Operational Resilience Audit

Posts about:

audit (7)

audit, Operational Resilience, Operational Resilience Audit

ORA Challenges Faced: Scope Definition

Jan 7, 2024 2:35:09 PM

Challenges Faced by Auditors when Conducting an Operational Resilience Audit

Scope Definition

The challenges to defining the scope for an operational resilience audit primarily revolve around the complexities arising from the interconnected nature of an organisation's operations and the need for a comprehensive understanding of its inner workings.

Interconnectedness of Business Functions

Many modern organisations have intricate webs of interconnected processes and systems. Pinpointing the boundaries of the audit scope becomes challenging because disruptions in one area can ripple across others. This interconnectedness makes it difficult to isolate individual components for assessment.

Dependency Identification

Understanding the dependencies between various critical business services, especially the breakdown in business functions, systems, and third-party entities, is crucial. However, these dependencies might only sometimes be explicit or easily discernible. Some critical dependencies might be hidden or overlooked, potentially leaving vulnerabilities to be addressed.

Depth of Understanding

A deep understanding of the organisation's operations, especially in larger or more complex enterprises, demands substantial time and resources. Without a comprehensive grasp of how different functions interrelate and support each other, auditors might miss critical components or fail to evaluate their significance accurately.

Dynamic Nature of Operations

Businesses are in a constant state of flux. New technologies, process changes, or market adaptations might alter the operational landscape. Keeping up with these changes and adjusting the audit scope is challenging and requires continuous monitoring and updates.

Subjectivity in Prioritisation

Identifying and prioritising critical processes or functions can be subjective. Different organisational stakeholders may have varying opinions on what is critical or less critical. Balancing these perspectives to create an objective and practical scope can be challenging.

Summarising the execution of Scope Definition ...

To tackle these challenges, auditors must collaborate closely with stakeholders across departments, leverage data analytics and technology to map dependencies, conduct extensive interviews and workshops, and continuously reassess the scope throughout the audit process.

Flexibility and adaptability are essential to refine the audit scope to align with the organisation's evolving operational landscape.

Summing Up ...

Addressing these challenges often requires a multidisciplinary approach involving collaboration across various departments, access to updated information, leveraging technological solutions for data analysis, and continuous adaptation to emerging threats.

Flexibility and agility in audit methodologies are crucial to assess and enhance an organisation's operational resilience effectively.

Types of Challenges Faced by OR Auditor and Reviewer

Find out more about Blended Learning ORA-5000 [ORA-5] & ORA-300 [ORA-3]

Please feel free to send us a note if you have any of these questions.

Moh Heng Goh

certification, Examination, audit, Blended Learning, Operational Resilience Audit

[ORA-5] Module (Day) 3 of ORA-5000 Operational Resilience Audit Expert

Jan 5, 2024 4:52:47 PM

Operational Resilience Expert Auditor (ORA-5000) Training Roadmap [Module 3]

Description of Module [Day] 3 Course

Detailed Course Content

The participants should understand the key areas and considerations when auditing the operational resilience project and program. By understanding the OR framework and requirements aligned to international and local OR standards and the audit process, the participants can develop the audit and compliance strategy.

This is followed by the implementation of an audit checklist with an audit programme that is aligned with the specific industry and business requirements with

The participant should, at a minimum, attain a basic grasp of OR concepts and principles:

In summary, participants should be able to:

Introducing Operational Resilience Auditing

What is Operational Resilience and OR Audit?
What is the difference between BCM and CM audit?
Evolution of Operational Resilience Auditing
Key regulatory drivers and frameworks
Audit methodologies and techniques
Roles and responsibilities of operational resilience auditors
Internal vs External OR Auditing

Planning for the OR Audit [Audit Planning]

Establish the scope and objectives of the OR audit.
Identify key stakeholders and their roles.
Develop a comprehensive audit plan outlining timelines, resources, and methodologies.

Determine the Data to be Collected [Data Collection]

Identify relevant data sources related to operational resilience.
Define data collection methods and tools.
Ensure that the data collected aligns with the audit objectives and scope.

Analyse the Data Collected from the Auditees [Data Analysis]

Employ analytical techniques to examine the collected data.
Identify patterns, trends, and potential areas of concern.
Collaborate with auditees to clarify and validate data points.

The Standardised Audit Program or Audit Checklist will be developed in Module 3. The participant will be orientated to the content of the operational resilience before the practicum starts.

Deliverables

Able to have a good understanding of Operational Resilience Audit
Able to conduct audit fieldwork on an organisation
Able to perform an audit interview and present findings of the audit

Course Content for ORA-5

More Information About Blended Learning Operational Resilience Audit (ORA) Courses

BCM Institute offers two levels of OR auditing courses: ORA-3 Blended Learning ORA-300 Operational Resilience Audit Specialist and the ORA-5 Blended Learning ORA-5000 Operational Resilience Audit Expert.




