Explain the Academic Research Lifecycle

ZEKEB

Perceived_Roles_of_the_Interna.pdf

Home >Information Systems homework help >Explain the Academic Research Lifecycle

Perceived Roles of the Internal Auditor in Business Continuity Planning in the

Government Sector

Dissertation

Submitted to Northcentral University

Graduate Faculty in the School of Business and Technology Management

In Partial Fulfillment of the

Requirements for the Degree of

DOCTOR OF PHILOSOPHY

MONDAY RUFUS

Prescott Valley, Arizona

September 2016

INFORMATION TO ALL USERS The quality of this reproduction is dependent upon the quality of the copy submitted.

In the unlikely event that the author did not send a complete manuscript and there are missing pages, these will be noted. Also, if material had to be removed,

a note will indicate the deletion.

Microform Edition © ProQuest LLC.

ProQuest LLC. 789 East Eisenhower Parkway

P.O. Box 1346 Ann Arbor, MI 48106 - 1346

ProQuest

Published by ProQuest LLC ( ). Copyright of the Dissertation is held by the Author.

ProQuest Number:

10181966

2016

Approval Page

Perceived Roles of the Internal Auditor in Business Continuity Planning in the

Government Sector

MONDAY RUFUS

Approved by:

0 C:~o\)12r I? 20 · / _____ __..!_ I~'

Chair: Dr. Edward Kim Date

Member: Dr. Julia Watkins

Member: Dr. Joseph Oloyedc

Certified by:

Dean of School: Dr. Peter Bcmski Date

I I

11 l I l

iii

Abstract

A government agency is expected to implement a plan to be followed should an

emergency arise. This minimizes the impact of disruption and ensures the quick

resumption of operations. But without the involvement of those with the right expertise,

management of a government agency could assume undesirable business continuity risks.

The purpose of this qualitative case study was to understand the perceived roles of the

internal auditor in business continuity planning within the government sector. The

findings arose from data collected from interviews with individuals using a purposive

convenience sample. The data analysis resulted in five themes. The five themes for the

overarching research question included: (a) significant negative impact, (b) obstacles, (c)

major roles, (d) areas to be excluded from the internal auditor, and (e) internal auditor’s

independence. Findings from the study indicated that the government sector did not

consider risks that could hinder the entity from successful mitigation of disruptions

because preference was given to other pressing issues. Other impediments affecting

business continuity planning included a lack of adequate communication, resources,

periodic testing, staff training, inept personnel, inaccuracy of business impact analysis,

and the notion that a disruption would never occur. The Internal auditor’s involvement in

business continuity planning in the government sector should be in an advisory capacity

because of their independence and knowledge of the entity and the risks affecting the

organization. To mitigate a threat to the internal auditor’s independence and promote

objectivity, the organization, and internal auditor should implement safeguards. The

implications of this study included providing valuable insights to management,

policymakers, and the internal auditor about the perceived roles of the internal auditor in

business continuity planning in the government sector and how to utilize his or her

expertise while ensuring independence and objectivity. Three recommendations for

future research included: (a) whether the internal auditor should play a role in

maintenance and update of the business continuity plan; (b) the reason a governmental

sector would be reluctant to test their business continuity plans periodically; and (c) the

roles of the internal auditor in business impact analysis during the development of a

business continuity plan.

Acknowledgements

A lot of people were instrumental in my completion of this journey. First, I

would like to thank my wife, Ugochi, for your unwavering support throughout the

duration of this endeavor. This milestone would not be impossible without your

understanding, sacrifice, and support. To my four children, Tina, Jeffrey, Chisom, and

Jonathan, I say thank you for all of your support. Even though our vacations plans were

affected because of required weekly assignments, you never relented in showing your

support. I would also like to extend my hearty thank you to my late mother who always

encouraged me to continue to strive for new heights. To my siblings, Ndoma,

Chigbundu, Maduabuchi, and Ahuru, I say thank you for your words of encouragement.

Equally important are my associates at the office. You listened whenever I

solicited your input during this journey. Additionally, I appreciated your interest in my

research topic and periodic inquiries on the progress. I would like to thank the following

Northcentral University’s faculty members: Dr. Bari Courts, Dr. Mary Beth Klinger, Dr.

John Hannnon, Dr. Ana Machuca, Dr. Linda Leatherbury, Dr. Alfred Greenfield, Dr. Bob

Levsseur, Dr. Anastasis Petrou, Dr. Susan Hebert, Dr. Shakil Akhtar, Dr. J. Dickinson,

Dr. Heather Miller, Dr. Kirby Scheer, and Dr. Diane Stottlemyer for your guidance and

input. A big thank you goes out to my Chair, Dr. Kim Edwards, and my committee

members for this dissertation, Dr. Julia Watkins, and Dr. Joseph Oloyede. I appreciated

your timely feedback and encouragement. Finally, my heartfelt thanks go out to the

internal auditors in the State of Texas who participated in this study. I sincerely

appreciate your time; your input in this study contributed to this significant milestone.

Table of Contents

Chapter 1: Introduction ........................................................................................................1

Background ....................................................................................................................3 Statement of the Problem ...............................................................................................5

Purpose of the Study ......................................................................................................6 Theoretical Framework ..................................................................................................7 Research Questions ......................................................................................................11 Nature of the Study ......................................................................................................11 Significance of the Study .............................................................................................15

Definition of Key Terms ..............................................................................................16 Summary ......................................................................................................................19

Chapter 2: Literature Review .............................................................................................21

Documentation .............................................................................................................22 How Business Continuity Planning Applies to the Government .................................23 Reasons for Business Continuity Planning ..................................................................26

Internal Audit Function ................................................................................................37 Role of Internal Auditor ...............................................................................................43

The Government and Readiness ..................................................................................47 Historical Legislative Perspectives ..............................................................................53 Organizations and Business Continuity Planning ........................................................55

Mitigating a Disaster ....................................................................................................57 Possible Impact of a Disaster .......................................................................................59

Preparing for a Disaster ...............................................................................................63

Responding to a Disaster .............................................................................................65

Summary ......................................................................................................................67

Chapter 3: Research Method ..............................................................................................69

Research Methods and Design .....................................................................................72 Population ....................................................................................................................75

Sample..........................................................................................................................75 Materials/Instruments ..................................................................................................76 Data Collection, Processing, and Analysis ..................................................................77 Assumptions .................................................................................................................80 Limitations ...................................................................................................................80

Delimitations ................................................................................................................81

Ethical Assurances .......................................................................................................82

Summary ......................................................................................................................84

Chapter 4: Findings ............................................................................................................86

Results ..........................................................................................................................87 Evaluation of Findings ...............................................................................................102 Summary ....................................................................................................................109

vii

Chapter 5: Implications, Recommendations, and Conclusions .......................................113

Implications................................................................................................................117 Recommendation .......................................................................................................124 Conclusions ................................................................................................................132

References ........................................................................................................................136

Appendices .......................................................................................................................160

Appendix A: Recruitment Letter - Telephone Script .......................................................161

Appendix B: Recruitment Letter - Email Script ..............................................................162

Appendix C: IRB Approval .............................................................................................163

Appendix D: Informed Consent Form .............................................................................164

Appendix E: Interview Guide .........................................................................................166

Appendix F: Interview Questions ....................................................................................167

viii

List of Tables

Table 1 Themes for Research Question .............................................................................88

Table 2 Significant negative impact ..................................................................................91

Table 3 The obstacles that get in the way of dealing with disruptions successfully .........94

Table 4 The reason for the internal auditor to play major roles in business continuity

planning..............................................................................................................................97

Table 5 The areas the internal auditor should be excluded ................................................99

Table 6 Independence of the internal auditor ..................................................................102

Chapter 1: Introduction

Business Continuity Planning, one of the most common topics in business circles,

high-profile meetings, and presentations today, continues to be a major issue, especially

in the government sector. More than ever, society expects the government to be genuine

and highly reputable, especially when managing disasters or any other crisis (Koronis &

Ponis, 2012). The expectation is that this trend will intensify as the political and business

environment continues to change considerably. When a crisis is not properly mitigated,

there could be a temporary disconnection with the public or other users of services or

even permanent disruption of business relations (Koronis & Ponis, 2012). The public

expectations have caused some regulatory agency personnel to begin thinking seriously

about business continuity planning (Jones, 2011).

For example, in May 2011, a tornado ripped through the City of Joplin, Missouri,

and killed 158 people, wounded more than 1,000, and damaged about 8,000 buildings.

According to Busch and Givens (2013), government has always emphasized the

importance of preparing for disruptions. When a disaster occurs, the purpose of business

continuity planning is to ensure critical functions can operate during and after a disaster

or other contingency, and then minimize recovery time to reach normal operations

(Carrington, 2010). Critical functions may require for the government to include

budgetary data, policy and regulatory data, human resource management data, and

acquisition and planning data (Office of Management & Budget, 2011). Governments

oftentimes worry about continuity as they are under pressure to keep up with the citizens’

expectations for optimum services. Additionally, globalization and technological

advancements have changed how governments do business (Izumi & Shaw, 2015; Nasim

& Sushil, 2010). For example, since the enactment of the E-government Act by the

United States Congress in 2002, government agencies in the United States are steadily

taking advantage of e-services. As a result, governments have become more transparent

and accountable to the public. Additionally, government services have become more

accessible, more efficient, and there is an increased opportunity for the citizens to

participate in government. Transactions can be completed online, which may include

paying for taxes online, renewing licenses, or even registering to vote. Online presence

also provides an opportunity to explore different ways to generating revenue, not only

targeting citizens of the United States but also people worldwide (Baird, Zelin, & Booker,

2012). According to Melnik (2015), there has been an increase in the number of cyber-

attacks against both United States government agencies and private organizations. For

example, cyber-attacks have increased by 35% from 2010 to 2013, specifically, 34,048 to

46,160. A government agency has to create a plan to be followed should an emergency

arise (Hall, Skipper, Hazen, & Sawalha, 2012). A well-executed plan minimizes the

impact of disruption and ensures the quick resumption of operations. This plan also

requires the assessment of risk and the implementation of risk management.

The internal auditor helps the government achieve its objectives of serving the

public by evaluating and improving the effectiveness of risk management. The internal

auditor reports to the oversight board or a designated committee and is in a position to

evaluate management’s understanding of risks affecting the organization and the potential

impact of any loss (Schneider, Sheikh, & Simione, 2012). The internal auditor also

assures the board of directors or its designated committee that management of the

organization can effectively mitigate any business continuity risks to acceptable levels

(Stefaniak, Houston, & Cornell, 2012). Additionally, in situations where management

has decided to assume the risk of undesirable business continuity risk, the internal auditor

notifies the board and also ensures a decision has been adequately documented (García,

Barbadillo, & Pérez, 2012).

Background

When a disaster occurs, it affects everyone including the government, businesses,

and families. The phrase “business continuity planning” is widely used in business or

government. The focus of a business continuity plan is to mitigate potential loss through

the identification, prioritization, and safeguarding of critical assets of the business, not

just information technology (Hoong & Marthandan, 2014). Good continuity plans

include providing an alternative path in support of critical business processes in the event

of an emergency, disaster, or other disruption (Carrington, 2010). The roles of the

government include protecting its people physically or economically, including, among

others, providing welfare, building roads, protecting the border, and funding education.

As a result, proper planning is required to ensure mitigation of losses or elimination of

the impact of disasters (FEMA, 2015; McGuire & Schneck, 2010). For example, the

American Bankers Association and Banking Administrations are expecting their

members to implement acceptable business continuity practices to ensure adequate

protection of the public interest (Koronis & Ponis, 2012). But historically, governments

have not stressed enough about resilience as a required quality for communities. But to

stress the importance of preparedness, the federal, state, and local governments have

instituted laws, statutes, ordinances, and guidance which may or may not be complied

with (Haddow, Bullock, & Coppola, 2011).

The United States government collects taxes from its residents on income

generated anywhere in the world (Hickman, 2012). The government sector would rely on

business continuity planning to mitigate the impact of any disruption that would affect its

ability to collect taxes. The government uses taxes collected to fund these projects (Reid,

Waring, Enriquez, & Shivdas, 2012). If the government was unable to process taxes

owing to the lack of contingency planning this would be considered an emergency.

Preparedness is required to mitigate the effect of disasters affecting the government’s

system such as tax database (DHS, 2008). Any disruption affecting the government also

impacts the public (Shughart, 2011). The management of the government agency would

be expected to utilize the right resources, including personnel, to ensure proper

implementation of business continuity planning. Implementation of business continuity

planning requires an adept knowledge of potential risks and its possible impacts on the

government (Glendon, 2013). When proper skills and knowledge are not used to ensure

continuity of business, there is the risk of unsuccessful response to a disaster, and

potentially significant losses (Kusumasari, Alam, & Siddiqui, 2010; Haque et al., 2012).

Although there have been advancements in the government sector in mitigating

disruptions, recurring errors continue to exist in the process (DHS, 2011; Faith, Jackson,

& Willis, 2011; Oh, 2012; Renaud, 2012). Internal audit as an organizational function

thrives on independence. As a result, the internal auditor understands the essence of

providing unbiased recommendations to management and those charged with governance

or oversight. Although internal auditors are not allowed to participate in decision-making

for an entity, owing to their independence, nothing precludes them from providing

proactive, risk-based recommendations (Wines, 2012; Zerni, 2012).

Statement of the Problem

A good plan minimizes the impact of disruption and ensures the quick resumption

of operations. But without the involvement of an independent person who understands

risk evaluation management of a government agency could assume undesirable business

continuity risks. An internal auditor is an independent person who understands risk

evaluation. The Auditors report directly to those charged with governance (García et al.,

2012). Sufficient literature does not exist on the perceived roles of the government

internal auditor in business continuity planning.

