Evidence Audit Examinations and Readiness

Evidence turns a claim about resilience into something another person can check. A firm may say that an important service will keep running through disruption, or return within its tolerance when it stops, but that statement only carries weight when a trail supports it. The trail runs from the service itself, through its map and its tolerance, to its tests and its incidents, with dates, owners and outcomes attached at each step. Audit and examination are the moments when someone outside the team that runs the service looks at that trail and asks whether it proves what it claims to prove.

This guide is the starting point for the cluster. It explains how the different kinds of checking fit together, where each one adds value, and where each one can mislead if it is treated as an end in itself. A clean examination is not the same as a resilient service, and a thick evidence file is not the same as readiness. The test that matters is practical: if a disruption happened tonight, could the people on duty find what they need, follow the plan, and show afterwards what happened and why.

Evidence does several jobs at once, and confusing them is a common source of trouble. It helps the firm itself learn, because a test result or an incident record shows what worked and what did not. It helps an auditor judge whether controls operate as described, rather than as intended. It helps a supervisor understand how the firm thinks about its important services and where its weak points sit. And it helps a board judge whether the assurance it receives is grounded in observed performance or in assertion.

Internal audit, external assurance and supervisory examination are often spoken of as if they were interchangeable, but they answer different questions and they report to different audiences. Internal audit serves the firm, testing whether its own arrangements work and whether its risks are understood, and it can be frank about weaknesses because its purpose is improvement. External assurance serves a reader outside the firm, and its scope and wording are shaped by the engagement agreed, so its limits need to be read as carefully as its conclusions.

A supervisory examination serves the supervisor, and it places the firm's resilience in the context of the wider system and the expectations of the regime that applies. Under DORA in the EU, the frame is the digital operational resilience regulation, while in the UK the frame is set by the FCA and PRA policy statements, and the two should never be merged into a single set of expectations. A firm that prepares one generic pack for every visitor will answer nobody well. Preparation should start from the question each visitor is entitled to ask, and from the service the question is about.

The pitfall for this cluster is evidence assembled for an examination and never used to run the service, so the firm is ready for the visit and unready for the disruption. The signs are familiar: a plan that nobody outside the team that wrote it has read, a test that rehearses the easy path and avoids the awkward dependency, a checklist completed without anyone checking that the underlying arrangement still exists, and an incident review that records lessons nobody owns. Each sign points to the same fault, which is that checking has become a performance rather than a discipline.

Read this pillar first for the overall picture, then move to the guides that match the task in hand. The guide on what good evidence looks like sets the standard for a single record. The guide on evidence trails shows how records for one service join up. The audit guides explain internal and external checking in turn, and the examination guide explains what a supervisor is doing and why. Self-assessment, checklists, gaps, incident evidence, board assurance, retention and new services each have their own guide, because each task tempts the firm toward a different shortcut.

Before relying on any assurance drawn from this cluster, ask whether the underlying evidence is tied to a named service, dated, and owned. Ask whether the most recent test or incident changed anything, and if it changed nothing, ask why. Ask whether the person presenting the evidence is also the person who would act in a disruption, and if not, whether the handover between them has itself been tested. Ask, finally, whether the regime being cited matches the firm and the service in question, with DORA and UK expectations kept distinct.

Educational guides can explain how evidence, audit and examination work, but they cannot certify that a particular firm is ready, and they are not a substitute for the firm's own judgement, its advisers, or its supervisor. The value of this cluster is that it gives a reader a way to ask better questions of the evidence in front of them, and to spot the moment when a polished file is standing in for a service that has not, in fact, been tested.