	Please feel free to send us a note if you have any questions.

Rose Lam

ORA Sustain Phase Questionnaires: Introduce Cultural Change

audit

ORA [Sustain] Questionnaires: Introduce Cultural Change

Jun 20, 2023 12:00:56 PM

OR Audit Questionnaires

Implement Phase

Introduce Cultural Change

OR_Roadmap_Sustain_Diagram

What is Organisational Culture?

Organisational Culture is not created by memo or a decision from senior management but developed over time and plays a crucial role in achieving organisational objectives, especially in this new area of operational resilience.

This section is the "Implement" phase of the Operational Resilience Planning Methodology. It is the first stage of the Implement phase: Identify Critical Business Services.

Audit Checklist for Introducing Cultural Change

Identification of Critical Business Services

Has the organisation identified its critical business services?
Are the critical business services clearly defined and documented?
Has the organisation prioritised the criticality of each business service?

Interdependencies and Interconnections

Are the dependencies and interconnections of critical business services identified?
Has the organisation mapped the dependencies between critical business services and supporting functions, systems, and vendors?
Are there contingency plans in place to address disruptions independent services?

OR Mapping Interconnections and Interdependencies BCMPedia

Business Impact Analysis

Has a business impact analysis (BIA) been conducted for each critical business service?
Are the potential financial, operational, and reputational impacts of disruptions to critical business services assessed?
Are each critical business service's recovery time objectives (RTOs) and recovery point objectives (RPOs) defined?

Risk Assessment

Has a comprehensive risk assessment been conducted for each critical business service?
Are the risks to each critical business service identified and assessed?
Are risk mitigation measures in place for identified risks?
Is there a process to regularly review and update risk assessments for critical business services?

Business Continuity Planning

Are business continuity plans in place for each critical business service?
Have the plans been tested and validated?
Are the business continuity plans documented and easily accessible to relevant personnel?
Are there clearly defined procedures for invoking and executing the business continuity plans?

Incident Management

Is there an incident management framework specifically tailored for critical business services?
Are there documented incident response procedures for critical business services?
Are roles and responsibilities clearly defined for managing incidents related to critical business services?
Is there a process to track and report incidents related to critical business services?

Communication and Stakeholder Management

Is there a communication plan to keep stakeholders informed during disruptions to critical business services?
Are there established communication channels to reach internal and external stakeholders?
Is there a process to prioritise and communicate with stakeholders based on the severity and impact of the disruption?

Testing and Exercises

Are regular testing and exercising of critical business services conducted?
Are the testing and exercising scenarios designed to simulate realistic disruptions?
Are the lessons learned from testing and exercises used to improve the operational resilience of critical business services?

Training and Awareness

Is there a training program to educate employees on the operational resilience of critical business services?
Are employees aware of their roles and responsibilities in maintaining the operational resilience of critical business services?
Are there regular awareness campaigns to promote a culture of operational resilience for critical business services?
Are training records maintained for compliance and audit purposes?

Continuous Improvement

Is there a process to capture and analyse lessons learned from disruptions to critical business services?
Are there mechanisms to incorporate the lessons learned into improvements for the operational resilience of critical business services?
Is there a culture of continuous improvement in managing the operational resilience of critical business services?
Are regular reviews and updates to the business continuity plans and procedures for critical business services

Note that some of the steps may overlap with the other stages of the "Implement" phase stages.

Find out more about Blended Learning BCM-8530 [BL-A-5] & BCM-8030 [BL-A-3]

Please feel free to send us a note if you have any of these questions.

Moh Heng Goh

audit, BCM-8530, BCM-8030, BCM-200, BCCLA

Table of Content: Operational Resilience Audit Questionnaires

Jun 20, 2023 12:00:51 PM

Bann_Managers Guide Book_Audit_

Detailed Operational Resilience Audit Questionnaires

This list of OR Questionnaires is intended to guide Auditors in developing their Standardized Audit Program. Refer to OR Questionnaires.

Plan


Implement

Identify Critical Business Services	Map Processes and Resources	Set Impact Tolerance	Conduct Scenario Testing	Improve Lesson Learnt
Sustain

	S/No	BCM Audit Questionnaires
	1	BC Roles And Responsibilities
	2	Project Management
	3	Risk Analysis and Review
	4	Business Impact Analysis
	5	Business Continuity Strategy
	6	Plan Development
	7	Testing And Exercising
	8	Program Management: Training and Awareness
	9	Program Management: Maintenance
	10	Crisis Management

Click the icon to access the respective “BCM Audit Questionnaires” questions.

