Maintaining the program and plan:
Testing, exercising, updating and reviewing

Updating the plan

Plans must be kept up-to-date to provide support for business continuity. Better practice entities have guidelines for periodic exercising, documentation maintenance, and ongoing training. Responsibilities for various aspects of business continuity plan updates are also established.

A business continuity plan is easily maintained if changes in the business and/or data processing environment initiate reviews and update the business continuity plan. When any component of the business continuity plan is affected, the following steps are taken:

the effect of the change is evaluated using a business impact analysis focusing on the new component(s) and any new interrelationships which occur;

the business continuity plans are modified to reflect the change; and

the Recovery Coordinator determines exercising requirements and schedules an exercise,
if necessary.

Reviewing the program

Better practice entities schedule regular internal audit or external reviews and evaluations of their business continuity program.

Better practice entities also undertake self assessments against their objectives, considering relevant standards and guidance documents.

Reports of the audits, reviews and self assessments should be provided to the business continuity committee. Responsibility for implementing any recommendations made to improve performance needs to be assigned.

Implementing a business continuity management program - Checkpoint 5

Table 1 of this better practice guide provides details on the implementation characteristics.

Further references

• Public Sector Internal Audit Better Practice Guide, 2007, Australian National Audit Office.
• Public Sector Internal Audit Toolkit, 2007, Australian National Audit Office.

_{The Workbook contains a template timetable for updating the business continuity plan. Click Here}