Operational Resilience Audit Work Program

// Program Overview

What This Work Program Covers

This Operational Resilience Audit Work Program (Work Program) provides IT audit and consulting professionals with a structured, regulator-aligned framework for evaluating whether an organization has established, implemented, and maintained effective operational resilience capabilities — covering Business Continuity Planning, Disaster Recovery, and the full resilience control lifecycle from governance through continuous improvement.

Applicability

TradFi & Digital Asset

Designed for use at banks, broker-dealers, exchanges, and clearing agencies — and extended for Digital Asset companies and Stablecoin issuers operating under OCC, NYDFS, and emerging GENIUS Act frameworks.

Regulatory Anchor

Multi-Framework Alignment

Anchored to COSO Internal Control — Integrated Framework (2013) and COSO ERM (2017), supplemented by FFIEC BCM Handbook, NIST CSF 2.0, OCC Bulletins, Federal Reserve SR 22-4, SEC Reg SCI, and FINRA Rule 4370.

Structure

Risk Statement → Control → Evidence

Each domain begins with a risk statement explaining what could go wrong, followed by a control objective, detailed audit procedures, expected evidence, and regulatory mapping broken out by framework.

Output

Audit-Ready & Engagement-Ready

Formatted for direct use by audit teams in fieldwork planning, evidence request letters, regulatory examination preparation, and remediation program management engagements.

// Scope — 8 Core Domains + 2 Supplemental

#	Domain	Description	Applies To
1	Governance & Oversight	Board accountability, policy framework, governance structure, and risk appetite definition	TradFi · Digital Asset
2	Business Impact Analysis	Critical process identification, dependency mapping, RTO/RPO/MTPoD/MBCO definition and validation	TradFi · Digital Asset
3	Business Continuity Planning	BCP documentation, activation criteria, crisis communications, alternate processing capabilities	TradFi · Digital Asset
4	Disaster Recovery — IT	DR architecture, data replication, backup controls, runbook governance, automated monitoring	TradFi · Digital Asset
5	Testing & Exercises	Test program design, execution documentation, lessons learned, regulatory test reporting	TradFi · Digital Asset
6	Third-Party Resilience	Vendor tiering, contractual protections, concentration risk, SOC report review	TradFi · Digital Asset
7	Incident Response Integration	CSIRP integration, regulatory notification procedures, crisis management	TradFi · Digital Asset
8	Monitoring & Continuous Improvement	KRI/KPI framework, board reporting, threat intelligence integration, self-assessment	TradFi · Digital Asset
S1	Digital Asset / Stablecoin	Supplemental: node redundancy, smart contract response, key management, reserve continuity	Digital Asset Only
S2	Regulatory Notification	Supplemental: SEC Reg SCI, FINRA 4370, NYDFS 72-hr notice, OCC reporting obligations	TradFi · Digital Asset

// Section 2 — Risk Assessment

Inherent Risk Universe & Scoring Methodology

The following threat-centric risk assessment identifies primary inherent risks associated with operational resilience failures. This supports evolution beyond compliance-based assessments toward a risk-stratified, scenario-driven approach consistent with FFIEC BCM and NIST CSF guidance.

Risk Category	Description	Score	Key Risk Indicator (KRI)
Technology Failure	Critical system outage, hardware failure, or data center unavailability causing prolonged disruption beyond RTO thresholds	5	% of critical systems exceeding RTO in tests; MTTR vs. RTO target
Cyber Event / Ransomware	Ransomware, DDoS, or destructive malware rendering systems unavailable or data unrecoverable; backup corruption risk	5	Time to contain cyber incidents; backup integrity failure rate
Data Corruption / Loss	Replication failure, database corruption, or backup failure resulting in data loss exceeding RPO thresholds	4	Replication latency vs. RPO target; backup job failure rate
Third-Party / Vendor Failure	Critical vendor outage or concentration risk without adequate contractual resilience protections	4	% of critical vendors with assessed BCPs; concentration risk score
Pandemic / Physical Loss	Pandemic, natural disaster, or building unavailability preventing access to primary sites	3	% workforce able to operate remotely; alternate site capacity ratio
Regulatory & Legal	Regulatory action or legal injunction requiring immediate service changes affecting critical activities	3	Open regulatory findings; MRAs/MRIAs outstanding; days to remediate
Blockchain / On-Chain Failure	Smart contract exploit, node failure, consensus failure, or bridge attack — Digital Asset only	5	% nodes in DR readiness; smart contract IR drill frequency
Key Person Dependency	Loss of critical personnel with specialized DR knowledge during an active recovery event	3	Single-person recovery dependencies; succession coverage ratio
Documentation Failure	Outdated, incomplete, or inaccessible BCP/DR documentation leading to inconsistent recovery execution	3	% of runbooks with lapsed review; % of DR procedures missing RTO criteria

// Residual Risk Rating Matrix

Inherent Risk Rating × Control Effectiveness = Residual Risk Rating

RESIDUAL RISK RATING MATRIX
↓ CONTROL EFFECTIVENESS	← INHERENT RISK RATING →
Rating / Description	1Insignificant(Very Low)	2Minor(Low)	3Moderate(Medium)	4Major(High)	5Severe(Critical)
4IneffectiveAbsent or non-functional	Insignificant	Minor	Moderate	Major	Severe
3Partially EffectiveInconsistent / incomplete	Insignificant	Minor	Moderate	Major	Severe
2Mostly EffectiveAdequate, minor gaps	Insignificant	Insignificant	Minor	Moderate	Major
1EffectiveFully operational	Insignificant	Insignificant	Insignificant	Minor	Moderate