Table of Content


C9	C10	C11
BC Roles and Responsibilities	Project Management	Risk Analysis and Review

C12	C13	C14
Business Impact Analysis	Business Continuity Strategy	Plan Development

C15	C16	C17
Testing and Exercising	Program Management: Training and Awareness	Program Management: Maintenane

C18
Crisis Management

Book Series		BCMPedia
		Audit

Do You Want to Attend a Comprehensive BCM Audit course remotely? Better still be certified?

Book	Certification Course

Reference Guide

Goh, M. H. (2010). A Manager's Guide to Auditing and Reviewing Your Business Continuity Management Program. Business Continuity Management Specialist Series (1st ed., p. 192). Singapore: GMH Pte Ltd.

Extracted from "Chapters 9 to 13"

Note: This version is the 2nd Edition being updated in 2021. The numeric in the square bracket {C##] is the cross-referencing of the actual chapters in the 2010 Edition.

Find out more about Blended Learning BCM-8530 [BL-A-5] & BCM-8030 [BL-A-3]



	Please feel free to send us a note if you have any of these questions to sales.ap@bcm-institute.org

Moh Heng Goh

ORA [Plan] Questionnaires: Anaylse Gap for Incident and Crisis Management

audit, Operational Resilience

ORA [Plan] Questionnaires: Analyse Gap for Incident and Crisis Management

Jun 15, 2023 7:48:42 PM

Analyse the Gap

OR_Plan_Update Diagram

What is Incident and Crisis Management?

Incident Management or IM refers to an organisation's activities to identify, analyze and correct threats.

Crisis Management or CM is the overall coordination of an organization's response to a crisis in an effective, timely manner, intending to avoid or minimize damage to the organization's profitability, reputation, or ability to operate.

This section is the "Plan" phase of the Operational Resilience Planning Methodology. It is the second stage of the Plan phase: Analyse Gap.

Audit Checklist for Analysing the Gap for Incident and Crisis Management

1. Crisis Management Structure

Is there a documented crisis management structure in place?
Are the structure's roles, responsibilities, reporting lines, and chain of command clearly defined?
Have alternates been designated for primary representatives in case of unavailability?
Are there regular training and awareness programs for personnel involved in the crisis management structure?

Checklist

Check if there is a documented crisis management structure.
Verify if roles, responsibilities, reporting lines, and chain of command are clearly defined within the structure.
Assess if alternates have been designated for primary representatives.
Review training and awareness programs for personnel involved in the crisis management structure.

2. Triggers and Activation Criteria

Are there pre-defined triggers and criteria for activating the crisis management structure?
Are these triggers and criteria reviewed and updated periodically to reflect organisational risk landscape changes?
Is there a mechanism for timely monitoring and identification of triggers to activate the crisis management structure?
Has the effectiveness of the triggers and activation criteria been tested through simulations or exercises?

Checklist

Determine if there are pre-defined triggers and criteria for activating the crisis management structure.
Verify if these triggers and criteria are reviewed and updated periodically.
Assess the mechanism for monitoring and identifying triggers to activate the crisis management structure.
Review simulations or exercises to test the effectiveness of the triggers and activation criteria.

3. Crisis Management Plans and Procedures

Are there comprehensive crisis management plans and procedures in place to guide actions and decisions during a crisis?
Have the crisis plans been developed based on a thorough assessment of potential risks and scenarios?
Are the plans regularly reviewed, updated, and tested for their effectiveness?
Are there clear guidelines on the roles and responsibilities of senior management during a crisis?
Is there a process for post-crisis evaluation and improvement of the crisis plans and procedures?

Checklist

Check if comprehensive crisis plans and procedures are in place to guide actions and decisions during a crisis.
Verify if the crisis plans are based on a thorough assessment of potential risks and scenarios.
Assess whether the plans are regularly reviewed, updated, and tested for effectiveness.
Review guidelines on the roles and responsibilities of senior management during a crisis.
Determine if there is a process for post-crisis evaluation and improvement of the crisis plans and procedures.

4. Tools and Processes for Situation Assessment

Are there tools and processes in place to facilitate timely updating and assessment of the latest situation during a crisis?
Is there a dedicated team responsible for gathering, analysing, and disseminating information to support decision-making?
Are the tools and processes regularly tested and updated to ensure their effectiveness?
Is there a mechanism to integrate information from various sources and stakeholders for a comprehensive situational assessment?

Checklist

Determine if tools and processes are in place to facilitate timely updating and assessment of the latest situation during a crisis.
Assess if a dedicated team is responsible for gathering, analysing, and disseminating information to support decision-making.
Verify if the tools and processes are regularly tested and updated.
Determine if there is a mechanism to integrate information from various sources and stakeholders for a comprehensive situational assessment.

