---
title: Operational Resilience Audit | Moh Heng Goh
description: Dr Goh Moh Heng is the President of BCM Institute and the Managing Director of GMH Continuity Architects – a specialised BCM Consulting firm. His primary areas of expertise include Business Continuity Management (BCM), Disaster Recovery Planning (DRP), ISO22301 BCM Audit and Crisis Management. Since 2011, Moh Heng has assisted more than 50 organisations, particularly those operating in the Asia-Pacific and Middle-East Region in their successful implementation of their Business Continuity Management System (BCMS) and achieving their BS 25999/ SS 540 / ISO 22301 organisation certification. Prior to establishing BCM Institute and GMH BCM Consulting, Dr. Goh held senior positions with a number of large organizations. During his career with the Government of Singapore Investment Corporation (GIC), he was responsible for all aspects of its business continuity and crisis management. At Standard Chartered Bank Plc, he saw and manage the global implementation of its BC management and planning for 52 countries. He also managed the BCM practice at PricewaterhouseCoopers.
---

[![BCMI Logo.png](https://blog.bcm-institute.org/hs-fs/hubfs/BCMI%20Logo.png?width=137&height=134&name=BCMI%20Logo.png "BCMI Logo.png")](https://www.bcm-institute.org/)

Open main menu Close main menu

- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/) Open the submenu 
    - [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
    - [Our History](https://www.bcm-institute.org/about-us/our-history/)
    - [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
    - [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
    - [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog) Open the submenu 
    - [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
    - [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
    - [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
    - [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
    - [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
    - [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
    - [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered) Open the submenu 
    - [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
    - [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
    - [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
    - [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
    - [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
    - [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
    - [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)

# Operational Resilience Audit

Select Category audit BCCLA BCM BCM-200 BCM-8030 BCM-8530 BCM Planning Methodology Blended Learning Books - Specialist Series Business Continuity Management certification Course Examination FAQ Hong Kong Monetary Authority Hybrid Learning ISO22301 Monetary Authority of Singapore Operational Resilience Operational Resilience Audit Operational Resilience Roadmap OR-200 OR-300 OR-400 OR-5000 ORA-300 ORA-400 ORA-5000 ORAE ORAS ORCE ORCP ORCS

Posts by:

## Moh Heng Goh

[Follow me on Facebook](https://www.linkedin.com/in/gohmohheng/) [Follow me on LinkedIn](https://www.linkedin.com/in/gohmohheng/)

Dr Goh Moh Heng is the President of BCM Institute and the Managing Director of GMH Continuity Architects – a specialised BCM Consulting firm. His primary areas of expertise include Business Continuity Management (BCM), Disaster Recovery Planning (DRP), ISO22301 BCM Audit and Crisis Management. Since 2011, Moh Heng has assisted more than 50 organisations, particularly those operating in the Asia-Pacific and Middle-East Region in their successful implementation of their Business Continuity Management System (BCMS) and achieving their BS 25999/ SS 540 / ISO 22301 organisation certification. Prior to establishing BCM Institute and GMH BCM Consulting, Dr. Goh held senior positions with a number of large organizations. During his career with the Government of Singapore Investment Corporation (GIC), he was responsible for all aspects of its business continuity and crisis management. At Standard Chartered Bank Plc, he saw and manage the global implementation of its BC management and planning for 52 countries. He also managed the BCM practice at PricewaterhouseCoopers.

![Table of Content for ](https://blog.bcm-institute.org/hubfs/Operational%20Resilience%20Audit/OR%20Audit%20Morepost%20and%20Icon/IC_OR%20Audit%20and%20Review%20Questionnaires_Plan.png)

[audit,](https://blog.bcm-institute.org/operational-resilience-audit/tag/audit) [Operational Resilience](https://blog.bcm-institute.org/operational-resilience-audit/tag/operational-resilience)

### [Table of Content for the "Plan" phase of the Operational Resilience Audit and Review Questionnaires and Checklists](https://blog.bcm-institute.org/operational-resilience-audit/toc-plan-phase-of-the-operational-resilience-audit-and-review-questionnaires-and-checklistsoc)

Feb 10, 2024 10:11:42 PM

#### [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/1e7be263-03e2-4f94-9204-8c10f0ab9988.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/1e7be263-03e2-4f94-9204-8c10f0ab9988)

#### Operational Resilience Audit Questionnaires and Checklist

#### Plan Phase

| **Operational Resilience Planning Methodology** |
| --- |
| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/e6f5e4be-87c2-41c5-95e6-29b61a952518.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/e6f5e4be-87c2-41c5-95e6-29b61a952518) |

Operational Resilience Planning Methodology:  The three phases are "Plan", "Implement", and "Sustain."  Each phase has five implementation stages.  

