Business Continuity Management (BCM) has evolved significantly over the past two decades.
Traditionally, BCM was viewed primarily as a compliance requirement focused on producing Business Continuity Plans, conducting periodic testing, and satisfying regulatory or audit expectations.
Audits of BCM programmes were therefore largely document-centric, concentrating on whether policies, plans, and procedures existed and whether periodic reviews had been completed.
Today, the operating environment has changed dramatically. Organisations are increasingly dependent on digital technologies, cloud computing, third-party service providers, artificial intelligence, global supply chains, and interconnected business ecosystems.
At the same time, disruptions have become more frequent, complex, and severe.
Cyberattacks, ransomware incidents, geopolitical tensions, pandemics, extreme weather events, infrastructure failures, and supply chain disruptions have demonstrated that organisational resilience can no longer be assessed solely by reviewing documentation.
Consequently, the role of BCM audits has expanded from verifying compliance to providing assurance on organisational resilience.
Auditors are now expected to evaluate whether an organisation can continue delivering its critical products and services during disruptions and recover within acceptable timeframes.
This chapter explores how BCM audits have evolved and what auditors must do differently to remain relevant in the era of digital resilience and operational resilience.
Historically, BCM audits focused on verifying compliance with internal policies, regulatory requirements, and industry standards.
Typical audit activities included:
Success was often measured by answering simple questions:
While these activities remain important, they do not necessarily demonstrate that the organisation is capable of responding effectively during a real disruption.
Many organisations that successfully passed BCM audits subsequently experienced significant failures during actual crises because the audits assessed documentation rather than capability.
As BCM programmes matured, auditors began evaluating whether continuity capabilities actually existed.
The focus expanded to include:
Auditors started asking more challenging questions:
Capability-based auditing represented a significant improvement because it moved beyond documentation and examined operational readiness.
Today, regulators and boards increasingly expect assurance that organisations can withstand, adapt to, respond to, and recover from disruptions.
This represents a shift toward resilience assurance.
Rather than asking:
"Does the organisation have a plan?"
Auditors now ask:
"Can the organisation continue delivering critical services during disruption?"
This approach aligns with modern operational resilience frameworks adopted by regulators worldwide.
Key questions include:
Modern organisations operate in highly interconnected environments.
Critical services often depend upon:
A disruption affecting any one of these components can impact business operations.
Traditional audits often fail to assess these complex interdependencies.
Cyber incidents have become one of the most significant causes of business disruption.
Examples include:
A BCM audit that does not evaluate cyber recovery capabilities provides only partial assurance.
Auditors must now assess:
Regulators increasingly focus on resilience outcomes rather than procedural compliance.
In Malaysia, Bank Negara Malaysia (BNM) expects regulated entities to demonstrate resilience capabilities through:
Similarly, ISO 22301 emphasises:
The expectation is clear:
Organisations must demonstrate resilience, not merely document it.
Boards and senior management increasingly recognise resilience as a strategic issue rather than an operational issue.
They seek assurance regarding:
As a result, BCM audit reports must provide meaningful insights into resilience capability rather than merely reporting procedural gaps.
Many BCM audits continue to focus on checklist compliance.
Common weaknesses include:
Auditors review plans without validating their effectiveness.
Common finding:
"The plan exists and was reviewed annually."
Missing question:
"Can the plan actually work during a crisis?"
Audits are often conducted solely through document reviews.
Key stakeholders may not be interviewed, including:
Without interviews, auditors cannot assess actual preparedness.
Many audits confirm that exercises occurred, but fail to assess:
Simply conducting a test does not demonstrate resilience.
Critical services increasingly rely on external providers.
Many audits overlook:
Third-party resilience must form part of every BCM audit.
Modern BCM auditors require broader competencies than traditional auditors.
They must understand:
The modern BCM auditor serves as a resilience assurance professional rather than merely a compliance reviewer.
Auditors should challenge management with questions such as:
The future of BCM auditing will be increasingly aligned with operational resilience.
Auditors will focus on:
Audit programmes will increasingly evaluate how organisations maintain service delivery during disruption rather than simply assessing whether continuity documentation exists.
The role of BCM auditing is undergoing a fundamental transformation. Traditional compliance-focused audits remain necessary but are no longer sufficient to provide assurance in today's complex and interconnected operating environment.
Modern BCM auditors must evaluate resilience capabilities, challenge assumptions, validate recovery arrangements, and assess whether organisations can continue delivering critical services during disruption.
By adopting a resilience assurance approach, auditors can provide boards, regulators, and stakeholders with meaningful confidence that the organisation is prepared for the uncertainties of the digital age.
The central question for every BCM audit should therefore be:
"Can the organisation continue to operate when disruption occurs, or does it merely possess documentation that suggests it can?"
| Introductory | C1 | C2 | C3 |
| eBook Cover | C4 | C5 | C6 |
BCM Institute offers two levels of BCM auditing courses: A-3 BCM-8030 ISO22301 BCMS Auditor [A-3] and the ISO22301 BCMS Lead Auditor [A-5].
| Please feel free to send us a note if you have any questions. |