Audit of Business Continuity Planning

Background

The Audit and Assurance Services Branch of Indigenous and Northern Affairs Canada ("INAC" or "the Department") identified the Audit of Business Continuity Planning in the Department's 2016-2017 to 2018-2019 Risk-Based Audit Plan mid-year update, which was approved by the Deputy Minister on September 13, 2016. The audit was identified as a high priority due to the significance of recent departmental events requiring the use of a business continuity plan. The audit was initiated in December 2016, and audit fieldwork concluded in April 2017. This report details the results of the audit.

Audit Objective and Scope

The objective of the audit was to assess the adequacy, efficiency and effectiveness of the design of the management control framework established for developing, maintaining and operationalizing the Department's Business Continuity Planning (BCP) Program.

The audit scope focused on assessing the governance framework,^{Footnote 1} the development of business continuity plans, the readiness and awareness of INAC's BCP Program, and the management controls in place to ensure that INAC has the capacity to deliver the BCP Program in compliance with applicable legislation and policies.

Audit work considered the incident management and internal emergency management processes that overlap and/or integrate with the BCP Program. Audit work also considered arrangements with external service providers, including other government departments, in support of the Department's overall BCP strategy. The scope was limited to those processes, agreements and controls that intersect or overlap with the BCP Program and excluded examining the internal emergency management and incident management programs in their entirety. The scope also excluded the Emergency Management Assistance Program, which is specific to emergency incidents occurring on First Nation Reserves.

Statement of Conformance

This audit was conducted in conformance with the International Standards for the Professional Practice of Internal Auditing, as supported by the results of the quality assurance and improvement program.

Conclusion

The Department has established a management control framework for developing, maintaining, and operationalizing its Business Continuity Plan. Also, the BCP Program is currently under review to strengthen readiness and awareness due to challenges experienced during recent incidents, including INAC office occupations.

Recognizing that changes are currently underway, opportunities to improve key elements of the BCP management control framework were identified, including strengthening the: governance structure and monitoring of the BCP Program; process for developing business continuity plans; and, communication and training provided to staff involved in BCP activities.

Recommendations

Based on observations made during the audit, the audit team recommends that the Chief Finances, Results and Delivery Officer in collaboration with the Director General of Human Resources and Workplace Services in consultation with the Senior Assistant Deputy Minister of Regional Operations and the Assistant Deputy Minister of Northern Affairs Organization :

1. Strengthen the BCP governance framework by:
   • Reviewing and assessing the roles and responsibilities needed to implement the BCP Program requirements;
   • Reviewing, updating and communicating BCP governance, policies and procedures;
   • Reviewing and reinforcing how support is delivered to regional/sectoral BCP Coordinators to promote effective development of business continuity plans; and
   • Strengthening the monitoring and reporting of the effectiveness of BCP, and formalizing a results-based reporting framework to promote accountability.
2. Strengthen the practices for developing business continuity plans by:
   • Reviewing, refining, clarifying and communicating BCP guidance material, including department-defined critical services and critical support services, to staff involved in BCP activities
   • Reviewing and reinforcing how priorities within and across sectoral/regional business continuity plans are identified and aligned; and
   • Conducting an assessment to determine whether the BCP Refinement Strategy promotes the effective development and integration of BIAs and business continuity plans, with appropriate consideration to stakeholder interdependencies.
3. Strengthen the BCP Program readiness and awareness by:
   • Formalizing a training and awareness program for regional/sectoral BCP Coordinators to carry out BCP-related responsibilities; and
   • Conducting an assessment to determine whether the BCP Program Refinement Strategy effectively promotes BCP Program awareness and readiness, including ensuring that business continuity plans are maintained, accessible and tested on a regular basis.

Management Response

Management agrees with the findings, has accepted the recommendations included in the report, and has developed a management action plan to address them. The management action plan has been integrated in this report.

