Operational Resilience Audit

audit, Operational Resilience, Operational Resilience Audit, ORAE, ORAS, ORA-5000, ORA-300, ORA-400

ORA Planning [1] Audit Planning

Jan 11, 2024 1:58:16 PM

Operational Resilience Audit Planning Step

Audit Planning

Preparation for Audit

When conducting audit planning during an operational resilience audit, it is essential to ensure thorough preparation to achieve the audit objectives effectively.

The following are detailed steps for the conduct of audit planning:

Define Audit Objectives
Determine Audit Scope
Identify the Audit Team and Assign Roles
Conduct Preliminary Research
Develop an Audit Plan
Conduct Risk Assessment
Plan Data Collection Methods
Establish Communication Channels
Develop an Audit Schedule
Conduct Entrance Meeting
Prepare Audit Documentation
Obtain Necessary Permissions and Access
Finalise Audit Plan

Define Audit Objectives

Establish the specific objectives of the operational resilience audit.
Outline what the audit aims to achieve. This includes identifying the key areas to be assessed, such as:
- The effectiveness of operational resilience measures
- Identify vulnerabilities
- Ensure compliance with established standards
- Preparedness, response and recovery plans
- Prepare testing mechanisms
- Provide governance and monitoring/reporting

Determine Audit Scope

Define the boundaries and extent of the audit.
Identify the departments, processes, systems, or locations included in the audit.
Consider any regulatory requirements, industry standards, or internal policies that should be considered.

Identify the Audit Team and Assign Roles

Assemble an audit team comprising individuals with relevant expertise and knowledge in operational resilience.
Assign specific roles and responsibilities to team members, including an audit lead, subject matter experts, and support staff.

Conduct Preliminary Research

Gather background information about the organisation's operational resilience framework, previous audits, incident reports, and relevant policies and procedures.
- This research will provide a foundation for understanding the organisation's context and identify potential focus areas.

Develop an Audit Plan

Create a comprehensive audit plan that outlines the approach, timelines, and resources required.
- The plan should include specific audit procedures, sampling methodologies, data collection methods, and analysis techniques.
Ensure that the plan aligns with the audit objectives and scope.

Conduct Risk Assessment

Perform a risk assessment to identify and prioritise areas of potential concern within the operational resilience framework.
- This assessment helps determine which areas require more in-depth scrutiny and guides the allocation of audit resources accordingly.

Plan Data Collection Methods

Determine the appropriate methods for collecting relevant data during the audit.
- This may involve document reviews, interviews with key personnel, observation of processes, or analysis of incident records.
Develop data collection templates or checklists to guide the audit team.

Establish Communication Channels

Set up communication channels with key stakeholders, including senior management, process owners, and relevant staff members.
Communicate the purpose and scope of the audit, expected timelines, and the level of cooperation required from stakeholders.

Develop an Audit Schedule

Create a detailed schedule that outlines the timing and duration of audit activities.
Consider the availability of key personnel and any potential disruptions to operations.
Allow sufficient time for on-site visits, interviews, and data analysis.

Conduct Entrance Meeting

Arrange an entrance meeting with key stakeholders to:

Introduce the audit team formally
Discuss the audit objectives, scope, and expectations and address any questions or concerns.
- This meeting helps establish a collaborative and transparent approach to the audit.

Prepare Audit Documentation

Develop standardised templates or tools to consistently document audit procedures, findings, and recommendations.
Ensure the documentation aligns with regulatory requirements, industry standards, and internal audit protocols.

Obtain Necessary Permissions and Access

Ensure that the audit team has the required permissions, access rights, and security clearances to perform the audit effectively.
Coordinate with relevant departments or IT personnel to obtain necessary access to systems, databases, and facilities.

Finalise Audit Plan

Review and finalise the audit plan based on any additional insights or feedback received during the preliminary stages of audit planning.
Obtain approval from relevant stakeholders before proceeding with the execution of the audit.

Following these detailed steps for audit planning, the operational resilience audit can be conducted systematically and efficiently, setting the stage for a comprehensive assessment of the organisation's resilience capabilities.

Operational Resilience Audit Planning Steps

ORA Planning Level Data Collection Stage 2

ORA Planning Level Summarise Findings Stage 4

Find out more about Blended Learning ORA-5000 [BL-ORA-5] & ORA-300 [BL-ORA-3]

Please feel free to send us a note if you have any of these questions.