Governments are oftentimes ill-prepared to handle disasters owing to a lack of

adequate resources, other competing issues, and proper preparation for catastrophic

events (Deverell, 2012). Even the Nationwide Plan Review conducted by the Department

of Homeland Security determined that only 10% of business continuity plans are

adequate to mitigate the effect of disasters (DHS, 2006). The lack of adequate

preparation could pose a significant challenge to the government should an event occur

(DHS, 2011e). Additionally, catastrophic events could result in unnecessary distress,

harm, and affect the public’s perception of the government (Kusumasari et al., 2010;

Shughart, 2011). These shortcomings are usually because of a lack of planning, which

may include proper identification of risks, impact analysis, consideration of response

alternatives, and testing and maintenance (Coles & Zhuang, 2011; Kusumasari et al.,

2010). Consequently, the problem addressed by this study was the lack of the use and the

limited understanding of the perceived roles of the internal auditor in business continuity

planning in the government sector. Governments oftentimes worry about continuity as

they strive to keep up with the citizens’ expectations for optimum services. Potential

risks to the government include the loss of mission critical data, displacement of workers,

and unavailability of facilities owing to catastrophic events (Gourio, 2012; McEntire,

2012; Raman, Dorasamy, Muthaiyah, Kaliannan, & Muthuveloo, 2011).

Purpose of the Study

This purpose of this qualitative case study was to explore the perceived roles of

the internal auditor in business continuity planning within the government sector.

Information systems experts and business consultants would agree that it is almost

impossible for a government sector to survive when critical systems are unavailable

owing to a disaster (Chandra, Williams, & Tang, 2013). In essence, the availability of

these critical systems is quintessential in trying to assess a government sector’s business

risk, which is the likelihood of the ability to achieve its objectives when a disaster strikes.

The focus of this case study was internal auditors in the governmental sector from the

State of Texas in the United States. Data sources for this study included semi-structured

interviews and open-ended questionnaires. To ensure credibility, the people selected

were a representative sample of internal auditors affected by the topic under study. Prior

to conducting interviews, the first phase of the study comprised using an interview guide

(Appendix E) developed by the researcher as a guide to avoid any appearance of

incompleteness and inconsistency. The second phase involved sending questionnaires to

the internal auditors at various State of Texas agencies. Face-to-face or telephone

interviews were conducted with the participants. As fieldwork unfolded, no additional

samples were needed due to the depth of discussions with existing interviewees. The

individuals interviewed in each participating state agency had the opportunity to respond

in their own words to express their personal perspectives about the types and possible

impacts of service disruptions, perceived readiness, and obstacles in dealing with

disruptions successfully, and what could help an organization mitigate the effects of

service disruptions. The results of this case study could be useful to the State of Texas

agencies and internal auditors as they continue to protect the interests of the public. With

most processing requiring access to increasingly integrated applications and databases,

when the system is down, there is no opportunity to do any meaningful work. The

essential nature of information and technology will continue to increase in the future.

Theoretical Framework

The focus of this study was directed toward exploring the roles of the internal

auditor in business continuity planning in the government sector. Due to the nature of the

identified research problem and purpose, an interpretive approach was determined to be

the best theoretical framework. One basic assumption of the interpretive framework is

that knowledge is gained or at least filtered through training and oftentimes reinforced by

scholarly articles, books, and advisors (Shank, 2006). Additionally, the interpretive

framework acknowledges the intimate relationship between the researcher and the topic

under study, and the situational constraints that shape the process (Shank, 2006). An

interpretive framework, unlike positive, does not predefine dependent and independent

variables and is not designed to test hypotheses. Rather, the focus is to produce an

understanding of the phenomenon (Shank, 2006). The focus of this study is not to

predefine dependent and independent variables or to test hypotheses, but rather to build

an understanding related to the perceived roles of the internal auditor in business

continuity planning in the government sector.

Interpretation plays a major role in qualitative research. Interpretation involves

answering the why questions, attaching significance to particular results, explaining

findings, and putting patterns into analytical frameworks. To assure correct

interpretation, there must be solid description, which is called thick description (Shank,

2006). Correctly conducted qualitative research presents detail, context, emotion, and

evokes self-feelings. During interviews, it is easy to interpret incorrectly. For example, a

part of business continuity planning is the risk assessment process (Lindell, Prater, &

Perry, 2007). During risk assessment, it is easy to misinterpret a threat and probability of

impact (Kent, 2011). Also, the lack of pure description and correct interpretation could

affect mitigation approaches used by management of the entity including the estimated

financial impact (Lindell et al., 2007). Additionally, management of the governmental

entity considers different alternatives during the planning stages. Since there is no

universal way of planning for mitigation of disaster or disruption, each approach is

subject to different interpretations. However, consideration is given to different types of

disasters and disruptions and how to mitigate their effects (Haddow et al., 2011).

Another area that is subject to interpretation is the unexpected outcome of an

event (Resnick, 1987). An event could be so unique that uncertainty exists as to the

approach to be used in responding. Sometimes responders might and would rely on past

experiences. But time is of the essence when a disaster occurs; therefore, responders

have limited time to develop strategies and no time to assess options (Patterson, Weil, &

Patel, 2010). Oftentimes, interpretations of the roles of the internal auditor in business

continuity planning might differ because of the background of the researcher, methods

used, or objective of the research (Shank, 2006). As a result, objectivity is very

important in qualitative research. One example of thick description utilized in this

proposed study was that of wink. During interviews, the researcher paid close attention to

wink, since each description detail presents a different level of interpretation (Shank,

2006). Additionally, the researcher took into account biases and predispositions during

both the fieldwork and analysis to get to the true essence of the phenomenon under study

(Converse, 2012; Dowling & Cooney, 2012).

The researcher’s perspective must be made explicit. Any research strategy

ultimately needs credibility to be useful. No credible research strategy advocates biased

distortion of data to serve the researcher’s personal interests and prejudices (Klein, 2012).

In this study, it was important to adopt a stance of neutrality. In addition, it was ill

advised to set out to prove a particular perspective or manipulate data to arrive at

predisposed “truths.”

Although the basic assumption of an interpretive framework lies in the view that

there are multiple truths, its approach is more about understanding, which is a primary

goal of qualitative research. Such truths could come from culture, belief, media, and

false ideologies (Shank, 2006). Such shared belief is considered intersubjectivity (Shank,

2006). This study reflected another interpretive framework related to critical awareness.

The idea was not to show weaknesses only but to outline different ways of making things

better. For example, governments implement business continuity plans to ensure

mitigation of the effects of any disruptive events, and thereby protect the assets of the

public.

In this study, the researcher conducted interviews and identified some weaknesses

related to business continuity planning. The participants reflected different ideologies

about the roles of the internal auditor in business continuity planning in the government

sector. Such ideologies could be learned or just beliefs (Shank, 2006). Oftentimes, such

ideologies could work against a person’s or government entity’s self-interest (Shank,

2006). For example, a person might believe that the only way to mitigate the impact of

service disruptions is through daily back-ups of data, which are kept in the establishment

or within close proximity and with the oversight of the internal auditor. However, such

ideology could be self-destructive when a disaster occurs. In essence, business continuity

planning might encompass much more than securing the entity’s data (Klein, 2012).

Other studies related to the subject under study. There was a study on the role

of the public sector asset manager in responding to climate change (Berenfeld, 2007).

The study discussed the need for public asset managers to mitigate and prepare for future

events (Warren, 2010). Another study discussed about business continuity management

in local governments. It emphasized that disruptions to the services could cause a

significant negative impact on the community and could prevent councils from meeting

its obligations (Pearson, 2010).

Another study was an assessment exploration of strategic business continuity

planning methods in Michigan small businesses (Lasecki, 2009). Another study

discussed business continuity management and how to ensure continuity of business by

focusing on the critical business processes (Smit, 2005). A study was conducted on the

cyclical approach to business continuity planning (Botha & von Solms, 2004). The study

discussed the limited business continuity planning by small and medium sized businesses

on account of the lack of resources. There was a study on transitioning from business

continuity to mission continuity (Mekdeci, 2011). That study focused on protecting

educational technology from potential compromise from a variety of threats including

natural disasters, human created risk, and environment dangers.

To recover from any disruption or disaster, a governmental agency needs to

design business continuity planning effectively (Allen, 2008). Literature concentrating

on the development of a business continuity plan failed to identify the roles of the

internal auditor in the identification of critical business processes; risk assessment and

defined threats; vulnerability; probability; impact analysis; disaster levels and recovery

strategy; implementation; testing; monitoring; and maintenance. Internal auditors of

government entities conduct periodic risk assessments and perform audit plans prior to

carrying out audit activities. To perform these assessments, they must understand every

aspect of the entity and critical nature of each unit. Since business continuity planning

also involves conducting an agency-wide risk assessment, it is important to determine the

roles of the internal auditor to ensure adequate protection of critical assets of the

governmental entity (Dickins & Daughterty, 2012).

Research Questions

Since the purpose of this qualitative single-case study was to understand the use

and the perceived roles of the internal auditor in business continuity planning within the

government sector, the research question was designed to arrive at this understanding:

RQ1. What are the perceived use and the roles of the internal auditor in business

continuity planning in the government sector?

Nature of the Study

The focus of business continuity planning is to ensure total survival, especially in

the governmental sector. Ineffective implementation and response to a disaster could

pose the risk of significant losses and negative impact on the government and ultimately

to the public. When a disaster occurs, the job of the government sector is to ensure its

functions can operate during and after a disaster or other contingency, and then minimize

recovery time to reach normal operations, and thereby protect the public (Moeller, 2008).

To mitigate the risk of substandard business continuity planning the right resources

should be utilized. Although no business continuity plan is perfect, the internal auditor,

an independent function, understands risk affecting an organization and is in a position to

report to management and those charged with governance about issues affecting the

organization (McGuire & Schneck, 2010).

This qualitative research focused on understanding the perceived roles of the

internal auditor in business continuity planning within the government sector. This case

study used purposive sampling to ensure the identification and selection of individuals or

groups of individuals with the proper knowledge and experience related to the

phenomenon under study. In addition, participants were expected to be available and

fully participate in the study. They also were expected to be able to convey experiences

or opinions in a coherent manner. The overall objective was to maximize efficiency and

ensure optimum validity (Suri, 2011; Patton, 2002; Yin, 2009). Accordingly, Jones

(2010) exhibited the same rationale during his research on the leadership of government

during an emergency.

Furthermore, the focus of this research strategy is to enhance the consistency and

accuracy of the data gathered, by reducing the unpredictability of responses obtained due

to the individual understanding of data gathering tools and information (Yin, 2009).

Additionally, qualitative research methodology has become increasingly popular within

the field of business continuity research (Rodriguez, Quarantelli, & Dynes, 2007;

Stallings, 2007). Also, this research design methodology is widely used within the public

policy and administration field. This methodology has been used when a study requires

an in-depth understanding of a phenomenon (Haddow et al., 2011). Finally, a host of the

significant studies and pertinent findings within the business continuity and crisis

management field have used qualitative research methodologies (Munro, 2011).

The primary benefit of employing the qualitative research design methodology

was the impartiality in the gathering of data by the researcher by reviewing the pertinent

documents first prior to interviewing the participants. This review ensured the

elimination of any form of participant bias when responding to the researcher’s questions.

Additionally, a qualitative case study provided an opportunity to gain a deeper

understanding of the subject under study (Munro, 2011).

Data collection consisted of utilizing several sources to ensure adequate

understanding of the roles of the internal auditor in business continuity planning in the

governmental sector. The first phase included reviewing a sample of business continuity

plans for different governmental agencies in the State of Texas to ensure the presence of

a business impact analysis, security risk assessment, recovery strategy, implementation

testing, and maintenance program, and disaster recovery plan (Dickins & Reisch, 2012;

Jarvelainen, 2012). Finally, there were interviews with internal auditors in different

governmental agencies in the State of Texas to gain an insight into their perceived roles

in business continuity planning within their respective state agencies.

Texas Government Code, Chapter 2102, Section 2102.004 requires that each state

agency that has an annual operating budget of $10 million; or has more than 100

employees; or receives and processes more than $10 million in cash in a fiscal year

establish an internal audit function. A total of 253 state agencies were identified that met

this requirement (Texas State Auditor’s Office, 2015). Each state agency’s internal

auditing function was expected to have an internal auditor. Additionally, the internal

auditor was required to prepare an internal audit plan by employing risk assessment

methodologies that identify individual audits to be performed during each year. Audits

included the agency’s major system and controls such as accounting systems and

controls, administrative systems and controls, and electronic data processing systems and

controls (Texas Internal Auditing Act, 2003).

The 80th Texas State Legislature, Senate Bill 908, requires all state agencies and

universities to have a business continuity plan or continuity of operations plan under the

guidance of the Texas State Office of Risk Management (Texas State Legislature, 2007).

The objectives were to ensure a state agency can perform its essential function under all

conditions, reducing the loss of life and minimizing property damage and loss, executing

a successful order of succession with accompanying authorities in the event of disruption,

and ensuring there are facilities from where the agency can perform essential functions,

and protecting personnel, facilities, equipment, records, and other assets critical to the

performance of essential functions in the event of a disruption.

The essential functions that must continue and restored quickly, as identified by

SORM include providing and/or assisting in the provision of basic needs which include

water, power, healthcare, communications, transportation services, sanitation services,

environment protection, commerce, and financial services. Emergency services include

providing and/or assisting local and tribal governments in providing critical emergency

services, including emergency management, police, fire, ambulance, medical, search and

rescue, hazmat, shelters, emergency food services, and recovery operations (Texas State

Office of Risk Management, 2016)

Significance of the Study

Business continuity planning should ensure the consideration of the potential risks

and the probability of occurrence. There must be the identification of critical business

processes, risk assessment and definition of threats, determination of vulnerabilities,

probability, impact, disaster levels and recovery, implementation and maintenance

strategies. In essence, there should be reasonable assurance of sufficient plan to mitigate

unwanted risks within certain tolerable limits (Gruiescu, Ioanăş, & Morega, 2010).

