...Audit of Business Continuity Planning (BCP) Final Audit Report Audit and Evaluation Branch June 2006 Tabled and approved by DAEC on January 9, 2007 Audit of Business Continuity Planning (BCP) Industry Canada (IC) TABLE OF CONTENTS 1.0 EXECUTIVE SUMMARY .............................................................................................. 2 1.1 INTRODUCTION ................................................................................................................ 2 1.2 OVERALL ASSESSMENT.................................................................................................... 2 1.3 MAIN FINDINGS, CONCLUSIONS AND RECOMMENDATIONS ............................................. 2 1.3.1 Business Continuity Plan Governance (See Section 3.1 of the BCP Standard) ......... 2 1.3.2 Business Impact Analysis (See Section 3.2 of the BCP Standard).............................. 3 1.3.3 Business Continuity Action Plans and Arrangements (See Section 3.3) .................... 4 1.3.4 BCP Program Readiness (See Section 3.4 of the BCP Standard) .............................. 5 1.3.5 BCP Training and Awareness (See Section 3.4 of the BCP Standard) ...................... 5 2.0 INTRODUCTION............................................................................................................. 7 2.1 BACKGROUND .................................................................................................................. 7 2...
Words: 5659 - Pages: 23
...between a risk analysis (RA) and a business impact analysis (BIA)? Any business uses resources, be it people, systems, money or information. These resources are all to a certain extent exposed to risks, and a risk analysis is supposed to give a comprehensive list of relevant risks. The resources are used by the business however, so losing a resource has a business impact. A Business Impact Assessment analyses the effects of the loss of a resource and hence the risk. 2. What is the difference between a Disaster Recovery Plan and a Business Continuity Plan? A Business Continuity Plan describes a set of procedures your company will use to continue critical business operations in the event of disruption (of those specific and/or all critical business operations). For instance, if the ability to take phone calls is a critical business operation (i.e. maybe you run a help desk), then you may define, in your BCP, what may cause a phone interruption, and what procedures you would take to respond to it. Conversely, as stated by Massimo, the Disaster Recovery Plan (DRP) is a subset of your BCP. The DRP specifies the further reaching implications of disaster -- where your primary place (or all places) of business are uninhabitable. Not only is this relevant to your place of business, but your workforce as well (Workforce Continuity). 3. Typically, a business continuity plan is also a compilation or collection of other plans. What other plans might a BCP and all supporting...
Words: 354 - Pages: 2
...Discussion: Business continuity plan Discussion: Business continuity plan A business continuity plan (BCP) is a practice adopted by the university to ensure continuity in their services and business unit processes in cases of disruptions preventing normal procedures from taking place (Latha, 2003). These disruptions may be in the form of threats such as earthquakes, fires or pandemics like the Ebola crisis. The main objectives of the BCP are to maintain, resume and recover all of the activities of the university as a whole unit implementing both the human operational factors (Ken, 2000). All the university departments are involved in the development of the BCP and as a team conduct a risk assessment and business continuity plan (Latha, 2003). In case the university cannot handle an emergency situation using routine measures, the president implements an emergency plan. The university’s incident command section comprises of the safety officer and emergency operations executive who oversee the emergency operations. The planning section coordinates responsibilities of planning and intelligence while the finance section keeps a record of all purchases and report making. The university business impact analysis (BIA) analyzes the critical functions that affect the health and safety of university staff and students. It also analyzes the critical functions that influence the continuity of the university. The functions of the BIA are prioritized and respective downtime estimated...
Words: 483 - Pages: 2
...– aSSESSmENt WORKSHEEt Perform Business Continuity Implementation Planning Course Name and Number: Student Name: Instructor Name: lab due date: 6 Perform Business Continuity Implementation Planning Overview In this lab, you were asked to begin the business continuity planning process for an e-commerce company, Online Goodies. You reviewed the key business functions and a prioritized list of impacted IT systems, applications, and data provided by your supervisor. You also compared the components of the major documentation required by the business continuity planning process: risk analysis, business impact analysis, business continuity plan, disaster recovery plan, and the business continuity implementation plan. Lab Assessment Questions & Answers 1. What is the difference between a risk analysis (RA) and a business impact analysis (BIA)? Risk analysis is often identifying the potential threats and the associated vulnerabilities to the organizations .Risk analysis doesn’t view the organization from the mission critical Business Process point of view. BIA the organization from the impact that is going to occur for an organization if the critical business processes are interrupted or tampered 2. What is the difference between a disaster recovery plan (DRP) and a business continuity plan (BCP)? Disaster recovery plan is have a full access to recover any lost data or essentials after a disaster while the business continuity is having what ever bare bones essentials...
