Incident Management and Business Resilience (CIA Part 2: Engagement Planning)
Introduction
Incident Management and Business Resilience is an important topic in CIA Part 2 (Practice of Internal Auditing), within Engagement Planning. Internal auditors must know how organizations prepare for, respond to, and recover from disruptions such as cyberattacks, natural disasters, pandemics, supplier failures, system outages, and fraud events. When planning an engagement, the auditor must judge whether the organization's resilience arrangements are well designed, documented, tested, and governed. They must also judge whether those arrangements match the organization's risk appetite and strategic objectives.
Why It Is Important
1. Organizational survival: Poorly managed disruptions can cause financial loss, regulatory penalties, reputational damage, and even business failure. Resilience protects the organization's ability to keep delivering critical products and services.
2. Stakeholder expectations: Boards, regulators, customers, and investors increasingly expect proof that the organization can withstand shocks. Examples include operational resilience rules in financial services and data breach notification laws.
3. Risk-based audit planning: Under the IIA Global Internal Audit Standards, the chief audit executive must consider the organization's key risks when building the audit plan. Disruption risk is almost always a key risk. Auditors also assess whether management's incident and continuity processes reduce that risk to an acceptable level.
4. Assurance and advisory value: Internal audit can give assurance on readiness, such as testing BCP and DRP design and effectiveness. It can also advise, for example by facilitating business impact analyses, without taking on management responsibility.
5. Lessons learned: Post-incident reviews help organizations improve controls. Internal audit can check whether lessons are actually captured and acted upon.
What It Is: Key Concepts and Definitions
Incident: An unplanned event that disrupts, or could disrupt, normal operations, services, or information security. Examples include a malware infection, data center outage, fire, or major data leak.
Incident Management: The structured process of identifying, logging, classifying, prioritizing, containing, resolving, and learning from incidents. Its goal is to restore normal service quickly and limit impact. In IT service management (for example, ITIL), incident management is distinct from problem management, which finds the root cause of recurring incidents.
Business Resilience (Organizational Resilience): The organization's ability to anticipate, prepare for, respond to, and adapt to change and sudden disruption in order to survive and prosper. It is broader than recovery. It includes culture, governance, supply chain, people, technology, and strategy.
Business Continuity Management (BCM): A holistic management process that identifies potential threats and their impacts. It builds a framework for resilience and effective response. ISO 22301 is the main international standard for business continuity management systems.
Business Continuity Plan (BCP): Documented procedures that guide the organization in responding to, recovering, resuming, and restoring operations to a predefined level after a disruption. It focuses on business processes.
Disaster Recovery Plan (DRP): A subset of continuity planning focused on restoring IT systems, data, and infrastructure after a disaster.
Crisis Management: The strategic, senior-level response to events that threaten the organization's reputation, viability, or stakeholders. It covers leadership decisions, communications, media handling, and stakeholder management.
Business Impact Analysis (BIA): The process of identifying critical business functions and the impact that disrupting them would have over time. The BIA sets recovery priorities and objectives.
Recovery Time Objective (RTO): The maximum acceptable time to restore a process or system after a disruption.
Recovery Point Objective (RPO): The maximum acceptable amount of data loss, measured in time. For example, an RPO of 4 hours means backups must be no more than 4 hours old.
Maximum Tolerable Period of Disruption (MTPD) / Maximum Tolerable Downtime (MTD): The time after which disruption impacts become unacceptable to the organization. The RTO must be shorter than the MTPD.
Minimum Business Continuity Objective (MBCO): The minimum level of service acceptable during a disruption.
How It Works: The Lifecycle
1. Governance and Policy
The board and senior management set the resilience policy, risk appetite, and accountability. A BCM steering committee or resilience function coordinates efforts. Roles are defined: incident response team, crisis management team, recovery teams, and communications leads.
2. Risk Assessment and Business Impact Analysis
- Identify threats such as natural, technological, human, supply chain, and cyber.
- Assess likelihood and impact.
- Run the BIA to rank critical processes, dependencies (people, IT, facilities, suppliers), RTOs, RPOs, and MTPDs.
- Note: the BIA identifies what is critical and how fast it must recover. The risk assessment identifies what could cause disruption.
3. Strategy Selection
Choose recovery strategies that are cost-effective and meet the RTO and RPO. Options include:
- Hot site: Fully equipped and operational, with near-real-time data. Fastest recovery and most expensive.
- Warm site: Partially equipped. Recovery takes hours to days.
- Cold site: Space and basic utilities only. Slowest recovery and cheapest.
- Mirror site / active-active: Real-time replication with near-zero downtime.
- Reciprocal agreements: Sharing facilities with another organization. Cheap but often unreliable.
- Cloud-based recovery (DRaaS), data backups (full, incremental, differential), redundant suppliers, remote work, and cross-training staff.
4. Plan Development
Document the incident response plan, BCP, DRP, crisis communication plan, and pandemic plans. Plans should include activation criteria, escalation paths, contact lists, step-by-step recovery procedures, and alternate locations. They should also cover vendor contacts and communication templates.
5. Incident Response Process
A typical sequence, based on NIST SP 800-61, runs as follows:
- Preparation: Policies, tools, and trained teams.
- Detection and Analysis: Monitoring, alerts, triage, classification, and severity rating.
- Containment: Limiting spread and damage.
- Eradication: Removing the cause.
- Recovery: Restoring systems and operations.
- Post-Incident Activity: Lessons learned, root cause analysis, and plan updates.
Escalation to crisis management happens when severity thresholds are breached.
6. Testing and Exercising
Plans must be tested regularly. Test types range from least to most rigorous and disruptive:
- Checklist / desk check: Reviewing the plan for completeness.