However, business continuity plans may not consider the necessary attributes required

when the proper expertise is not utilized (Erickson, 2006; Henstra, 2010).

The threat of catastrophic events needs to be understood and properly

communicated to those charged with the oversight of the government agency as such

events could have significant negative effects on the government (Law & Robson, 2014).

Service disruptions could jeopardize the government entity’s critical products and

financial security (Goudsmit, 2012) when the business continuity plan is not planned

properly. Recently, there have been instances of disasters that resulted in significant

economic losses. Economic losses arising from disasters between 2001 and 2010

approximated over $1 trillion. This amount doubled the total amount of losses incurred

between 1981 and 1990 (Kunreuther & Michel-Kerjan, 2011). As such, management and

the oversight body need to rely on an independent function to provide insight into the

nature of risks affecting the government agency, the likelihood of the risks and the risks,

and the level of preparedness (Stewart & Subramaniam, 2010).

The internal auditor who is charged with auditing all of the activities should

understand the functions of the governmental entity and is in a position to provide

independent information regarding risks and the effectiveness of the business continuity

plans in a non-cost prohibitive way (Dickey, Schwagel, & White, 2006). Even in the

business environment today, internal auditing is considered a significant part of an

organization’s internal control structure. To reinforce the critical nature of this function,

Section 303a of the New York Stock Exchange’s Corporate Governance Listing

Standards (2013) specifically requires companies to have an internal audit function.

Therefore, it is important to ensure management understands internal auditing is an

essential part of the organization and is positioned to offer support in risk management

(Dickey et al., 2006). The estimated cost of the BP oil spill was $6.6 billion in the United

States and $1.5 billion in the Caribbean (Kunreuther & Michel-Kerjan, 2011). These

uncertainties can be mitigated by properly implementing preventive mechanisms and

control processes utilizing the right expertise to address threats and vulnerabilities (Geale,

2012). Also, government agencies are not immune to disasters; therefore, proper

business continuity planning is required.

Definition of Key Terms

Audit committee. An operating body of the governing body responsible for

overseeing financial reporting and providing an ongoing link between the governing body

and the independent auditor, separate from management (Gauthier, 2007).

Business continuity management. Business continuity management is a process

that assures the identification of potential impact of risks that threaten an organization,

provide a system for forming resilience and means for an effective and efficient reaction

to these threats, and to ensure the eventual preservation and interest of its key

stakeholders, reputation, brand and value-creating actions (Calderon, 2003).

Business continuity risk. A business continuity risk is a probability that the

entity will continue to exist after a significant event (Calderon, 2003).

Business impact assessment. A business impact assessment is the evaluation of

the entity’s requirements based on the importance to business functions (Berenfeld, 2007)

Business continuity. Business continuity is designed to allow an organization to

examine its processes, so it understands how things work—where the risk points are and

how to start establishing mitigation alternatives and approaches (Garcia, 2008).

Critical business processes. Processes that must be restored immediately after a

disruption of service occurs (Calderon, 2003).

Disaster. An event that could result in a loss (Bayrak, 2009).

Disaster recovery. Disaster recovery provides for the restoration of critical

facilities and IT services such as hardware, software, and telecommunications following a

significant event (Bayrak, 2009; Parker, 2011).

Internal auditing. Internal auditing has been defined as an independent,

objective assurance and consulting activity designed to add value and improve an

organization’s operations. It helps an organization achieve its objectives by bringing a

systematic, disciplined approach to evaluate and improve the effectiveness of risk

management control and governance processes (Burnaby, Hass, & Abdolmohammadi,

2009).

Independent. Impartial and unbiased in discharging duties. The internal auditor

must have an impartial, unbiased attitude in discharging his or her duties (Sinason, 2011).

Internal control. Internal control has been defined as a mechanism implemented

by management to assure “the accomplishment of the organization’s objectives” (Tysiac,

2012, p. 24).

Low impact disaster. Temporary, little to no damage or loss, easily remedied,

may require no organizational response, such as power loss due to thunderstorm or failure

to make a backup of data because a key person was out of the office (Bayrak, 2009).

Major impact disaster. An event that is long-term, causing destruction or loss of

data center, office space, warehouse, or other, such as the first World Trade Center attack

in 1993, or a major attack against one or more e-commerce sites such as the February

2000 distributed denial-of-service attack on eBay or Hurricane Sandy of October 2012.

Medium impact disaster. An event causing possibly temporary, minor damage

or loss that will require some remediation, such as power loss due to an accident that

knocked down a pole carrying electric lines, or a computer virus spreading rapidly

through the organization (Bayrak, 2009).

Mitigate. An action to ensure an occurrence is less severe or harmful (Berenfeld,

2007). Organizations develop and implement business continuity plans to mitigate

service disruptions.

Risk assessment. Risk Assessment is the quantitative or qualitative

determination value of risk associated with specific situations and documented threats

(Pinta, 2011).

Risk mitigation. Risk mitigation is developing “appropriate, cost-effective

controls that work to reduce potential threats or reduce the impact of those threats should

they occur” (Mekdeci, 2011).

Stakeholders. Individuals, groups, or organizations affected by an organization’s

actions, especially whenever there is a disruption of service.

Threats. Threats are potential events that could cause technology or facilities to

be unavailable or damaged (Mekdeci, 2011).

Vulnerability. Susceptible to a risk or harm. As a part of business continuity

planning, organizations assess vulnerabilities (Mekdeci, 2011).

Summary

When a disaster occurs, the purpose of business continuity planning is to ensure

critical functions can operate during and after a disaster or other contingency, and then

minimize recovery time to reach normal operations (Carrington, 2010). Governments are

oftentimes ill-prepared to handle disasters owing to a lack of adequate resources, other

competing issues, and proper preparation for catastrophic events (Deverell, 2012).

Therefore, they apply their resources toward more critical issues. But government

agency has to create a plan to be followed should an emergency arise (Hall, Skipper,

Hazen, & Sawalha, 2012). This minimizes the impact of disruption and ensures the quick

resumption of operations. A well-executed plan minimizes the impact of disruption and

ensures the quick resumption of operations. This plan also requires the assessment of

risk and the implementation of risk management. The internal auditor helps the

government achieve its objectives of serving the public by evaluating and improving the

effectiveness of risk management. Consequently, the problem to be addressed by this

study was the lack of the use and the limited understanding of the perceived roles of the

internal auditor in business continuity planning in the government sector. This

qualitative research focused on understanding the perceived roles of the internal auditor

in business continuity planning within the government sector. This case study used

purposive sampling to ensure the identification and selection of individuals or groups of

individuals with the proper knowledge and experience related to the phenomenon under

study. The researcher used semi-structured interviews and open-ended questionnaires for

data collection.

Chapter 2: Literature Review

This study explored the roles of the internal auditor in business continuity

planning within the government sector. When an organization experiences a disruption

of service because of a disaster or other unexpected incidents, the responsibility of an

organization is to ensure critical functions will continue to operate during or after the

incident (Cascardo, 2013). Business continuity plans are the measures an organization

has in place to ensure the continuance of business if there is a disruption of normal

operation (Lindström, 2012). The primary objective is to ensure mission-critical systems

of the entity, such as the government, continue to function at an acceptable level

regardless of a disaster or disruption (Randeree, Mahal, & Narwani, 2012). Governments

oftentimes worry about continuity as they are under pressure to keep up with the citizens’

expectations for optimum services. Additionally, globalization and technological

advancements have changed how governments do business (Nasim & Sushil, 2010). A

government agency has to create a plan to be followed should an emergency arise (Hall et

al., 2012). Thus, an implemented and complete plan minimizes the impact of disruption

and ensures the quick resumption of operations.

For example, the United States collects taxes from its residents on income

generated anywhere in the world (Hickman, 2012). The government sector would rely on

business continuity planning to mitigate the impact of any disruption that would affect its

ability to collect taxes. The management of the government agency would be expected to

utilize the right resources to ensure proper implementation of the business continuity

plan. Implementation of business continuity planning requires an adept knowledge of

potential risks and their possible impact on the government (Glendon, 2013). For

example, Malaysia had never experienced tsunami until its occurrence 2006, and because

of a lack of proper planning, experience, and expertise, the government was not prepared

to mitigate the disruption arising from that event (Raman et al., 2011). Potential risks to

the government include the loss of mission critical data, displacement of workers, and

unavailability of facilities because of catastrophic events (Gourio, 2012). The internal

auditor helps the government achieve its objectives of serving the public by evaluating

and improving the effectiveness of risk management. The government internal auditor

could assist in risk evaluation during the implementation of business continuity planning.

Historically, government internal auditors roles have been in the areas of audit

performance, testing the integrity and reliability of the information provided to elected

officials or public, participating in measuring performance by reviewing the

reasonableness of performance targets and making recommendations to management and

elected officials, and assisting elected officials and management in an advisory capacity

(Epstein, 2010). Some of the issues affecting governments today are adapting to changes

related to information technology (Marsh, Fischer, & Montondon, 2013). But, there has

been little or no attention given to the role of the internal auditor in business continuity

planning in the government sector. Ironically, information technology is a major part of

the business continuity planning (Aikins, 2011).

Documentation

The literature review was conducted by using several online library databases,

which included ProQuest ABI/INFORM Global, Roadrunner Search, and EBSCOhost,

for peer-reviewed, academic articles with key terms of business continuity planning,

internal auditing, and government sector. Different variations of these terms used to

search databases were disaster recovery, risk management, independent, internal control,

mitigation, risk assessment, threats, vulnerability, crisis, and stakeholders. This

document includes 203 peer-reviewed journal articles published within the last five years

and properly referenced and cited.

The strategy used to gather appropriate literature included research on information

pertinent to business continuity planning and roles of the internal auditor within the

government sector in the United States. The literature search involved looking for

resources in different journals, books, dissertations, magazines, newspapers conference

papers and proceedings, trade journals, and other pertinent journals available in

Northcentral University’s online database. Each source was reviewed and evaluated to

determine its applicability to the subject under study.

How Business Continuity Planning Applies to the Government

Governments serve the public and as such should be concerned about the threats

to the continuity of their operations. Just like other organizations, they face different

types of risks on a daily basis, which includes failure of established internal controls,

catastrophic events, and noncompliance with regulations (Nor Azimah, 2013).

Emergency conditions can arise at any time; therefore, it is the expectation of the public

that the government protects its assets to ensure continuity of operations. Government

leaders need to identify the risks and institute a plan to ensure successful recovery should

an event occur (Smith, 2013). As a result, there is a need for the design and

implementation of a business continuity plan that provides reasonable assurance of

mitigating any emergency (Ditch, 2014).

Although it is almost impossible to predict how long or the severity of a potential

disaster, a risk assessment can be used to project the likelihood of a threat such as

earthquakes, tornadoes, pandemic, terrorist acts, and other disruptive events (Adini, Laor,

Cohen, & Israeli, 2012). A properly conducted risk assessment can also sustain safety,

security, and improve the knowledge should an emergency occur; and thereby enhance

the resilience of the organizational systems (Johnsen & Veen, 2013). Business continuity

planning needs to continue to evolve and expand as it is more than daily backups and

facilities for housing staff; it involves the organization as a whole. Even the U.S. Federal

Reserve Board, the Office of the Comptroller of the Currency, and the Securities and

Exchange Commission identified the need for a business continuity plan and published an

interagency paper to the financial services industry. Their goal was to ensure timely

response and adequate protection of assets should a catastrophic event occur. The

specific objective was to ensure swift recovery and appropriate continuation of critical

services following a disaster or any other catastrophic event (Law & Robson, 2014).

The Securities and Exchange Commission firmly believes it is important to have

an alternative plan to ensure continuity of operations. As a result, in 2004, the Securities

and Exchange Commission enacted rules requiring the National Association of Securities

Dealers and New York Stock Exchange members to develop and implement business

continuity plans (Law & Robson, 2014). Specifically, the Securities and Exchange

Commission requires members of National Association of Securities Dealers and New

York Stock Exchange to develop procedures related to major service interruptions. The

concept is that among securities professionals this requirement will streamline regulation

and ultimately reduce the cost to members (Cereola & Cereola, 2011).

In response to the accounting scandal involving certain high profile organizations,

President George Bush signed the Sarbanes-Oxley Act of 2002 (Scott & Nganje, 2011).

Additionally, because of recent fraudulent activities in different organizations,

management and stakeholders are concerned about the increasing risk related to business

continuity (Randeree et al., 2012). For example, corporate fraud has caused the collapse

of one of the major auditing organizations (Beets, 2011). Another example was the

indictment of Enron’s CEO and conviction of other members of management who

violated ethics, trust, and integrity tied to the abuse of power (Soltani, 2014). Although

Sarbanes-Oxley did not specifically require the implementation of business continuity

plans, such provision was indirectly made in the interpretation of Section 404,

Management Assessment of Internal Control (Cereola & Cereola, 2011). Sarbanes-Oxley

does specifically require member organizations to understand the risks that may have a

significant impact on their financial reporting and as a result, business continuity became

an integral part of the Sarbanes-Oxley Act (Cereola & Cereola, 2011).

The goal of business continuity planning is not to prevent disasters or service

disruptions, but, like an insurance policy, it deals with risk identification and assessment,

and planning for the mitigation of losses from an unfavorable incident (Goldberg, 2013).

Such planning ensures that an organization will be able to respond to a disaster, and

critical business activities will continue to function at an acceptable level (Turulj &

Bajgoric, 2012). Business continuity planning could mitigate losses from disasters when

properly developed and implemented (Turulj & Bajgoric, 2012). To ensure proper

mitigation of losses from disaster, there should be refined methods of understanding

risks, which would involve deploying different expertise in the organization to participate

in the risk identification and assessment (Santos, Borges, Canós, & Gomes, 2012).