Severe — Immediate Board escalation required

Major — Prompt senior management action

Moderate — Targeted remediation plan required

Minor — Low residual risk

Insignificant — Adequately controlled

1

Governance and Oversight

TradFi · Digital Asset · COSO Control Environment · FFIEC BCM §15-17

Domain Overview

Evaluates whether the Board of Directors and senior management have established, approved, and actively oversee an operational resilience program aligned with regulatory expectations. Effective governance is the foundation on which all other resilience controls depend — without defined accountability structures, risk appetite, and oversight mechanisms, BCP/DR programs lack the strategic direction and sustainability required to withstand regulatory scrutiny.

⚠Risk:Without Board-level accountability and defined governance structures, the operational resilience program may lack strategic alignment and resources, resulting in inadequate response to disruption events and regulatory non-compliance.

Board-Level Accountability and Policy Framework

Audit Procedures

Obtain Board-approved OR and BCP/DR policy. Confirm currency (reviewed ≤12 months), risk appetite articulation, and named accountability assignments.
Inspect Board/Risk Committee minutes over review period. Confirm OR is a standing agenda item and Board receives BCP/DR test results and material incident reporting.
Confirm policy suite covers all resilience domains and references applicable regulatory requirements (FFIEC, SEC, FINRA, OCC).
Digital Asset: Confirm policies address on-chain continuity, smart contract IR, and key management recovery obligations.

Expected Evidence

Board-approved BCP/DR policy with revision history and dated sign-off
Board and Risk Committee minutes confirming OR reporting receipt
Policy index with owner, version, and last review date
Evidence of policy update following regulatory change or material incident

Regulatory Mapping

FFIEC BCM pp. 12-17 OCC Bulletin 2019-37 Federal Reserve SR 22-4 NIST CSF GV.OC-01 COSO ICIF Control Environment COSO ERM Governance & Culture ISO 22301 §5.1

⚠Risk:Absence of a formally designated senior management owner and active oversight committee may result in fragmented accountability and insufficient resource commitment to BCP/DR program maintenance.

Senior Management Oversight and Governance Structure

Audit Procedures

Confirm a named senior-level role (CRO, COO, or designated resilience head) is formally accountable for the OR program.
Verify governance committee exists with defined cadence, quorum requirements, and documented minutes (minimum quarterly).
Confirm roles, responsibilities, and backup designations for BCP/DR activation authority are formally documented and current.
Assess whether periodic resilience maturity self-assessments are conducted and results reported to governance.

Expected Evidence

Org chart / RACI matrix showing OR program ownership
Governance committee charter with terms of reference
Committee meeting minutes (minimum quarterly)
Documented roles, responsibilities, and backup designations

Regulatory Mapping

FFIEC BCM pp. 15-17 OCC Heightened Standards 12 CFR Part 30 App. D FINRA Rule 4370-01 COSO ICIF CE Principles 1-5 COSO ERM Governance & Culture Component

⚠Risk:An incomplete or outdated policy and procedure framework may result in inconsistent control execution and an inability to demonstrate regulatory compliance during examinations or post-incident reviews.

Policy Completeness, Currency, and Regulatory Alignment

Audit Procedures

Evaluate whether policy suite comprehensively covers BCP, DR, incident response, crisis communications, and third-party resilience with no material gaps.
Confirm policies are aligned with applicable regulations and that a regulatory change monitoring process triggers timely updates.
Verify each policy has a documented review cycle (minimum annual) with completed sign-offs and maintained revision history.
Assess whether policy exceptions are tracked, approved at appropriate authority level, and subject to compensating controls.

Expected Evidence

Policy inventory with status, owner, version, and last review date
Annual review attestations signed by policy owners
Policy exception register with approvals
Evidence of regulatory change management triggering updates

Regulatory Mapping

FFIEC BCM p. 12 ISO 22301 §6.2 NIST CSF GV.PO-01 COSO ICIF Control Activities Principle 12 OCC Stablecoin Interp. Letter 1174 NYDFS Part 500 §500.16

2

Business Impact Analysis (BIA)

TradFi · Digital Asset · COSO Risk Assessment · FFIEC BCM §22-28

Domain Overview

Assesses the quality, currency, and completeness of the BIA — the foundational risk assessment document that identifies critical business processes, maps technology dependencies, and establishes RTOs, RPOs, MTPoD, and MBCO. A stale or incomplete BIA is one of the most common root causes of audit findings in operational resilience engagements.

⚠Risk:If critical processes are not formally identified and risk-tiered, recovery resources may be misallocated, causing the organization to miss regulatory recovery time requirements and fail to restore the most critical services first.

Critical Process Identification, Dependency Mapping, and Tiering

Audit Procedures

Obtain the most recent BIA. Confirm it was completed or formally reaffirmed within the past 12 months or following a material organizational change.
Assess whether the BIA applies an objective criticality tiering framework (Critical/High/Medium/Low) with documented, consistently applied assignment criteria.
For a sample of Tier 1/2 processes, trace dependencies to underlying applications, data stores, infrastructure, and third-party services. Confirm accuracy.
Verify the BIA is formally approved by process owners and changes to ownership or dependencies are reflected in the current version.

