Iso 9001 internal audit checklist

1. Iso 9001 internal audit checklist
Your management has given you the task to implement business continuity, but you're
not really sure how to do it? Although it is not an easy task, you can use the BS 25999-2
methodology to make your life easier - here are the main steps necessary to implement
this standard:
1. Obtain management support
Although this is not a mandatory step in BS 25999-2, this is certainly the crucial step in
the beginning - if the management does not understand the benefits of business continuity
and is not committed to this project, your project is most probably going to fail.
2. Treat it as a project
It will take quite a lot of time and resources to set up your business continuity
management system (BCMS) - you have to define clearly what needs to be done, in
which time-frame, and what are the roles in project implementation. In other words, you
have to apply project management methods.
3. Define objectives and scope; write down a BCM Policy
You have to define what is it you want to achieve with the BCMS - compliance,
decreasing the level of risk, requirements of your customers/partners etc. You also have
to define what you are going to include in your BCMS - the whole organization, or just a
part of it. For instance, you may decide that you are going to include only your data
centre if you are providing hosting services to your customers. All of these have to be
documented in the BCM Policy.
4. Defining roles and responsibilities for BCMS
Because the BCMS is going to become a permanent activity in your organization, you
have to define clear responsibilities for it, especially for the "sponsor" of the BCMS
(someone accountable for the BCMS but not engaged in day-to-day BCMS activities) and
"BCM coordinator", "BCM manager" or something similar to it - one or more persons
with active duties regarding the BCMS. It is the best to document these roles and
responsibilities in your BCM Policy.
5. Implement mandatory procedures
BS 25999-2 requires the following four mandatory procedures to be implemented:
document and records control, internal audit, preventive and corrective actions - these

2. procedures are actually the foundation of your management system, similarly to ISO
27001 or ISO 9001.
6. Perform business impact analysis and risk assessment
Through business impact analysis you have to identify the critical activities, their
maximum tolerable period of disruption, the dependencies of those critical activities
(including dependencies to suppliers and outsourcing partners), and set recovery time
objectives.
By doing the risk assessment you actually find out what could be the causes to the
disruption of your critical activities - those could be natural, but also man-made activities
(either malicious or accidental). You would also need to do risk treatment, which means
you need to decide how to decrease the possibility of something going wrong.
Unfortunately, the risk assessment and treatment are not very well defined in this
standard, so you might take a look at ISO 27001 which describes them in more detail.
7. Determining the business continuity strategy
Before you proceed with writing business continuity plans, you actually have to
determine which resources you will need for resuming your critical activities - which
people, locations, data, hardware, software, suppliers, outsourcing partners etc.
The business continuity strategy has to determine not only what you need, but also how
you are going to provide those resources.
8. Developing incident management plans and business continuity plans
The purpose of incident management plans is to describe how you are going to respond
directly to the occurrence of an incident (e.g. fire, earthquake, bomb threat, power failure
etc.) in order to prevent it to spread, and to try to decrease its direct effects.
On the other hand, the purpose of business continuity plans is to describe how you are
going to recover your critical activities - how you are going to put all the resources you
have prepared into action. This means you have to describe who is going to do what, in
which time, using which data and technology, in order to put your organization back into
operation.
All of these plans have to be described in detail, because they must be executed even in
case the main personnel is not available - therefore, they have to be written in such a way
that somebody else would be able to execute them.
9. Training and awareness

3. You need to define the level of competence needed for the execution of business
continuity plans in case of disruption, and then train all the personnel (both employees
and external partners) to reach this level of competence.
However, this is not enough - you also need to explain to your personnel why BCM is
necessary. Let's face it - your business continuity plans will be used maybe only once in a
life time, so most people consider it as a waste of time. Therefore, you have to explain to
them why such a thing must exist. (See also How to deal with BCM sceptics)
10. BCMS exercising
If you thought you have written your plans perfectly, you are probably wrong - it is
almost impossible to write a plan with no errors right at the beginning. This is why
exercising is a mandatory part of BCMS - you have to test your plans in a situation that
more or less resembles a real disruption. Only then will you find out what you planned
well, and what you didn't.
11. Maintaining and reviewing the BCMS
Another way to keep your BCMS up-to-date is by defining the intervals at which you will
review your business continuity plans, but also other arrangements (e.g. contracts with
suppliers and outsourcing partners, training and awareness etc.). There are all sorts of
changes in the environment that are threatening your documentation to become obsolete -
it is enough for an employee to leave the company to have an unusable telephone number
in a plan if that person had a role in the BCMS.
It is also mandatory to perform post-incident review if an incident really occurred - the
purpose is to find out how the organization really reacted - did it follow the plans or not.
12. Internal audit
The purpose of internal audit is to find out if there is something wrong, in an objective
manner - the internal auditor should be a person who can find out if something is done
wrong within your BCMS in order to correct it. If done properly, internal audit could be
one of the best ways to improve your BCMS.
13. Management review
As said before, it is very important to get your management involved in the project -
management review is designed exactly for that. The standard requires the management
to examine all the relevant facts about BCM and decide whether it has fulfilled its
purpose. Once that is done, the management has to decide which improvements must be
made.
14. Preventive and corrective actions

4. The best thing would be to prevent mistakes (or in terms of BS 25999, the "non-
conformities") from happening - this is what the preventive actions are used for - they are
a systematic way of correcting things before a problem occurs. Similar to preventive
actions, there are also corrective actions which resolve the problem that has already
occurred.
Now the question is - why would you use BS 25999-2? Although it is (still) not an
international standard, it is the most popular standard for business continuity worldwide -
the above mentioned steps are designed by the best business continuity experts, so if you
want to implement the best accepted practices for business continuity, you have to look
no further.
Here you can download the diagram of BS 25999-2 implementation process showing all
these steps together with the required documentation (registration required).
If you want to download over free 50 ebook for iso 9001 standard, you can visit:
http://iso9001ebooks.info
Best regards