Planning for and surviving a BCM audit

Business continuity management (BCM) is moving progressively higher up the agendas of boardroom executives due to growing regulator, insurer and investor interest in risk management and BCM activity. With increasing pressure across all sectors, BCM has become an integral part of any effective corporate governance framework. Boardroom executives and senior management are thus now expected to provide an appropriate level of business continuity preparedness to better protect shareholder, investor and other stakeholder interests. The purpose of this paper is to build a link across the 'chasm' that separates the auditee from the auditor. The paper attempts to illuminate understanding about the process undertaken by an auditor when reviewing the BCM process. It details the steps the BCM auditor typically undertakes, and provides practical guidance as to the types of documentation and other supporting evidence required during the process. Additionally, the paper attempts to dispel commonly-held misconceptions about the BCM audit process. Executives, senior management and BCM practitioners will all benefit from the practical guidance offered in this paper, to assist in planning for and surviving a BCM audit.