Click each phase's five stages to learn more about the detailed questions and how the checklist supports them.  Note that there is overlap for some of the stages in terms of content, as you will never be auditing all 15 stages concurrently during the maturity of the organisation OR program.

The rationale is that you, as a reviewer or auditor, will not be conducting the audit of review for all three phases together. Hence, the essential controls still need to be embedded in several stages.

 

| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/7341550b-2a0b-49e3-8c83-4dce92ec089c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/7341550b-2a0b-49e3-8c83-4dce92ec089c) |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- |
| Questionnaires and Checklist "Plan" Phase | Assess Capability and Maturity | Analyse Gap | Develop Strategy Roadmap | Confirm Risk Appetite | Develop and Embed Governance |
| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/1647d0a3-e979-4c71-94e9-8488aafa24db.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/1647d0a3-e979-4c71-94e9-8488aafa24db) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/3366727a-b443-473b-b062-509be81aa7db.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3366727a-b443-473b-b062-509be81aa7db) | [![OR Plan Phase Questionnaires: Analyse Gap](https://no-cache.hubspot.com/cta/default/3893111/2e3307ac-338a-4628-a9a3-695561d51060.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2e3307ac-338a-4628-a9a3-695561d51060) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/108ffcf2-d07c-42de-abf0-6b53b8289b00.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/108ffcf2-d07c-42de-abf0-6b53b8289b00) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/07359f00-9a2a-4081-9679-401b5dcd3ad0.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/07359f00-9a2a-4081-9679-401b5dcd3ad0) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/3b3ef5a2-285b-47f6-83ef-18429418ab13.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3b3ef5a2-285b-47f6-83ef-18429418ab13) |

#### Find out more about Blended Learning ORA-5000 \[ORA-5\] & ORA-300 \[ORA-3\]

| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/130553fb-1a34-45c7-8d7a-0e91483d5237.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/130553fb-1a34-45c7-8d7a-0e91483d5237) | [![Tell Me More About BCM- 8030](https://no-cache.hubspot.com/cta/default/3893111/4efea5b2-f209-48aa-b101-671debce9437.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4efea5b2-f209-48aa-b101-671debce9437) | [![New Call-to-action](https://no-cache.hubspot.com/cta/default/3893111/4df1d21d-d377-487a-920b-b7799c6a2c82.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4df1d21d-d377-487a-920b-b7799c6a2c82) |
| --- | --- | --- |
| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/618b44d7-b58a-4819-87b6-aa423fe4461d.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/618b44d7-b58a-4819-87b6-aa423fe4461d) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/6a19ecac-b465-4c06-a769-36a0b69ce74c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6a19ecac-b465-4c06-a769-36a0b69ce74c) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/826e513d-4cd5-4894-9e76-9b4e2e262334.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/826e513d-4cd5-4894-9e76-9b4e2e262334) |
| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/d0bd308d-92fc-49b5-b250-bb5b8b08c3b3.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0bd308d-92fc-49b5-b250-bb5b8b08c3b3) | Please feel free to send us a note if you have any of these questions. [![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/f457bdeb-1008-40d6-bffa-be4583a4ab41.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f457bdeb-1008-40d6-bffa-be4583a4ab41) |

![Moh Heng Goh](https://app.hubspot.com/settings/avatar/970b3fc77336e0347b69e316ba48751e) 

[Moh Heng Goh](https://blog.bcm-institute.org/operational-resilience-audit/author/moh-heng-goh) 

[Read More](https://blog.bcm-institute.org/operational-resilience-audit/toc-plan-phase-of-the-operational-resilience-audit-and-review-questionnaires-and-checklistsoc)

![Table of Content for ](https://blog.bcm-institute.org/hubfs/Operational%20Resilience%20Audit/OR%20Audit%20Morepost%20and%20Icon/IC_OR%20Audit%20and%20Review%20Questionnaires_Implement.png)

