Internal Audit of Resilience

Internal audit of resilience is the firm's own independent check on whether its resilience arrangements work as described. It sits apart from the teams that design, run, and test important services, and it asks a harder question than whether documents exist: do the controls operate, under realistic conditions, for the services that matter most, and does the evidence support the assurance the firm gives itself? Its value lies in its independence and in its willingness to report weaknesses plainly, while there is still time to fix them.

A good internal audit does not simply repeat the work of the resilience team in different words. It chooses its scope by risk, follows the trail for selected services from map to tolerance to test to incident, and tests whether the people named in plans can actually do what the plans require. Its report should leave the firm with a short list of findings that are specific enough to act on, each with an owner and a date, rather than a general judgement that everything is broadly satisfactory.

Independence matters because resilience work is easy to grade generously from the inside. The team that built a plan naturally believes in it, and the team that ran a test naturally remembers the parts that went well. An auditor who did not build the plan and did not run the test can ask the awkward questions without loyalty to the original design, and can follow a thread that the original team stopped following because it became uncomfortable.

Scope should follow risk to important services, not convenience or rotation alone. Services whose failure would cause the most harm to users, services with complex supplier chains, services that have changed recently, and services whose last test or incident raised questions are natural priorities. A plan that audits every service equally, regardless of risk, spreads effort thinly and may miss the service where a weakness matters most.

Within a chosen service, scope should follow the trail. The auditor can start from the map, check that it reflects the service as it runs today, then check the tolerance, then examine the most recent tests and incidents to see whether they genuinely exercised the dependencies the map identifies. That service-by-service approach produces findings that a service owner can act on, whereas a review of resilience as a general topic tends to produce observations that belong to nobody in particular and are therefore fixed by nobody.

The difference between a document review and an audit is testing. Reading a plan shows what the firm intends; testing shows what happens. An auditor might ask the second person on a rota to locate the recovery sequence, walk through a test record with the people who ran it to check that the record matches their memory, or trace an incident follow-up to confirm that the agreed change was actually made and is visible in the current plan.

A useful finding is specific, evidenced, and owned. It names the service, the control or arrangement concerned, the evidence examined, and the gap found, in terms that the service owner can act on without further interpretation. It distinguishes between a missing document, a control that did not operate, and a tolerance that no longer reflects the service, because each fault needs a different fix. A finding that merely says resilience could be improved helps nobody.

Internal audit cannot make a service resilient, and its assurance is only as good as its scope, its access, and its willingness to report bad news. An audit that examines only well-run services, that accepts prepared evidence without testing it, or that softens findings to preserve relationships will produce comfort without insight, and that comfort is dangerous precisely because it looks like assurance.

The firm should therefore read audit reports with the same critical eye it applies to other evidence. Ask which services were not examined, what the auditor could not access, and whether the findings match what tests and incidents have already suggested. Where audit, testing, and incident experience point in the same direction, the firm has a strong signal. Where they disagree, the disagreement itself is worth investigating, because it usually reveals a gap in understanding that matters more than any single finding.