Requirement
The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions.
Points of Focus
Considers Mitigation of Risks of Business Disruption
Requirement: Risk mitigation activities include the development of planned policies, procedures, communications, and alternative processing solutions to respond to, mitigate, and recover from incidents that disrupt business operations. Those resilience policies and procedures include monitoring processes, information, and communications to support the achievement of the entity's objectives during response, mitigation, and recovery efforts.
Considers the Use of Insurance to Mitigate Financial Impact Risks
Requirement: The risk management activities consider the use of insurance to offset the financial impact of loss events that would otherwise impair the ability of the entity to support the achievement of its objectives.
Explanation
The organization must plan for events that could disrupt the business — outages, disasters, or other incidents — by developing recovery procedures and alternative processing options, and by considering insurance to offset financial impact. Auditors look for documented resilience plans and evidence that disruption risks identified in the risk assessment have corresponding mitigation activities.