Expected Evidence

Completed BIA with approval sign-off, review date, and version history
Criticality tiering methodology and scoring criteria
Process-to-technology dependency mapping (e.g., CMDB extract)
Evidence of BIA refresh triggered by a material change

Regulatory Mapping

FFIEC BCM pp. 22-28 Federal Reserve SR 14-1 §III ISO 22301 §8.2.2 NIST CSF ID.AM-01/04 COSO ERM Strategy & Objective-Setting COSO ICIF Risk Assessment Principles 6-7

⚠Risk:Undefined or unvalidated RTOs and RPOs expose the organization to recovering systems in the wrong sequence or failing to restore data currency, resulting in regulatory breaches and client impact.

RTO and RPO Definition, Regulatory Validation, and Plan Linkage

Audit Procedures

Verify RTOs and RPOs are explicitly defined for all Tier 1/2 processes and supporting systems, traceable to the BIA.
Assess whether RTOs/RPOs are benchmarked against applicable regulatory requirements (e.g., SEC Reg SCI same-business-day recovery) and client SLAs.
Confirm BIA-defined RTOs/RPOs are formally referenced and operationalized in DR procedures and recovery runbooks.
Digital Asset: Confirm on-chain and off-chain recovery objectives are defined separately, accounting for blockchain transaction continuity.

Expected Evidence

BIA table showing RTOs and RPOs by system and process tier
Evidence of RTO/RPO validation against regulatory thresholds
DR procedures referencing BIA-defined recovery targets
(Digital Asset) Separate on-chain and off-chain RTO/RPO definitions

Regulatory Mapping

FFIEC BCM pp. 24-26 SEC Reg SCI Rule 1002(b) FINRA Rule 4370(d)(5) COSO ERM Performance / Risk Response COSO ICIF Risk Assessment Principle 9

3

Business Continuity Planning (BCP)

TradFi · Digital Asset · FFIEC BCM §32-38 · FINRA Rule 4370 · ISO 22301 §8.4

Domain Overview

Reviews whether the organization has designed, documented, and maintained comprehensive BCPs for all critical business lines. Effective BCPs translate BIA findings into actionable recovery procedures — covering plan completeness, activation authority, crisis communications, manual workarounds, and alternate processing capabilities within defined MTPoD thresholds.

⚠Risk:Incomplete, outdated, or inaccessible BCP documentation may cause uncoordinated recovery responses, extended service outages, and missed regulatory notification deadlines when a disruption occurs.

BCP Documentation Completeness, Currency, and Accessibility

Audit Procedures

Obtain current BCP for each critical business line. Confirm scope, activation criteria, sequential recovery procedures, defined roles, current emergency contacts, and regulatory notification requirements.
Verify documented succession plans with validated contact information accessible during a primary system outage.
Confirm plans are in a centralized, version-controlled repository with offline/hard-copy provisions.
Confirm formal annual review and owner attestation with sign-off captured in revision history.

Expected Evidence

BCP documents with revision history for each critical business line
Centralized document repository with access controls and offline backup
Annual review attestations by business owners
Validated emergency contact lists

Regulatory Mapping

FFIEC BCM pp. 32-38FINRA Rule 4370(b) and (d)NIST CSF RC.RP-01ISO 22301 §8.4.4COSO ICIF Control Activities Principle 12

⚠Risk:Ambiguous activation criteria and inadequate crisis communications may delay BCP declaration, slow recovery resource mobilization, and result in untimely communication to regulators and clients.

BCP Activation Criteria and Crisis Communication Protocols

Audit Procedures

Review BCP activation criteria. Confirm unambiguous event type, severity threshold, and named declaration authority — not subject to interpretation under pressure.
Assess crisis communication procedures covering all stakeholder groups: staff, clients, regulators, board, and media — with defined responsible parties and timing.
Confirm regulatory notification requirements and templates are embedded in the BCP, cross-referenced to the incident response plan.

Expected Evidence

BCP activation criteria and declaration authority matrix
Crisis communication plan with stakeholder-specific notification procedures
Pre-drafted regulatory notification templates
Evidence of communication protocol testing during exercises

Regulatory Mapping

FFIEC BCM p. 36SEC Reg SCI Rule 1002(b)(5)FINRA Rule 4370(d)(6)NIST CSF RS.CO-02/03ISO 22301 §8.4.3

4

Disaster Recovery — IT Recovery Capabilities

TradFi · Digital Asset · FFIEC BCM §44-48 · SEC Reg SCI · NIST CSF PR.DS

Domain Overview

Evaluates IT disaster recovery capabilities enabling the organization to restore critical systems and data following a technology disruption. Key areas: DR architecture alignment with production, data replication and RPO compliance, automated monitoring, runbook governance, and validated failover — all anchored to BIA-defined RTOs/RPOs. This domain frequently generates the most technically complex findings in operational resilience audits.

⚠Risk:If the DR environment is not maintained in alignment with production, recovery attempts may fail or produce inconsistent results, leading to extended outages and inability to demonstrate adherence to regulatory recovery standards.

