The Plan That Grew Without Control
Vertex Logistics has 47 business continuity plan documents spread across three shared drives and two department wikis. There is a corporate template, but departments have modified it freely. The plan for the largest distribution hub was last revised 26 months ago and names a site manager who left 18 months ago. Two departments have plans that reference a recovery facility that was decommissioned last year. Version control consists of filenames such as final_v3_REALLYFINAL.docx. An auditor asks the program manager to demonstrate that plans are current, approved, and accessible during an outage. The program manager knows that the primary document repository is hosted on a server in the same building as the distribution hub's main office, and that the hub's own plan is stored only there.
1. How should the program manager respond to the auditor, and what does an honest answer require?
Read the worked answer
The honest answer is that the program cannot currently demonstrate currency, approval, or accessibility for a meaningful portion of its plans, and that this is a known deficiency with a remediation plan. Attempting to assemble a favorable sample would be a misrepresentation that the auditor is likely to detect and that would undermine credibility for years.
Break the auditor's three questions apart. Currency: at least one plan is 26 months old and names a departed manager; two reference a decommissioned facility. Approval: filename conventions are not approval evidence. Accessibility: the repository sits in the same building as the hub it serves, and the hub's only copy of its own plan is there - meaning a building-level event destroys the plan needed to respond to that event. That last point is the most serious finding and should be volunteered rather than waiting to be asked.
A credible response includes a remediation plan with dates: consolidation to a single controlled repository, a defined review cycle with named owners, an approval record, and offsite or cloud hosting independent of any single building. It also includes a triage step - identify which of the 47 plans cover critical functions and prioritize those, because bringing all 47 current simultaneously is unlikely to be achievable and would delay the important ones.
Presenting the deficiency with a plan is far stronger than presenting a curated sample. Auditors and regulators generally respond better to disclosed gaps with remediation than to discovered concealment.
2. Design the document control approach. What specific controls address the failures described?
Read the worked answer
Each control should map to an observed failure rather than being adopted generically.
Single repository: consolidate all 47 plans into one controlled system hosted independently of any operating site, with role-based access and offline retrieval capability. This addresses both the sprawl and the building-dependency problem. Plans must be retrievable when the network is degraded, so a defined offline copy process is part of the control, not an afterthought.
Single template with controlled customization: departments modified the template freely, which is why references to a decommissioned facility survived. Allow a defined set of department-specific sections while locking structural elements, and require that any reference to a facility, system, or role be drawn from a maintained register rather than typed freehand.
Named-owner review cycle: assign each plan an owner and a review interval tied to criticality - for example, annually for critical-function plans and on any material change of personnel, site, or system. Trigger-based review is what would have caught the departed site manager within weeks rather than 18 months.
Approval record: require sign-off by the accountable business owner within the system, with date and version retained. This replaces filename conventions with auditable evidence.
Version and status labeling: a single current version per plan, with superseded versions archived and clearly marked, so no one can act on a stale copy.
Finally, measure it: report percent of critical plans current, percent approved, and number of overdue reviews to management each quarter. Controls that are not measured decay, which is precisely how 47 documents reached this state.