GLASGOW LIFE Review of Business Continuity Planning. Final Report

Transcription

1 Final Report INTERNAL AUDIT September 2011 Glasgow City Council Internal Audit 1

2 Table of Contents Section No Section Title 1 Introduction and Background 2 Audit Remit 3 Audit Opinion 4 Conclusions 5 Recommendations 6 Implications Action Plan Glasgow City Council Internal Audit 1

3 1. Introduction and Background Business continuity plans (BCPs) are the means by which organisations plan to minimise the potential impact of any major interruption to business critical functions and systems to ensure that these can be maintained and recovered effectively. As part of the agreed programme of work for 2011/2012, Internal Audit has undertaken a review of business continuity planning at Glasgow Life. 2. Audit Remit The purpose of the audit was to gain assurance that Glasgow Life has appropriate and effective business continuity planning arrangements in place to ensure continued operations in the event of any major business interruption. The scope of the audit included testing controls in operation to ensure that: A business continuity plan is in place to ensure the continued operation and recovery of services in the event of system failure or disruption; Business continuity processes are regularly tested to confirm that the arrangements proposed are fit-for-purpose and effective in the their performance, and BCP documents are regularly reviewed and updated. An Internal Audit report issued in April 2011 noted that Glasgow Life s Corporate BCP does not recognise the loss of business critical systems as a priority. This audit further develops issues with the organisation s BCP readiness. 3. Audit Opinion Based on the audit work carried out, some assurance can be placed upon the control environment for business continuity planning but the further work identified requires to be carried out as a matter of priority. Seven further opportunities for improvement were identified, and the auditor noted a commitment by staff to address the issues. Glasgow City Council Internal Audit 2

4 4. Conclusions Based upon the work carried out, the conclusions reached during the audit were as follows: Six areas reviewed were found to be satisfactory. These included the appointment of a suitable officer as responsible for business continuity planning across Glasgow Life, the development of a programme of scheduled BCP testing and arrangements for undertaking, documenting and responding to issues identified during the actual desktop BCP testing exercises. Various aspects of the corporate BCP and the venue specific plans were found to be out of date. Best practice dictates that BCPs must be regularly reviewed, otherwise there is an increased risk that these documents will not accurately reflect current processes, thereby diminishing their usefulness in the event of a major service crisis. As some specific business critical systems have not been identified in the Corporate BCP, there is an increased risk that the Plan will not contain the detail required to ensure that the business can function, recover and secure key data in the event of a major crisis or service interruption. Failure to store all corporate and service level BCPs in a single secure repository could delay the implementation of BCPs and prolong a period of service disruption. As no formal business continuity planning training has been delivered in relation to the Corporate BCP, there is an increased likelihood that the approach adopted by Glasgow Life is inconsistent across the organisation and may not be compliant with best practice. 5. Recommendations Resulting from the conclusions, seven recommendations for improvement, four rated high priority and three rated medium priority were identified. These recommendations and the organisation s responses are shown below. Glasgow City Council Internal Audit 3

5 6. Implications Legal Financial Personnel Service Plan Environmental Glasgow City Council Internal Audit 4