Objective
Ensure the BCM program is reviewed and audited annually, corrective actions are closed, and evidence remains controlled and retrievable.
Control Activity
Compliance coordinates an annual management and Board review and an annual independent internal and external BCM audit, with findings documented and actions followed up. Periodic reviews are triggered by system changes, new regulations, mergers, relocations, or major incidents. The control verifies that the following records are maintained and securely stored: BCM policy, plans, and sub-plans; training attendance, awareness programs, and materials; test scripts, schedules, results, and corrective action plans; incident reports, severity ratings, root cause analyses, and regulatory reports. All records are retained for regulator and auditor review. Findings, incident lessons and exercise weaknesses receive owners and due dates and are tracked to verified closure. Proportionality is re-assessed annually as part of the Compliance Review and Audit cycle, or whenever there is significant operational growth, expansion into new jurisdictions, or changes in technology architecture or outsourcing arrangements. Approved versions and evidence are retained securely.
Evidence
- Expected evidence: Annual management and Board review
- Expected evidence: Independent audit report
- Expected evidence: Corrective-action register and closure evidence
- Expected evidence: Lessons-learned and plan-update records
- Expected evidence: Controlled document and evidence inventory
- Evidence location: source evidence in SYS-ECM-001 Compliance Framework Library, SYS-ECM-002 Compliance Reporting and Evidence Repository, SYS-OUT-001 Outsourcing Register; target Hermes assessment record in Odoo under ISS-HERMES-001.
- Retention: according to the applicable approved policy and Bitkaya record-retention requirements.
- Testing method: inspect annual review and audit completion and sample findings through verified closure and retained evidence
- Testing frequency: annual and after material disruption, failed exercise or significant change
Relationships
- Requirements: REQ-IT-006 Maintain Business Continuity Management, REQ-OUT-009 Monitor Audit and Control Outsourcing Arrangements
- Policy: POL-BCM-001 Business Continuity Manual
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Procedure: PROC-BCM-007 Review Audit and Improve BCM
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: implemented
History
- 2026-07-26: Normalized evidence metadata and separated design status from runtime effectiveness.
- 2026-07-26: Created from the approved Business Continuity Manual version 1.0.