Exam CCAK topic 1 question 196 discussion

B. Annually The control audit frequency for an organization’s business continuity management and operational resilience strategy should typically be conducted annually. An annual audit allows the organization to systematically review and assess the effectiveness of its business continuity plans and operational resilience measures, ensuring they remain aligned with current risks, business objectives, and regulatory requirements. This frequency is generally sufficient to identify any changes needed due to evolving threats, business processes, or external factors while also providing enough time to implement improvements. More frequent audits, like monthly or quarterly, might be excessive unless there are specific risks or regulatory requirements necessitating such a schedule. Conversely, biannual audits might not provide adequate oversight to ensure the strategy remains effective and up-to-date.

BCR-01 Audit Guidelines