1.1 Context

Business continuity planning (BCP) is a "proactive planning process that ensures critical services are delivered during a disruption.^{Footnote 2} A critical service is one whose compromise would result in a high degree of injury to the health, safety, security or economic well-being of Canadians, or to the efficient functioning of the Government of Canada.^{Footnote 3}

A business continuity plan includes the plans, measures and arrangements to ensure the continuous delivery of critical services and products, which permits the organization to recover its facility, data and assets. The plan also identifies necessary resources to support BCP, including personnel, information, equipment, financial obligations, legal counsel, infrastructure protection and accommodations.^{Footnote 4}

Business continuity plans are not meant to cover all organizational services or activities, but rather the organization's critical services as well as any services that directly or indirectly support critical services, referred to as "critical support services".

Business impact analyses (BIAs) must be performed to assess the impacts of disruptions on the organization and to identify and prioritize critical services and associated support services and assets. The business continuity plans should be established based on the results of the BIAs. The performance of BIAs and development of business continuity plans should be consistent across the organization and the results of these activities should be documented, comprehensive and approved.^{Footnote 5}

As part of the Government of Canada's baseline security requirements described in the Treasury Board Policy on Government Security (PGS) and the associated Operational Security Standard - Business Continuity Planning Program (OSS-BCPP), departments must establish a BCP Program to provide for the continued availability of services and associated assets that are:^{Footnote 6}

• Deemed critical to the health, safety, security, or economic well-being of Canadians;
• Deemed critical to the effective functioning of government; or
• Warranted by a threat and risk assessment (TRA).

The OSS-BCPP states that a BCP Program is composed of four elements:^{Footnote 7}

• The establishment of BCP Program governance;
• The conduct of a BIA;
• The development of business continuity plans and arrangements; and
• The maintenance of BCP Program readiness.

BCP complements incident management, which is the discipline of protecting personnel and containing/neutralizing threats and hazards, as well as internal emergency management, which is the discipline of preventing and mitigating emergencies with an emphasis on emergency prevention, mitigation, preparedness, response and recovery.^{Footnote 8} BCP ensures critical services can continue to be delivered throughout a disruption, while emergency management seeks to minimize damage and bring the incident under control in a timely manner.^{Footnote 9}

1.2 BCP at INAC

At INAC, BCP is recognized and administered as a formal program within the Information Management Branch of the Chief Finances, Results and Delivery Officer (CFRDO) Sector. INAC outlines the roles and responsibilities for implementing the BCP Program through its Policy on Business Continuity Management (BCM). The Policy on BCM adopts the Treasury Board OSS-BCPP.

Per the OSS-BCPP, the Departmental Security Officer (DSO) is to direct and coordinate the security program, which includes BCP. At INAC, the DSO, within the Human Resources and Workplace Services Branch, is responsible for establishing and directing the departmental security program that ensures coordination and implementation of all BCP Program requirements, issues and functions. The Chief Information Officer (CIO), within the CFRDO Sector, is responsible for directing and managing the BCP Program and monitoring compliance to the Policy on BCM. Also consistent with the OSS-BCPP, INAC has appointed a full-time Departmental BCP Coordinator who is responsible for the Departmental BCP Program and ongoing liaison with the DSO. Reporting to the CIO, the Departmental BCP Coordinator is responsible for the development and maintenance of the overall BCP Program.

The BCP Program is coordinated at the national level, and applies to all regions and sectors of INAC. The development of region- and sector-specific business continuity plans is the responsibility of regional/sectoral heads (i.e. Regional Directors General and Assistant Deputy Ministers). Specifically, regional/sectoral heads are accountable to the Deputy Minister for the effectiveness and maintenance of BCP for their respective organizations. They are responsible for ensuring departmental expert review and compliance with the BCP Program requirements. Each region and sector has a BCP Coordinator to support the implementation, maintenance, and testing of the BCP Program. Regional/sectoral BCP coordinators perform these activities on a part-time basis and have other full-time duties, which typically fall within the region/sector's corporate services. Most regional/sectoral BCP Coordinators also act as the security officer for their region/sector.