[audit,](https://blog.bcm-institute.org/operational-resilience-audit/tag/audit) [Operational Resilience](https://blog.bcm-institute.org/operational-resilience-audit/tag/operational-resilience)

### [Table of Content for "Implement" phase of the Operational Resilience Audit and Review Questionnaires and Checklists](https://blog.bcm-institute.org/operational-resilience-audit/toc-implement-operational-resilience-audit-and-review-questionnaires-and-checklists)

Feb 10, 2024 10:02:48 PM

#### [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/1e7be263-03e2-4f94-9204-8c10f0ab9988.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/1e7be263-03e2-4f94-9204-8c10f0ab9988)

#### Operational Resilience Audit Questionnaires and Checklist

#### Implement Phase

| **Operational Resilience Planning Methodology** |
| --- |
| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/e6f5e4be-87c2-41c5-95e6-29b61a952518.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/e6f5e4be-87c2-41c5-95e6-29b61a952518) |

Operational Resilience Planning Methodology:  The three phases are "Plan", "Implement", and "Sustain."  Each phase has five implementation stages.  

Click each phase's five stages to learn more about the detailed questions and how the checklist supports them.  Note that there is overlap for some of the stages in terms of content, as you will never be auditing all 15 stages concurrently during the maturity of the organisation OR program.

The rationale is that you, as a reviewer or auditor, will not be conducting the audit of review for all three phases together. Hence, the essential controls still need to be embedded in several stages.

 

| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/c990ec99-5540-42a1-aff4-17d33eebcb5c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/c990ec99-5540-42a1-aff4-17d33eebcb5c) |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- |
| **Questionnaires and Checklist "Implement" Phase** | **Identify Critical Business Services** | **Map Processes and Resources** | Set Impact Tolerance | Conduct Scenario Testing | Improve Lesson Learnt |
| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/364ae747-6a97-41a1-b7d1-91700680add0.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/364ae747-6a97-41a1-b7d1-91700680add0) | [![OR Implement Phase Questionnaires: Identify Critical Business Services](https://no-cache.hubspot.com/cta/default/3893111/9cceea67-c644-485d-9da4-0814183e182a.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/9cceea67-c644-485d-9da4-0814183e182a) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/2552685d-b93a-4af3-b324-dc40c4f61e16.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2552685d-b93a-4af3-b324-dc40c4f61e16) | [![OR Implement Phase Questionnaires: Set Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/b563836c-a5ad-4aa7-a76e-dc6deee365c9.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b563836c-a5ad-4aa7-a76e-dc6deee365c9) | [![Conduct Scenario Testing](https://no-cache.hubspot.com/cta/default/3893111/69d5664a-51d6-43bb-893c-6f03d787fa9b.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/69d5664a-51d6-43bb-893c-6f03d787fa9b) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/7b30fd5b-cce6-457b-a787-24a2bb30b9cb.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/7b30fd5b-cce6-457b-a787-24a2bb30b9cb) |

#### Find out more about Blended Learning ORA-5000 \[ORA-5\] & ORA-300 \[ORA-3\]

| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/130553fb-1a34-45c7-8d7a-0e91483d5237.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/130553fb-1a34-45c7-8d7a-0e91483d5237) | [![Tell Me More About BCM- 8030](https://no-cache.hubspot.com/cta/default/3893111/4efea5b2-f209-48aa-b101-671debce9437.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4efea5b2-f209-48aa-b101-671debce9437) | [![New Call-to-action](https://no-cache.hubspot.com/cta/default/3893111/4df1d21d-d377-487a-920b-b7799c6a2c82.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4df1d21d-d377-487a-920b-b7799c6a2c82) |
| --- | --- | --- |
| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/618b44d7-b58a-4819-87b6-aa423fe4461d.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/618b44d7-b58a-4819-87b6-aa423fe4461d) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/6a19ecac-b465-4c06-a769-36a0b69ce74c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6a19ecac-b465-4c06-a769-36a0b69ce74c) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/826e513d-4cd5-4894-9e76-9b4e2e262334.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/826e513d-4cd5-4894-9e76-9b4e2e262334) |
| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/d0bd308d-92fc-49b5-b250-bb5b8b08c3b3.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0bd308d-92fc-49b5-b250-bb5b8b08c3b3) | Please feel free to send us a note if you have any of these questions. [![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/f457bdeb-1008-40d6-bffa-be4583a4ab41.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f457bdeb-1008-40d6-bffa-be4583a4ab41) |