DR Architecture Design and Production Environment Parity

Audit Procedures

Obtain current DR architecture documentation. Confirm the DR environment mirrors production in application versions, configuration settings, and infrastructure specs.
Using sample-based testing, verify application version parity between production and DR is maintained through a formal CI/CD pipeline or deployment process.
Review application and system inventory. Confirm all Tier 1/2 systems have designated DR environments with documented, tested failover procedures.
Digital Asset: Confirm blockchain nodes and validator infrastructure are replicated to geographically distributed DR environments with tested failover.

Expected Evidence

DR architecture diagram (current, approved version)
Application version and configuration comparison report (prod vs. DR)
Sample deployment pipeline records confirming environment parity
Application inventory with DR environment designations for Tier 1/2 systems

Regulatory Mapping

FFIEC BCM p. 44SEC Reg SCI Rule 1001(a)(2)(v)NIST CSF RC.RP-02FINRA Rule 4370(d)(2)COSO ICIF Control Activities

⚠Risk:Inadequate replication controls or absent automated monitoring may result in data loss exceeding RPO — preventing the organization from restoring a clean, current dataset following a disruption.

Data Replication Integrity, Backup Controls, and RPO Compliance

Audit Procedures

Review data replication architecture. Confirm automated monitoring and alerting is deployed to detect replication latency and failures in near-real time.
Obtain replication logs and monitoring reports. Confirm successful completion; any exceptions tracked, escalated, and resolved within SLAs.
Confirm data integrity validation (checksums, row counts) between primary and DR runs on defined frequency with documented results.
Review backup policy: encrypted, geographically separate, retained per policy, and restorability tested at least annually.

Expected Evidence

Automated replication monitoring configuration and alert routing
Replication job completion and exception logs (review period)
Data integrity validation reports (checksums/row counts)
Backup policy and annual restoration test results
(Digital Asset) Key backup and recovery procedure test evidence

Regulatory Mapping

FFIEC BCM p. 47NIST CSF PR.DS-01/11ISO 22301 §8.7OCC Stablecoin Interp. Letter 1179NYDFS Part 500 §500.15

⚠Risk:Decentralized or incomplete DR runbooks may cause inconsistent recovery execution, missed steps, or failure to meet RTO targets — undermining the reliability of the DR program during an actual event.

DR Runbook Governance, Completeness, and Centralized Accessibility

Audit Procedures

Obtain all DR runbooks for Tier 1/2 systems. Confirm each includes: sequential recovery steps, explicit RTO start/stop criteria, success metrics, rollback procedures, escalation contacts, and owner information.
Verify runbooks are in a centralized version-controlled repository with formal annual review and owner attestation. Offline access provisions must exist.
Confirm runbooks cross-reference the BIA, validating alignment to RTOs/RPOs for each system.
Flag decentralized or fragmented storage as a control gap requiring remediation.

Expected Evidence

Centralized runbook repository with access controls and version history
Annual review attestations for each runbook
Runbooks containing RTO criteria, success metrics, and rollback procedures
BIA-to-runbook cross-reference documentation

Regulatory Mapping

FFIEC BCM p. 42ISO 22301 §8.4.5FINRA Rule 4370(d)(3)COSO ICIF Control Activities Principle 11

5

Testing and Exercises

TradFi · Digital Asset · FFIEC BCM §52-58 · SEC Reg SCI Rule 1002(b)(4) · FINRA 4370(e)

Domain Overview

Examines the design, execution, and follow-up of the BCP/DR testing program. Regular, well-designed testing is the only reliable means of validating that recovery capabilities will perform as intended. Regulators expect scenario diversity, formal documentation, and a structured lessons learned process that closes gaps before the next test cycle.

⚠Risk:An untested or inadequately scoped testing program creates false assurance that recovery capabilities will perform as designed, potentially exposing the organization to extended outages and undetected control gaps.

Test Program Design, Scope, and Regulatory Coverage

Audit Procedures

Obtain annual testing calendar. Confirm tests scheduled for all Tier 1/2 systems at required frequencies (minimum annual full DR; semi-annual tabletop).
Assess test scenario diversity: technology disruption, people-focused, and third-party failure scenarios.
For SEC Reg SCI entities: Confirm annual test with members/participants conducted and results reported to SEC within 30 days.
Confirm participation in applicable industry-coordinated resilience exercises with documented outcomes.

Expected Evidence

Annual testing calendar with scenario descriptions and scope
Test coverage mapping to Tier 1/2 systems and processes
SEC Reg SCI test notification and results submission
Industry exercise participation records and outcomes

Regulatory Mapping

SEC Reg SCI Rule 1002(b)(4)FINRA Rule 4370(e)FFIEC BCM pp. 52-58ISO 22301 §8.5NIST CSF RC.IM-01

⚠Risk:Poorly documented test results prevent evaluation of recovery performance against defined objectives and reduce audit and regulatory assurance over the effectiveness of the BCP/DR program.

Test Results Documentation and Lessons Learned Governance

Audit Procedures

Obtain results reports for the most recent DR test cycle. Confirm: test objectives, scope, expected vs. actual outcomes, RTO/RPO achievement, issues, and management sign-off.
Assess whether a standardized results template is used consistently across all tests and teams.
Confirm RTO start/stop criteria are explicitly defined and consistently applied.
Verify all identified issues are logged in an issue tracking system with owners, severity ratings, and target dates. Confirm high-priority closure is independently validated.