- Tabletop exercise / structured walkthrough: Teams discuss their response to a scenario.
- Simulation: A realistic scenario is run without affecting live operations.
- Parallel test: Recovery systems are brought up alongside production, which keeps running.
- Full interruption test: Production is shut down and operations move to the recovery site. This is the most realistic and the riskiest.
7. Maintenance and Continuous Improvement
Update plans after organizational changes, system changes, tests, and real incidents. Training and awareness keep staff ready.
Internal Audit's Role in Engagement Planning
When planning an engagement on incident management or resilience, the internal auditor should:
- Understand the organization's objectives, critical services, and risk appetite.
- Review governance, including board oversight, clear ownership, and policy approval.
- Assess whether the BIA and risk assessment are current and complete.
- Evaluate whether recovery strategies are aligned with the RTO and RPO.
- Check whether test results and lessons learned are tracked to closure.
- Review third-party and supply chain resilience, including vendor BCPs and contractual SLAs.
- Examine incident logs, classification, escalation, and root cause trends.
- Consider IT general controls such as backups, offsite storage, and access controls.
- Set engagement objectives, scope, criteria (for example ISO 22301, NIST, COSO, or COBIT), and the work program.
Independence caution: Internal audit may advise on, facilitate, or review BCM. However, it should not own the BCP, make recovery decisions, or serve as the incident response leader. Doing so would impair objectivity. If it gives advisory input, it should disclose this and avoid later auditing its own work without safeguards.
Internal audit's own resilience: The CAE should also make sure the internal audit activity has its own continuity arrangements.
Common Audit Findings
- The BIA is outdated or missing, or RTOs were set without business input.
- Plans have never been tested, or tests were superficial.
- RTO/RPO targets cannot be met by the existing backup or recovery infrastructure.
- Contact lists are out of date, or plans are stored only on the systems that might fail.
- Third-party dependencies are not considered.
- There is no lessons-learned process, or there are recurring incidents with no problem management.
- Escalation criteria are unclear, and the crisis communication plan is missing.
Exam Tips: Answering Questions on Incident Management and Business Resilience
1. Know the sequence. The BIA and risk assessment come before strategy selection and plan development. If a question asks for the first step in developing a BCP, the answer is usually obtaining management commitment or support, or performing a BIA, depending on the options given. Senior management support is the foundation, and the BIA is the first analytical step.
2. Distinguish BCP from DRP. BCP covers business processes and the whole organization. DRP covers IT recovery. DRP is a component of BCP.
3. RTO versus RPO. RTO is about time to restore, or downtime. RPO is about data loss tolerance, which drives backup frequency. A low RPO means more frequent backups or replication.
4. Recovery site trade-offs. Hot means fast and costly. Cold means slow and cheap. Warm sits in between. Match the site to the RTO and to cost-benefit reasoning.
5. Testing hierarchy. The full interruption test is the most thorough but carries the highest risk. The tabletop or walkthrough has the least disruption. A parallel test does not interrupt production. Questions asking for the best evidence of plan effectiveness often point to actual testing results, not documentation review.
6. Internal audit's role. Pick answers where internal audit evaluates, provides assurance, or advises. Reject answers where it designs and owns the plan, leads the recovery, or approves the strategy. Management owns resilience. The board oversees it.
7. Incident versus problem. Incident management restores service quickly. Problem management finds and removes the root cause. If an incident keeps recurring, the control gap is weak problem management or root cause analysis.
8. Post-incident review. The most valuable step after recovery is a lessons-learned review and updating the plan. Expect questions that ask what should happen after an incident is resolved.
9. Look for risk-based reasoning. In planning questions, choose the answer that ties scope to the most critical processes and highest risks identified in the BIA. Do not choose answers that suggest auditing everything equally.
10. Watch for currency and storage traps. A plan stored only on the main server, or one not updated after a major change such as a merger or new ERP system, is a classic weakness.
11. Third parties count. Outsourcing a function does not outsource accountability. Look for answers requiring vendor continuity assurance, right-to-audit clauses, or SOC reports.
12. Elimination strategy. Remove answers that are absolute (for example, "eliminates all risk"), that impair independence, or that skip foundational steps. The CIA exam rewards the most appropriate or best answer, so compare the remaining options for scope and timing.
13. Keywords to recognize: "critical functions" points to the BIA. "Data loss" points to RPO. "Downtime" points to RTO or MTD. "Reputation or media" points to crisis management. "IT infrastructure restoration" points to the DRP. "Most realistic test" points to full interruption.
Sample Question Walkthrough
Question: An internal auditor is planning an engagement to evaluate the organization's business continuity program. Which of the following would provide the strongest evidence that the plan will work in an actual disruption?
A. The plan was approved by senior management.
B. The plan was benchmarked against ISO 22301.
C. Results of a recent simulation test with documented corrective actions completed.
D. Interviews with department heads confirming awareness of the plan.
Answer: C. Approval, benchmarking, and awareness support design and governance, but they do not show operating effectiveness. Test results with remediation give the most persuasive evidence.
Summary
Incident management deals with detecting, responding to, and recovering from specific disruptive events. Business resilience is the wider capacity to anticipate, absorb, and adapt to shocks through BCM, DRP, crisis management, and a resilient culture. For the CIA Part 2 exam, master these points:
- The lifecycle: governance, then BIA and risk assessment, then strategy, then plans, then testing, then maintenance.
- Key metrics: RTO, RPO, and MTPD.
- Recovery site options and testing types.
- Internal audit's proper assurance and advisory role during engagement planning.
Always choose answers that reflect risk-based thinking, proper sequencing, management ownership, and preserved auditor objectivity.
