SAMA Business Continuity Management Framework

Who it applies to

SAMA-regulated financial institutions, with emphasis on critical business services and the third parties that support them.

What internal audit has to show

Audit has to show that continuity plans exist for critical services, that they were tested, and that test results and remediation were followed through.

What Oversight does with SAMA BCM

• Builds the inventory of critical business services, dependencies and recovery objectives from your existing BIA and plans.
• Drafts the review program covering governance, business impact analysis, plan quality, testing and third-party continuity.
• Collects test reports and evidence of remediation from service owners and keeps the status current.
• Produces the findings and the committee view of resilience posture from the same working record.

Typical engagements

• Business continuity and disaster recovery review
• Critical service recovery testing assurance
• Crisis management and communications review