8.2.1 a) to e)?

3. What is the most recent business impact analysis?

4. Who was involved in creating it?

5. What are its conclusions?

6. What significant changes have happened that have prompted a business impact analysis to be carried out?

7. What is the most recent risk assessment?

8. Does it identify a reasonable set of risks and specify owners?

9. Are the likelihood and impact of risks assessed appropriately and risk levels determined?

10. How are the risks then evaluated and prioritized?

11. Review the most recent risk treatment plan.

12. Are reasonable risk treatment options selected?

8.3 Business continuity strategy 1. What is the business continuity strategy

Page 9 of 13

BCMS-FORM-09-4

Recommended Questions

Audit Findings

Evidence Reviewed

of the organization?

2. What evaluations of suppliers have been conducted?

3. How are the resource requirements for the implementation of the strategy determined?

4. Which risks have been treated?

8.4 Establish and implement business continuity procedures 1. What procedures have been established to manage disruptive incidents?

2. How well do the procedures meet the requirements of 8.4.1 a) to f)?

3. What is the management structure used during incidents?

4. Has this structure been used to manage an incident recently and if so what was the outcome?

5. What is the approach to communication during an incident?

6. What procedures are in place for items a) to g) in 8.4.3?

7. When were they last exercised?

8. What business continuity plans are in place?

9. Which of them have been used to date?

10. What documented information is available in relation to the use of the plans e.g.

Page 10 of 13

BCMS-FORM-09-4

Recommended Questions

Audit Findings

Evidence Reviewed

activity logs, communications?

11. Are all of the areas defined within 8.4.4 includied in the plans?

12. How would normal business activities be restored after each plan has been activated?

8.5 Exercising and testing 1. What is the schedule of plan exercises and tests?

2. When was the last test or exercise carried out?

3. What did it cover?

4. Who was involved?

5. How successful was it?

6. What was learned from the test?

7. What records of the test are available?

9. Performance Evaluation 9.1 Monitoring, measurement, analysis and evaluation 1. How is it determined what should be monitored and measured?

2. Review evidence of monitoring and measurement.

3. What procedures are in place to cover monitoring and measurement in different areas?

Page 11 of 13

BCMS-FORM-09-4

Recommended Questions

Audit Findings

Evidence Reviewed

4. How are results reported?

5. How are business continuity procedures evaluated?

6. Is a sample post-incident review available?

9.2 Internal audit 1.

2.

3.

4.

How often are internal audits carried out?

Who carries them out?

Are the auditors objective and impartial?

Review the most recent internal audit report.

5. Have any nonconformities resulting from previous audits been addressed?

6. Does the audit programme cover the complete scope of the BCMS? 9.3 Management review 1. How often are management reviews carried out?

2. Who attends them?

3. Are they minuted?

4. Are all areas in 9.3 covered at management reviews?

5. Review the results of the most recent one.

6. What outputs resulted from it?

Page 12 of 13

BCMS-FORM-09-4

Recommended Questions

Audit Findings

Evidence Reviewed

7. Does the management review represent a reasonable assessment of the health of the BCMS?

10. Improvement 10.1 Nonconformity and corrective action 1. How are nonconformities identified?

2. How are they recorded?

3. Review the records of a recent nonconformity.

4. Was appropriate action taken to correct it and address the underlying causes?

5. Was the effectiveness of the corrective action reviewed?

10.2 Continual improvement 1. How are improvements identified?

2. Are they recorded?

3. What evidence of continual improvement can be demonstrated?

Page 13 of 13

BCMS-FORM-09-4