-
How to Run a Business Impact Analysis: RTOs, RPOs and the Processes That Matter
The business impact analysis is the document every continuity and resilience program rests on and the one most often done as a questionnaire exercise. This guide gives the…
Updated
·
18–27 minutes -
How to Audit the Business Continuity Program End to End: A Work Program With Test Steps
Business continuity programs are audited often and badly: the auditor confirms that plans exist and tests were held, and the next real disruption shows that the plans did…
Updated
·
18–27 minutes -
Operational Resilience Explained: Important Business Services, Impact Tolerances, Tests
Operational resilience began as a UK regulatory idea and has become the way financial firms and, increasingly, other organizations think about disruption. This guide explains the framing and…
Updated
·
19–28 minutes -
The Organizational Resilience Topical Requirement: A Conformance Workbook for April 2027
The IIA issued the Organizational Resilience Topical Requirement on 30 April 2026; it becomes mandatory for assurance engagements on 30 April 2027. This workbook sets out all twenty…
Updated
·
21–31 minutes -
Third-Party Resilience: Continuity When the Failure Is Not Yours
Continuity planning for the failures that belong to someone else: criticality-tiered continuity requirements for suppliers, the evidence that proves resilience rather than asserting it, the arithmetic linking a…
Updated
·
19–28 minutes -
Fourth Parties and Vendor Concentration: The Risk Behind the Risk
Your vendors’ vendors: three failures that arrived through the back door (CrowdStrike, Change Healthcare, MOVEit), the terms defined precisely, what DORA, the interagency guidance, the EBA and PRA,…
Updated
·
18–28 minutes -
Auditing Cyber Resilience: Can the Organization Actually Recover?
Recovery-side cyber assurance, distinct from prevention-focused audits: resilience versus security, the frameworks that describe recovery (NIST SP 800-160 Vol. 2, CSF 2.0 Recover, DORA Articles 11 and 12,…
Updated
·
19–29 minutes -
DORA for Internal Auditors: ICT Risk, Incident Reporting, and Resilience Testing
The EU Digital Operational Resilience Act as an evergreen structure for internal auditors: scope and proportionality, the five pillars with their articles and delegated regulations, the ICT risk…
Updated
·
19–28 minutes -
How to Audit Incident Response: Detection to Post-Mortem
The method for auditing incident response as a program rather than a plan: the eight components and their controls under NIST SP 800-61 Rev. 3 and the IIA’s…
Updated
·
20–30 minutes -
How to Audit Backups and Recovery: The Restore Test Is the Only Test
Backups are a job that runs; recovery is an outcome that has been proven or has not. The nine controls with their NIST, ISO, CISA and DORA references,…
Updated
·
23–35 minutes -
How to Audit Business Continuity and Resilience (2026 Guide)
Auditing resilience as a capability, not a binder: the 2026 setting (the IIA Topical Requirement effective 30 April 2027, DORA, the UK regime, ISO 22301), precise vocabulary, all…
Updated
·
22–34 minutes