Rothstein Home: Your Source for Disaster Recovery, Business Continuity Books, Service Level Agreements & More Rothstein: Management Consulting Services Rothstein: Business Survival Newsletter Rothstein: Original Feature Articles Rothstein: Disaster Recovery Forum Rothstein: Today's Industry News Rothstein: Links to Industry Web Sites Contact Rothstein Associates

Who Pays the Piper?
Auditing the Business Continuity
Management Funding Structure

Disaster Recovery & Business Continuity & Contingency Planning & Disaster Prevention Bookstore
Service Level Management & Service Level Agreements Bookstore

by  Rolf von Roessing, MBCI, CISA, CISSP

The “whose budget” syndrome in business continuity management has been a
hotly debated issue for some time. For the BCM auditor, the question of funding a corporate continuity process or program looks insignificant at first sight. In terms of adequacy of funding, there are no immediate difficulties - quite simply add up the numbers, and match them against typical benchmarks such as turnover, profit before tax, or any other predefined criteria. A closer look reveals that the funding (and therefore sponsorship!) structure for business continuity often leads to a hidden organizational bias.

      Imagine a corporate BCM department funded by the (much larger) IT budget. Whatever they tell you - the auditor - can you be sure that people address BCM as
a strategic initiative? How many senior IT people does it need to give it that little extra push towards IT disaster recovery, an area where they are more experienced and willing to spend money? Conversely, what would you expect when auditing a corporate BCM program that is run by the risk management and insurance people? Typically, their notion of a disaster might be a class action rather than a technological problem.

      As an auditor, one of your responsibilities will be to balance these diverse interests and give an impartial, true and fair opinion on the BCM program you are reviewing. Funding, although an important part of the overall BCM process, is a prerequisite to planning and maintaining business continuity, but it should not be the dominant factor in shaping the contents of business continuity. BCM addresses the going concern assumption, and it should be treated accordingly in your audit report.

Rolf von Roessing is the author of AUDITING BUSINESS CONTINUITY:
GLOBAL BEST PRACTICES

 

Copyright (c)2004, Rothstein Associates Inc. All Rights Reserved.

Back to Top

Site Map | The Rothstein Catalog on Disaster Recovery | The Rothstein Catalog on Service Level Books

Contact Us | Management Consulting Services | Business Survival Newsletter | Original Feature Articles

Disaster Recovery Forum | Today's Industry News | Links to Industry Web Sites | ‘Keep Me Posted’ | Privacy Policy

 

E-mail Rothstein Associates Inc.