Business continuity planning and disaster recovery are often used

interchangeably, but their objectives are different. Business continuity planning is

broader in scope since it encompasses developing, testing, and the continuity of an

organization as a whole, including people, facility, and critical information technology

(Friedman, 2014). Disaster recovery concentrates on developing, testing, and

implementing continuity for critical information technology and business applications

(Friedman, 2014). Business continuity planning tends to be utilized to identify the

resources, threats, and potential impact of threats, as well as ways of mitigating

disruptions affecting the organization as a whole (ISACA, 2012). In essence, to ensure

continuity, critical processes of an organization, including IT, need to be restarted or

recovered within an acceptable time frame. The lack of awareness and understanding of

threats by a segment of the organization could be a hindrance during the formulation of a

business continuity plan (Ojha, Gianiodis, & Manuj, 2013). As a result, it is important

for senior management, IT managers, and operational employees to get involved in the

development of a business continuity plan (Lindström, 2012).

Reasons for Business Continuity Planning

At a minimum, over a billion individuals in different countries worldwide are

periodically exposed to disasters and the frequency of disasters is steadily increasing. For

example, between 1900 and 1909, about 73 disasters occurred, but during the period of

2000 to 2005, there were instances of 2,788 disasters (Pathirage, Seneviratne,

Amaratunga, & Haigh, 2012). According to Chen and Lee (2012), natural disasters occur

about 400 times each year and result in over 70,000 deaths and affect more than 230

million people. These worldwide disasters are affecting different organizations.

Disasters can affect any organization, large or small, and at any level of

development (Heller, 2012). In today’s dynamic world, organizations are always looking

for different ways of achieving their goals and ensure continuity of operations (Spremic,

Jakovic, Braje, & Cavlek, 2013). The Internet has steadily been essential to all facets of

the world prompting questions on how to manage and govern it (De Turck, Kiriha, &

Hong, 2012). Notwithstanding, the past 20 years has seen tremendous advancement

toward a technology base that is more universal; therefore, enhancing worldwide

connectivity. Additionally, the number of connections and data exchanges has increased

(Ghezzi et al., 2013). As more catastrophic events occur, organizations and the public as

a whole worry about the continuity of business functions. Additionally, technology has

made the world one interconnected marketplace. Organizations are steadily transitioning

from stand-alone word processing and paper filing to server-based systems (Friedman,

2014). These systems make it easier to access documents remotely and obtain real-time

information. The Internet has steadily become essential to all facets of the world.

Businesses are steadily moving to real-time operations; making connectivity very

important to ensure achievement of an organizations’ objectives (Friedman, 2014).

Advanced technologies are required for mobile computing in the workplace,

enterprise resource planning, virtualization, cloud computing, social networking, and

faster connectivity to ensure a competitive edge (Nicoll & Owens, 2013). Cloud

computing is the method of storing and processing information offsite and it has changed

the way business is conducted in the 21st-century (Tudoran & Ionescu, 2014). From an

economic standpoint, cloud computing affords an organization the option of operating

without having to pay for hardware, software, maintenance, and data storage costs and

management. Cloud computing is also considered to be environmentally friendly

because it enhances energy efficiency and has the advantage of scalability (Dudin &

Smetanin, 2011). Owing to the continued technological transformations and

globalization of computer resources, cloud computing offers organizations many ways of

improving productivity; it is estimated that cloud computing has become a $46 billion

business (Aleem & Christopher, 2013). Although cloud computing offers organizations

many ways of improving productivity, some are worried about security issues such as

hacking (Jeya & Kannan, 2014). Cloud computing is the method of storing and

processing information offsite and it has changed the way business is conducted in the

21st century (Nicoll & Owens, 2013). Business continuity plans and critical data stored

in the cloud can be easily accessible through laptops, smartphones, and tablets. However,

this convenience comes with risks. Internet-based attacks have increased significantly,

resulting in severe disruptions in different organizations (Sterbenz et al., 2013).

Disruptions can impact recovery time and accessibility of data if business continuity is

not properly implemented. However, efficiency is achieved when recovery is

accomplished without delay.

The United States has recently had incidents of denial of service attacks aimed at

different business establishments (Campbell, 2013). These incidents were previously

classified as improbable but are currently considered major threats to organizations

(Campbell, 2013). Some are considered criminally motivated and could be initiated

internally or externally. As a result, this type of attack should be classified as a business

continuity issue.

There is also an increased use of personal data storage devices such as CD, USB

sticks, and even smartphones. These devices can be infected, therefore, posing

significant risks to organizations. There is also a growing reliance on outsourcing of

services to other entities and ergo, and as a result, there are increased security issues

related to data as well as reputational risks (Jarvelainen, 2012). As a result, it is

important to develop and implement business continuity planning to ensure the protection

of critical infrastructure. There are also constant expectations from the public, customers,

and government that necessitates building resilient infrastructure to ensure continuity of

business functions (Campbell, 2013). To comply with such demands, organizational

leaders should adopt the right technology policies as well as procedures and recovery

alternatives, and ensure they are tested periodically as a component of the business

continuity planning (Heller, 2012). The internal auditor ensures the organization’s

business continuity incorporates mobile devices that support critical functions and usage

of social media. As a result, mobile devices should have scheduled backups, and there

should be training on how they are backed up. The internal auditor should also review

contracts with mobile device vendors to ensure there is a provision for replacement and it

aligns with the recovery time objective.

Over the past four decades, the United States has experienced an increase in

losses arising from natural disasters such as wind, hail, tornadoes, and lightning

(Goudsmit, 2012). According to the U.S. government’s National Climatic Data Center in

North Carolina, it is believed that hurricane damage will increase in the future on account

of changes in the atmosphere (Campbell, 2013). Specifically, precipitation will rise as

the atmosphere becomes moister; thereby causing more rainfall and flooding. There are

also political overtures that may impede mitigating against natural disasters. Some

politicians, specifically, the state of North Carolina Republic state legislature, passed in

2012 a law disallowing any plans for flood defense on the potential effects of climate

change until 2016 (Campbell, 2013). Although no other states have implemented such a

law, it is still important to ensure that critical assets are protected.

Although an organization’s leaders can achieve the business’ strategic objectives

through the utilization of proper technologies, they oftentimes introduce new risks that

should be mitigated (Jarvelainen, 2012). Such planning by management provides

reasonable assurance of aligning an organization’s goals with its business continuity,

avoids redundancies, ensures efficiency and effectiveness, and ultimately meets the

expectations of the stakeholders (Jarvelainen, 2012). As a result, there is a need for

constructing strong and flexible infrastructures and specifying business continuity

procedures to ensure restoration of critical business functions within recovery times that

are acceptable for an enterprise (“Four emerging”, 2012).

Historically, some organizational managers have failed to plan appropriately for

disasters because of the lack of ordered priorities or because of the difficulty in

determining the potential cost of a service disruption (Malalgoda, Amaratunga, & Haigh,

2013). Sometimes disasters can be predicted in advance. An example was the New

Orleans’ flooding following Hurricane Katrina. Still, an event shocks many people

whenever it occurs. As a result, many government leaders are mandating certain

industries to implement and document a business continuity plan that is frequently tested

(Heller, 2012). For example, in the United States, certain industries such as healthcare,

utilities, and financial services are required to implement and maintain a business

continuity plan. During the World Trade Center attack in 1993, it took Morgan Stanley’s

employees over 4 hours to vacate the building (Law & Robson, 2014). After that

incident, the business continuity plan for the organization had to be revamped to ensure

better mitigation of any future events.

More than ever, society expects the government to be genuine and highly

reputable, especially when managing disasters or any other crisis (Koronis & Ponis,

2012). The expectation is that this trend will intensify as the political and business

environment continues to change considerably. When a crisis is not properly mitigated,

there could be a temporary disconnection with the public or other users of services or

even permanent disruption of business relations (Koronis & Ponis, 2012). The public

expectations have caused some regulatory agency personnel to begin thinking seriously

about business continuity planning (Jones, 2011). For example, the American Bankers

Association and Banking Administrations are expecting their members to implement

acceptable business continuity practices to ensure adequate protection of the public

interest (Koronis & Ponis, 2012).

Preparing and implementing a business continuity plan requires different

expertise to ensure proper response to events (Davison, 2014). Management of disasters

with the right resources, which can include the deployment of the internal auditor for

assessing risks, is important (Zaharia, Dragne, & Tilea, 2014). The identification of the

right resources might also provide a reasonable assurance of continuity of business after a

disaster (Heller, 2012). The internal auditor focuses not only on internal control but

overall organizational risks. This scope ensures the identification of critical business

processes; performance of risk assessment and defining threats; determination of

vulnerabilities, probabilities, potential impacts, disaster levels and recovery; and

implementation strategies. Additionally, reasonable assurance is provided in terms of

keeping unwanted risks within certain tolerable limits (Gruiescu et al., 2010).

An organization should have an alternative path in support of critical business

processes in the event of an emergency, disaster, or other disruption (Jan & Lurie, 2012).

When a disaster occurs, the job of management is to ensure business functions can

operate during and after a disaster or other contingency, and minimize recovery time to

reach normal operations (Jan & Lurie, 2012). The focus should be to ensure total

business survival, not just information technology (Hemond & Benoit, 2012). The ability

to recover from an unexpected incident can mean the difference between recovery and

loss of the business entirely (Hemond & Benoit, 2012).

Recently, there have been instances of disasters that resulted in significant

economic losses. Economic losses arising from disasters between 2001 and 2010 were

set at approximately $1.2 trillion (Kunreuther & Michel-Kerjan, 2011). This amount

surpasses the $528 billion between 1981 and 1990 (Kunreuther & Michel-Kerjan, 2011).

For example, the earthquake that struck Japan in 2011 damaged more than 275,000

buildings, 3,559 roads, 77 bridges, and 29 railways and the estimated economic losses

were $210 billion (Farber, 2011). This amount from the Japanese earthquake is

approximately double the amount of economic loss from Hurricane Katrina (Farber,

2011).

The tsunami disaster shows how modern societies’ interdependencies make them

susceptible to disasters as damage to networks could affect the delivery of key services

(Farber, 2011). Also, the McLure fire of 2003 was the worst fire in British Columbia in

terms of damages caused and as a result, many businesses incurred significant economic

losses totaling approximately $5.6 billion (Cox & Perry, 2011). Owing to the fire loss,

approximately 200 top businesses decided to close their businesses permanently (Cox &

Perry, 2011). The government, just like other organizations, could be affected

significantly by disasters without notice (De Smit, Lagadec, & Leysen, 2012).

The SARS infection epidemic that occurred between 1996 and 2006 comprised

over 3,000 cases and more than 1,300 deaths (K. Lee, Lan, Wang, Fang, & Shiao, 2014).

Those incidents resulted in a significant customer decline in Chinese eateries in North

America. As a result, some scheduled conventions were canceled, which ultimately

affected several cities and necessitated the intervention of the government (K. Lee et al.,

2014). The terrorist attack that occurred in the London, England in 2005 caused 55

deaths (Ramiah & Graham, 2013). That attack significantly affected the country’s

transportation and telecommunications systems.

Another example of instances of disaster with significant business impact was the

BP Deepwater Horizon spill that occurred in 2010 (Farber, 2011). BP personnel spent

about 3 months trying to stop the flow of oil. Additionally, Hurricane Irene in 2011

caused a significant economic loss due to flooding in the northeast (Farber, 2011). The

estimated cost was $6.6 billion in the United States and $1.5 billion in the Caribbean

(Kunreuther & Michel-Kerjan, 2011). An organization’s leaders can mitigate this type of

uncertainty by implementing preventive mechanisms and control processes to address

threats and vulnerabilities (Geale, 2012). Also, government agencies are not immune to

disasters; therefore, proper business continuity planning is required. Such planning

would necessitate gathering the right internal and external resources and properly

deploying them to ensure prevention or mitigation of disasters (Geale, 2012).

Oftentimes senior management and the majority of the members of an entity lack

the awareness and an adequate understanding of the business continuity process

(Niemimaa & Jarvelainen, 2013). These entities include the government, financial

institutions, utilities, and healthcare (Lindström, 2012). As a result of this lack of

awareness and understanding, there is the reluctance to implement a business continuity

plan, and this lack of knowledge could determine whether an entity continues to exist

(Malalgoda et al., 2013).

There were studies in various areas within business continuity planning. These

included the need for public asset managers to mitigate and prepare for future business

continuity planning management in local governments, an exploration on business

continuity planning in Michigan small businesses, how to ensure continuity of business in

general small and medium businesses, and on education technology (Botha & von Solms,

2004; Lasecki, 2009; Mekdeci, 2011; Smit, 2005; Warren, 2010). But none of the studies

addressed the roles of the internal auditor in business continuity planning in the

government sector. To recover from any disruption or disaster, government agencies

need effectively designed business continuity plans (Lindström, 2012).

Management and audit committees need to rely on an independent function such

as the internal auditor to provide information regarding the nature of risks, the likelihood

of the risks, the significance of the risks, and conditions of the organization’s

preparedness (Stewart & Subramaniam, 2010). The internal auditor is charged with

auditing all of the activities of an organization and understands the organization and is in

a position to provide assurance to management that the business continuity plan is

effective, key personnel are knowledgeable of the business continuity plan, its execution

is practical, and that it is cost-effective (Dickey et al., 2006). In the business environment

today, internal auditing is considered a significant part of an organization’s internal

control structure. To reinforce the critical nature of this function, Section 303a of the

New York Stock Exchange’s Corporate Governance Listing Standards (2013)

specifically requires companies to have an internal audit function. Therefore, it is

important to ensure management understands internal auditing is an essential part of the

organization and is positioned to offer support in risk management (Dickey et al., 2006).

No entity is immune to the threat of service disruptions. Service disruptions could

jeopardize an entity’s critical products and financial security (Goudsmit, 2012).

Although developing and implementing a business continuity plan involves a significant

financial commitment, the cost of not developing and implementing one could be greater.