![Moh Heng Goh](https://app.hubspot.com/settings/avatar/970b3fc77336e0347b69e316ba48751e) 

[Moh Heng Goh](https://blog.bcm-institute.org/operational-resilience-audit/author/moh-heng-goh) 

[Read More](https://blog.bcm-institute.org/operational-resilience-audit/toc-implement-operational-resilience-audit-and-review-questionnaires-and-checklists)

![Table of Content for ](https://blog.bcm-institute.org/hubfs/Operational%20Resilience%20Audit/OR%20Audit%20Morepost%20and%20Icon/IC_OR%20Audit%20and%20Review%20Questionnaires_Sustain.png)

[audit,](https://blog.bcm-institute.org/operational-resilience-audit/tag/audit) [Operational Resilience](https://blog.bcm-institute.org/operational-resilience-audit/tag/operational-resilience)

### [Table of Content for "Sustain" phase of the Operational Resilience Audit and Review Questionnaires and Checklists](https://blog.bcm-institute.org/operational-resilience-audit/toc-sustain-operational-resilience-audit-and-review-questionnaires-and-checklist)

Feb 10, 2024 10:00:19 PM

#### [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/1e7be263-03e2-4f94-9204-8c10f0ab9988.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/1e7be263-03e2-4f94-9204-8c10f0ab9988)

#### Operational Resilience Audit Questionnaires and Checklist

#### Sustain Phase

| **Operational Resilience Planning Methodology** |
| --- |
| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/e6f5e4be-87c2-41c5-95e6-29b61a952518.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/e6f5e4be-87c2-41c5-95e6-29b61a952518) |

Operational Resilience Planning Methodology:  The three phases are "Plan", "Implement", and "Sustain."  Each phase has five implementation stages.  

Click each phase's five stages to learn more about the detailed questions and how the checklist supports them.  Note that there is overlap for some of the stages in terms of content, as you will never be auditing all 15 stages concurrently during the maturity of the organisation OR program.

The rationale is that you, as a reviewer or auditor, will not be conducting the audit of review for all three phases together. Hence, the essential controls still need to be embedded in several stages.

 

| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/d9091de7-7d46-44a7-b58b-dfc7cc1401cd.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d9091de7-7d46-44a7-b58b-dfc7cc1401cd) |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- |
| **Questionnaires and Checklist "Sustain" Phase** | **Introduce Cultural Change** | **Develop Communication Strategy** | Implement Training and Awareness | Provide Self-assessment | Conduct Independent Quality Review |
| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/e636e9eb-f895-414f-9dca-28c40865611c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/e636e9eb-f895-414f-9dca-28c40865611c) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/64fd9860-0947-49fd-816b-56c17b11246c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/64fd9860-0947-49fd-816b-56c17b11246c) | [![OR Sustain Phase Questionnaires: Develop  Communication Strategy](https://no-cache.hubspot.com/cta/default/3893111/72be4e01-db4c-48c6-b09a-082b6ca1c2cc.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/72be4e01-db4c-48c6-b09a-082b6ca1c2cc) | [![OR \[Sustain\] Questionnaires: Implement Training and Awareness](https://no-cache.hubspot.com/cta/default/3893111/f9696683-cec5-4914-ac3b-48962d7f5f9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f9696683-cec5-4914-ac3b-48962d7f5f9e) | [![OR Sustain Phase Questionnaires: Provide Self-assessments](https://no-cache.hubspot.com/cta/default/3893111/9fe0e863-566c-4917-b4b8-fcfb4a36dd61.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/9fe0e863-566c-4917-b4b8-fcfb4a36dd61) | [![OR Sustain Phase Questionnaires: Conduct Independent Quality Reviews](https://no-cache.hubspot.com/cta/default/3893111/0c524aa6-325a-4a99-bd7f-512403b2b0e7.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/0c524aa6-325a-4a99-bd7f-512403b2b0e7) |