Expected Evidence

DR test results reports (last two test cycles)
Standardized results template with expected vs. actual outcomes
RTO measurement records with defined start/stop timestamps
Issue tracking register with severity, owners, and target dates
Evidence of independent closure validation for high-priority items

Regulatory Mapping

FFIEC BCM p. 55-58FINRA Rule 4370(e)(2)ISO 22301 §10.2COSO ICIF Monitoring Principle 17COSO ERM Review & Revision Component

6

Third-Party and Vendor Resilience

TradFi · Digital Asset · OCC Bulletin 2019-37 · FFIEC BCM §62-65 · NIST CSF GV.SC

Domain Overview

Assesses whether the organization has extended resilience controls to critical third-party providers. Third-party concentration risk and vendor-level recovery capability adequacy are priority examination areas under OCC, FFIEC, and Federal Reserve guidance. Without formal vendor tiering, contractual resilience protections, and periodic due diligence, a vendor disruption can cascade directly into a client-facing service failure with no independent mitigation path.

⚠Risk:Reliance on critical third-party providers without assessing or contractually securing their operational resilience capabilities creates concentration risk and may expose the organization to service disruptions it cannot independently mitigate.

Vendor Tiering, Contractual Protections, and Resilience Testing Integration

Audit Procedures

Obtain vendor inventory. Confirm tiering process classifies vendors by criticality (service dependency, concentration risk, substitutability).
Confirm all Tier 1/2 vendors have been subject to OR due diligence within the past 12 months, including review of vendor BCP/DR capabilities.
Review sample contracts for Tier 1/2 vendors. Confirm: RTO/RPO commitments, incident notification SLAs, BCP testing requirements, and right-to-audit clauses.
Confirm vendor DR testing is incorporated into the organization's own program or structured review of vendor-provided results.
Obtain current SOC 1/2 reports for co-location and data center providers and confirm reviewed for resilience control coverage.

Expected Evidence

Vendor inventory with criticality tiering and last assessment date
Due diligence records for Tier 1/2 vendors
Sample vendor contracts with resilience provisions highlighted
Vendor BCP documentation or SOC 2 Type II reports
Co-location provider SOC reports with review evidence

Regulatory Mapping

OCC Bulletin 2013-29 / 2020-10FFIEC BCM pp. 62-65OCC 2019-37NIST CSF GV.SC-01/06/07Federal Reserve SR 13-19ISO 22301 §8.6COSO ERM Performance Component

7

Incident Response Integration

TradFi · Digital Asset · NIST CSF RS · NIST SP 800-61r3 · NYDFS Part 500 §500.16

Domain Overview

Evaluates whether resilience protocols are effectively integrated with the cybersecurity incident response plan, crisis management framework, and regulatory notification obligations. The majority of significant disruption events intersect with a cyber event — siloed response plans that don't define the cyber-to-DR escalation pathway are a recurring source of audit findings and regulatory examination concerns.

⚠Risk:Disconnected BCP/DR and cybersecurity incident response plans may cause response team confusion, delayed DR activation, and missed regulatory notification timelines when a cyber event triggers a recovery scenario.

BCP/DR and Cyber Incident Response Integration; Regulatory Notification Procedures

Audit Procedures

Obtain BCP/DR and CSIRP. Confirm cross-reference with defined trigger points for escalation from cyber response to DR activation and clear handoff of authority.
Review exercise records. Confirm at least one scenario tested the cyber-to-DR handoff pathway (e.g., ransomware requiring failover).
Confirm regulatory notification timelines and templates are documented and responsibilities assigned for SEC, FINRA, OCC, Fed, NYDFS as applicable.
Review crisis management framework: team composition, activation criteria, authority levels for key decisions, and stakeholder communication protocols.

Expected Evidence

BCP/DR and CSIRP with cross-reference and trigger escalation points
Integrated exercise results demonstrating cyber-to-DR handoff
Regulatory notification procedures with timelines and pre-drafted templates
Current regulatory contact directory with validation evidence
Crisis management plan with team roster and authority matrix

Regulatory Mapping

NIST CSF RS.CO-01/02NIST SP 800-61r3FFIEC BCM p. 36-38SEC Reg SCI Rule 1002(b)(5)FINRA Rule 4370(d)(6)NYDFS Part 500 §500.16/17ISO 22301 §8.4.3COSO ERM Information, Communication & Reporting

8

Monitoring, Reporting, and Continuous Improvement

TradFi · Digital Asset · COSO Monitoring Activities (Principles 16-17) · FFIEC BCM §60

Domain Overview

Reviews the resilience monitoring framework, governance reporting quality, and continuous improvement processes. A program that lacks KRI/KPI tracking and active improvement processes will plateau at baseline compliance — unable to evolve in response to emerging threats, changing regulatory expectations, or lessons from test exercises and real incidents.

⚠Risk:Without defined KRIs and performance metrics, the organization cannot objectively measure resilience program health, identify deteriorating control effectiveness, or demonstrate compliance with risk appetite thresholds to the Board and regulators.

KRI/KPI Framework, Board Reporting, and Continuous Improvement

Audit Procedures

Obtain KRI/KPI framework. Confirm metrics defined with thresholds, frequency, and escalation triggers for: replication latency vs. RPO, RTO achievement rates, % of plans with lapsed review, open items aging, and vendor incident frequency.
Review KRI reporting for past four quarters. Confirm consistent measurement, breach escalation, and trend analysis.
Review Board/Risk Committee OR reports (last 4 quarters): program status, test results, open findings, KRI dashboard, and forward-looking risk outlook.
Confirm continuous improvement mechanism for lessons from tests, incidents, near-misses, and threat intelligence feeds into plan updates and scenario development.
Verify annual resilience maturity self-assessment performed and results drive a prioritized improvement roadmap approved by senior management.

