Skip to content

ACCA Strategic Professional · Strategic Business Leader · IT systems security and control

Vantor Bank has a documented business continuity plan that has never been exercised. A new risk committee chair asks what most improves confidence that the plan will work. Which action is most appropriate?

The bank should run scenario-based tests and exercises and update the plan from what they reveal. Untested plans give no real assurance. Regulatory filing, insurance or restricting the plan to IT do not show people and systems can actually recover.

  1. ARun scenario-based tests and exercises, then update the plan for lessons learnedCorrect
  2. BFile the plan with the regulator to demonstrate compliance
  3. CIncrease the insurance cover on IT equipment
  4. DRestrict the plan to the IT department to keep it confidential

Explanation

Plans only give assurance when tested through walkthroughs, simulations or full failover, and then revised. Filing the plan, buying insurance or restricting circulation does not show that staff can execute it. Continuity involves the whole business, so limiting it to IT is also wrong.

Did you get it right without looking?

One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.

Practise IT systems security and controlFree diagnostic mock

More IT systems security and control questions