#### Find out more about Blended Learning ORA-5000 \[ORA-5\] & ORA-300 \[ORA-3\]

| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/130553fb-1a34-45c7-8d7a-0e91483d5237.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/130553fb-1a34-45c7-8d7a-0e91483d5237) | [![Tell Me More About BCM- 8030](https://no-cache.hubspot.com/cta/default/3893111/4efea5b2-f209-48aa-b101-671debce9437.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4efea5b2-f209-48aa-b101-671debce9437) | [![New Call-to-action](https://no-cache.hubspot.com/cta/default/3893111/4df1d21d-d377-487a-920b-b7799c6a2c82.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4df1d21d-d377-487a-920b-b7799c6a2c82) |
| --- | --- | --- |
| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/618b44d7-b58a-4819-87b6-aa423fe4461d.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/618b44d7-b58a-4819-87b6-aa423fe4461d) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/6a19ecac-b465-4c06-a769-36a0b69ce74c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6a19ecac-b465-4c06-a769-36a0b69ce74c) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/826e513d-4cd5-4894-9e76-9b4e2e262334.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/826e513d-4cd5-4894-9e76-9b4e2e262334) |
| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/d0bd308d-92fc-49b5-b250-bb5b8b08c3b3.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0bd308d-92fc-49b5-b250-bb5b8b08c3b3) | Please feel free to send us a note if you have any of these questions. [![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/f457bdeb-1008-40d6-bffa-be4583a4ab41.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f457bdeb-1008-40d6-bffa-be4583a4ab41) |

![Moh Heng Goh](https://app.hubspot.com/settings/avatar/970b3fc77336e0347b69e316ba48751e) 

[Moh Heng Goh](https://blog.bcm-institute.org/operational-resilience-audit/author/moh-heng-goh) 

[Read More](https://blog.bcm-institute.org/operational-resilience-audit/toc-sustain-operational-resilience-audit-and-review-questionnaires-and-checklist)

![\[ORA\] Emerging Trends in Operational Resilience Auditing: A 2024 Report](https://blog.bcm-institute.org/hubfs/Operational%20Resilience%20Audit/CTA%20ORA%20Morepost/CTA_ORA_Emerging%20Trends%20in%20ORA%20a%202024%20Report.png)

[audit,](https://blog.bcm-institute.org/operational-resilience-audit/tag/audit) [Operational Resilience,](https://blog.bcm-institute.org/operational-resilience-audit/tag/operational-resilience) [Operational Resilience Audit,](https://blog.bcm-institute.org/operational-resilience-audit/tag/operational-resilience-audit) [ORAE,](https://blog.bcm-institute.org/operational-resilience-audit/tag/orae) [ORAS,](https://blog.bcm-institute.org/operational-resilience-audit/tag/oras) [ORA-5000,](https://blog.bcm-institute.org/operational-resilience-audit/tag/ora-5000) [ORA-300,](https://blog.bcm-institute.org/operational-resilience-audit/tag/ora-300) [ORA-400](https://blog.bcm-institute.org/operational-resilience-audit/tag/ora-400)

### [\[ORA\] Emerging Trends in Operational Resilience Auditing: A 2024 Report](https://blog.bcm-institute.org/operational-resilience-audit/ora-emerging-trends-in-operational-resilience-auditing-2024-report)

Feb 9, 2024 11:56:56 PM

### Emerging Trends in Operational Resilience Auditing: A 2024 Report

[![ORA Emerging Trends in ORA: A 2024 Report](https://no-cache.hubspot.com/cta/default/3893111/81fb1b6c-5300-4af2-b0ff-e1f3fb8a6746.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/81fb1b6c-5300-4af2-b0ff-e1f3fb8a6746)Operational resilience has become a top priority for organizations across industries, prompting the rise of specialized auditing practices.

This report explores key emerging trends shaping the landscape of operational resilience auditing in 2024.

#### 1. Increased Regulatory Scrutiny

Regulatory bodies worldwide are implementing stricter requirements for operational resilience, mandating regular audits and stress testing exercises. This drives demand for skilled auditors familiar with relevant regulatory frameworks.

#### 2. Focus on Third-Party Risk Management

Modern businesses' interconnectedness amplifies third-party vulnerabilities' impact. Audits increasingly scrutinize third-party contracts, risk management procedures, and control environments to ensure supply chain resilience.

