A.5.30 Audit Evidence Pack

What the auditor wants to verify

The auditor wants to confirm that ICT readiness is planned, implemented, maintained, and tested based on business continuity objectives and ICT continuity requirements.

Evidence to request

Strong evidence

• BIA or continuity analysis identifies priority ICT services and recovery sequence.
• RTO, RPO, and service restoration expectations are documented and approved.
• Recovery playbooks are available to responders and usable under stress.
• ICT continuity tests cover important systems and likely failure modes.
• Test findings and real continuity events lead to improvements.
• Supplier ICT continuity arrangements are reviewed or tested where dependency is significant.

Weak evidence

• RTO/RPO values exist but are not tied to business priorities.
• Recovery plans are outdated or unavailable to responders.
• Backups exist but restoration has not been tested.
• Testing covers only easy scenarios.
• IT and business stakeholders disagree on restoration priorities.
• Supplier resilience is assumed from contract wording.

Sample interview questions

• Which ICT services are most critical and why?
• What RTO and RPO apply to this service?
• How do IT recovery priorities match business priorities?
• Show a recent restore or continuity test record.
• How are supplier ICT continuity dependencies reviewed or tested?

Common nonconformities

• Continuity requirements are not based on business impact
• Backups are treated as the whole continuity plan
• RTO and RPO are unrealistic
• Supplier continuity is not tested or reviewed
• Test findings are not tracked to closure

Related notes

• A.5.30 ICT Readiness for Business Continuity
• ICT Continuity Requirements and Test Record
• A.5.30 Audit Checklist