5. Stakeholder Communication

Is there a list of internal and external stakeholders to be informed when a critical business service is disrupted?
Are communication plans and requirements documented for each stakeholder group?
Do the communication plans include criteria for determining the severity and timing of notifications?
Are there predefined communication channels for efficient stakeholder communication, such as email distribution lists or notification systems?
Are alternative communication channels identified and documented in case the primary channels are unavailable?

Checklist

Verify if there is a list of internal and external stakeholders to be informed when a critical business service is disrupted.
Review communication plans and requirements documented for each stakeholder group.
Assess if the communication plans include criteria for determining the severity and timing of notifications.
Verify if there are predefined communication channels, such as email distribution lists or notification systems, for efficient communication with stakeholders.
Determine if alternative communication channels have been identified and documented in case the primary channels are unavailable.

6. Mainstream and Social Media Communication

Are communication channels effectively established to reach stakeholders through mainstream and social media platforms?
Are designated personnel responsible for managing communications on these channels during a crisis?
Are there guidelines or protocols to ensure consistent and accurate messaging through mainstream and social media?

Checklist

Assess if there are established communication channels to effectively reach stakeholders through mainstream and social media platforms.
Verify if designated personnel manage communications on these channels during a crisis.
Review guidelines or protocols to ensure consistent and accurate mainstream and social media messaging.
Assess if there are mechanisms to monitor and respond to public sentiment and feedback during a crisis.

Do note that some steps may overlap or appear similar in the other stages of the OR planning phases. If this occurs, the questionnaires and checklists must be contextualised to the topic under review.


Questionnaires and Checklist "Plan" Phase	Assess Capability and Maturity	Analyse Gap	Develop Strategy Roadmap	Confirm Risk Appetite	Develop and Embed Governance

Find out more about Blended Learning ORA-5000 [BL-ORA-5] & ORA-300 [BL-ORA-3]

Please feel free to send us a note if you have any of these questions.

Moh Heng Goh

Operational Resilience Audit

audit (7)

ORA Challenges Faced: Scope Definition

Challenges Faced by Auditors when Conducting an Operational Resilience Audit

Scope Definition

Interconnectedness of Business Functions

Dependency Identification

Depth of Understanding

Dynamic Nature of Operations

Subjectivity in Prioritisation

Summarising the execution of Scope Definition ...

Summing Up ...

Find out more about Blended Learning ORA-5000 [ORA-5] & ORA-300 [ORA-3]

[ORA-5] Module (Day) 3 of ORA-5000 Operational Resilience Audit Expert

hbspt.cta._relativeUrls=true;hbspt.cta.load(3893111, '5411be84-441a-42e0-8059-8136c82c4332', {"useNewLoader":"true","region":"na1"}); Operational Resilience Expert Auditor (ORA-5000) Training Roadmap [Module 3]

Description of Module [Day] 3 Course

Detailed Course Content

hbspt.cta._relativeUrls=true;hbspt.cta.load(3893111, 'a266b07d-fd3e-4748-b632-d044f442286b', {"useNewLoader":"true","region":"na1"});

Deliverables

More Information About Blended Learning Operational Resilience Audit (ORA) Courses

ORA [Sustain] Questionnaires: Introduce Cultural Change

OR Audit Questionnaires

Implement Phase

Introduce Cultural Change

What is Organisational Culture?

Audit Checklist for Introducing Cultural Change

Identification of Critical Business Services

Interdependencies and Interconnections

Business Impact Analysis

Risk Assessment

Business Continuity Planning

Incident Management

Communication and Stakeholder Management

Testing and Exercises

Training and Awareness

Continuous Improvement

Find out more about Blended Learning BCM-8530 [BL-A-5] & BCM-8030 [BL-A-3]

Table of Content: Operational Resilience Audit Questionnaires

Detailed Operational Resilience Audit Questionnaires

Table of Content

Do You Want to Attend a Comprehensive BCM Audit course remotely? Better still be certified?

Reference Guide

Find out more about Blended Learning BCM-8530 [BL-A-5] & BCM-8030 [BL-A-3]

ORA [Plan] Questionnaires: Analyse Gap for Incident and Crisis Management

hbspt.cta._relativeUrls=true;hbspt.cta.load(3893111, '7341550b-2a0b-49e3-8c83-4dce92ec089c', {"useNewLoader":"true","region":"na1"});

Analyse the Gap

What is Incident and Crisis Management?

Audit Checklist for Analysing the Gap for Incident and Crisis Management

1. Crisis Management Structure

2. Triggers and Activation Criteria

3. Crisis Management Plans and Procedures

4. Tools and Processes for Situation Assessment

5. Stakeholder Communication

6. Mainstream and Social Media Communication

Find out more about Blended Learning ORA-5000 [BL-ORA-5] & ORA-300 [BL-ORA-3]

Operational Resilience Expert Auditor (ORA-5000) Training Roadmap [Module 3]