Top Tips for Producing a BCMS Audit Programme

An internal auditor should add value to a Business Continuity Management system (BCMS) and should drive continual improvement. Ultimately, that is why we audit against a standard - to improve business continuity within our organization. Having auditors within the organization can allow for opportunities for improvement to be identified and implemented quickly, meaning the business embeds improvement as best practice.

Read my top tips on producing a BCMS Audit Programme below.

1. Define your scope - As auditors we can be obsessed with scope and spend a lot of time ensuring that the scope is correct on the certificate. If your scope is less than the whole organization, then you should have a think about how to define your scope further.
2. Make sure you use the correct company terms or terminology from standards - Rather than using terminology such as ‘Directors of the company’ or ‘Vice Presidents’, use language that is consistent across the business or terminology from ISO 22301, such as’ Top Management’ to allow ease of understanding.
3. Understand the link between non-conformity and an opportunity for improvement - A non-conformity means you have not met the requirements of the standard. Either you have not conformed with one of the clauses or not met your own requirements e.g. not updated your plans every six months. This presents an opportunity for improvement for the business as conformity = best practice.
4. Know when to dig deeper - If you are struggling to rectify a non-conformity you should carry out a root cause analysis. This will enable you to decide what you are going to do to in terms of corrective action, who is going to do it and when it will be done. Finally determine what steps you are going to take in future to ensure that the corrective action is effective.
5. Nominate your internal communicators - You need to state who is going to report to top management on the state of business continuity within the organization. If you have a sponsor for business continuity, the role of briefing top management needs to be stated within their responsibilities to ensure communication is timely and effective.
6. Working with consultants and third parties - If you work with a third party or consultant you need to make sure that your organization is involved and well informed and that all the business continuity knowledge and best practice does not reside within the third party or consultant.
7. Know your timelines - It is encouraged to do your internal audits 2-3 months before the external audit rather than the week before. Make sure you plan your auditing timeline into existing workloads and diaries to avoid last minute changes.
8. Make documents readily available – To avoid incorrect information being provided, decide in advance how you will store and file all the documents for the audit. Consider electronic access and ensure all relevant employees know how to access and source the information.
9. Review your internal standards - During the development of your BCMS you will have developed internal standards which should be updated every six months. It is a good idea to have a checklist of these internal standards and monitor them throughout your management review.
10. Look back at clause 9.3 - In clause 9.3 of the standard there is a list of items which should be considered as part of the management of the BCMS. With experience I have put them within the management review and used them as a checklist to go through each time a management review was conducted.
11. Train your staff - Make sure when you are carrying out awareness training for staff that the message is clear and concise. This makes it much easier for employees to recount the key messages to the auditor.
12. Aim for certification - Finally, I still strongly suggest that if you want to do business continuity properly and want to truly embed it within your organization, you go for ISO 22301 Certification.