An example is the earthquake in Japan that cut off critical pharmaceutical equipment of

the biotechnology company that had facilities in the United States. The high wind from

the earthquake caused significant property damage and disruption of services. A part of

the business continuity plan is the purchase of adequate insurance protection (Goudsmit,

2012).

Business continuity planning involves more than just a plan for information

systems. The first step to be considered in business continuity planning is the business

impact analysis which identifies risks and reveals the financial, human, and reputational

impact on the organization (Lindström, 2012; Nicoll & Owens, 2013)). There are

different approaches for performing a business impact analysis. One is the use of a

questionnaire which is circulated to the appropriate individuals in the organization. The

information is obtained, tabulated, and analyzed (Ojha & Gokhale, 2009). The next step

is developing recovery strategies. These are a combination of preventative, detective and

corrective measures. A primary goal would be to develop a strategy that identifies the

best way to recover critical systems in case of interruption. The appropriate strategy

would be the one with a cost for an acceptable recovery time that is also reasonable

compared to the impact and likelihood of occurrence as determined in the business

impact analysis (Goudsmit, 2012; Jarvelainen, 2012).

The next step in business continuity planning involves developing a plan. Based

on the input received from business impact analysis and the recovery strategy chosen by

management, a detailed business continuity plan is developed (Lindström, 2012;

Randeree et al., 2012). The various factors usually considered include pre-disaster

readiness covering incidence response management to address all incidences affecting the

organization, evacuation procedures, procedures for declaring a disaster, procedures for

declaring a disaster, the clear identification of the responsibilities in the plan, and the

identification of the various resources required for recovery and continued operation of

the organization (Jarvelainen, 2012; Sawalha, Anchor, & Meaton, 2012).

The next step in the business continuity planning involves testing the business

continuity plan to determine how well the plan works. The test should address all critical

components and simulate actual primetime processing conditions. There should be

training and exercises to ensure awareness of respective responsibilities. Additionally,

there should be detailed documentation of observations, problems, and resolutions. This

documentation serves as important historical information that can facilitate actual

recovery during a real disaster. Business continuity plans should be reviewed and updated

on a scheduled basis to reflect continuing recognition of changing requirements

(Bajgoric, 2014; Randeree et al., 2012).

Internal Audit Function

An internal audit is an independent function within an organization that is

responsible for evaluating the effectiveness of enterprise risk management control

(Burnaby et al., 2009). Stewart and Subramaniam (2010) examined the independence

and objectivity of the internal auditor by reviewing the reporting relationship of the

internal auditor within an organization and the roles the internal auditor plays in

assurance, consulting activities, and risk management. Internal auditors were found to

play an important role in strengthening risk assessment and internal control (Stewart &

Subramaniam, 2010). Additionally, Christopher, Sarens, and Leung (2009) discussed the

importance of the internal auditing function in enhancing corporate governance. The

enactment of the Sarbanes-Oxley Act has made it even more essential for business

managements to rely on the internal auditor during a review of internal control. Internal

auditors provide additional services, which are usually initiated by the board of directors

or audit committee and management to ensure proper accountability (Christopher et al.,

2009).

Internal auditors assume advising responsibilities to ensure the improvement of an

organization’s fundamental process (Badara & Saidin, 2013). They must propose an

audit plan based on risk assessment. Additionally, they help an organization maintain

appropriate internal control. Internal auditors are involved in continuous risk assessment

and evaluation to ensure the achievement of organizational goals (Burnaby & Hass,

2011).

The internal control provides reassurance to the users of the reliability of

information presented to the stakeholders (Lenz & Sarens, 2012). The public wants to be

sure the government sector is run very efficiently and effectively. Additionally, external

auditors expect organizations to have a good internal control (Lehman, 2010). The

internal auditors are usually very knowledgeable about the activities of the organization

and could add value during the development and implementation of a business continuity

plan to provide reasonable assurance to the public about the objectivity of the information

presented (Sinason, 2011).

Internal audit and independence. For an internal audit to be effective it must be

independent (Al-Matari, Al-Swidi, & Fadzil, 2014). In essence, the work of the internal

auditor should be free from the influence of the management of an organization. Internal

auditors, especially the heads of the internal audit functions in organizations, usually have

certifications in any of the following: Certified Public Accountant granted by a state

board of public accountancy under standards promulgated by the American Institute of

Certified Public Accountants, Certified Internal Auditor granted by the Institute of

Internal Auditors, or Certified Information Systems Auditor granted by the Information

Systems Audit and Control Association (ISACA). Each of these professional bodies has

different standards with which their licensees must comply. Some of these standards

include undergoing periodic external quality control reviews and maintaining minimum

continuing education credits (Al-Matari et al., 2014). Continuing education allows them

to be proficient in different areas including the identification of fraud risks, threats to

business continuity, risk assessment, IT skills, and conducting business impact analysis

(Dickins & Reisch, 2012).

Internal audit and risk management. Internal auditors are required to comply

with the Institute of Internal Auditor’s International Standards for the Practice of Internal

Auditing (de Zwaan, Stewart, & Subramaniam, 2011). In 1999, the Institute of Internal

Auditors redefined internal audit to encompass three areas: (a) risk management, (b)

control, and (c) governance (de Zwaan et al., 2011). Enterprise risk management has

been defined as a process which is effected by those charged with governance within an

organization, management, and other applicable personnel assigned to identify potential

threats or events that could potentially affect an organization, manage the risk to an

acceptable appetite, and provide reasonable assurance of achieving overall objectives of

the organization’s goals and objectives (Hosban & Hamdan, 2015; Pang & Li, 2013).

Internal auditing is a significant component of an entity’s governance, overall risk

management, and internal control (Anderson, Christ, Johnstone, & Rittenberg, 2012).

The internal auditor provides an independent evaluation of systems in place within an

organization and provides reasonable assurance to the management on whether internal

control is functioning as intended (Guxholli, Karapici, & Gjinopulli, 2012). Management

has to institute a good internal control to ensure proper documentation and

implementation of the business continuity planning (Jalba, 2013). In the past, internal

auditors analyzed documents, reconciled bank accounts, identified issues, and made

recommendations for eradicating the cause of the issues discovered (de Zwaan et al.,

2011). More of the issues identified related to errors made by staff or the lack of

understanding of established policies and procedures (de Zwaan et al., 2011). Owing to

the increased reliance on technology and the number of vulnerabilities and threats, an

organization could leverage the knowledge of the internal auditor during the development

of the policies and procedures related to business continuity to ensure alignment with the

overall organizational risk management and reduce redundancies (Mekdeci, 2011). A

good business continuity strategy is to conduct a periodic business impact analysis on the

critical systems to make sure they are still valid (Jarvelainen, 2012). The business impact

analysis serves as an introduction to the issues facing the government in terms of

resources, critical systems, and operations. The government sector can use the business

impact analysis to evaluate threats and risks and critical systems required to provide

services. Based on the business impact analysis, the government, just like other

organizations, can determine the recovery time objective for critical functions. The

recovery time objective is the maximum time allowed to recover a business unit or

function. If the recovery time objective is surpassed, the government sector will incur a

significant loss. An organization may use a combination of questionnaires and interviews

during the business impact analysis. The internal auditor is in a position to facilitate the

development of the questionnaires to ensure they are sufficient and relevant (Stewart,

2009).

The management of a government sector might sometimes be worried about

regulatory mandates and privacy issues such as health and human services, whether

information technology strategies are aligned with the overall organizational goals and

regulatory requirements fulfilled (Ayalon, 2011). Additionally, the oversight board

wants to ensure that appropriate controls are considered to provide reasonable assurance

that data integrity is guaranteed in the event of a disaster (Odoyo, Omwono, & Okinyi,

2014).

Additionally, the internal auditor could serve as a resource during the update of

the business continuity plan to ensure significant changes to critical business processes

have been captured (Mekdeci, 2011). A good business practice ensures that backups are

frequently tested to confirm that data can be restored to form in the event of a disaster

and that restoration can occur within the recovery time objective and recovery point

objective instituted by an organization (Sawalha, Anchor, & Meaton, 2012). The internal

audit reviews the business continuity planning to ensure that there is periodic training and

awareness regarding threats and vulnerabilities (Camara, Crossler, Midha, & Wallace,

2011; DHS, 2015).

Another role of the internal auditor would be to make sure that during the

procurement process of third party providers, a full cost and benefit analysis was

performed to ensure that the outsourcing made sense and proper diligence was

sufficiently performed (Kent, 2011). The analysis might include determining whether it

would be cheaper to perform the process in-house in lieu of outsourcing (Kent, 2011). In

essence, if the data center were operated in-house, how much would it cost the

organization versus outsourcing the function; this might include getting the key business

units to be involved in the process (Nicoll & Owens, 2013). This process is considered a

transfer of risk to another entity; however, it is a part of the organization’s cost in the

business continuity planning process (Wees, 2013). An organization’s objective should

be to ensure that the cost of the business continuity planning does not outweigh its

benefits (Baker, 2012).

To further support this assertion of the independence of the internal auditor,

Franck and Sundgren (2012) found organizations that have internal audit functions are

more likely to discover and report fraudulent activities than those operating without any.

Marques (2014) added that internal auditors are likely to uncover fraudulent activities and

corruption. As a result, an organization can expect the internal auditor to assess

objectively the threats and risk factors affecting the entity to ensure continuity of business

processes if a catastrophic event occurs (Franck & Sundgren, 2012). A conflict might

arise on account of a simple disagreement between individuals, groups, and departments

in organizations, such as the government, in determining critical businesses or allocating

the resources earmarked for business continuity business. Since no organization is

immune from conflicts, the internal auditor is in a position to serve as the eye of the

board of directors in making sure the overall interests of the organization is represented,

especially, when analyzing the need for a business continuity plan. A conflict that is not

adequately or independently resolved, especially when related to business continuity

planning, could negatively affect an organization (Mukhtar, 2013).

Owing to regulatory requirements, there has been an increased awareness and

demand for internal assurance within organizations (Dickey et al., 2006). Internal

assurance includes the need for adequate internal control and risk management.

Independence and objectivity are required to accomplish this task, and the internal

auditor is in a position to provide this assurance (Soh & Martinov-Bennie, 2011). The

Health Insurance Portability and Accountability Act and the Sarbanes-Oxley Act are

examples of the increased regulations that warrant the need for the protection of

organizations’ assets. Furthermore, there has been an increase of dangers related to

terrorism, natural disasters, and even fraudulent acts within organizations (Randeree et

al., 2012). These threats pose significant risks to organizations, especially governmental

agencies whose services are needed at all times. Also, the media exaggeration has

amplified the public perception of these risks (Randeree et al., 2012).

Role of Internal Auditor

Generally, the internal auditor would make a recommendation for the

improvement of the processes in place. Management valued the opinion of the internal

auditor, and as a result relied immensely on that function. Nowadays, internal auditing

has expanded to encompass functioning in an advisory capacity to management and those

charged with governance (de Zwaan et al., 2011). Additionally, the internal auditor is

charged with addressing concerns about risk identification, risk evaluation, and the

implementation of internal control to ensure achievement of an organization’s goals. As

a result, many organizations have begun paying more attention to internal auditing and

enterprise risk management structures (Jalba, 2013).

Although organizations may be aware of the need to protect their assets, some are

not knowledgeable or are reluctant to implement a business continuity plan (Pathirage et

al., 2012). Therefore, involving the internal auditor ensures that these critical business

processes are identified. If any are excluded by management, possibly on account of

unnecessary conflicts, the unbiased internal auditor is in a position to report such

omission to the board of directors (Randeree et al., 2012). The internal auditor is in a

position to relay to the board of directors or its designated committee whether

management understands risks affecting the organization and the potential impact of any

loss (Schneider et al., 2012). The internal auditor also assures the board of directors or its

designated committee that management of the organization can effectively mitigate any

business continuity risks to acceptable levels (Stefaniak et al., 2012). Additionally, in

situations where management has decided to assume the risk of undesirable business

continuity risk, the internal auditor notifies the board and also ensures sure a decision has

been adequately documented (García et al., 2012).

The internal auditor evaluates critical functions within the organization and as

such participates in the improvement of governance, risk management, and control

processes (Christopher et al., 2009). Internal auditors are expected to promote the right

ethical values by communicating significant risk exposures to the appropriate level of

management and those charged with governance (Leung, Cooper, & Perera, 2011). As

the evaluators of critical functions, the internal auditors understand the need for business

continuity planning (Christopher et al., 2009). Additionally, due to their knowledge of

the organization and understanding of risk management, they understand firsthand the

steps that should be taken to ensure proper development and implementation of business

continuity planning (Christopher et al., 2009). They can also educate management and

those charged with governance on potential threats to the organization, and the

importance of supporting business continuity planning with adequate resources (Kanellou

& Spathis, 2011). Resources include the right individuals and funds needed for the

business continuity plan. The internal auditors can also assist in educating employees

and creating proper awareness and ensure activities align with overall objectives of the

organization (Kanellou & Spathis, 2011).

Internal auditors determine whether the structures implemented by management

are adequate and functioning appropriately (Jalba, 2013). In essence, internal auditors

can change management’s strategic objectives through recommendations based on the

execution of the internal audit plan. Management values the work of the internal auditors

not only because of their independence but because of the standards they follow in

accomplishing internal audit tasks (Soh & Martinov-Bennie, 2011). The work of the

internal auditor requires collecting data and evaluating risk; this aids in providing

pertinent information in an advisory role. The roles are advisory in matters related to

information technology systems and strategic risks affecting the organization (Leung et

al., 2011). Additionally, this function is considered a first-line of defense in opposition to

unacceptable response to corporate risks (Muqattash, 2011). The internal auditor’s role is

explicitly specified by those charged with governance or its designated audit committee

(Muqattash, 2011).

Authority of the internal auditor. The internal auditor, who is the head of the

internal audit function, provides an objective assessment of risk management and reports

to those charged with governance within an organization. Those charged with

governance is the board of directors of an organization or its designated committee

(Dickins & Daughterty, 2012). The authority of the internal auditor is documented in the

organization’s internal audit charter, which is approved by those charged with

governance or its designated committee (Holt, 2012).

