Finding · F-IAQ2-BCP-01
Restore test evidence incomplete
ClosedBCP-01 · Backup restore and DR are testedOperations & ResilienceQ2 2026 Unified Program Review
Fraud indicator
Rating
No
High
Medium
Low
Requirement to validation
Requirement
ISO-A.5.30 · ISO-A.8.13 · ITGC-OP-01 · RBI-ITGRCA-2023-8 · SOC2-A1.2 · SOC2-A1.3
mapped
Policy
Business Continuity & Backup Policy
pol-bcp
Control
BCP-01
Backup restore and DR are tested
Application
Amazon Web Services (ap-south-1) · Microsoft Azure (corporate)
mapped
Evidence · Q3
6 items
4 approved · 2 pending · 0 rejected
Test · Q3
Pass
TST-ISO-BCP-01 · High confidence
Finding
F-IAQ2-BCP-01 · Medium
Closed
Action
Rahul Nair
REM-F-IAQ2-BCP-01 · Closed
Validation
Validated
as recorded
Observation
Raised 2026-06-24 in the Q2 2026 internal audit baseline. The H1 restore test was performed but the RTO measurement and sign-off were not retained.
Applications: Amazon Web Services (ap-south-1), Microsoft Azure (corporate).
Potential risk
The control may not operate consistently, weakening reliance by auditors and the regulator.
Root cause
Restore test template had no RTO field.
Agreed action plan
Remediate: restore test evidence incomplete.
Management response: Management agreed and committed to remediate before the Q3 review.
- Action
- REM-F-IAQ2-BCP-01
- Owner (FPR)
- Rahul Nair
- Target date
- 31 Jul 2026
- Priority
- Medium
- Status
- Closed
- Validation
- Validated · planned 26 Sep 2026
Evidence for this control (8)
| Evidence | Title | Control | Source system | Collected | Status |
|---|---|---|---|---|---|
| ISO-REQ-020 | AWS: Portal DB restore test report | BCP-01 | 8 Oct 2026 | Accepted | |
| ISO-REQ-021 | Microsoft Azure: SAP HANA restore test report | BCP-01 | 7 Oct 2026 | Accepted | |
| ITGC-REQ-029 | AWS: Portal DB restore test report | BCP-01 | 9 Oct 2026 | Under review | |
| Q2-EV-028 | Amazon Web Services (ap-south-1) · screenshot (Q2) | BCP-01 | Amazon Web Services (ap-south-1) | 23 Jun 2026 | Accepted |
| Q2-EV-029 | Microsoft Azure (corporate) · system export (Q2) | BCP-01 | Microsoft Azure (corporate) | 4 Jun 2026 | Accepted |
| RBI-REQ-025 | AWS: Portal DB restore test report | BCP-01 | 4 Oct 2026 | Accepted | |
| RBI-REQ-026 | Microsoft Azure: SAP HANA restore test report | BCP-01 | 9 Oct 2026 | Accepted | |
| SOC2-REQ-033 | AWS: Portal DB restore test report | BCP-01 | 9 Oct 2026 | Under review |
Tests of this control (3)
| Test | Control | Cycle | Tested | By | Result | Confidence |
|---|---|---|---|---|---|---|
| TST-ISO-BCP-01 | BCP-01 · Backup restore and DR are tested | Q3 2026 Unified Program Review | 7 Oct 2026 | Suresh Pillai · Northgate Certification Services | Pass | High |
| TST-RBI-BCP-01 | BCP-01 · Backup restore and DR are tested | Q3 2026 Unified Program Review | 1 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit (IS Audit cell) | Pass | High |
| TST-Q2-BCP-01 | BCP-01 · Backup restore and DR are tested | Q2 2026 Unified Program Review | 20 Jun 2026 | Farah Khan, Vikram Mehta · Meridian Internal Audit | Pass with Observation | Medium |