Business continuity, vulnerability, data centre and banking audits

A power failure hits a bank's data centre at 2 p.m. on salary day. The back-up generator fails to start, because it has not been tested for months. For nine hours, customers cannot withdraw cash. A good business continuity plan, tested and audited, would have prevented most of the damage.

Specialised IS audits, such as the audit of the continuity plan, of vulnerabilities, of the data centre and of banking transactions, give assurance on exactly these points.

This topic covers the audit of a business continuity plan, the vulnerability audit and its procedures, the data centre audit, concurrent audit of banking transactions, and how an IS audit is reported. The previous topic covered IT risks and the IS audit process, and the next covers data analytics and artificial intelligence.

Key terms in plain English

Syllabus check

This topic is in syllabus area F, technology in audit, assurance and forensics (5% of marks). It covers:

• audit of a business continuity plan
• systems vulnerability audit and data centre audit
• auditing banking transactions
• reporting IT audit activities

CAMA 2020 and IT audits

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

The business continuity plan

A contingency or business continuity plan (BCP) is a document that sets out how an entity will continue to operate if unplanned incidents disrupt operations. Having a plan is only half the battle. The key question is how the organisation knows that the plan is sound and adequate.

The answer is an audit of the BCP, preferably by someone other than the people who developed it, for objectivity: the team that wrote the plan can hardly find its faults. The audit has three parts:

1. Validating the BCP;
2. Verifying the preventive measures for ensuring continuity; and
3. Examining evidence of the performance of activities that ensure continuity and recovery.

Steps in a BCP audit

• Obtain and review the plan to see whether it is complete and approved by management.
• Review the organisation chart and the business process analysis.
• Ask management about their involvement in and knowledge of the plan.
• Review the assumptions, to see whether they are reasonable and fit the type of business.
• Review the business impact analysis (BIA) and ask whether the recovery time objective (RTO) and the recovery point objective (RPO) have been identified. The RTO is the maximum time the business can be without a service. The RPO is the maximum amount of data loss, measured in time, that the business can accept.
• Compare the recovery strategies with the BIA to see that they align.
• Ask management whether an emergency coordinator has been appointed and discuss the role with them.
• Identify the staff with critical roles in the plan and discuss with them to confirm their awareness and readiness.
• Identify third-party links and test that their contacts are viable.
• Verify the back-up tapes to the back-up logs and labels.
• Verify the maintenance and testing logs of key equipment such as generators, uninterruptible power supplies, fire control equipment and air conditioners.
• Verify whether the BCP has been tested.
• Review the BCP documents to see whether they have been reviewed and updated recently.

The nature, complexity and cost of a BCP are related to how much the business depends on IT. Testing the plan with drills is the best assurance, but an audit by an IS auditor can reveal weaknesses that drills do not. A BCP should cover alternative sites (hot, warm or cold), data back-up and restoration, communication with staff, customers and regulators, roles and responsibilities and a schedule of tests.

The auditor also checks that the back-up media are stored off-site, that restoration has been tested, and that the plan was updated after changes in systems, premises or staff.

Systems vulnerability audit

Every corporate information system holds sensitive information about the organisation, its employees, customers and suppliers. Responsible organisations try to keep it from unauthorised people inside and outside. No system is perfect, so hackers and disgruntled people may exploit its weaknesses. Organisations must therefore look for the hidden threats and deal with them quickly. A vulnerability audit identifies security risks in an enterprise information system and network.

At the end, the IS auditor gives a comprehensive threat analysis report which includes all the security incidents detected and recommends how to protect against them. It finds flaws in the company's security procedures, design, implementation or internal controls, and weaknesses that could be triggered or exploited to cause a breach. During the test, the audit team decides which flaws are in danger of being exploited.

They may run special software to scan for vulnerabilities, test from inside the network, or use approved remote access, to see what must be corrected to meet security standards.

Procedures for a vulnerability audit. Most IS auditors do an on-site audit, with these steps:

1. identify the information systems components to be covered;
2. set up and configure the appliance, that is, the scanning tool;
3. scan the applications, servers, websites and networks and inspect the traffic;
4. analyse the results of the scan;
5. generate a report; and
6. present the findings and the solutions to address the weaknesses found.

A penetration test goes a step further: authorised testers try to break in, using the vulnerabilities found, to show how far an attacker could get. The two are often combined. The auditor needs written authority from management before scanning, so that the work is lawful and does not disrupt live systems.

Data centre audit

The data centre is a key part of an organisation's ICT infrastructure, because it hosts servers, routers, switches, software and supporting equipment. Periodic audit gives stakeholders reasonable assurance that their investment in physical ICT hardware, software and supporting equipment such as power, cooling, environmental, safety and security devices is protected and works well.

The internal audit team, made up of IS auditors, is responsible for routine audit of the data centre. The scope should cover all aspects of operations, infrastructure, administration, human capacity and relevance to the business, as part of the data centre's audit work programme. Key areas are:

Auditing banking transactions: concurrent audit

A financial entity such as a bank needs a concurrent audit, a continuous and robust review of its transactions outside the statutory audit and the routine internal audit. A concurrent audit examines banking transactions as they occur, which gives the bank an early warning signal for timely detection of all forms of irregularities and lapses.

Lending is a major function of banks and generates much of their daily transactions, so a concurrent audit often reviews loans and advances.

Typical checks cover:

• that loans were approved by the right authority and are within limits
• that security was perfected and documented before disbursement
• that loan terms agree with the approval
• that interest and fees are correctly computed
• that the loan is correctly classified under the prudential guidelines and provided for
• that large and unusual transactions, such as cash and transfers, are reviewed for money laundering signs
• that exceptions are reported promptly to management

In Nigeria, banks are also subject to the rules of the Central Bank of Nigeria and the Nigeria Deposit Insurance Corporation.

Reporting IT audit activities

At the end of the work the IS auditor produces a report to the management of the organisation. There is no generally accepted template. A typical report has:

• a cover page;
• terms of reference;
• background information;
• an executive summary, which should be under five pages unless that is impracticable;
• the body, with findings, their implications and recommendations, usually in a table; and
• appendices.

Findings are rated by risk, such as high, medium and low, with an owner and a date for management's action, and the report is followed up.

Worked examples

1. The RTO is 2 hours, and the RPO is 15 minutes.
2. The auditor checks that back-up frequency and the standby site meet these targets.

1. The plan is not validated.
2. The auditor recommends a test, such as a simulated shutdown, and an update of the plan.

1. Weaknesses in environmental control and physical access.
2. Recommendations: a maintenance schedule and a visitor log.

1. The loan was released without perfected security.
2. The concurrent audit flags it at once, so that the bank can act.

How to score full marks

• Group the BCP audit steps under validate, verify and examine.
• Give the six procedures of a vulnerability audit in order.
• Use the data centre areas as a checklist.
• Define concurrent audit as real-time review.

Common mistakes in the exam

• Having the plan's authors audit it.
• Forgetting RTO and RPO.
• Confusing vulnerability scanning with a statutory audit procedure.
• Missing the data centre's environmental and power controls.

Quick revision

• BCP audit: validate, verify, examine evidence.
• Vulnerability audit: scope, set up, scan, analyse, report, present.
• Data centre: eleven areas.
• Concurrent audit: transactions as they occur.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.