Purpose
Review, audit and improve the BCM program and retain reliable evidence of its design and operation.
Steps
| # | Action | Details | Evidence |
|---|---|---|---|
| 1 | Collect current records | BIA, risk, plan, incident, training, exercise, supplier, corrective-action records | Record collection |
| 2 | Review BCM program | At least annually and after material disruption, failed exercise, or significant change; periodic reviews triggered by system changes, new regulations, mergers, relocations, major incidents; conduct Annual Board Review of updated BCM plans | Board review minutes |
| 3 | Reassess proportionality | Whether scope, controls, and automation remain proportionate to Bitkaya’s size, complexity, and risk | Proportionality assessment |
| 4 | Arrange annual audit | Independent internal and external BCM audit; findings documented and actions followed up; appropriate independence | Audit report |
| 5 | Present results to Board | Review and audit results, material risks, overdue actions presented to management and Board | Board presentation |
| 6 | Assign corrective actions | Owners, priorities, due dates; track to verified closure | Corrective-action register |
| 7 | Update BCM documents | Plans, procedures, controls, training based on lessons learned | Updated documents |
| 8 | Retain records securely | Approved versions and evidence with controlled access and retrievable history: BCM policy/plans/sub-plans, training attendance/materials, test scripts/results/corrective plans, incident reports/root cause analyses/regulatory reports | Records archive |
| 9 | Re-assess proportionality | Annually in Compliance Review and Audit cycle, or on operational growth, new services, new jurisdictions/regulatory regimes, or technology/outsourcing changes; adjustments ensure BCM stays fit-for-purpose and cost-effective | Proportionality review record |
Records
- Annual management and Board review
- Internal or external audit report
- Corrective-action register and closure evidence
- Lessons-learned reports
- Approved BCM documents and version history
Relationships
- Policy: POL-BCM-001 Business Continuity Manual
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Control: CTRL-BCM-007 Ensure BCM Review Audit Records and Improvements Are Maintained
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Frequency: annual and event-driven
History
- 2026-07-26: Created from sections 14, 15 and 16 of the approved Business Continuity Manual.