Words: 681 - Pages: 3
...IA2: Business Continuity Plan for Information Technology CSEC 650 University of Maryland University College Abstract Business contingency and continuity of operations plan are vital to business, especially those reliant on digital media. Whether through nature events or the more likely interruption of computer systems and networks, a disruption of any type is a serious business concern. A disruption can harm operational revenue, services, supply-chain, and reputation. Any of the preceding effects from a disruption could possibly be severe enough to mean the end of business as a going concern. To avoid severe or long term damaging disruption, a comprehensive contingency plan can provide a guide for how resources and personnel will be allocated in the event of a crisis. Keywords: Business Continuity Plan (BCP), Information Technology, contingency plan Table of Contents Business Continuity Plans 4 Planning Steps 5 Business Impact Analysis 6 Recovery Strategies 8 Data Backup 10 IT Personnel Training 10 Alternate Site 11 Contingency Plan Development 12 Training and Testing 13 Recommended Training and Testing 14 Test Schedule 15 Summation 17 References 18 Business Continuity Plans Greater numbers of businesses now must consider the protection of their computer information systems as a vital aspect of their operations. Even as organizations became ever more reliant on computer systems over the past several decades, information technology (IT) contingency planning was not...
Words: 4274 - Pages: 18
...d M a n u a l s Operational Risk Management and Business Continuity Planning for Modern State Treasuries Ian Storkey Fiscal Affairs Department I N T e r N A T I o N A l M o N e T A r y F U N D INTerNATIoNAl MoNeTAry FUND Fiscal Affairs Department Operational Risk Management and Business Continuity Planning for Modern State Treasuries Prepared by Ian Storkey Authorized for distribution by Sanjeev Gupta November 2011 DISCLAIMER: This Technical Guidance Note should not be reported as representing the views of the IMF. The views expressed in this Note are those of the authors and do not necessarily represent those of the IMF or IMF policy. JEL Classification Numbers: Keywords: H12, H60, H63, H83 business continuity, disaster recovery, business continuity and disaster recovery plan, operational risk, operational risk management, treasury operations ian@storkeyandco.com Author’s E-Mail Address: TECHNICAL NoTEs ANd MANUALs Operational Risk Management and Business Continuity Planning for Modern State Treasuries Prepared by Ian Storkey This technical note and manual (TNM)1 addresses the following main issues: • What is operational risk management and how this should be applied to treasury operations. • What is business continuity and disaster recovery planning and why it is important for treasury operations. • How to develop and implement a business continuity and disaster recovery plan using a six practical-step process and how to have it...
Words: 10882 - Pages: 44
...BUSINESS CONTINUITY PLAN (BCP) Business Continuity Plan (BCP) American Public University Instructor: Jenelle Davis, MS, CISSP, CISM, CISA, CSSLP September 12, 2014 Business Continuity Plan (BCP) The word Business continuity Planning is a plan that is used by businesses of all kinds in order to maintain a complete company presence for any and all customers new and old alike it will help a company in the event of a small incident all the way thru a big catastrophe for example if the company has a power outage and can’t get the systems up with a business continuity plan it would have a reasonable temporary solution for the temporary problem in order to keep the company running ,business as usual, by having a back-up generator that would have power delivered to the building and get all the systems that run on electricity back up and running until the power can be fixed or replaced on a permanent basis, this can also apply to situations that cause a more long term or permanent setback for a company and even in that instance a business continuity plan can be used as well again if the situation is more dire and the company had a problem like lead paint or asbestos or even something of a structural...
