Audit execution and evidence gathering against continuity criteria
Evidence quality
Evidence must be sufficient (enough to support the conclusion) and appropriate (relevant and reliable). The reliability hierarchy runs from the auditor's direct observation and re-performance, through documentary records created at the time, down to testimony and hearsay. Interviews alone rarely justify a significant finding.
The three tests
For each control ask: is it designed to meet the criterion? has it been implemented at least once as designed? does it operate effectively over time, evidenced by sampled instances? "The plan says we call the crisis team" answers design only.
Methods
Document review, interviews, observation, walkthroughs, sampling, re-performance (tracing a call tree, reconstructing a business impact analysis) and analysis of exercise after-action reports. Test the artefacts continuity actually depends on: contact data currency, alternate-site contract validity, backup restore tests, exercise records, training attendance, and supplier continuity evidence.
Working papers
Record the criteria, what was tested, sample size and selection method, results, and cross-references to evidence. A finding must be traceable from the report back to the evidence without relying on the auditor's memory.
Traps
Accepting a plan document as evidence of capability; testing backups and calling it a business continuity exercise; confusing correction (fixing the instance) with corrective action (removing the cause); sampling only the best-performing site; forming conclusions before all evidence is reviewed.
Rule of thumb: triangulate - document, interview and observation or re-performance should agree before a significant finding, or a clean opinion, is issued.