#### 3. Integration with Cybersecurity Audits

The convergence of cyber and operational risks necessitates combined audits examining IT infrastructure, data security, and incident response capabilities alongside traditional operational resilience assessments.

#### 4. Adoption of Technology-Assisted Auditing

Advanced analytics, artificial intelligence (AI), and automation are transforming how audits are conducted. These tools enable auditors to analyze vast datasets, identify hidden patterns, and streamline data collection, freeing time for deeper analysis and judgment.

#### 5. Shift Towards Scenario-Based Testing

Static assessments give way to dynamic scenario-based testing that simulates real-world disruptions. This approach helps organizations refine their resilience plans and identify vulnerabilities under pressure.

#### 6. Evolving Threat Landscape

Auditors must stay informed about emerging threats like climate change, geopolitical instability, and cyberattacks, continuously adapting their methodologies to address these dynamic risks.

#### 7. Growing Demand for Skilled Professionals

The burgeoning field of operational resilience auditing creates a talent gap.

Training and certification programs are crucial to upskill existing professionals and attract new talent to meet the rising demand.

#### 8. Emphasis on Business Continuity Management (BCM) Integration

Effective operational resilience relies on integrating resilience principles into existing BCM frameworks.

Auditors focus on ensuring BCM programs align with organizational objectives and address emerging threats.

#### 9. Continuous Improvement and Learning

Operational resilience is an ongoing journey, not a destination.

Audits should emphasize the importance of continuous improvement, learning from incidents, and adapting resilience plans based on evolving threats and organizational changes.

#### 10. International Collaboration and Harmonization

Harmonization across jurisdictions and industries is critical as regulations and best practices evolve.

International collaboration among regulators, auditors, and professional bodies is gaining momentum to facilitate knowledge sharing and consistent approaches.

By staying informed about these trends, audit professionals can adapt their practices, embrace new technologies, and contribute to building robust and adaptable operational resilience for organizations in the face of ever-changing risks.

| ##### Find out more about Blended Learning ORA-5000 \[ORA-5\] & ORA-300 \[ORA-3\] |
| --- |

| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/130553fb-1a34-45c7-8d7a-0e91483d5237.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/130553fb-1a34-45c7-8d7a-0e91483d5237) | [![Tell Me More About BCM- 8030](https://no-cache.hubspot.com/cta/default/3893111/4efea5b2-f209-48aa-b101-671debce9437.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4efea5b2-f209-48aa-b101-671debce9437) | [![New Call-to-action](https://no-cache.hubspot.com/cta/default/3893111/4df1d21d-d377-487a-920b-b7799c6a2c82.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4df1d21d-d377-487a-920b-b7799c6a2c82) |
| --- | --- | --- |
| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/618b44d7-b58a-4819-87b6-aa423fe4461d.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/618b44d7-b58a-4819-87b6-aa423fe4461d) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/6a19ecac-b465-4c06-a769-36a0b69ce74c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6a19ecac-b465-4c06-a769-36a0b69ce74c) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/826e513d-4cd5-4894-9e76-9b4e2e262334.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/826e513d-4cd5-4894-9e76-9b4e2e262334) |
| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/d0bd308d-92fc-49b5-b250-bb5b8b08c3b3.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0bd308d-92fc-49b5-b250-bb5b8b08c3b3) | Please feel free to send us a note if you have any of these questions. [![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/f457bdeb-1008-40d6-bffa-be4583a4ab41.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f457bdeb-1008-40d6-bffa-be4583a4ab41) |

![Moh Heng Goh](https://app.hubspot.com/settings/avatar/970b3fc77336e0347b69e316ba48751e) 

[Moh Heng Goh](https://blog.bcm-institute.org/operational-resilience-audit/author/moh-heng-goh) 

[Read More](https://blog.bcm-institute.org/operational-resilience-audit/ora-emerging-trends-in-operational-resilience-auditing-2024-report)

![\[ORA\] Internal vs External Auditing of Operational Resilience: Roles, Responsibilities and Ethics](https://blog.bcm-institute.org/hubfs/Operational%20Resilience%20Audit/CTA%20ORA%20Morepost/CTA_ORA_Internal%20vs%20External%20OR%20Auditors.png)

