The Critical Role of Internal Audit

Business Continuity and Crisis Management

Publication
August 02, 2023

The increasingly fast-paced and unpredictable nature of the modern business landscape has left organisations increasingly susceptible to a myriad of challenges that can disrupt their operations and even threaten their existence altogether. Natural disasters, cyberattacks and economic downturns are just a few examples of crises that may result in significant disruptions to a business’s operations and financial stability. In such uncertain times, it is imperative for the survival of organisations that a proactive approach is taken to business continuity and crisis management.

Various institutions, such as the International Organisation for Standardisation (ISO), National Institute of Standards and Technology (NIST), Business Continuity Institute (BCI) and Disaster Recovery Institute International (DRII), have developed specific standards and guidelines for organisations to incorporate into their models of business continuity and crisis management^[1]. Each business must identify its unique requirements depending on its relevant region, industry and business model.

Understanding Business Continuity and Crisis Management
The Evolving Role of Internal Audit
Identifying and Assessing Risks
Providing Assurance and Independent Oversight

Understanding Business Continuity and Crisis Management

At its core, business continuity refers to a company’s ability to maintain its essential functions and to continue to deliver products or services during or following a crisis, thus minimising the potentially adverse impacts on stakeholders and operations. Crisis management is closely intertwined with this and relates to the process of responding to and recovering from a crisis effectively. A well-designed crisis management plan is an integral part of an organisation's overall business continuity strategy.

The Evolving Role of Internal Audit

The primary role of internal audit (IA) has traditionally been to assess operational controls, identify potential inefficiencies and ensure compliance with legal and regulatory requirements. More recently however, as the business landscape has evolved, so too has the role of IA, and internal auditors are increasingly becoming key players in the organisation's crisis management and business continuity efforts. IA, as an independent and objective function within the organisation, can play a critical role by identifying risks, assessing processes and controls, and guiding management's responses to crisis events. IA functions are also well positioned to perform a Gap Analysis of business continuity processes and procedures against the various business continuity standards and guidelines developed by the organisations listed above.

Identifying and Assessing Risks

Internal auditors excel at identifying and assessing risks across various aspects of an organisation's operations. During a crisis, this becomes even more critical. By conducting comprehensive risk and control assessments, they can identify potential weaknesses that may be more likely to be exposed during a crisis. Organisations can then leverage this information to allocate their resources more effectively during a crisis scenario, focusing on the more vulnerable areas of operations. Adopting a proactive approach allows businesses to implement measures to mitigate these risks before they can potentially escalate into a full-blown emergency. Additionally, IA can assist in designing and implementing a robust control framework that strengthens the organisation’s ability to respond effectively when a crisis occurs.

Providing Assurance and Independent Oversight

In the event of a crisis, stakeholders, including the board of directors, executive management, and external parties, need assurance that the organisation is prepared to respond appropriately and effectively. Internal auditors, as independent and objective professionals, provide an invaluable source of assurance during these challenging times. Thorough testing is required to ensure that an organisation’s business continuity plan (BCP) will prove effective in practice. Independent evaluations of the BCP, as well as the performance of scenario-based testing exercises, will offer key oversight and help build confidence and trust among stakeholders within an organisation.

Conclusion

In an increasingly uncertain world, business continuity and crisis management have become essential for organisations striving to withstand and recover from unexpected disruptions. The many different ways in which these crisis events manifest themselves mean that there will never be a single model of business continuity and crisis management that is valid for all organisations. With that being said, however, IA can offer a unique skill set and objective perspective, and with that provide invaluable assistance for organisations in identifying their risks, monitoring their processes and evaluating their business continuity plans and processes. Their involvement can make a substantial difference and provide crucial support to businesses during these challenging times. As organisations continue to navigate the complexities of the modern business environment, recognising the pivotal role of IA in business continuity and crisis management is no longer an option and can now be considered a necessity.

How we can help

If you have any queries or would like to know more about business continuity and crisis management or how our dedicated teams can support you, please contact our local Internal Audit team.