Moh Heng Goh

certification, Blended Learning, Operational Resilience Audit, ORAE, ORAS, ORA-5000, ORA-300

[ORA-5] What is an ORA-5000 Operational Resilience Expert Auditor Course?

Jan 7, 2024 7:15:45 PM

Overview of ORA-5000 Operational Resilience Expert Auditor [ORA-5] Course

While professionals generally still prefer to attend an onsite classroom-based course with a facilitator or instructor being present, (electronic) online video face-to-face workshop practices are fast gaining momentum as a participant prefer to acquire the learning over some time. The other preference is reducing travelling as remote work or attending courses in the office is becoming the norm.

The roadmap above is a snapshot of what you can expect from the programme. It is divided into the respective modules 1 to 4. Find each module's syllabus by clicking the four [Course Content] buttons. The content has been carefully crafted to ensure that your participation and outcome match each day of the ORA-5000 OR Audit Expert competency level.

Click any of the four buttons [Course Requirement] to learn more about your participation and involvement in this course.

The course fee is SGD 3,850 for 100% online and SGD 4,150 for online + onsite, payable before the class starts.

Module
Course Content
Course Requirement

Breakdown of the Time Spent

Module	Mode of Study	Flexible (Hours)	Mandatory & Fixed Timing (Hours)
	Online Self-pace eLearning (Eight 1-Hour Self Pace eLearning Classes)	1	8 (1-hour self-pace eLearning sessions)
	Facilitated Online Workshop (1 Hour Self-Reading + 6 Hours Scheduled Online Classes)	1	6 (3-hour x 2 separate sessions)
	Online Training and Discussion Workshop (2 Hours Reading/ Assignment + 3-Hour Schedule Online Classes)	2	6 (3-hour x 2 separate sessions)
	Online Training and Discussion Workshop (2 Hours Self Reading/ Assignment + 3 Hours Schedule Online Classes)	2	6 (3-hour x 2 separate sessions)
	Total Hours	6	24

	Attempt Qualifying Examination	Question	Duration
	Operational Resilience Audit Expert (ORAE) after ORA-5 course	100	2 and 1/2 hours
	Operational Resilience Audit Specialist (ORAS) after ORA-3 course	100	Completed during the Module 1 eLearning Module
	Operational Resilience Certified Planner (ORCP) after ORA-2 course	50	1 and 1/2 hours

Operational Resilience Audit for Financial Institutions

Post-COVID-19, various regulatory developments have impacted the financial services industry, such as refining the management of disruptions, increasing interconnectedness and third-party/ outsourcing dependencies and dependencies on IT. This emphasises that operational resilience will remain a significant concern for the board, regulators, policymakers, investors and customers.

The challenge is organizations' approaches to dealing with differing regulations globally. In terms of resilience structure, organizations have looked at their governance frameworks and ensured they are fit for purpose. They utilise stress and scenario testing to assess their capabilities, which is more than their existing business continuity and crisis management programs.

What are the Differences and Concerns?

Click the icon on the right to learn more about the difference between Blended Learning and Hybrid Learning offered by BCM Institute.

The entire process is redesigned with pre-reading (at your own time and pace) and preparatory work (rather than one hour doing the work in class) supported by proprietary guidance notes. In fact, after several cohorts, the content from those who had attended our other advanced-level courses highlights a better way to provide the same outcome.

Instructors: Note that instructors delivering the modules will remain the same as those providing the onsite training. At BCM Institute, most instructors still practise BCM and risk management professionals (in this case, operational resilience and operational risk) with a minimum of 12 years of direct BCM experience as they hold regional or global resilience responsibilities.

International Participation: Another significant change will be the participation of more international delegates compared to the traditional majority of Asian participants. Be expected to discuss and work as teams from around the world.

Be expected to have more pre-readings as the objective is to ensure that knowledge that could be acquired via reading should be done outside the training session. More time is allocated to sharing experiences between the participants and facilitators.

Schedule for Courses: This is the schedule and dates for the start of the next course. Click "ORA-5000 Course Calendar" to learn more about the "RUNs" for the year.

Find out more about ORA-5000 [ORA-5] & ORA-300 [ORA-3]



	Please feel free to send us a note if you have any of these questions.

Suhana Sunreh