The authority of the charter helps ensure objectivity by the internal auditor

(Aikins, 2012). For example, a government agency manager cannot try to reduce the

scope of the internal auditor’s function or even reject the recommendations of the internal

auditor without the approval of the board of directors. In essence, the management of an

organization cannot override the mandate of a charter without the approval of the board

of directors (Aikins, 2012). As a result, the internal auditor is believed to be impartial

and unbiased in the discharge of his or her duties (Muqattash, 2011).

The Institute of Internal Auditors requires that the internal auditor maintain

objectivity and be independent in performing his or her duties (Muqattash, 2011).

Internal auditors in the government sector are considered watchdogs because they are in a

position to promote trust and accountability owing to their independence (Elmore, 2013).

As a result, the internal auditor avoids any conflicts of interest and is free to report any

corporate risks and serve as an early warning system to the board of directors and the

organization as a whole. For example, a part of developing a business continuity plan is

identifying critical business processes to ensure adequate protection and recovery

(Randeree et al., 2012).

Internal auditor and third parties. The participation of the internal auditor

ensures full knowledge of the contract terms between the organization and the third-party

providers (Nicoll & Owens, 2013). This knowledge provides an opportunity for the

internal auditor to monitor the contract requirements and risks associated with the third

parties. Some of this monitoring might include reviewing for compliance with business

continuity, adherence to laws and regulations, or maintenance of certain financial ratios

or other key performance measures to continue to qualify to contract with the government

agency (Nicoll & Owens, 2013). Another key role of the internal auditor would be to

determine how data will be transmitted, received, and validated, and whether a third party

is to be used for back-up of data (Wayman, 2013).

The internal auditor could facilitate the testing of application controls of the third

party (Wayman, 2013). During that process, the internal auditor might discover certain

application controls are different for providers being considered, even though the data

field layout might be the same. Additionally, the internal auditor would ensure the third

party has sufficient information security policies, guidelines, and monitoring. The

agreement with the third party could include a requirement to encrypt all data files and

maintain them on a secure network (Wayman, 2013).

The internal auditor would also review the third party’s business continuity to

ensure there is a procedure for recovering critical data (Wayman, 2013). Alternatively,

the internal auditor might determine whether the third party service provider has

undergone an external review performed in accordance with the American Institute of

Certified Public Accountants on Standards for Attestation Engagements No. 16,

previously known as No. 70. This could limit the level of front-end information

technology review to be conducted by the internal auditor (Wayman, 2013).

The members of management and those involved in the activities of the

organization might not be cognizant of the internal control and its effect regarding the

third party (Wayman, 2013). They also might not know the role of the internal auditor in

helping the organization mitigate risks. To help ease this issue, the internal auditor might

conduct training sessions in internal controls, the roles of the internal auditor within the

organization, and risks associated with third party service providers (Wayman, 2013).

The Government and Readiness

A study indicated that management of public sector organizations spend relatively

more time than their private counterparts dealing with different crises (Thach, 2012).

One explanation is because they are responsible to various constituencies and changes

related to legislation and budget (Thach, 2012). Any significant service disruption within

a government agency affects its stakeholders, including the public (Leverty, 2012). As a

result, government agencies must be readily available to ensure the protection of the

public during disasters. Prevention cannot be accomplished without a steady or periodic

assessment of risks (Chang, Huang, Roan, Chang, & Ying, 2014).

Types of disasters. Organizations and communities are steadily exposed to

different types of disasters warranting the need for business continuity planning (Afedzie

& McEntire, 2010). The different types of disasters that can affect the government may

include inherent, environmental, external, and internal disasters. Inherent disasters may

include fire, flood, and tornado; environmental disasters may include power outages or no

telephone; external disasters may include terrorism and sabotage; and internal disasters

may include employee misdeed, fraud, and accident (Bajgoric, 2014; Verchick & Hall,

2011). Government agencies, just like other organizations, must develop a business

continuity plan using different relevant expertise to ensure proper identification of risks,

threats, impact analysis, and mitigations of those of risks (Afedzie & McEntire, 2010).

Inherent disasters can occur at any time, and when it happens, it can affect an

entire region, city, state, and even international boundaries. As a result, organizations,

such as government entities, need to plan for unforeseen events by deploying the relevant

resources to ensure adequate mitigation of potential disasters (Amancei, 2011). For

example, the state of Iowa has experienced three catastrophic floods since 1993

(Verchick & Hall, 2011). The 2008 floods significantly affected cities within Cedar

Rapids and other neighboring communities and caused several million dollars in property

damages (Verchick & Hall, 2011).

Uncertainties created by inherent disasters have caused experts in the United

States to begin paying significant attention to rainstorms (Maurice, 2013). Maurice

(2013) felt the frequency and intensity of rains are to be blamed for the precipitation

increase noticed in the United States over the last half-century. Heavier rains, floods, and

hurricanes increase the chances of larger property damage. For example, it is estimated

that the flooding that occurred in the United Kingdom in 2007 affected about 7,000

organizations and caused over $4.5 billion in damages (Wedawatta & Ingirige, 2012).

Other inherent disasters include heat waves, wildfires, and even epidemic illnesses, which

ultimately may affect the continuity of critical operations of the government (Verchick &

Hall, 2011). These potential disasters could significantly disrupt services and cause a

delay in restoring critical governmental functions and negative reactions from the public

may ensue (Lester & Persia, 2011). Well-designed business continuity planning would

include identification of these threats, their probability of occurring, and indicate an

objective plan for the mitigation of any possible service disruption (Gunnec & Salman,

2011). However, these tasks would require the expertise of those with risk management

experience, such as the internal auditor (Anderson et al., 2012).

Cities in the United States face disaster risks. However, some have the highest

natural disaster exposure risks, such as Miami, New Orleans, Oakland, San Francisco,

Honolulu, San Jose, Houston, Los Angeles, and Long Beach (Sun, 2011). Also, many

interior cities, such as Oklahoma City, Tulsa, Sacramento, and Memphis face serious

disaster risks (Sun, 2011). In 2008, there were 37 natural catastrophes, which resulted in

about $25 billion in losses (Born & Klimaszewski-Blettner, 2013). Government agencies

in the United States can easily be affected by any of these catastrophic events. As a

result, proper business continuity planning is required to ensure mitigation of disruptions

that may be caused by these events (Omar, Alijani, & Mason, 2011).

The terrorist attack on the homeland of the United States on February 26, 1993,

left an indelible mark on the history of the United States (Sorial, 2011). Prior to this

incident, terrorism was considered an external issue with a remote or no potential impact

on the United States (Sorial, 2011). On that date, Islamic terrorists ignited a 1,500-pound

bomb in the World Trade Center that killed six people and critically injured hundreds of

people (Law & Robson, 2014). Many thought that was an aberration because the stock

market was not hugely impacted; the next day the market fall was less than 1% (Law &

Robson, 2014).

The year after the 1993 World Trade Center bombing, the stock market

experienced an average gain of 13.7% (Law & Robson, 2014). That event was quickly

forgotten until September 11, 2001, when the United States was hit again. On that day,

two planes crashed into the World Trade Center; one crashed into the Pentagon, and

another into a field in Pennsylvania. Those events have permanently changed the United

States as a nation (Sorial, 2011). As a result, there were an estimated 2,700 deaths

reported in New York and 125 in the Pentagon, and an economic loss of over $80 billion

(Sorial, 2011).

Many organizations had not been adequately prepared to mitigate the impact of

those World Trade Center attacks (Law & Robson, 2014). Although overall, disaster

recovery and business continuity planning were in place; they were not adequately

implemented (Law & Robson, 2014). As a result, many organizations were not able to

continue providing services after the September 11, 2011, attacks and eventually

discontinued business operations (Law & Robson, 2014). On August 14, 2003, New

York City experienced an electrical blackout that is still considered one of the largest

catastrophic events in United States history (Farley & Weisfuse, 2011). The blackout,

which lasted approximately three days, affected eight United States’ cities and parts of

Canada.

The threats of catastrophic events need to be understood as such events could

have significant negative effects on the government (Law & Robson, 2014). Lessons

learned from different catastrophic events are that unexpected events may have a negative

impact on an establishment if there are no strategies for mitigation (Grimaila & Badiru,

2013). Some establishments fail to recover from a disaster because of insufficient

knowledge of threats, vulnerabilities, and the lack of resources (Chang, Wilkinson,

Potangaroa, & Seville, 2012). Some establishments fail to recover from a disaster

because of insufficient knowledge of threats and vulnerabilities (Malalgoda et al., 2013).

Additionally, there might be the lack of specified responsibilities and coordination, and

the use of inappropriate expertise during the development of the business continuity plan

(Malalgoda et al., 2013). To ensure adequate readiness, business continuity planning

would require the deployment of different expertise, such as the internal auditor, to

participate in business impact analysis, risk assessment, and designing the right solution

for the establishment (Pierson, 2013).

A large percentage of entities fail to understand how business continuity planning

could mitigate the impact of service disruptions, including the different roles involved in

its implementation (Chamlee-Wright, 2010). Business continuity planning, a risk

management process, should be in place and properly implemented by the government to

ensure mitigation of disasters and protection of consumer interest (Lindberg & Seifert,

2011). For example, insurance companies, as well as other segments of the financial

services industry, should make sure that risk management programs are in place and

functioning properly (Karim, 2011). The companies must be monitored by state

regulatory agencies as required by law to ensure adequate protection of consumer interest

(Lindberg & Seifert, 2011). Ironically, governmental entities sometimes do not have the

right information or tools to make decisions (Ben-Shahar & Logue, 2013). Additionally,

they have limited resources to monitor those they regulate (Ben-Shahar & Logue, 2013).

The United States has faced its share of disasters and as a result, there have been

efforts by the government sectors, including nonprofits, healthcare, and academics, to

prepare for and mitigate disasters (Staley, Zelman, Porto, Hobbs, & Paul, 2009). When a

disaster occurs, the job of the governmental agencies is to ensure their functions can

operate during and after a disaster or other contingency, and then minimize recovery time

to reach normal operations, thereby protecting the public (Johnston, Becker, & Paton,

2012). As a result, there must be an alternative path in support of critical business

processes in the event of an emergency, disaster, or disruption of services, which would

include establishing goals. These goals must be supported by management and those

charged with governance as well as incorporated into the overall management of the

organization (Karim, 2011). There must be an agency-wide risk assessment that would

include the identification of threats, the probability of occurrence, and business impact

analysis (Pinta, 2011). There must be strategies for mitigating the impact of service

disruptions, a business continuity plan development, implementation, training, testing,

and periodic reviews (Nicoll & Owens, 2013). A governmental agency could lack the

expertise to carry out these tasks; therefore, the internal auditor could serve as a

facilitator in this effort (Pierson, 2013).

The internal auditor should be in a position to provide assurance to management

and those charged with governance that response plans related to the business continuity

plans are appropriate, flexible, and adaptive and that the individuals identified in the

business continuity plans are capable of executing the recovery process effectively.

Additionally, the internal auditor could ascertain that the business continuity plan is

regularly reviewed and that it is updated when deemed necessary, especially when new

threats and vulnerabilities are highly probable (Mix, 2012).

Historical Legislative Perspectives

No entity is immune to disasters. In 1973, the United States enacted the Flood

Disaster Protection Act by expanding national flood insurance (Herbane, 2010). In 1977,

the US Foreign Corrupt Practices Act was enacted (Herbane, 2010). Although the US

Foreign Corrupt Practices Act was enacted was enacted to thwart and indict cases of

bribery and corruption of foreign officials, it also included a provision requiring the

keeping and safeguarding of organizational records from damage (Darrough, 2010).

These new accounting rules were enacted to provide reasonable assurance of preventing,

among other things, unlawful or unsupported transactions and misrepresentation of data

or records (Weber & Wasieleski, 2013). Additionally, these rules would provide the

possible benefits of improved financial reporting and compliance with applicable laws

and regulations (Krishnan & Yu, 2012). To ensure compliance with these rules,

insurance companies must be steadily monitored by insurance regulatory agencies

(Karim, 2011). Such monitoring would require the availability of data whenever needed

(Karim, 2011). Additionally, management needs timely information to ensure proper

assessment of operational risks (Năstase & Unchiaşu, 2013). As a result, governmental

agencies would benefit from well-designed and implemented business continuity

planning. Such timely information would afford management an opportunity to decide

whether to accept, mitigate, avoid, transfer, or eliminate the risks arising from an

incident. Management could also calculate the residual risk and cost of risk (Năstase &

Unchiaşu, 2013).

The United States’ Office of Comptroller of Currency Banking BC-177 of 1983

required US banks to implement formal disaster recovery plans, which included testing

(Herbane, 2010). The US Expedited Funds Availability Act of 1989 required all

federally chartered financial institutions to make provisions for next day availability of

deposits, including the implementation of business continuity plans (Herbane, 2010).

The World Trade Center attack that occurred in September 2001 in the United

States necessitated the need for a revaluation of business continuity planning (Law &

Robson, 2014). That event resulted in the loss of thousands of lives, injuries, and

unavailability of buildings and telecommunications. Since then, there have been a

plethora of regulations within the financial services sector (Sorial, 2011). Such

regulations have come from the Federal Reserve Board, Office of Comptroller of

Currency, and the Securities and Exchange Commission. One regulation is the

requirement for a business continuity planning and disaster recovery for the financial

services sector (Herbane, 2010).

The 2005 Hurricane Katrina caused significant service disruptions in the United

States, resulting in over 1,800 deaths and an estimated $80 million in damage (Baker,

2012). Also in 2005, New Zealand experienced a total telecommunications network

failure (Baker, 2012). In a survey of 240 senior executives in the United States about the

entity’s business continuity planning, it was observed that 21% suspended their business

operations on account of the harm caused by a disaster. A well-implemented business

continuity plan mitigates service disruptions and negative impact to services (Karim,

2011).