Words: 779 - Pages: 4
...restoration of business ops if significant disruptions occur BCP and DRP BIA stands for Business Impact Analysis MTD stands for Maximum Tolerable Downtime first step in building BC program Project initiation and management activites of project initiation and mgmt 1) obtain senior mgmt support 2) define a project scope, the objectives, to be achieved and planning assumptions 3) estimate the project resources needed (human and financial) 4) Define a timeline and major deliverables Senior leadership's two major goals 1) Grow the business 2) Protect the brand What are the risk to a corporation for not having BC/DRP? 1) Financial 2) Reputational 3) Regulatory Formula for calculating financial risk P * M = C P: Probability of harm M: Magnitude of harm C: Cost of prevention Prudent man rule exercise the same care in managing the company affairs as in managing one's own affairs 1. Which of the following is considered the most important component of the enterprisewide continuity planning program? c. Executive management support 2. During the threat analysis phase of the continuity planning methodology, which of the following threats should be addressed? a. Physical security b. Environmental security c. Information security d. All of the above d. All of the above 3. The major objective of the business impact assessment process is to: a. Prioritize time-critical business processes b. Determine the most appropriate recovery time objective for business processes c...
Words: 2067 - Pages: 9
...Assessment Worksheet Perform Business Continuity Plan Implementation Planning Course Name & Number: ______________________________________________________________ Student Name: _______________________________________________________________________ Instructor Name: _____________________________________________________________________ Lab Due Date: _______________________________________________________________________ Overview The instructor will lead the class in discussions pertaining to a business continuity plan. Key elements of a business continuity plan starting with a risk analysis, business impact analysis, and alignment of critical business functions and processes will be discussed. Students will craft a business continuity implementation plan outline as part of this lab’s deliverables. Lab #6 Assessment Questions & Answers 1. What is the different between a risk analysis (RA) and a business impact analysis (BIA)? 2. What is the difference between a Disaster Recovery Plan and a Business Continuity Plan? Copyright © 2013 Jones & Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com -58All Rights Reserved. Current Version Date: 02/11/2012 Student Lab Manual 3. Typically, a business continuity plan is also a compilation or collection of other plans. What other plans might a BCP and all supporting documents include? 4. What is the main difference between a Disaster Recovery Plan (DRP) and a Business Continuity Plan (BCP)? 5. What is the purpose...
Words: 380 - Pages: 2
...between a risk analysis (RA) and a business impact analysis (BIA)? a. Risk assessment (RA) is a structure discipline that must discover the threats, vulnerabilities, and values of an organization’s assets. A key factor in risk assessment is the determination of the likelihood of an adverse event affecting an Organization, process, or system. Risk assessment is a valuable tool to help the organization recognize itself threat environment and ensure that the steps are undertaken to minimize the resulting risks to an acceptable level. b. Business Impact Analysis (BIA) is the key to a successful BCP implementation. Understanding and standardizing Enterprise business process names is critical to the success of the BIA. The intent of the BIA process is to help the organization’s management appreciate the magnitude of the operational and financial impacts associated with a disaster or serious disruption. When they understand, management can use this knowledge to calculate the recovery time objective (RTO) for time-critical support services and resources. For most Organizations, these support resources include: Facilities - IT infrastructure (including voice and data communications networks) - Hardware and software - Vital records Data - Business partners The connection is made when each of the time-critical business processes is mapped to the above supporting resources. 2. What is the difference between a disaster recovery plan (DRP) and a business continuity plan (BCP)? a. Disaster...
Words: 966 - Pages: 4
...University Continuity Planning Overview CIS-359: Disaster Recovery Management October 29, 2015 Introduction: This paper will briefly expound upon the lead position or manager’s role, of a healthcare company. It will provide a list of responsibilities a business continuity manager is expected to perform, how to build the framework for, and execute a business continuity plan, and also display a chart that pertains to giving a BCP presentation. Explain four high-level activities that aid in the initiation of a viable, business continuity plan. The role of an experienced business continuity manager in a healthcare business must identify and implement all of aspects of the business’, business continuity plan or BCP. To remain in accordance with the BCP, in preparation for disaster, from the start date, while it is in ongoing stages, and also afterward. Business continuity managers, work directly and strategically with the in-house BCM (Business Continuity Management) division, the business owner, and also the BCM’s, guidance and/or steering committee. They are expected to supervise, utilize paramount communication skills, monitoring the efficiency and progress of those team members and/or subordinates, who report directly to the, business continuity manager. In a healthcare environment, an efficient and thorough business continuity leader, structures accountability framework, by working close-knit with the business’ IT department, existing business managers...