[audit,](https://blog.bcm-institute.org/operational-resilience-audit/tag/audit) [Operational Resilience,](https://blog.bcm-institute.org/operational-resilience-audit/tag/operational-resilience) [Operational Resilience Audit,](https://blog.bcm-institute.org/operational-resilience-audit/tag/operational-resilience-audit) [ORAE,](https://blog.bcm-institute.org/operational-resilience-audit/tag/orae) [ORAS,](https://blog.bcm-institute.org/operational-resilience-audit/tag/oras) [ORA-5000,](https://blog.bcm-institute.org/operational-resilience-audit/tag/ora-5000) [ORA-300,](https://blog.bcm-institute.org/operational-resilience-audit/tag/ora-300) [ORA-400](https://blog.bcm-institute.org/operational-resilience-audit/tag/ora-400)

### [\[ORA\] Internal vs External Auditing of Operational Resilience: Roles, Responsibilities and Ethics](https://blog.bcm-institute.org/operational-resilience-audit/ora-internal-vs-external-auditing-of-operational-resilience-roles-responsibilities-and-ethics)

Feb 8, 2024 9:41:08 PM

### Internal vs External OR Auditing: Roles, Responsibilities and Ethics

[![ORA Internal vs External OR Auditors](https://no-cache.hubspot.com/cta/default/3893111/970b1fe4-eeac-421c-8106-814f62262919.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/970b1fe4-eeac-421c-8106-814f62262919)While internal and external auditors contribute to assessing and strengthening operational resilience, their roles, responsibilities, and ethical considerations differ significantly.

Hence, it is helpful to understand the differences in roles, responsibilities and ethical considerations between IA and EA.

### Internal Auditors (IA)

#### Roles of IA

- **Independent assurance provider.** Evaluating the effectiveness of existing resilience programs and controls within the organization.
- **Risk consultant.** Collaborating with business units to identify and mitigate operational risks impacting resilience.
- **Process improvement advocate**. Proposing recommendations to enhance OR posture and optimize processes.
- **Change agent.** Driving improvements in risk management culture and awareness across the organization.

#### Responsibilities of IA

- Conducting risk assessments and audits focused on operational resilience.  
  Testing controls and processes designed to mitigate identified risks.
- Evaluating the adequacy and effectiveness of resilience plans and preparedness.
- Reporting findings and recommendations to management and relevant stakeholders.
- Monitoring and measuring the effectiveness of implemented improvements.

#### Ethical Considerations of IA

- Maintaining independence and objectivity: Avoiding undue influence from management or bias towards specific outcomes.
- Confidentiality: Protecting sensitive information obtained during audits while ensuring adequate reporting for oversight purposes.
- Competence and professional diligence: Continuously updating knowledge and skills to perform audits effectively and adhere to professional standards.
- Acting in the organisation's best interests: Balancing adherence to regulations with supporting the organization's long-term sustainability and ethical conduct.

### External Auditors (EA)

#### Roles of EA

- Independent opinion provider: Offering an external perspective on the organization's overall risk management and resilience posture.
- Regulatory compliance assurer: Verifying adherence to relevant regulations and standards impacting operational resilience.
- Stakeholder assurance provider: Building confidence for investors, creditors, and other stakeholders regarding the organization's resilience capabilities.

#### Responsibilities of EA

- Conducting audits focused on specific regulatory requirements or contractual obligations related to operational resilience.
- Assessing the design and effectiveness of controls based on agreed-upon procedures.
- Reporting findings and opinions to relevant stakeholders, potentially including public disclosure.
- May not delve as deeply into operational details as internal auditors.

#### Ethical Considerations of EA

- **Maintaining independence and objectivity.** Avoiding conflicts of interest and undue influence from clients or regulators.
- **Professional scepticism.** Maintaining a critical questioning stance ensures audit conclusions are based on accurate and sufficient evidence.
- **Confidentiality.** Protecting sensitive information obtained during audits while fulfilling reporting requirements to designated parties.
- **Communication and transparency.** Communicating limitations and uncertainties associated with their audit findings and opinions.