Organizations and Business Continuity Planning

Organizations of all sizes continue to work hard to safeguard their assets should a

disaster occur; they recognize that availability of data can give them comfort and help

ensure long-term availability of services. However, researchers have noted that while

some organizations have business continuity plans to ensure continuity of business, most

businesses are far from meeting their objectives when an emergency occurs (Lindström,

Samuelson, & Hägerfors, 2010). When organizations were less dependent on

information technology, alternative plans for business resumption and activities during an

emergency were manual in nature. The plans often included temporarily replacing a

crashed computer system with older, paper-based processes, which the workers might

already know (Afedzie & McEntire, 2010).

Today, organizations, including the government, are more dependent on

information technology. The experiences of the BP oil spill, Hurricane Katrina in the

United States, and tsunamis give a clear indication that a disaster can occur at any time

without any prior warnings (Ostrander & Lowry, 2012). While organizations are still

trying to understand the need for business continuity planning, the internal auditors have

been proactive in recognizing the importance of mitigating the impact of disruptive

events (Sarens, Abdolmohammadi, & Lenz, 2012). The internal auditor is in an excellent

position to assist with the identification and assessment of risks in the organization

(Sarens et al., 2012). The first task might be to get senior management to understand the

need for business continuity planning. One approach would be to outline the specific

areas within an organization that could be impacted as a result of a disaster: loss of

information technology, personnel, business facilities, and third parties with critical

business relationships with a government establishment (Baker, 2012).

Crisis may arise from different sources, such as vendors, customers, and

organization’s facilities. Even information security risks are considered possible business

continuity threats. As a result, some organizations are requiring their independent audit

organizations implement a business continuity plan to ensure mitigation of disruption of

services (Jarvelainen, 2012). Some organizations mitigate service disruptions and ensure

continuity of business by controlling their suppliers by requiring business continuity

plans, periodic testing of these plans, and relevant certification (Cascardo, 2012).

However, for the majority of organizations, certainly, for the large ones, this controlling

of suppliers is no longer possible (Cascardo, 2012). With most processing requiring

access to increasingly integrated applications and databases, when the system is down,

there is no opportunity to do any meaningful work. Researchers have tried to determine

how organizations can mitigate the impact of disasters (Afedzie & McEntire, 2010), and

some have concluded that there should be a frequent backup of data, preparation of a

business continuity plan, periodic meetings, and involvement of all stakeholders

(Lehman, 2010).

Mitigating a Disaster

All stakeholders should participate in the planning for reducing the impact of

disasters (Biedrzycki & Koltun, 2012). The stakeholders should include employees, the

board of directors, elected officials, customers, consumers, suppliers, and the public

(Afedzie & McEntire, 2010). There should also be a risk assessment and impact analysis

(Pinta, 2011). Risk assessment would include defining the types of risks or threats to the

organization and impact analysis would include analyzing the probability of threats

occurring and their impact (Afedzie & McEntire, 2010).

To mitigate hazard, there should be adequate preparedness (McEntire, 2012).

One of the first steps is to determine the types of disasters that can occur within the

specific vicinity where the government agency resides (McEntire, 2012). This

determination could be achieved through consultation with various relevant resources

within the organization, such as the internal auditor (de Zwaan et al., 2011). The internal

auditors probably understand the functions of their respective agencies more than any

other person because of their roles in performing organization-wide risk assessments as a

part of determining the auditable areas to be proposed to the board of directors for audit

or evaluation (Sarens et al., 2012). This knowledge includes formulating, testing, and

exercising disaster plans. There should also be adequate training and discussion with the

public and others about disasters and how to mitigate them (Sarens et al., 2012).

McEntire (2012) also discussed the variables that determine the degree of

vulnerability. Some groups, individuals, groups, organizations, and communities are

more vulnerable than others; however, the vulnerability can be minimized. But to reduce

vulnerability, there should be a strategy for reducing risks, susceptibility, and increasing

resistance and resilience (Verchick & Hall, 2011). Other risk-reducing strategies include

disaster prevention training and coordination with other coalition partners (Chen & Lee,

2012).

A business continuity plan is a part of long-term planning for an organization

(Momani, 2010). An example is the lasting effect created by Hurricane Katrina on

August 28, 2005, which caused significant service disruptions (Farber, 2011).

Additionally, in a survey of 240 senior executives about the entity’s business continuity

planning, it was observed that 21% suspended their business operations because of the

harm caused by a disaster (Karim, 2011). A well-implemented business continuity plan

mitigates service disruption and negative impact to services (Karim, 2011).

Another issue requiring attention is the outsourcing of tax preparation overseas by

tax preparers (Desai & Roberts, 2013). The client’s concerns have been the security of

information and the associated business risks, such as business continuity (Wayman,

2013). Some tax practitioners, especially certified public accountants, have tried to

alleviate their clients’ concerns by implementing business continuity and disaster

recovery plans (Desai & Roberts, 2013). These certified public accountants are regulated

by governmental agencies, which must ensure that licensing information is current and

available at all times. As a result, there must be continuous assessments of business

continuity plans to ensure up-to-date alignment with the long-term goals of the

government sector. The internal auditors oftentimes participate in assessing risks but

have rarely participated in business continuity planning (Desai & Roberts, 2013).

Possible Impact of a Disaster

A disaster is a significant and unpredictable incident that has the potential to

present negative results for an organization. The possible impacts of a disaster to an

organization might include legal obligations due to noncompliance with the law, violation

of contracts with suppliers, and other interested parties (Bayrak, 2009). Certainly, for the

organizations that outsource certain activities, such as data centers, computer help desks,

and facility maintenance, there could be enormous financial, legal, and compliance risks

related to such associations if a disaster occurs. Therefore, the participation of the

internal auditor in the business continuity planning is essential to ensure the identification

of internal risks and control gaps associated with the outside service providers (Wayman,

2013).

If an organization, such as a university, goes down because of the impact of a

disaster, the concern is what could happen to an employee. Additionally, concerns would

be regarding how students, the public, and customers perceive the organization because

of the decline as a result of the disaster. For example, in September 2008, Hurricane Ike

hit Lamar University, Beaumont, Texas (Beggan, 2011). According to Beggan (2011),

the 2000 U.S. Census showed that the city of Beaumont had a population of 113,866 and

the university was a significant part of this government’s social and economic

infrastructure and it was considered a top 10 employer in the city. Owing to the

hurricane, the university was closed for about 10 days and suffered approximately $11

million in damages (Beggan, 2011). Hurricane Ike resulted in the withdrawal of 150

students and tuition, and fee losses of $480,000 for the 2008 fiscal year (Beggan, 2011).

However, this was significantly less because of the lessons learned in the previous

hurricane, Hurricane Rita. Hurricane Rita caused the university to close for 20 days and

generated approximately $38 million of damages (Beggan, 2011).

The 2005 flooding that emanated from Hurricane Katrina in New Orleans created

the need for businesses and educational institutions in vulnerable vicinities to reevaluate

their plans for disaster recovery (Baker, 2012). Many businesses were incapacitated

because of the loss of information spanning several years (Baker, 2012). Similar to the

flooding, there have been several power outages in modern industrial societies that had

significant economic impact (Omar et al., 2011). Examples were the power outages in

the Northeastern United States and Canada in August 2003.

Many insurance companies became insolvent after the 1992 Hawaii and Andrew

hurricanes, and the 2004-2005 Florida hurricane season (Carson, McCullough, & Pooser,

2013). The 10 costliest hurricanes in the United Stated impacted the State of Florida and

seven of these events occurred in 2004 and 2005 (Carson et al., 2013). Owing to the

impact of the 2004-2005 hurricanes, five insurance companies in Florida became

insolvent, and claims totaling $1 billion were paid by the Florida Insurance Guaranty

Association and ultimately passed the costs to the policyholders (Medders, McCullough,

& Jäger, 2011). To mitigate the impact of the risks associated with catastrophic events,

the United States government has tried to intervene by providing capacity for the funding

of these events. However, general participation varies based on the magnitude of loss

(Medders et al., 2011).

The Federal Emergency Management Agency (FEMA) provides monetary

assistance to organizations when there is a declared disaster (Nicoll & Owens, 2013).

FEMA has been active in providing guidance to organizations to ensure adequate

preparation for disasters. There are tips for different disasters, including earthquakes,

fire, and flood (Nicoll & Owens, 2013). This agency became part of the U.S. Department

of Homeland Security in 2003 in the wake of the 9/11 terrorist attacks. However,

policymakers in the United States have held different perspectives on whether the

government should be participating in the funding of catastrophic losses (Nicoll &

Owens, 2013). For example, the exposure of future earthquakes in the United States is

significant, making the management of risk related to disaster an important issue

(Medders et al., 2011). Another example is that New York has had a constant threat of

tropical storms and in 2005, 15 hurricanes made their way into the North Atlantic region

of the United States (Medders et al., 2011). Additionally, the annual cost for disasters

arising from power outages to United States consumers is estimated to be $79 billion

(Omar et al., 2011). Therefore, business continuity is one of the most significant

concerns of management in the United States, ranking fourth overall (Luftman & Zadeh,

2011). However, studies have indicated that businesses are not ready for possible

disasters, and consequently, some do not survive disasters (Luftman & Zadeh, 2011).

Organizations should ensure that critical business processes are available when

needed; however, not all processes can be available compared to the costs associated with

that function. Additionally, important, but noncritical, processes can be unavailable

when needed. As a result, it is important that the right combination of personnel perform

a business impact analysis in which all are considered. This exercise helps prepare for

possible disruption of services (Akkiraju, Bhattacharjya, & Gupta, 2012).

Mitigating different disruptions stemming from natural or human-made hazards,

or technological causes are one of the primary reasons for implementing business

continuity planning (Asgary & Mousavi-Jahromi, 2011). The risk of service disruptions

has amplified as organizations continue to depend heavily on technological infrastructure

and the majority of businesses have incurred some form of disruptions on account of

power outages (Asgary & Mousavi-Jahromi, 2011). In a survey conducted in 2001, it

was determined that 70% of the organizations interviewed had had service disruptions

emanating from power outages, which generated significant expenses to businesses and

their major customers. Furthermore, in a recent survey of international business

organizations, it was determined that in excess of 87% had activated their business

continuity plans as a result of a power outage. As a result, businesses are taking different

measures to ensure adequate protection of information assets. For example, the power

outage in the Northeastern United States and Canada on August 2003 resulted in

significant economic impacts (Omar et al., 2011). The annual cost resulting from power

outages to United States electricity consumers is $79 billion (Omar et al., 2011).

Organizations and communities are steadily exposed to different types of disasters

and as a result, government, healthcare, and academia have been intensifying efforts to

ensure mitigation of disasters (Staley et al., 2009). In the late 1970s and 1980s,

governments began creating a statutory framework to get involved in mitigating disasters

(Hemond & Benoit, 2012). For example, in 1979, the United States created FEMA. In

the 1960s, the Canadian government passed its first laws related to mitigating disasters.

Also, in 2006, the International Organization for Standardization has also conducted a

symposium on how to mitigate disasters (Hemond & Benoit, 2012).

Different types of service disruptions can be very catastrophic to organizations

and can negatively affect business organizations. The possible ramifications of the lack

of business continuity plan or an inadequate plan can result in significant risks, which

may include the loss of public trust and ultimately the deterioration of critical functions

(Guster, Lee, & McCann, 2012). Stakeholders have been scrutinizing organizations’

preparedness for a long time (Guster et al., 2012). Another issue faced by organizations

is acquiring relevant skills to ensure adequate development, evaluation, and maintenance

of the business continuity plan and disaster recovery (Kanellou & Spathis, 2011).

Developing a business continuity plan requires at a minimum risk assessment, a

business impact analysis, team development, organization-wide awareness and training,

and coordination with government agencies responsible for safety and emergency (Guster

et al., 2012). There should be simulations and other exercises. This concept, which is

widely used today, was borrowed from the military. Management and employees of

organizations have been integrated into plans to mitigate disasters. As a result, they are

able to develop management tools and anticipate the impact of disasters and how to

manage them (Hemond & Benoit, 2012).

Implementation of key policies would help enhance resilience during a disaster

(Kantur & Arzu, 2012). Public and private organizations can embark on new

technologies, such as alternative power sources. Additionally, local, state, and federal

governments can promote resilience by sharing pertinent information. Such information

sharing could strengthen the coordination of mundane services (Kantur & Arzu, 2012).

Preparing for a Disaster

Most organizations are completely dependent on their computer systems and

supporting information technology personnel, communication network, files, and

program (Grosskopf, 2010). Most organizations also recognize that success could

depend on the capacity to provide information whenever requested by the customers,

employers, suppliers, and other stakeholders (Omar et al., 2011). As a result, it has

become imperative for the management of these organizations to find effective ways of

protecting information assets and plan for swift recovery should a disaster occur (Omar et

al., 2011). Disaster planning involves much more than backing up data. Some

organizations focus primarily on violence in the workplace, wildfires, and weather, but

the landscape of the world has steadily been changing; therefore, organizations need to

explore future potential hazards or threats. Even the U.S. government has developed

guidance to assist staff in assessing and quantifying the risk hazards such as terrorism,

infectious diseases, and evolving risks (Law & Robson, 2014). For example, the U.S.

Department of Homeland Security developed the Handbook for Rapid Visual Screening

of Buildings to Evaluate Terrorism Risks (FEMA, 2009; Nicoll & Owens, 2013).

An organization should periodically conduct a comprehensive risk analysis that

identifies its critical business systems, the risks applicable to those systems, the

probability of a disaster occurring, and the effect of the disaster on business functions

(Bayrak, 2009). Additionally, there should be a system in place for updating the risk

analysis whenever there are major changes affecting these critical systems. Such changes

may include information technology, service agreement, and processing requirements.