Expected Evidence

KRI/KPI framework with metric definitions, thresholds, and owners
Quarterly KRI reports with breach documentation and escalation
Board/Risk Committee resilience reports (last 4 quarters)
Evidence of ad-hoc escalation for material events
Annual resilience maturity self-assessment report with roadmap
Continuous improvement log or action register with CTI inputs

Regulatory Mapping

FFIEC BCM p. 60NIST CSF ID.IM-02/04OCC Heightened Standards 12 CFR Part 30 App. DISO 22301 §10.1FINRA Rule 4370(d)(7)COSO ICIF Monitoring Principles 16-17COSO ERM Review & Revision; Information, Communication & Reporting

// Supplemental — Digital Asset & Stablecoin Resilience

Digital Asset-Specific Resilience Considerations

Organizations issuing Stablecoins or transacting on blockchain networks face a distinct set of operational resilience challenges that supplement traditional BCP/DR requirements. The following supplemental procedures apply to Digital Asset organizations and are in addition to all eight core domains.

Blockchain Node Redundancy & Failover

Single-region node concentration; validator downtime; node synchronization failure during recovery

Confirm node distribution across geographic regions and cloud providers with tested DR failover.
Verify failover tests include node switchover validation and chain synchronization confirmation.
Assess whether RTO/RPO targets are defined for on-chain transaction latency separately from off-chain systems.

OCC Interp. Letter 1174 · NYDFS Part 200 · NIST CSF RC.RP-02

Smart Contract Incident Response

Smart contract exploit, reentrancy attack, or logic error causing minting/burning failures or reserve drainage

Verify an emergency smart contract pause/upgrade mechanism exists and has been tested with documented results.
Review incident response runbook for smart contract events including pause, upgrade, and rollback procedures.
Assess whether on-chain monitoring tools are deployed for anomaly detection with DR configurations.

OCC Interp. Letter 1179 · NYDFS Part 200.12 · ISO 22301 §8.4

Cryptographic Key Management & Recovery

Loss of private keys; compromise of signing keys; MPC or multi-sig quorum failure; HSM failure during recovery

Confirm key backup and recovery procedures are documented, tested annually, and stored in geographically redundant secure storage.
Verify MPC or multi-signature recovery quorum procedures are documented and exercised.
Assess HSM failover capability and confirm failover has been tested within the past 12 months.

NYDFS Part 200.9 · OCC Interp. Letter 1174 · NIST SP 800-57

Stablecoin Reserve Continuity

Reserve manager unavailability; failure to maintain 1:1 reserve attestation; inability to process redemptions during DR event

Review reserve management BCP. Confirm attestation provider has independent DR capability.
Assess whether redemption processing can continue during primary system outage with defined workarounds.
Verify customer communication plan for reserve-related disruptions.

OCC Interp. Letter 1174 · GENIUS Act §3(b) · PWG Report (2021)

On-Chain Transaction Monitoring & Reporting

Inability to monitor on-chain activity during incident; delayed detection of suspicious transactions; failed regulatory reporting

Confirm on-chain monitoring tools have DR configurations and are tested as part of DR exercises.
Verify regulatory reporting obligations (e.g., FinCEN SAR filing) can be fulfilled during a technology disruption.
Review on-chain DR test results and confirm monitoring continuity was validated.

FinCEN FIN-2019-G001 · NYDFS Part 200.15 · FATF VASP Guidance

Regulatory Notification — Digital Asset Events

Missed or untimely notification for cyber incidents, stablecoin reserve changes, or operational disruptions

Confirm NYDFS Part 500 §500.17 72-hour cyber incident notification procedure is documented and responsible parties named.
For GENIUS Act-regulated entities: Confirm reserve disclosure and redemption suspension notification procedures are established.
Verify regulatory contact directory is current and accessible offline during an incident.

NYDFS Part 500 §500.17 · GENIUS Act §4 · OCC 12 CFR Part 30

// Section 5 — Maturity Assessment Model

Operational Resilience Maturity Assessment

The following five-level model provides a structured framework for assessing the overall effectiveness and sophistication of the organization's operational resilience program. Maturity ratings are assigned holistically across all eight audit domains, informed by evidence gathered during fieldwork.

1

Initial

Ad Hoc

Non-Compliant
Immediate Action Required

No formal BCP/DR policies in place
Recovery processes undocumented
Testing rarely or never performed
RTOs/RPOs not defined
Vendor resilience not assessed

Regulatory findings expected. Material control failures. Escalation to Board required. Significant residual risk — urgent remediation.

2

Developing

Repeatable

Partially Compliant
Targeted Remediation Needed

Basic BCP/DR documentation exists but incomplete
RTOs/RPOs defined for some systems only
Annual testing partially executed
Limited third-party oversight
Governance structure forming

Material gaps present. Regulatory expectations not consistently met. Targeted remediation underway. Close monitoring required.

3

Defined

Consistent

Baseline Compliant
Monitoring Gaps Remain

Documented BCP/DR for all critical systems
RTOs/RPOs defined, baselined, and referenced
Annual tests executed; results documented
Third-party BCPs reviewed periodically
Board receives annual resilience updates

Foundational compliance met. Regulatory minimums satisfied. Gaps in automated monitoring and threat-centric testing should be addressed to progress to Level 4.

