OR [Sustain] Questionnaires: Conduct Independent Quality Reviews

What is an Independent Quality Review?

A significant part of independent quality review revolves around audit and assurance.  It significantly contributes to achieving organisational objectives and value creation for shareholders and stakeholders, especially when implementing operational resilience.

• Are operational resilience policies and procedures well-documented and up to date?
• Is there evidence of a comprehensive operational resilience framework?
• Are the policies and procedures aligned with industry best practices and regulatory requirements?
• Are there clear guidelines and standards for operational resilience practices?
• Is there evidence of senior management endorsement and approval of operational resilience policies?

• Review operational resilience policies and procedures documentation.
• Assess the comprehensiveness and currency of the operational resilience framework.
• Evaluate the alignment of policies and procedures with industry best practices and regulations.
• Verify the presence of clear guidelines and standards for operational resilience practices.
• Determine if senior management has endorsed and approved the operational resilience policies.

• Has training on operational resilience been provided to employees at all levels?
• Is there evidence of awareness campaigns and communication initiatives related to operational resilience?
• Are training materials comprehensive and effectively communicated to employees?
• Is there a mechanism to track and monitor employee completion of operational resilience training?
• Are training programs periodically updated to reflect changes in operational resilience requirements?

• Verify the provision of operational resilience training to employees at all levels.
• Assess the effectiveness of awareness campaigns and communication initiatives.
• Evaluate the comprehensiveness and clarity of training materials.
• Determine if there is a mechanism to track and monitor employee completion of training.
• Review the process for updating training programs based on changes in requirements.

• Have operational resilience plans and procedures been tested through exercises and simulations?
• Is there a documented schedule for testing and exercising operational resilience capabilities?
• Are different scenarios and levels of disruptions considered during testing?
• Are testing results analyzed to identify areas for improvement and corrective actions?
• Are there mechanisms to track and follow up on implementing corrective actions identified during testing?

• Review documentation of operational resilience testing and exercise plans.
• Evaluate the adequacy of the testing schedule and the consideration of various scenarios.
• Assess the analysis of testing results to identify areas for improvement.
• Verify the existence of mechanisms to track and follow up on corrective actions.
• Determine if lessons learned from testing and exercises are documented and incorporated into improvements.

• Is there an incident response plan in place for operational resilience incidents?
• Has the incident response plan been tested and validated?
• Are roles, responsibilities, and communication channels clearly defined within the incident response plan?
• Is there a designated incident response team and a straightforward escalation process?
• Is there a process for post-incident analysis and continuous improvement of the incident response capabilities?

• Review the incident response plan documentation for operational resilience incidents.
• Evaluate the testing and validation activities conducted on the incident response plan.
• Assess the clarity and accuracy of roles, responsibilities, and communication channels.
• Verify the incident response team's existence and composition and escalation process.
• Determine if there is a process for post-incident analysis and continuous improvement.

• Are there mechanisms to monitor and ensure compliance with operational resilience regulations?
• Is there evidence of regular assessments and audits to evaluate compliance?
• Are compliance gaps and deficiencies promptly addressed and remediated?
• Are there documented processes to stay updated with evolving regulatory requirements?
• Are there precise mechanisms for reporting and escalating non-compliance issues?

• Evaluate the mechanisms to monitor and ensure compliance with operational resilience regulations.
• Review evidence of regular assessments and audits to evaluate compliance.
• Assess the effectiveness of processes for addressing compliance gaps and deficiencies.
• Verify the existence of processes to stay updated with evolving regulatory requirements.
• Determine the clarity and effectiveness of mechanisms for reporting and escalating non-compliance issues.

Questionnaires and Checklist "Sustain" Phase

Implement Training and Awareness

Provide Self-assessment

Conduct Independent Quality Review