Internal Audit Finds Nothing Because It Looked at Nothing
A utility company is preparing for its first certification audit. Its internal audit of the BCMS was completed last month by a two-person team drawn from the finance department, neither of whom had BCMS training. The audit report is three pages long, lists every clause of the standard with 'conforms' beside it, cites no evidence, and contains no findings. The audit covered the continuity plans and the policy, but did not examine the business impact analysis, the risk assessment, supplier arrangements, or the exercise records. The audit team leader is a personal friend of the BCMS manager and the audit was scheduled in the same week the BCMS manager was on leave. The management review is scheduled for next week and will use this audit as its main input. The certification body's Stage 1 visit is in six weeks.
1. Assess the internal audit against what the standard requires, and identify the risks to the certification effort.
Read the worked answer
The internal audit does not meet the standard's requirements in substance, even though a report exists.
Deficiencies:
- Competence. Auditors must be competent for the audit they perform. Two finance staff with no BCMS training auditing a BCMS is a competence gap, and it is auditable in its own right.
- Coverage. The audit skipped the BIA, risk assessment, supplier arrangements, and exercise records - arguably the highest-value parts of the system. An audit that examines only the easy artefacts cannot provide assurance.
- Evidence. 'Conforms' against every clause with no cited evidence is an assertion, not an audit finding. Audit conclusions must be supported by objective evidence.
- Independence and objectivity. The team leader's friendship with the BCMS manager, and the scheduling during the manager's absence, compromise the appearance and likely the reality of objectivity. Auditors should not audit their own work or be in a position where objectivity is compromised.
- No findings. A first-cycle internal audit of a new BCMS with no findings at all is a strong signal that the audit was not probing.
Risks to certification:
- The management review will be based on invalid input, so its conclusions will be unreliable.
- The Stage 1 audit will likely surface the internal audit's inadequacy, and the certification body may question whether the system has been genuinely evaluated.
- If gaps in the BIA, risk assessment, or exercises exist, they are currently unknown and unaddressed with six weeks to go.
2. What should the BCMS manager do between now and the management review, and what should be reported honestly to the certification body?
Read the worked answer
Actions before management review:
- Do not present the existing audit as valid assurance. The manager should state plainly that the internal audit is not fit for purpose and explain why.
- Commission a supplementary internal audit immediately, with competent auditors (trained, ideally independent of the BCMS function) and a scope covering the areas missed - BIA, risk assessment, suppliers, exercises. Six weeks is tight but enough for a focused audit of the highest-risk areas.
- Address independence. Use auditors with no conflicting relationship; if internal capability is thin, engage a qualified external auditor for this cycle.
- Feed both the original audit (as a lesson) and the supplementary audit into management review, and record the corrective action on the internal audit process itself - competence, planning, independence, evidence standards.
- Update the audit programme so future cycles have defined criteria, competent auditors, and coverage of all BCMS elements.
On reporting to the certification body:
- The organization is not obliged to volunteer every internal weakness, but it must not misrepresent the internal audit as adequate evidence of evaluation. If asked, or if the supplementary audit reveals nonconformities, these should be disclosed and shown to be under corrective action.
- Presenting a defective audit as valid assurance would be a misrepresentation and, if discovered, would damage credibility far more than an honest account of a corrective action in progress.
The exam point: internal audit is a control that must itself be controlled - competence, independence, coverage, and evidence. A 'clean' audit that examined nothing is worse than an honest audit with findings.