#### Key Differences

- **Focus. ** Internal auditors focus on broader operational resilience within the organisation, while external auditors may have a narrower scope dictated by regulations or contracts.
- **Reporting.** Internal auditors report primarily to management and internal stakeholders, while external auditors report to their clients and potentially publicly.
- **Depth of engagement.** Internal auditors typically understand the organisation's internal workings and may conduct more in-depth assessments.
- **Impact.** Internal auditors directly impact internal change and improvement within the organisation, while external auditors provide assurance and may trigger regulatory consequences.

#### Collaboration and Coordination

While their roles and responsibilities differ, effective operational resilience relies on collaboration and coordination between internal and external auditors.

- **Sharing information and insights.** Internal auditors can provide external auditors valuable context and understanding of the organisation's operations and risk landscape.
- **Joint assessments.** In some cases, collaborative audits can leverage the strengths of both parties for a more comprehensive evaluation.
- **Mutual respect and understanding.** Recognising the value each type of auditor brings to building a robust operational resilience framework.

By understanding internal and external auditors' different roles, responsibilities, and ethical considerations, organisations can effectively leverage their combined expertise to assess and strengthen their operational resilience posture.

| ##### Find out more about Blended Learning ORA-5000 \[ORA-5\] & ORA-300 \[ORA-3\] |
| --- |

| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/130553fb-1a34-45c7-8d7a-0e91483d5237.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/130553fb-1a34-45c7-8d7a-0e91483d5237) | [![Tell Me More About BCM- 8030](https://no-cache.hubspot.com/cta/default/3893111/4efea5b2-f209-48aa-b101-671debce9437.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4efea5b2-f209-48aa-b101-671debce9437) | [![New Call-to-action](https://no-cache.hubspot.com/cta/default/3893111/4df1d21d-d377-487a-920b-b7799c6a2c82.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4df1d21d-d377-487a-920b-b7799c6a2c82) |
| --- | --- | --- |
| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/618b44d7-b58a-4819-87b6-aa423fe4461d.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/618b44d7-b58a-4819-87b6-aa423fe4461d) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/6a19ecac-b465-4c06-a769-36a0b69ce74c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6a19ecac-b465-4c06-a769-36a0b69ce74c) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/826e513d-4cd5-4894-9e76-9b4e2e262334.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/826e513d-4cd5-4894-9e76-9b4e2e262334) |
| [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/d0bd308d-92fc-49b5-b250-bb5b8b08c3b3.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0bd308d-92fc-49b5-b250-bb5b8b08c3b3) | Please feel free to send us a note if you have any of these questions. [![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [![New call-to-action](https://no-cache.hubspot.com/cta/default/3893111/f457bdeb-1008-40d6-bffa-be4583a4ab41.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f457bdeb-1008-40d6-bffa-be4583a4ab41) |

![Moh Heng Goh](https://app.hubspot.com/settings/avatar/970b3fc77336e0347b69e316ba48751e) 

[Moh Heng Goh](https://blog.bcm-institute.org/operational-resilience-audit/author/moh-heng-goh) 

[Read More](https://blog.bcm-institute.org/operational-resilience-audit/ora-internal-vs-external-auditing-of-operational-resilience-roles-responsibilities-and-ethics)

[1](https://blog.bcm-institute.org/operational-resilience-audit/author/moh-heng-goh) [2](https://blog.bcm-institute.org/operational-resilience-audit/author/moh-heng-goh/page/2) [3](https://blog.bcm-institute.org/operational-resilience-audit/author/moh-heng-goh/page/3) [4](https://blog.bcm-institute.org/operational-resilience-audit/author/moh-heng-goh/page/4) [5](https://blog.bcm-institute.org/operational-resilience-audit/author/moh-heng-goh/page/5) <https://blog.bcm-institute.org/operational-resilience-audit/author/moh-heng-goh/page/2>

#### More About Us

- BCM Certification
- BCM Institute Code of Ethic
- Contact Us

[Follow us on Facebook](https://www.facebook.com/people/Business-Continuity-Resiliency-Certification-Institute/100076077522073/?paipv=0&eav=AfadYlvGYlKFiAwSRhdWttoRma9-2SYiuD01qCq4BOIYcDs3bGuQ-Sj7eFTYWwmt7Uw&_rdr) [Follow us on LinkedIn](https://my.linkedin.com/school/business-continuity-management-institute-bcm-institute/people) [Follow us on Facebook](https://www.youtube.com/@BCMInstitute)