---
title: [OR] [P3] [S5] What is Conducting an Independent Quality & Assurance Review in Operational Resilience?
description: [OR] [P3-S5] Conduct Independent Quality & Assurance Review in Operational Resilience?
image: https://blog.bcm-institute.org/hubfs/Operational%20Resilience%20OR/OR%20Diagram/OR%20Roadmap%20Diagram/Updated%20OR%20PM%20Diagram/OR%20PM%20%5B3%5D_Conduct%20Independent%20Quality%20Review.png
---
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Operational Resilience Planning Methodology "What Is? How To?" Series
# \[OR\] \[P3\] \[S5\] What is Conducting an Independent Quality & Assurance Review in Operational Resilience?
[![\[OR\] \[E2\] \[C19\] \[P3\] \[S5\] Conducting Independent Quality Review](https://no-cache.hubspot.com/cta/default/3893111/ce795037-24ce-4c90-afd2-5253ea9ebb4c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/ce795037-24ce-4c90-afd2-5253ea9ebb4c)[![\[OR\] \[BoK 15\] \[What Is\] Conduct Independent Quality Review](https://no-cache.hubspot.com/cta/default/3893111/2f2e1295-9ba0-492d-aa28-e923bc982463.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2f2e1295-9ba0-492d-aa28-e923bc982463)[](https://cta-redirect.hubspot.com/cta/redirect/3893111/c50d0125-94f5-4132-9e99-42632414f34f)Audit and assurance are significant parts of independent quality and assurance review.
They contribute significantly to achieving organisational objectives and creating value for shareholders and stakeholders, especially when implementing operational resilience.
This is the introductory blog \[OR\] \[P3\] \[S5\] to Stage 5 of the "SUSTAIN" phase of the OR Planning Methodology.
It is a pre-reading for participants attending the Operational Resilience Expert Implementer course.
[![\[OR\] \[Full Banner\] \[M4\] Pre reading for Participants](https://no-cache.hubspot.com/cta/default/3893111/230a731c-ff3f-45bd-bedb-13defd4dd6f6.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/230a731c-ff3f-45bd-bedb-13defd4dd6f6)
[Moh Heng Goh](https://blog.bcm-institute.org/operational-resilience/author/moh-heng-goh) Apr 8, 2023
###### Operational Resilience Certified Planner-Specialist-Expert
### [![\[OR\] \[E2\] \[C19\] \[P3\] \[S5\] Conducting Independent Quality Review](https://no-cache.hubspot.com/cta/default/3893111/ce795037-24ce-4c90-afd2-5253ea9ebb4c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/ce795037-24ce-4c90-afd2-5253ea9ebb4c)
### [![\[OR\] \[Banner\] \[What Is\] \[P3\] \[S5\] Conduct Independent Quality Review](https://no-cache.hubspot.com/cta/default/3893111/db7476f4-0299-4209-9fbe-901d82b1ea34.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/db7476f4-0299-4209-9fbe-901d82b1ea34)
### What is an** Independent Quality & Assurance Review?**
[![\[OR\] \[BoK 15\] \[What Is\] Conduct Independent Quality Review](https://no-cache.hubspot.com/cta/default/3893111/2f2e1295-9ba0-492d-aa28-e923bc982463.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2f2e1295-9ba0-492d-aa28-e923bc982463)[](https://cta-redirect.hubspot.com/cta/redirect/3893111/b655b64d-a554-4981-b9e5-5b839ac2d451)A significant part of the independent quality review (IQR) revolves around audit and assurance.
It contributes to achieving organisational objectives and creating value for shareholders and stakeholders, especially when operational resilience is implemented.
Therefore, it is essential to consider this combined assurance model, or the "Three Lines Model," adapted from the Institute of Internal Auditors (IIA, 2020).
The Three Lines Model, previously known as the "Three Lines of Defence", explains the relationship between the elements of an organisation’s assurance and independent review environment.
These include the governing body, board, executive management, board committees, external auditors, and regulators.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/1a6b6379-ed1d-4b18-ad6a-b1abf524571d)
Three Line Model
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a95777af-0036-479c-8f57-0f52ddb08108)[](https://cta-redirect.hubspot.com/cta/redirect/3893111/ac154dfb-994a-4ddb-bff0-8b5ba26e7236)First Line Role
The First Line involves managers and staff who own and manage risk.
It focuses on real-time risk management and the management of risks and controls.
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/e731a336-2803-4e0d-9b1b-62c01da11566)Second Line Role
The Second Line monitors risk. It incorporates functions that oversee or specialise in compliance or risk management.
It is mainly concerned with risk oversight and review of First-Line activities.
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/aa973397-820e-414f-9a39-6a8bca238a81)
#### Third Line Role
The Third Line assures the strategic management of risk and provides independent assurance beyond the First and Second Lines.
Its primary role is to evaluate the adequacy and effectiveness of the first two Lines.
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/63de76b9-f5fe-41e9-b3b2-dd47ca3b4879)
#### Fourth Line Role
Often called the Fourth Line, although it sits outside the Three Lines, external assurance plays a vital role in the organisation’s governance and risk management approach.
#### Looking Out for Weakness
The independent reviewer or auditors should consider potential red flags indicating weaknesses during the review.