4

Managed

Measured

Proficient
Regulatory Expectations Met

Fully documented, centralized BCP/DR
RTOs/RPOs tested and validated annually
Multi-scenario testing: tabletop, parallel, failover
Vendor resilience contractually protected with SLAs monitored
KRIs/KPIs tracked and reported quarterly

Strong control environment. Regulatory expectations substantially met. Proactive risk management in place. Focus forward on threat intelligence integration and digital resilience.

5

Optimized

Continuous

Leading Practice
Full Regulatory Alignment

Threat-centric, forward-looking resilience strategy
Automated replication monitoring with real-time alerts
Continuous testing integrated into change management
Digital asset / blockchain resilience addressed and tested
Lessons learned drive systemic program improvement

Leading practice. Full alignment with FFIEC, NIST CSF, COSO ERM, and regulatory requirements. Resilience embedded in organizational culture.

// Section 6 — ERM / ITRM Framework Uplift

ERM / ITRM Framework Design — Regulatory Remediation Guidance

This section provides practical guidance for organizations supporting regulatory remediation engagements (OCC, Federal Reserve, or SEC findings) that require design or uplift of an Enterprise Risk Management (ERM / ITRM) framework with emphasis on operational resilience, BCP, and DR.

ERM / ITRM Component	Design Requirement	Regulatory Anchor
Risk Identification & Classification	Establish a structured risk taxonomy covering Logical Access, IT Asset Management, Operational Resilience/DR, Configuration Management, and Change Management. Each domain should have documented risk statements, control objectives, and control ownership.	FFIEC IT Exam Handbook · NIST CSF 2.0 Identify Function · OCC 12 CFR Part 30 App. D
COSO Framework Integration	Anchor the framework to COSO ICIF (2013) five components: Control Environment, Risk Assessment, Control Activities, Information & Communication, Monitoring Activities. Overlay COSO ERM (2017) for enterprise-level risk appetite, strategy alignment, and performance monitoring.	COSO ICIF (2013) · COSO ERM (2017) · SOX 302/404 · IIA Standards 2120
Risk Scoring Methodology	Design a standardized, objective, and repeatable scoring approach using a 5×4 matrix (Inherent Risk 1-5 × Control Effectiveness 1-4) to derive residual risk ratings. Document scoring criteria to ensure consistency across assessors and time periods.	NIST CSF ID.RA · FFIEC MRAM · OCC Heightened Standards
Threat Intelligence Integration	Evolve from compliance-based to threat-centric risk assessments by integrating threat intelligence feeds (FS-ISAC, CISA alerts) into scenario development for resilience testing and risk assessments.	NIST CSF 2.0 Identify/Detect Functions · CISA Cyber Hygiene Services · FS-ISAC TLP Amber Feeds
Risk Appetite & Tolerance Framework	Define explicit risk appetite statements for each ERM / ITRM domain with quantified KRI thresholds. Operationalize risk appetite through KRI/KPI tracking and board-level reporting on breaches and remediation progress.	OCC Heightened Standards §I.C · Federal Reserve SR 11-7 · Basel Committee BCBS 239
Risk Aggregation & Board Reporting	Implement risk aggregation enabling roll-up from individual control assessments to domain-level and enterprise-wide risk views. Board reports should provide directional trend analysis, material risk flag summaries, and forward-looking risk outlook.	BCBS 239 · FFIEC BCM p. 60 · Federal Reserve SR 22-4
Remediation Program Management	Establish structured issue tracking with defined severity ratings, escalation protocols, and aging dashboards. For regulatory findings (MRAs/MRIAs), maintain a dedicated remediation register with regulatory submission schedules.	OCC Heightened Standards · Federal Reserve SR 08-08 · FFIEC BCM p. 58

// Executive Stakeholder Management — Key Strategies

Risk Narrative Over Technical Detail

Translate findings into business impact

Frame DR/resilience gaps in business-impact language. Executives respond to regulatory exposure, peer benchmarking, and financial consequence — not technical architecture deficiencies.

Regulatory Urgency Anchoring

Reference examiner findings and timelines

Reference specific MRA language or public enforcement actions to establish urgency without alarmism. Use examination timelines to create accountability for remediation commitments.

Data-Driven KRI Dashboards

Green / Yellow / Red visibility for executives

Provide executives with a concise KRI dashboard at each governance meeting. Trending yellow KRIs drive proactive engagement before findings escalate to regulatory issues.

Continuous Progress Demonstration

Remediation tracker visible to sponsors

Maintain a dashboard showing findings opened vs. closed, % on-track vs. at-risk, and quarter-over-quarter improvement. Regulators credit observable progress even before full closure.

