What should be the control audit frequency for Business Continuity Management?

The correct answer is B. Annually. Business Continuity Management (BCM) controls - such as BCP testing, DR plan reviews, and RTO/RPO validation - are generally audited on an annual cycle according to standards like ISO 22301 and the CSA CCM. Annual auditing is sufficient because BCM plans typically change on a…

Cloud Risk Management

Question

Options

AQuarterly
BAnnually
CMonthly
DSemi-annually

How the community answered

(46 responses)

A
4% (2)
B
87% (40)
C
7% (3)
D
2% (1)

Explanation

Business Continuity Management (BCM) controls - such as BCP testing, DR plan reviews, and RTO/RPO validation - are generally audited on an annual cycle according to standards like ISO 22301 and the CSA CCM. Annual auditing is sufficient because BCM plans typically change on a yearly basis aligned with business cycles, major infrastructure changes, or post-incident reviews. More frequent frequencies (quarterly, monthly) would be resource-intensive and rarely warranted unless the organization has experienced a significant incident or major change. Semi-annual (D) is also used in some contexts but the primary standard expectation is annual.

Topics

#Business Continuity Management#Control Audit Frequency#Risk Management#Audit Planning

Community Discussion

No community discussion yet for this question.

Full CCAK Practice