These include:
- Lack of skills and understanding at senior levels
- Lack of substantiated analysis of essential and critical business services and the required resilience levels
- Limited data and unrealistic assumptions supporting scenario analysis and testing
- Limited/incomprehensive register of business services
- Limited/incomprehensive inventory of people, processes, technology, facilities and data (especially those relevant to critical services
- Overreliance on end-user computing
- Qualification, experience and the role of personnel involved in performing resilience arrangements (including analysis and design activities)
- Significant/unexplained fluctuations in probability assessments, disruptions and the potential impact
- Poor articulation and understanding of risk appetite and risk tolerances across the organisation
- Inflexible legacy infrastructure that is hard to fix and further complicated by adding ever more layers and systems to manage
- New regulations that increase operational resilience challenges (particularly regarding the risk of illegally sharing sensitive customer information).
[![\[OR\] \[Banner\] \[How to\] \[P3\] \[S5\] Conduct Independent Quality Review](https://no-cache.hubspot.com/cta/default/3893111/6569bd7c-7cf7-45ca-be19-06b712ed24df.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6569bd7c-7cf7-45ca-be19-06b712ed24df)
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c50d0125-94f5-4132-9e99-42632414f34f)How to Conduct an Independent Quality & Assurance Review?
An Independent Quality and Assurance Review (IQR) is an external validation of the operational resilience program's effectiveness in the sustain phase.
Here is a detailed breakdown of the steps involved:
#### Prepare IQR
- \[1-1\] Scope Determination. Identify the areas of your operational resilience program for review using the three-line model.
- This could encompass specific risks, critical processes, controls, incident response capabilities, or the entire program.
- **\[1-2\] Reviewer Selection**. Choose an independent reviewer with relevant expertise in operational resilience and risk management.
- This could be an internal audit team, external auditors, industry specialists, or regulatory bodies (depending on your chosen model).
- **\[1-3\] Review Criteria**. Establish clear criteria for the review based on industry best practices, internal standards, and regulatory requirements.
- **\[1-4\] Data Preparation**. Assemble relevant documentation, reports, test results, and other materials for the reviewer's inspection.
- **\[1-4\] Communication and Agreement**. Communicate the scope, objectives, and methodology of the IQR to the reviewer and obtain their agreement.
#### Conduct IQR
- **\[2-1\] On-site Review. ** Visit on-site by the reviewer to observe processes, interview personnel, and review documentation.
- **\[2-2\] Testing and Evaluation.** Assess the effectiveness of controls, incident response plans, and training programs through simulations or other testing methods.
- **\[2-3\] Data Analysis.** Compare the collected data against the reviewer's established criteria.
- **\[2-4\] Draft Report. ** Create a draft report summarising their findings, including strengths, weaknesses, opportunities for improvement, and recommendations.
#### Review and Report IQR
- **\[3-1\] Management Response.**Respond formally to the draft report, addressing the reviewer's findings and outlining an action plan for improvement.
- **\[3-2\] Final Report.** Finalise the report with your responses and recommendations for senior management consideration.
- **\[3-3\] Implementation of Action Plan.** Develop and implement a detailed action plan based on the IQR findings, with clear timelines, responsibilities, and resource allocation.
- **\[3-4\] Monitoring and Reporting.** Monitor progress on the action plan and report regularly to senior management on its effectiveness.
[![\[Banner\] \[Summing\] \[OR\] \[E2\] \[C19\] Conducting Independent Quality Reviews](https://no-cache.hubspot.com/cta/default/3893111/c8a957a9-acb3-45ed-98ab-290e94e02707.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/c8a957a9-acb3-45ed-98ab-290e94e02707)
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/03e3e5c5-5fae-4b56-9821-8fbd1a1b4725)
| | **Definition** | **Explanation** | **Definition** | |
| --- | --- | --- | --- | --- |
| | ** Independent Review ** | is a critical assessment of the operational resilience project or programme conducted by qualified and objective individuals (or reviewers) at arm’s length from the project/programme. Such a review supports enhanced OR project/programme decision-making and oversight by applying expert analysis and providing impartially obtained evidence. | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/dd924818-f421-40a0-8c74-750bc9a2afae) | |
| | **Internal Audit** | individuals operating independently from management to provide assurance and insight into the adequacy and effectiveness of governance and risk management, including internal control. | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/0a5059e1-f75a-445e-8904-e48071974af5) | |
| | **External Audit** | is an examination conducted by an independent accountant. This type of audit is most commonly intended to result in certification of an entity's financial statements. | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/11ce8c92-c6e6-48f1-a4dd-09ac1bb9f62f) | |
| | **Risk Oversight** | describes the board’s role in the risk management process | | |
| | **The Three Lines Model** | The model is previously known as the "Three Lines of Defence." | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/1a6b6379-ed1d-4b18-ad6a-b1abf524571d) | |
| | | | | |
Reference: IIA. (2022). IIA's Three-Line Model, The Institute of Internal Auditors, Inc
##### "Sustain" Phase of the OR Planning Methodology
| **Introduce Culture Change Management** | **Develop Communication Strategy** | **Implement Training and Awareness** | **Provide Self-assessment** | **Conduct an Independent Quality Review** | |
| --- | --- | --- | --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3668f599-8d2a-44e3-882d-b1219d30cdd7) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/9e169987-fcde-4b09-afd3-aa01a6ebe9b3) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c1f2028b-0c55-4571-81b2-54220525cb6b) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/02aa5bbf-4770-457a-abc2-ea8ae897fb1f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/b655b64d-a554-4981-b9e5-5b839ac2d451) | |
#### More Information About Blended Learning OR-5000 \[OR-5\] or OR-300 \[OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-3 Blended Learning OR-300 Operational Resilience Implementer course and the OR-5 Blended Learning OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/32739296-1993-4215-8dbf-5b3e1caa8f40) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments**
### More Posts
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/d41714c9-8019-4282-95bf-08d62ddc4710)
All rights reserved. Copyright 2026