AUDITRIBE
PRACTICAL AUDIT GUIDE

Business Continuity & Disaster Recovery

Assess whether critical operations can continue or recover within acceptable time after major disruption.

Key Risks

  • Prolonged operational shutdown
  • Single points of failure
  • Unrecoverable data
  • Untested recovery plans
  • Dependence on critical people or suppliers

Documents & Data

  • Business continuity plan
  • Business impact analysis
  • Disaster recovery plan
  • Critical asset register
  • Backup reports
  • Test/exercise results
  • Emergency contact lists

Key Controls

  • Business impact analysis
  • Defined recovery objectives
  • Backup and restoration
  • Alternative facilities/resources
  • Crisis roles and communication
  • Periodic continuity testing

Practical Audit Procedures

  1. Identify critical processes and compare them with the business impact analysis.
  2. Review recovery time and recovery point objectives for reasonableness and approval.
  3. Verify backup success and inspect evidence of restoration tests.
  4. Review continuity exercises and whether identified gaps were closed.
  5. Assess critical equipment, supplier and key-person dependencies.
  6. Confirm plans, contacts and recovery procedures are current and accessible.

Questions to Ask

  • What could prevent this process from achieving its objective?
  • Which controls are considered critical, and who owns them?
  • What evidence shows the controls actually operated during the period?
  • What exceptions, incidents or recurring problems occurred?
  • What has management changed since the last review?

Need a ready-to-use audit checklist?

Use Steal My Checklist to move from understanding the audit area to performing practical fieldwork.

Get Steal My Checklist