Operational
BCM Recovery Testing
Business continuity and disaster recovery test outcomes against agreed recovery time objectives.
Why an untested recovery plan is an assumption
Business continuity and disaster recovery plans only provide assurance once they have been tested against real recovery time objectives, because an untested plan is merely a hopeful document. King IV and sound governance expect the governing body to confirm that the institution can actually recover critical services, not just that a plan exists. AuditPro Core records recovery test outcomes against agreed recovery time objectives so resilience is evidenced rather than assumed.
The Numbers
AuditPro Core renders this view from your tenant's live, tamper-evident records. The figures below are illustrative sample data.
Critical services
24
Tested this year
17
71%
Met RTO
12
of 17 tested
Untested
7
no recent test
Actual vs target recovery time by service
Recovery test outcomes
| Service | Last tested | RTO met | Actual (hrs) |
|---|---|---|---|
| Revenue billing | Mar 2026 | No | 11 |
| Payments | Feb 2026 | Yes | 4 |
| Water SCADA | Apr 2026 | No | 3 |
| Call centre | Jan 2026 | Yes | 5 |
| Payroll | May 2026 | Yes | 10 |
Figures shown are illustrative sample data for demonstration. AuditPro Core renders these views from your own tenant's live, tamper-evident records.
Recovery time objective
The recovery time objective is the maximum acceptable time to restore a critical service after disruption. It turns continuity from a vague aspiration into a measurable target.
Testing versus planning
A plan describes intended recovery; a test proves whether it works. Only testing exposes the dependencies, gaps and timing failures that planning overlooks.
Test outcomes
A test that meets its recovery objective gives genuine assurance; one that misses reveals a real exposure. Failed tests are valuable because they find weaknesses before a crisis does.
Test currency
Resilience decays as systems and staff change. A plan tested long ago offers little assurance today, so recency of testing is itself a measure of readiness.
How AuditPro Core Bridges the Gap
- Test recording: each recovery test is logged with its result against the agreed objective.
- Objective comparison: the platform shows actual recovery against the target to expose shortfalls.
- Exception workflow: failed or missed tests generate remediation actions for the relevant plan.
- Audit-ready export: test history evidences continuity readiness for the audit committee and assurance providers.
Key Takeaways
- An untested recovery plan is an assumption, not assurance.
- Recovery time objectives turn continuity into a measurable target.
- Failed tests are valuable; they find gaps before a real crisis does.
- Resilience decays over time, so test recency signals readiness.
See This on Your Own Data
AuditPro Core renders this dashboard from your tenant's live, tamper-evident records — every figure traceable to source.