Spring 2009 issue of Horizons

GENERAL TOPICS Sustaining After the Unexpected (cont.)

Devoting appropriate resources to the data backup processes, and eventually a full DRP/BCP, can greatly increase an organization’s sustainability after a loss or corruption of data and systems. Sustainability requires management commitment to leveraging the right resources and willingness to invest the time and capital in the technology and people. Making this commitment will ensure that your organization is prepared to weather any unexpected storm that comes its way. Some helpful resources are the Department of Homeland Security’s Web site on business continuity and disaster planning, http://www.ready.gov/business/ plan/index.html, and the Disaster Recovery Journal, www.drj.com.

procedures to keep in mind when evaluating the data backup methodology at your organization are: • Completing a full data backup at least once per week and an incremental or differential backup at the end of each day; • Completing backups of transaction logs periodically throughout the day; • Completing backups of key system configurations and application files before and after system changes; • Keeping backup copies off-site in a secured and climate-controlled environment; • Performing trial data and full system restores on a regular basis (i.e. monthly, quarterly, etc.) to check the plan and procedural effectiveness and efficiency, as well as system and tape efficacy; and • Reviewing the backup methodology on an annual basis and updating as necessary. Depending on the nature of your business, the extent of your DRP, recovery metrics and budget, options are available to back up and secure data. No matter the solution you choose, it’s important to formalize the process and document the methodology. Share your methodology with your vendor(s) and make sure they are meeting your data backup requirements. Document the understanding in a service agreement to ensure no surprises during a disaster. Conclusion A good data backup, DRP and BCP approach must consider all data for recovery of period end as well as necessary interim and historical information. Developing a data backup plan that meets the needs of the business, customers and owners requires time and effort from a committed management team aware of the risks to the business. It can be advantageous to leverage specialists that are able to provide experience and an unbiased, broad perspective in developing and reviewing a cross-departmental plan. Specialists also can assist management in implementing the plan. Once the plan is defined, investments may be necessary to implement and, if needed, execute the recovery plan.

Questions? Contact:

Audrey Katcher, CPA, CISA Partner Internal Audit Services Group 314.290.3420 audrey.katcher@rubinbrown.com

15

u spring 2009 issue