Audit and assessment of your BCM system

Creation of an audit plan

Creating an audit plan as part of business continuity management (BCM) is an essential step in ensuring the resilience and continuity of a company in the event of a crisis. Our audit plans cover several key aspects:

• Objectives and scope: We work with you to define the specific objectives of the audit, such as assessing the effectiveness of BCM measures and identifying weaknesses. The scope should cover the relevant processes, systems and departments of the company.
• Risk assessment: We carry out a comprehensive risk assessment with you to identify potential threats and vulnerabilities. This helps to prioritise the audit process.
• Audit methodology: We select suitable methods for collecting and analysing data for you, such as interviews, document reviews and observations. A combination of these methods ensures a well-founded assessment.
• Resource allocation: We support you in identifying the resources required, including personnel, time and budget, to effectively implement the audit plan.
• Reporting and follow-up: We work with you to determine how the results of the audit are documented and communicated and develop a plan with you for following up on the identified measures for continuous improvement.

A well-structured BCM audit plan not only helps to fulfil legal requirements, but also strengthens the trust of customers and other stakeholders in the company's crisis management capabilities.

Audit performance

Conducting a business continuity management (BCM) audit is a crucial process for evaluating the effectiveness and efficiency of existing BCM measures. Our process can be broken down into these key steps:

• Preparation: In the preparation phase, we work with you to determine the scope of the audit and the relevant stakeholders are informed. This includes putting together the audit team and drawing up a detailed audit plan that includes objectives, time frame and methodology.
• Document review: A thorough analysis of the existing documentation is essential. This includes BCM strategies, emergency plans, risk analyses and previous audit reports. This documentation provides valuable insights into the existing processes and their implementation.
• Data collection: In this phase, relevant data is collected through interviews with your employees, observations of exercises and simulations, and process reviews. This information is crucial for us to assess the actual implementation of the BCM measures.
• Analysis and evaluation: We analyse the information collected in order to evaluate the effectiveness of the BCM measures. Key performance indicators (KPIs) are used to determine whether the objectives have been achieved and where there is potential for improvement.
• Reporting: Once the audit has been completed, our audit team prepares a report summarising the results, highlighting any weaknesses identified and, if necessary, providing specific recommendations for action. This report is presented to the relevant stakeholders to ensure transparency and accountability.

By systematically carrying out a BCM audit, companies can ensure that they are prepared for potential crisis situations and can maintain their business processes even in difficult times.

Evaluation & action planning

After reporting, a follow-up plan is developed to ensure that the recommended measures are implemented promptly. This promotes the continuous improvement of the BCMS in accordance with the PDCA cycle.  

• Identification of weak points: Once the audit has been completed, the collected data and observations are thoroughly analysed by our experts. This involves identifying both the strengths and weaknesses of the existing BCM measures. Based on this, specific weaknesses and potential for improvement can then be identified. This may include, for example, the need for updates to the emergency plans, better employee training or the implementation of new technologies to support BCM.
• Determination of audit measures: The next step is to work with you to plan specific measures to rectify the identified weaknesses. These measures should be formulated SMART (Specific, Measurable, Attractive, Realistic, Timed) in order to facilitate implementation and make progress traceable.
• Assignment of responsibilities: Clear responsibilities are defined for each measure. This ensures that the implementation of the measures is specifically addressed and, as a result, is not only planned but also realised.
• Time frame for implementation: A realistic time frame will be defined with you within which the measures are to be implemented. This schedule will take into account both short-term and long-term measures.

• Certified Lead Auditor ISO 22301
• Certified Lead Auditor ISO 27001
• Certified 1^st & 2^nd party Auditor ISO 9001
• Certified 1^st & 2^nd party Auditor IATF 16949

• Certified Business Continuity Manager
• Certified BCM Implementer
• Certified IT Risk Manager
• Quality Manager (QMF), Quality Management Representative (QMB)
• Process manager