Words: 1125 - Pages: 5
...LAB 6 What is the difference between a risk analysis (RA) and a business impact analysis (BIA)? Risk analysis is a technique to identify and assess factors that may jeopardize the success of a project or achieving a goal. Business continuity planning "identifies an organization's exposure to internal and external threats and synthesizes hard and soft assets to provide effective prevention and recovery for the organization, while maintaining competitive advantage and value system integrity”. In addition to some disagreement among business continuity professionals regarding the BIA and risk assessment definitions and outcomes, disagreement also exists regarding the order of execution: whether it is best to perform the risk assessment before, during, or after the BIA. While many professionals argue that it is best to perform the risk assessment before the BIA to establish the risk landscape in which the organization operates, Evaluation argues the opposite. What is the difference between a Disaster Recovery Plan and a Business Continuity plan? A disaster recovery plan is a documented process or set of procedures to recover and protect a business IT infrastructure in the event of a disaster. Such plan, ordinarily documented in written form, specifies procedures an organization is to follow in the event of a disaster. Business continuity planning "identifies an organization's exposure to internal and external threats and synthesizes hard and soft assets to provide effective prevention...
Words: 1291 - Pages: 6
...ISS 310 Mr. Behboodi CCSD Business continuity Plan Assignment 2 03/22/2016 The business continuity planning (BCP) is the creation of a strategy through the recognition of threats and risks facing a company, with an eye to ensure that personnel and assets are protected and able to function in the event of a disaster. When business is disrupted, it can cost money. Lost revenues plus extra expenses means reduced profits. Insurance does not cover all costs and cannot replace customers that defect to the competition. This strategy can be comprised of a basic 4 part setup with an array of sub categories within these guidelines. The type of business that I will be making a mock example for would be an IT business. This paper will also explain the composition of the 4 parts of a BCP. The battle plan. Consisting of 4 parts, Business impact analysis, plan development and testing and Exercises. Part 1 the business continuity impact analysis picks up on the problems resulting from negative effects of a normal business function and processes. This makes it easier to fix and rectify the problem down the road. Also conducting a workshop to instruct business function and process mangers how to complete the business impact analysis. Once finishing a basic training for management level employees, conduct follow up...
Words: 527 - Pages: 3
...CheckPoint: Business Continuity Plan The steps involved in the Business Continuity Plan (BCP) include identification of the scope and boundaries. This mean to determine the critical aspects of the business that need to be part of the plan by analyzing people, facilities, IT systems, and risks. The second step is to create a Business Impact Assessment (BIA) as a result of the step one analysis. The third step is once the BIA is complete those who are responsible must present to senior management and cell the concept of the BCP. The last step is once the BCP is approved is to present it to all necessary departments making sure they understand all of the components. The purpose of a BCP is to prepare businesses in the event of disaster. This plan will provide employees with detailed instructions and backups in the event of an emergency. This is a great concept because in the event of disaster, companies will have reduced panic and knowledge of exactly what to do and how to carry on with business despite the circumstances. The case study I chose to read was “SunGard Helps Keep Atlantis health Plan’s Business in Business after Disaster Strikes.” This case study talked about how a disaster recovery company named SunGard helped Atlantis Health through their disaster. The two companies began working with each other after the 9/11 attacks in New York, when Atlantis Health had no BCP. After getting that situation under control the companies developed a plan in the preparation...
Words: 324 - Pages: 2
...through the recognition of threats and risks facing a company, with an eye to ensure that personnel and assets are protected and able to function in the event of a disaster. Business continuity planning (BCP) involves defining potential risks, determining how those risks will affect operations, implementing safeguards and procedures designed to mitigate those risks, testing those procedures to ensure that they work, and periodically reviewing the process to make sure that it is up to date. 2.When a business continuity plan is correctly used it can help reduce operational risks. Operational risk is the risk of loss experienced from internal processes as a result of external events. These internal processes could have failed completely or simply been inadequate. This does include calculating the legal risk as well but does not take into account business risk that is based in strategy or reputation. Some examples of operational risk are losses arising because of internal or external frauds, natural disaster, failed transaction processing or inability to meet the commitment of service, and the disruption of business or system failures. 3.There are many different approaches to BCP and DRP. Some companies address these processes separately, whereas others focus on a continuous process that interweaves the plans. The National Institute of Standards and Technology 4.The degree of spread of Ebola in the months ahead is uncertain. In the unlikely event of a worst- case scenario...
Words: 1432 - Pages: 6