1.3 BCP changes underway at INAC

At the time of this audit, INAC already had multiple internal initiatives underway to strengthen its BCP Program. As an example, a ‘Lessons Learned' report was recently developed further to 2016 Occupy INAC^{Footnote 10} incidents. The report identified challenges experienced invoking business continuity plans and made recommendations to prevent and mitigate protest-related impacts on INAC business operations. The report recommended that regions revisit and revise their business continuity plans to ensure relevancy in terms of social protest scenarios as well as to ensure they account for scenarios with longer-term business disruptions.

2.1 Audit Objective

The objective of the audit was to assess the adequacy, efficiency and effectiveness of the design of the management control framework established for developing, maintaining and operationalizing the Department's Business Continuity Plan.

2.2 Audit Scope

The audit examined the adequacy, efficiency and effectiveness of the design of INAC's BCP Program and associated management controls intended to provide assurance that the Department:

• Complies with applicable Government of Canada policies, procedures, directives and standards, including the Treasury Board PGS and OSS-BCPP; and
• Has the appropriate processes and controls in place to support continued operations should events occur that require the business continuity plan to be used.

The audit scope included an assessment of the following areas of highest priority, which were determined based on a risk assessment performed during the audit's planning phase:

• Governance framework, including the roles and responsibilities in place to support the BCP Program from a national, sectoral and regional perspective;
• Development of business continuity plans, including the management controls in place to ensure that business continuity plans, BIAs and related planning activities are documented, comprehensive, and approved;
• BCP Program readiness and awareness, including the management controls in place to ensure that business continuity plans are well-communicated and routinely reviewed/tested and updated; and
• Management controls in place to ensure that INAC has the capacity to deliver the BCP Program in compliance with applicable legislation and policies.

Audit work considered the incident management and internal emergency management processes that overlap and/or integrate with the BCP Program, in light of the areas listed above. Audit work also considered arrangements with external service providers, including other government departments, in support of the Department's overall BCP strategy. However, the scope was limited to those processes, agreements and controls that intersect or overlap with the BCP Program, and excluded examining the internal emergency management and incident management programs in their entirety.

The scope also excluded the Emergency Management Assistance Program, which is specific to emergency incidents occurring on First Nation reserves. Lastly, the scope was limited to the design of the BCP Program and management controls, and excluded procedures to test the effectiveness of the business continuity plans.

5.1 BCP Program governance and delivery

The establishment of a governance framework is essential to the effective delivery of a BCP Program. Within the governance framework, it is pertinent that roles, responsibilities, and accountabilities are clearly defined, documented and well understood.^{Footnote 11}

The BCP Program governance framework is defined by the INAC Policy on BCM. The Policy is aligned to the requirements of the Treasury Board Policy on Government Security and the OSS-BCPP, and defines the expected results of the BCP Program. The Policy also defines the roles, responsibilities and accountabilities for implementing the BCP Program's requirements. In addition to the Policy, a roles and responsibilities reference guide exists for senior management, with key decision points for invoking a business continuity plan in the event of an incident/emergency.

While a governance framework exists, the following opportunities exist to strengthen BCP Program governance in support of the achievement of the Policy's expected results.

5.2 Development of business continuity plans

Based on the results of the BIA, business continuity plans must include sufficient detail to execute required actions during a business disruption.^{Footnote 15} Departmental guidance and templates are in place to support the development of INAC's business continuity plans. For example, there are documented procedures and templates (last updated in 2011-12) to support regions and sectors in performing BIAs and developing business continuity plans. These documents are maintained by the Departmental BCP Coordinator.

While processes and documented guidance are in place to develop BIAs and business continuity plans, the following opportunities for improvement were noted.

5.3 BCP Program readiness and awareness

BCP readiness and awareness are essential to enabling business continuity during an incident and/or business disruption that requires the business continuity plans to be invoked.^{Footnote 17} While activities are in place to support BCP Program readiness and awareness, the following opportunities for improvement were noted.