Disaster recovery and business continuity auditing

Given organizations' increasing dependency on information technology to run their operations, Business continuity planning covers the entire organization, and Disaster recovery focuses on IT. Auditing documents covering an organization's business continuity and disaster recovery plans provides a third-party validation to stakeholders that the documentation is complete and does not contain material misrepresentations. Lack of completeness can result in overlooking secondary effects, such as when vastly increased work-at-home overloads incoming recovery site telecommunications capacity, and the bi-weekly payroll that was not critical within the first 48 hours is now causing perceived problems in ever recovering, complicated by governmental and possibly union reaction. Often used together, the terms Business Continuity and Disaster Recovery are very different. Business Continuity refers to the ability of a business to continue critical functions and business processes after the occurrence of a disaster, whereas Disaster Recovery refers specifically to the Information Technology (IT) and data-centric functions of the business, and is a subset of Business Continuity. The primary objective is to protect the organization in the event that all or part of its operations and/or computer services are rendered partially or completely unusable. Minimizing downtime and data loss during disaster recovery is measured in terms of two concepts: Recovery Time Objective (RTO), time until a system is completely up and running Recovery Point Objective (RPO), a measure of the ability to recover files by specifying a point in time restore of the backup copy. An auditor examines and assesses the procedures stated in the BCP and DR plan are actually consistent with real practice a specific individual within the organization, who may be referred to as the disaster recovery officer, the disaster recovery liaison, the DR coordinator, or some other similar title, has the technical skills, training, experience, and abilities to analyze the capabilities of the team members to complete assigned tasks more than one individual is trained and capable of doing a particular function during the Disaster Recovery exercise.