During a business continuity audit, an IS auditor discovers that a business impact analysis (BIA) was not conducted. What should the auditor do FIRST?
The IS auditor's role is to assess and report on risk, not to perform the missing control activity itself. Because the BIA is the foundation for defining recovery time objectives, recovery point objectives, and critical resource requirements, the absence of a BIA represents a control gap whose significance must first be evaluated in terms of its effect on the organization's ability to recover from a disruption. This evaluation determines the severity of the audit finding and the appropriate recommendation. The auditor should not perform the BIA themselves, as this is a management function and doing so would compromise auditor independence; compliance testing and regulatory notification are not appropriate initial responses to this type of gap.
Community Discussion