General

What the baseline asks

Hold internal audits at planned intervals to find out whether the BCMS satisfies both the standard and what the organization itself requires of its BCMS, and whether it is put into practice and kept up effectively.

What it means when the service runs in the cloud

The general audit requirement is that the programme is planned and impartial. Add cloud dependency as an explicit audit criterion so it is not left to the auditor's discretion.

Evidence an auditor or a customer asks for

• Audit schedule with planned intervals and evidence of adherence
• Audit reports addressing conformity to internal requirements, to the standard, and to effective implementation
• Coverage map showing the whole BCMS is audited across a cycle

Common gaps in a cloud estate

• Audits test conformity to the standard only and never to the organization's own BCMS requirements
• Effectiveness untested, with audit limited to documentation existence
• Coverage concentrated on easy areas, leaving parts of the BCMS unaudited for years

Done well, what the file shows

Done well, this clause leaves a audit schedule with planned intervals and evidence of adherence that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

Confirm cloud dependency is a named criterion in the audit plan.