// Appendix A — Regulatory Quick Reference

Regulatory Framework Matrix

Regulation / Guidance	Key OR Requirement	Applicable To	Testing Frequency	Primary Domain
FFIEC IT Exam Handbook – BCM	Board oversight, BIA, BCP/DR testing, recovery objectives, vendor management	Banks, Credit Unions, Broker-Dealers	Annual minimum	All Domains
OCC Bulletin 2019-37	Third-party risk management; resilience of critical activities; oversight of service providers	National Banks, FSBs	Annual vendor assessment	Domain 6
Federal Reserve SR 22-4	Operational resilience; recovery and resolution planning; impact tolerances	BHCs, FBOs, Financial Holding Cos.	Annual + stress scenario	Domains 1, 2, 3
SEC Regulation SCI	Systems compliance; DR/BCP for covered SCI entities; same-day recovery; annual member test	ATSs, Exchanges, Clearing Agencies	Annual with members	Domain 5
FINRA Rule 4370	Annual BCP review; emergency contacts; customer disclosure; material change notification	FINRA Member Firms, Broker-Dealers	Annual; alternating-yr alt. site	Domains 3, 5
NIST CSF 2.0	Govern, Identify, Protect, Detect, Respond, Recover — Govern function added in v2.0	All Financial Institutions	Continuous; annual formal review	All Domains
COSO ICIF (2013)	5 components: Control Environment, Risk Assessment, Control Activities, Information & Communication, Monitoring Activities — SOX 302/404 anchor	All Financial Institutions / Public Cos.	Annual for SOX entities	Domains 1, 2, 8
COSO ERM (2017)	Governance & Culture, Strategy & Objective-Setting, Performance, Review & Revision, Information Communication & Reporting	All Financial Institutions	Annual; integrated with strategy	All Domains
OCC Stablecoin Interp. Letters 1174/1179	Operational controls for stablecoin issuance; reserve management continuity; third-party tech risk	National Banks issuing / holding stablecoin	Ongoing supervisory	Domains 4, 6, Digital
NYDFS Part 500 / 23 NYCRR 200	Cybersecurity program; operational continuity; 72-hour cyber incident notice; annual certification	NY-licensed Financial & VCEs	Annual VAPT; biennial pentest	Domains 1, 7, Digital
ISO 22301:2019 (BCMS)	International BCMS standard; PDCA framework; MTPoD and MBCO requirements	Global / Best Practice	Annual internal audit; triennial cert.	All Domains

// Appendix B — Standard Evidence Request List

#	Evidence Item	Purpose	Domain	Priority
1	Board-approved BC/DR Policy with revision history	Policy framework completeness and currency	Domain 1	High
2	Current BIA with RTOs, RPOs, MTPoD, and MBCO for all Tier 1/2 systems	Recovery objectives defined and current	Domain 2	High
3	BCP documents for all critical business lines with revision history	Plan completeness and currency	Domain 3	High
4	DR runbooks for Tier 1/2 systems — centralized repository access	Runbook completeness and governance	Domain 4	High
5	Data replication monitoring dashboard and 90-day replication job logs	Replication health and RPO compliance	Domain 4	High
6	Application deployment records confirming prod/DR environment parity	DR environment alignment	Domain 4	High
7	DR test results reports — last 2 test cycles	Testing coverage and results documentation	Domain 5	High
8	Issue/remediation tracker export — open and closed DR-related items	Lessons learned and remediation tracking	Domain 5	High
9	Vendor inventory with tiering and annual resilience assessment records	Third-party resilience oversight	Domain 6	High
10	Sample vendor contracts (3-5 Tier 1 vendors) with resilience provisions	Contractual protections for critical vendors	Domain 6	Medium
11	Cybersecurity Incident Response Plan (CSIRP) with BCP/DR integration	Incident response integration	Domain 7	High
12	Regulatory notification procedures with current contact lists	Regulatory notification compliance	Domain 7	Medium
13	KRI/KPI framework with definitions, thresholds, and 4-quarter reporting history	Risk monitoring and governance reporting	Domain 8	High
14	Board/Risk Committee resilience reports — last 4 quarters	Board oversight quality	Domain 8	Medium
15	Annual resilience maturity self-assessment report	Continuous improvement evidence	Domain 8	Medium
16	(Digital Asset) Blockchain node inventory with DR site designations	On-chain resilience coverage	Digital Supplement	High
17	(Digital Asset) Key management recovery procedures and test results	Cryptographic key resilience	Digital Supplement	High
18	(Digital Asset) Smart contract incident response runbook and test evidence	Smart contract resilience	Digital Supplement	High

Operational ResilienceAudit Work Program

What This Work Program Covers

TradFi & Digital Asset

Multi-Framework Alignment

Risk Statement → Control → Evidence

Audit-Ready & Engagement-Ready

Inherent Risk Universe & Scoring Methodology

Governance and Oversight

Business Impact Analysis (BIA)

Business Continuity Planning (BCP)

Disaster Recovery — IT Recovery Capabilities

Testing and Exercises

Third-Party and Vendor Resilience

Incident Response Integration

Monitoring, Reporting, and Continuous Improvement

Digital Asset-Specific Resilience Considerations

Blockchain Node Redundancy & Failover

Smart Contract Incident Response

Cryptographic Key Management & Recovery

Stablecoin Reserve Continuity

On-Chain Transaction Monitoring & Reporting

Regulatory Notification — Digital Asset Events

Operational Resilience Maturity Assessment

ERM / ITRM Framework Design — Regulatory Remediation Guidance

Translate findings into business impact

Reference examiner findings and timelines

Green / Yellow / Red visibility for executives

Remediation tracker visible to sponsors

Regulatory Framework Matrix

Get the Full Work Programas a Formatted PDF

On Its Way

Operational Resilience
Audit Work Program

Get the Full Work Program
as a Formatted PDF