Complete Application Form: Sample DR BoK 6 TE #4

Testing and Exercising

Example BoK 6 TE #4

1. What was performed?

• Reviewed the Change Control Process for the BCM department.
• Reviewed ABC Bank Data Centre Operations Processes on Change Management, Computer Operations Security and Job Scheduling & Batch Processing.

2. When was it done?

• Started in Feb 20x9 and ended in mid-May 20x0

3. How was it carried out?

Planning & Preparation

• Conducted research to have an overview of the department and to understand the department’s processes and activities.

• Studied and identified the bank and regulatory policies requirements that will be used for the review.

• Prepared Review Plan and defined the scope (review areas, coverage period), objectives, resources, timeframe, activities and approaches of the review.

• Identified reviewees/ participants that needed to be involved in the review.

• Established Review Checklist and Schedule to ensure the review is carried out as per schedule and focus.

• Prepared Review Program and list of questionnaires to be used during the review.

• Requested documentation required to review; such as procedures and past audit/review reports.

Fieldwork

• Conducted kick-off meetings with auditees and presented the Review Plan to them. Introduced the reviewer team, presented the scope and objectives of the review and shared the review timeframe, activities and approaches with the team.

• Arranged and conducted interviews with auditees in accordance with the Review Plan and Review Program. Documented the information obtained.

• Requested documents/ evidence and verified them.

• Reviewed and analyzed the information and documentation obtained to reach a review conclusion.

• Identified and drafted review observations and findings.

• Reviewed and confirmed the observations and findings with auditees.

Reporting & Follow-up

• Classified the observations and findings into major or minor. The major finding is a finding that caused a significant impact on the department. The minor finding is a finding that is not significant and is considered an improvement needed.
• Prepared draft report. Stated the information pertaining to the review in formal and listed the classified observations and findings into the draft report.
• Presented and discussed the draft report with auditees. Reviewees to provide a correction action plan and target rectification date for each of the findings.
• Finalized the draft report and issued a final report. The final report is issued to auditees and the management team. Reviewees / the manager in charge have to rectify the findings accordingly as per the commitment timeline.
• Performed monthly follow-up with auditees/ manager in-charge until all findings are closed. Evidence is requested from auditees/ managers in charge and verified to ensure the findings are closed properly.