Business continuity management audit program.
How to audit whether an organisation can continue or restore critical processes during disruptions, based on BSI standard 200-4 and the module DER.4.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether a continuity management exists that knows the critical business processes and their dependencies, derives precautions and plans from them and shows through exercises that the plans hold in a real event. It also assesses whether management takes responsibility for the topic.
Scope
- Continuity management or BCM system with policy, roles, impact analysis, strategies and plans
- IT contingency planning and recovery for the critical processes
- Crisis communication, alerting and reporting channels
- Out of scope: fire protection and occupational safety in detail, unless agreed separately
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | A continuity management policy is approved by management and sets objectives, scope and responsibility. | BSI standard 200-4; BSI DER.4; NIS2 Directive Art. 20 | Read the policy, check approval and currency, and trace the reporting line to management. | Policy with approval, management decisions |
| 2 | Roles for continuity management are filled, including continuity officers and crisis team, with deputies. | BSI standard 200-4; BSI DER.4 | Check role descriptions, staffing and deputies, and test a sample of contact details for reachability. | Role descriptions, staffing list, contact list |
| 3 | An impact analysis has identified the critical processes, their recovery times and their dependencies. | BSI standard 200-4; BSI DER.4 | Read method and results and confirm processes and dependencies with the business units on a sample basis. | Impact analysis, process list with recovery times, dependency overview |
| 4 | Disruption scenarios and their likelihood are assessed and the results feed into planning. | BSI standard 200-4 | Review the risk analysis for disruptions and check whether scenarios such as loss of a site, provider, IT or staff are included. | Risk analysis, scenario list |
| 5 | Continuity and recovery strategies with the necessary resources are derived from the analysis and approved. | BSI standard 200-4 | Compare strategies and resource planning with the results of the impact analysis. | Strategy documents, budget and resource planning |
| 6 | Contingency and recovery plans exist for the critical processes and are available in a real event even without the main environment. | BSI DER.4 | Read the plans for two critical processes and establish where they are stored and whether they are accessible offline. | Contingency plans, storage concept, evidence of access |
| 7 | Recovery times and tolerable data loss of IT match the requirements of the processes. | ISO/IEC 27001:2022 Annex A 5.30; NIS2 Directive Art. 21(2)(c) | Compare the process targets with the technical capabilities of IT and the results of recovery tests. | Comparison of targets, IT test records |
| 8 | Alerting, internal and external communication and the reporting channels for significant security incidents are defined. | BSI DER.4; NIS2 Directive Art. 23 | Read the communication plan and trace the reporting channel through an example, including deadlines. | Communication plan, alerting list, reporting templates |
| 9 | Dependencies on service providers are recorded and secured by commitments for an emergency. | NIS2 Directive Art. 21(2)(d) | Select critical providers from the impact analysis and check contractual commitments on availability and support in an emergency. | Provider list, contracts, provider confirmations |
| 10 | Exercises and tests are planned, carried out and evaluated, and the results lead to improvements. | BSI standard 200-4; BSI DER.4; ISO/IEC 27001:2022 Annex A 5.30 | Check the exercise plan and reports of the last two years and establish which actions followed from the results. | Exercise plan, exercise reports, action list |
| 11 | Participants are trained and made aware of their tasks in an emergency. | BSI DER.4 | Check the training plan and attendance lists and ask a sample of participants about their tasks. | Training plan, attendance lists |
| 12 | During a disruption, security measures such as access controls remain effective in emergency operation. | ISO/IEC 27001:2022 Annex A 5.29 | Check emergency operating procedures for planned exceptions to access and protection measures and their approval. | Emergency operating procedures, exception approvals |
| 13 | Plans are updated after changes and incidents and maintained with a version history. | BSI standard 200-4 | Compare the change history of the plans with organisational changes and incidents of the last year. | Version history, incident reports, change requests |
| 14 | Management reviews the continuity management regularly and decides on improvements. | BSI standard 200-4; NIS2 Directive Art. 21(2)(f) | Review management reviews and reports of the last two years and follow up decisions. | Management review, reports, decisions |
Documents to request
- Continuity management policy
- Role descriptions, staffing and contact list
- Impact analysis with process list and recovery times
- Risk analysis and scenario list
- Contingency and recovery plans for the critical processes
- Communication and alerting plan
- Exercise plan and exercise reports of the last two years
- Contracts and commitments of critical providers
- Management review of continuity management
Typical findings
- The impact analysis is outdated or does not cover essential processes.
- Plans are stored only on systems that would fail in a real event.
- Exercises are limited to tabletop games; a technical recovery has never been tested.
- Recovery times of the processes and the capabilities of IT do not match.
- Roles are not filled or contact details are out of date.
- Plans were not adjusted after organisational changes.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing