There are many ways an organization can prepare for a business continuity audit. Experts predict that regulatory scrutiny and compliance risks are going to intensify. Regulatory change costs organizations the most, with the financial services sector experiencing the most disruption. Keeping your business compliant with industry regulations is key to its longevity. Besides, disobeying compliance standards will most likely lead to costly fines.
For example, 41% of firms say they can activate their business continuity (BC) plans inside the “Golden Five Minutes.” This percentage is an improvement over 32% in the previous year.
Today, more employees work remotely. About 75% of firms take advantage of business continuity software-as-a-service (SaaS) technology.
In part, this circumstance exists because firms can deploy SaaS quickly. Also, the technology allows them to perform incident management seamlessly. However, there’s more than technology to effective business continuity and risk management.
To learn more about preparing for a business continuity audit with the FFIEC handbook, continue reading.
The Standard for Business Continuity
Firms are getting better at business continuity activation due to the increased industry demand for a centralized SaaS platform.
With the emergence of COVID-19, Agility Recovery has seen increased customer activity in requesting help with business continuity testing and incident management. Also, the pandemic has highlighted the importance of business continuity planning.
The Federal Financial Institutions Examination Council establishes (FFIEC) continuity guidelines. The council usually publishes its guidelines in the Information Technology Examination Handbook. You may have heard this guide called the IT handbook. However, this year the FFIEC has renamed the guide Business Continuity Management.
The FFIEC change points to changing priorities and new expectations for member firms. Consequently, the update is generating considerable interest among banks and other financial institutions. Accordingly, those in the financial space must be prepared for a future business continuity plan audit. Compliance, IT, and risk leaders should know about the updated guide for this reason.
The FFIEC has issued Business Continuity Management to address institutions’ growing reliance on SaaS. These resources might include cloud-based services and other third-party IT resources.
SaaS resources also outsource part of their IT infrastructure. Resultantly, their resources are also interconnected. SaaS resources are also ripe for interruptions such as outages, cyberattacks, and data breaches. Furthermore, the risks associated with this interconnectivity are in constant flux. This circumstance creates a challenge in maintaining business continuity.
Getting Into Business Continuity Planning
Business continuity management can serve as an effective guide. It will help you meet the challenge of a continually evolving digital space. The guide is beneficial for both financial and non-financial organizations.
Financial institutions, however, must prepare for a business continuity audit. The Business Continuity Management Handbook offers guidance in this regard.
Positioning for a Business Continuity Audit
There are a few steps organizations need to take to prepare for a business continuity audit. BC Management outlines the steps in Appendix A.
Appendix A is an important part of the BC Management handbook. A firm should treat Appendix A as BCP audit preparation requirements. However, there are a few steps that firms should take before working through the appendix.
Firstly, you’ll need to determine what the FFIEC will audit. Next, you need to gather relevant information. This information includes BC plans, impact analyses, risk assessments, and other relevant information.
You’ll also need to identify subject matter experts. These individuals will participate in the audit and answer auditor questions. Additionally, identify areas for which no evidence is available. In this regard, you’ll need to explain why there’s no evidence available. Conversely, you can find usable alternative evidence.
Walking Through the Steps
Appendix A of Business Continuity Management contains 13 steps. These are the steps the auditors will take. They’re also helpful for preparing for an audit.
Step 1: Determine the Scope of the Audit
First, you’ll want to gather various documents based on interviews with senior management. You’ll also want to collect information based on the identification of new threats and vulnerabilities.
Step 2: Assess Whether Senior Management Promotes Governance of BC
For this step, you’ll need to consult with senior management. You must determine the role of senior management in BC. Also, you must assess how much they support your continuity initiative.
Step 3: Assess Whether Senior Management Performs Audits to Validate BC
You want to review whether your organization has performed any BC audit activity. If so, you want to review the results of that activity.
Step 4: Evaluate Whether Senior Management Developed a Sustainable Business Impact Analysis
For this step, you’ll want to look for evidence of developing a business impact analysis. You’ll also want to determine whether the results are used to improve BC activities.
Step 5: Determine Whether Management Conducted a Risk Assessment
Now, you want to look for evidence of a risk assessment to identify and mitigate potential risks. The risk assessment should evaluate possible threats and vulnerabilities.
Step 6: Evaluate Whether the Current Risk Management Strategy Promotes Resilience
Here, you want to look for evidence of resilience. You also want to look for recoverability capabilities within your organization. These abilities may include multiple data centers, multiple offices, or cloud-based technology.
Step 7: Determine Your Organization’s BC Communications Protocols
During this step, you’ll want to look for evidence of regular communication with other groups. These groups may include lawmakers and law enforcement. They can also include emergency responders as well as state and local agencies.
Step 8: Assess the Appropriateness of Organizational BC Activities
Here, you want to look into the extensive details of your business continuity plan. It’s essential to make sure that they’re complete and account for a variety of possible events.
Step 9: Determine Training and Awareness Surrounding BC Activities
Now, you want to look for evidence of training programs for emergency team members, employees, and senior management. You’ll also need to look for evidence of programs to inform employees about the BC program’s importance and their roles in this regard.
Step 10: Determine Whether Your Organization’s Exercise and Testing Program Satisfies Your BC Objectives
At this stage, you want to examine evidence of exercise and testing activities. You’ll also want to assess post-exercise reports and proof. More importantly, you want to know if these activities result in improvements in your program.
Step 11: Determine if Management Continually Measures BC Program Effectiveness
Now you want to assess whether management reviews and updates your BC program so that they’re consistent with current operations. You’ll also want to look for evidence of activities that support the maintenance and improvement of a business continuity program.
Step 12: Assess Whether the Board Has Established Expectations for BC Reporting
Now, you want to evaluate whether senior management expects periodic reporting of BC activities. These activities might include staffing changes or updates to the business impact assessment.
Step 13: Discuss Corrective Action and Communicate Findings
Finally, you’ll want to address the reporting of audit findings and plans for implementing corrections. You’ll also want to address the preparation of work papers. This information may include documents that contain audit findings and analyses.
A Business Continuity Plan in Action
In the last week of August 2020, Hurricane Laura hit southern Louisiana. Hurricane Laura was a Category 4 storm. It was one of the most powerful storms to strike the Gulf Coast in decades.
The hurricane impacted downtown Lake Charles, Louisiana, severely. It left widespread destruction in its path.
Ahead of the storm, however, Gulf Coast Bank reached out to the Agility Recovery hotline. The bank needed a thorough recovery plan quickly in case the coming storm impacted its branches.
When the Gulf Coast Bank team returned to Lake Charles, they found that this was indeed the case.
Soon after the initial contact, Agility deployed a mobile banking center. The firm also supplied a mobile recovery center.
The center included components such as onboard safes and teller under counter units. It also had a security system. Besides, it included a lobby and teller stations to provide for the needs of the bank.
Agility planned, coordinated, and deployed these resources in less than 24 hours.
The Agility team worked around the clock for two straight days. By doing so, the team set up the mobile center and trained personnel in its use.
Ultimately, we helped Gulf Coast Bank fulfill its mission to protect people. We also helped them to fulfill their commitment to the community.
Prepare for the Unexpected with the Right Partner
Now you know more about how to prepare for a business continuity audit with the FFIEC handbook.
For more than 30 years, Agility has partnered with banks and financial institutions. During that time, we’ve provided for their unique continuity needs.
We specialize in engineering custom-tailored recovery services. With them, we can help you achieve your desired business outcomes.
It’s our mission to help you meet your business challenges. What’s more, we’re dedicated to delivering quick, flexible, and cost-effective business continuity solutions.