Another component of the risk analysis is identifying critical business processes and the

order of restoration if there is a disruption of service. To conduct a good risk analysis,

the organization’s management must provide the needed support. When such support is

lacking or inadequate, resources might not be properly utilized or prioritized. As a result,

the business continuity plan might not align with the overall goal of the organization

(Bayrak, 2009).

Responding to a Disaster

The government plays a significant role in the mitigation of disasters. But some

government agencies fail to prepare properly and respond to disasters because of

inadequate preparation, lack of resources, and other pressing needs (Henstra, 2010). If

the government fails to plan appropriately for a disaster, the public’s safety, financial

security, and self-reliance is significantly affected (FEMA, 2015). Some organizations

fail in their response to a disaster on account of a lack of communication and training

(Jahangiri, Izadkhah, & Seyed, 2011). In a survey of 200 organizations of all sizes,

approximately 57% successfully achieved the recovery time objective, while 33% did

not, and 10% could not invoke their business continuity plan (Ojha & Gokhale, 2009).

Failure can happen to the government if a business continuity plan is not adequately

implemented.

Flooding can play a significant role in our society as a whole. There could be

damage to buildings, building equipment, and staff shortages, which could result in the

inability to conduct business. For a government agency, such an event could negatively

disrupt business. In a recent investigation of senior executives, they rated the

government right below their customers as the most important constituency (Johnson,

2010). There have been a number of flood events in the United Kingdom in recent years,

and the forecast is that it will increase in the future because of changes related to climate

(Wedawatta & Ingirige, 2012). The 2007 flooding affected over 40,000 homes and about

7,000 businesses in the United Kingdom and caused damages of approximately $4.5

billion (Wedawatta & Ingirige, 2012).

In addition to the United States government’s involvement in business continuity

planning in the 1970s and 1980s, and the creation of FEMA in 1979, the military started

its preparedness in the 1970s in the civil service arena (Hemond & Benoit, 2012). In the

1990s, management was integrated into the concept of preparedness, which resulted in

the development of management tools to ensure adequate mitigation of service

disruptions (Wedawatta & Ingirige, 2012).

In recent times, the hazards of business interruptions have intensified as

businesses have increasingly become dependent on information technology

infrastructures that are extensively linked to external resources (Sawalha, Jraisat, & Al-

Qudah, 2013). Having an effective business continuity plan ensures mitigation of service

disruption and recovery of information assets (Momani, 2010). In essence, while it might

not be possible to prevent or eliminate service disruptions, the goal is to reduce the effect

of any unforeseen emergencies (Sudmeier, Jaboyedoff, & Jaquet, 2013). For example,

during the financial crisis of 1997, especially in Southeast Asia, the Singapore dollar was

devaluing quickly against the United States dollar because of adverse currency pressures

from other nearby countries, including Thailand (Pheng, Ying, & Kumaraswamy, 2010).

In essence, while it might not be possible to prevent or eliminate service disruptions, the

goal is to reduce the effect of any unforeseen emergencies (Sudmeier et al., 2013). That

negatively affected the economy and reduced business opportunities for construction

companies. Additionally, there were bankruptcies, which made it very difficult to obtain

financing and maintain positive cash flow (Pheng et al., 2010).

A study conducted by AT&T of 530 entities indicated that 83% of the business

leaders who responded indicated their entity had implemented a business continuity plan,

12% reported they did not have a plan and 5% were unsure (Jones, 2011). The preferred

solution is to have the right combination of internal controls and tools that will meet the

expectations of management in managing the different aspects of the business continuity

(Jones, 2011).

Summary

When an organization experiences a disruption of service because of a disaster or

other unexpected incident, it is the organization’s responsibility to ensure critical

functions will continue to operate during or after the incident (Cascardo, 2013). Today,

organizations, including the government, are more dependent on information technology.

The government sector would rely on business continuity planning to mitigate the impact

of such disruption. A large percentage of organizations today fail to understand how

business continuity planning could mitigate the impact of service disruptions.

The experiences of the BP oil spill, Hurricane Katrina in the United States, and

tsunamis give a clear indication that a disaster can occur at any time without any prior

warning (Ostrander & Lowry, 2012). The management of the government agency would

be expected to utilize the right resources to ensure proper implementation of the business

continuity planning. Implementation of business continuity planning requires an adept

knowledge of potential risks and their possible impact on the organization (Glendon,

2013). As a result, there is a need for an independent function whose responsibilities

would include informing management and the audit committee about the nature of risks,

the likelihood of the risks, the significant of the risks, and the conditions of the

organization’s preparedness.

The internal auditor usually understands the activities of the organization and is in

a position to provide assurance to management that the business continuity plan is

effective, key personnel are knowledgeable of the business continuity plan and of its

practical execution, and that it is cost-effective. The internal auditor is in an excellent

position to assist in the organization-wide business continuity planning (Sarens et al.,

2012).

There are a few studies on business continuity planning. For example, there was a

study on the role of the public sector asset manager in responding to climate change. The

study discussed the need for public asset managers to mitigate and prepare for future

events (Warren, 2010). Another study was an assessment exploration of strategic

business continuity planning methods in Michigan small business (Lasecki, 2009). But

none of the studies discussed the role of the internal auditor in business continuity

planning in the government sector.

Chapter 3: Research Method

This qualitative single-case study examined the use and the perceived roles of the

internal auditor in business continuity planning within the government sector. The

problem addressed by this study was the lack of the use and the limited understanding of

the perceived roles of the internal auditor in business continuity planning in the

government sector. The question that guided data collection and analysis for the present

study was:

RQ1. What are the perceived use and the roles of the internal auditor in business

continuity planning in the government sector?

The government sector is required to address any vulnerabilities that could have a

significant impact on operations (Adams, 2008). Exploring the roles of the internal

auditor in business continuity planning within the government sector included the

examination of planning, implementation, and maintenance of the business continuity

plan. As a result, the study necessitated employing the proper research design.

Governments have become more transparent and accountable to citizens. As a

result, government services have become more accessible, more efficient, and there is an

increased opportunity for citizens to participate in government. The advent of the

Internet has provided the government sector the opportunity to find ways of generating

more income locally and globally (Baird et al., 2012). Transactions such as taxes,

renewal of licenses, or registering to vote can be completed electronically. Additionally,

in the last few years, cyber-attacks have steadily increased against both United States

government agencies and private organizations (Melnik, 2015). To mitigate the impact

of any disaster or disruption of service, a government agency has to implement a business

continuity plan or an emergency plan (Hall et al., 2012). Inadequate preparation by the

government could have a significant negative impact on the agency and the public

(Haque et al., 2012). The internal auditor helps the government achieve its objectives of

serving the public by evaluating and improving the effectiveness of risk management.

To address the research questions posed for this study, a qualitative research

method was employed. Schram (2006) identified five qualitative research methods that

included narrative, grounded theory, phenomenology, ethnography, and case study. The

focus of narrative research is on exploring the life of people or an individual. Narrative

research method seeks to develop or build a theory about a specific issue or topic. It is

the qualitative equivalent to meta-synthesis, wherein qualitative information and findings

are summarized and analyzed to build and strengthen a theory being developed by the

study (Finlayson & Dixon, 2008). The method is more relevant when the focus is to

explore individual experiences, but not large numbers of anonymous participants. A

narrative research is usually used in biography research wherein the focus is on the

specific elements of a particular person (Essers, 2012).

The focus of phenomenology is on offering insight into how people or an

individual could make sense of a given phenomenon, in a specific context.

Phenomenology requires studying and analyzing several individuals who have shared

similar experiences. Phenomenology research is focused on ‘lived experiences’ of

participants to provide meaning to the phenomenon being studied. Phenomenology must

also be used by the researcher in a manner that portrays a special, open

phenomenological attitude (Finlay, 2009). It is only by combining these two criteria that

phenomenology can be successfully done. The method is common in the field of

philosophy and education. The individuals must be able to describe their experiences

fully. An example is an interaction between an instructor and a parent (Finlay, 2009).

The focus of grounded theory is developing a theory that is derived from and

grounded in data from the field. In essence, the goal is to generate a theory. Grounded

theory is best used when theory is not available to explain a process or phenomenon

(Finlay, 2009). Grounded theory, meanwhile, makes use of the substantive body of

grounded research toward a higher, more abstract level. Grounded theory means that the

researcher is required to comb through information about the issue or topic at hand to the

point of saturation that the results and finding were exhaustive enough for theory building

(Barnett-Page & Thomas, 2009).

The focus of ethnography is interpreting cultural behaviors. The method is more

relevant when it is used to describe cultural differences (Barnett-Page & Thomas, 2009).

In this method, specific components of an observed phenomenon are taken together as a

whole to arrive at a sufficient explanation, providing depth and dimension to the issue or

topic under study (Barnett-Page & Thomas, 2009). An example would be to describe

what people in Canada and the United States do in a given circumstance. The focus of a

case study is developing and analyzing one or two cases (Bowyer & Davis, 2012). Under

this approach, a topic of interest can be documented and studied in detail, specifically its

nature, dynamics, structure, processes, and culture.

Moreover, the case study approach is used to generate an in-depth, multi-faceted

understanding of a complex issue in its real-life context and it is also intrinsic,

instrumental, and collective (Crowe et al., 2011). A case study is an appropriate

approach to research if the case or issue is distinctive enough that it is worth documenting

and reviewing, providing a deep analysis of the issues at hand that, as Crowe et al. (2011)

defined, bring out the different facets or dimensions relevant to these issues. Vissak

(2010) provided a thorough analysis of the case study approach, specifically applied in

international business research. The author discussed how the case study method should

be conducted in business research, which, in the present study’s case, is about business

continuity. An example would be providing a case related to business continuity

planning and the perceived roles of the internal auditor. The case has now been fully

described and analyzed.

Research Methods and Design

This qualitative research is a single-case study. The utilization of a qualitative

methodology facilitated the understanding of the perceived roles of the internal auditor in

business continuity planning in the government sector. Qualitative methodology enabled

the researcher to collect data that systematically answered the research question, and

ultimately produced findings that could be used by the government sector. This case

study utilized purposive sampling. Adopting the case study method, the researcher was

able to gain insight, and as a result increased the credibility, integrity, and transferability

of data collection during the study. Additionally, the case study research methodology

appropriate for this study was useful in enhancing reliability and accuracy of the data

collected, by limiting inconsistencies resulting from individual interpretations of data

collection instruments including file artifacts (Yin, 2009). Moreover, qualitative research

has become one of the leading research strategies utilized by disaster researchers

(Rodriguez et al., 2007; Stallings, 2007). This methodology is also widely used within the

government sector, and several pertinent discoveries have emerged within the emergency

management arena due to the frequent use of qualitative research (Munro, 2011). Jones

(2010) used this me

Quantitative methodology pertains to experiments that are aimed at producing

internally valid, reliable, replicable, and findings that can be generalized. Therefore, this

method involves experiments that tend to mandate control of different variables utilizing

observations as a primary data collection tool (Yin, 2009). This study was not

experimental, rather interpretive with the primary purpose of an in-depth understanding

of the phenomenon researched (Yin, 2009), which involved no mandate to control

different variables. To ensure alignment with the research purpose and question, the

researcher utilized an interview questionnaire which comprised open-ended questions

(Patton, 2002). Additionally, this study included utilizing a small sample of participants

from a specific group. Therefore, quantitative methodology was not appropriate for the

study. Furthermore, this study did not include clarification of causation and relationship

among different variables, which are common in quantitative and mixed-methods

research. Therefore, qualitative methodology was best option because the goal of the

research study was not to draw a statistical inference based on the findings.

The primary strength of the case study methodology is the focus on a certain

phenomenon; but flexible for further exploration. The researcher’s focus was on the

theoretical framework and not on a large population. A purposive sampling technique

was used, and the participants were individuals (Yin, 2009).

A case study is usually data-coded and analyzed with statistics or patterns, which

involves understanding the perceived roles of the internal auditor in business continuity

planning within the government sector through the collection of raw data and the analysis

of the initial pattern (Glaser & Strauss, 1967). A case study can be past or future-based,

depending on the nature of the design (Glaser & Strauss, 1967). However, for the

purpose of the current study, the case study design utilized a past perspective to fully

understand the perceived roles of the internal auditor in business continuity planning

within the governmental sector, which generated new information for the future as a

framework for leaders of business continuity planning, as well as for agencies in business

continuity planning (Glaser & Strauss, 1967; Yin, 2009).

The target population for this study was internal auditors in the governmental

sector from the State of Texas in the United States. According to Glaser and Strauss

(1967), purposive sampling is most appropriate for case studies. Purposive convenience

sampling is the process of collecting data from a body of people who have experience

with the phenomenon under study and are available to the researcher to share their

perceptions and experiences (Jones, 2010). This research methodology provided a

reasonable assurance that data collected were reliable because of expected limited

variability of the interpretation of data collection device (Yin, 2009). Additionally,

qualitative research has been regarded as the ideal approach to business continuity and

disaster recovery studies (Stallings, 2007). Finally, many of the significant studies and

pertinent findings within the business continuity and crisis management field have used

qualitative research methodology (Munro, 2011).

Findings arising from the research were valid. To promote this, the researcher

avoided being biased by using a questionnaire and one-on-one interviews for all

participants (Shank, 2006). There was honesty about personal perspectives, and

transparency was exhibited as data were collected and analyzed. The researcher made

sure each participant was not pressured into participating in the research. An informed

consent form was signed by each participant prior to the interview (Drost, 2011).

Population

This study examined the roles of the internal auditor in business continuity

planning in the government sector. The study participants included government internal

auditors in the State of Texas agencies. In order to recruit participants, the researcher

obtained the list of internal auditors from the website of the Texas State Auditor’s Office.

The list included the names, phone numbers, and email addresses of the State of Texas

internal auditors working for the State of Texas agencies (Texas State Auditor’s Office,

2015). The total number of internal auditors for this study was 253.

The participants of this study were limited to government internal auditors

working for the State of Texas agencies and between 18 and 65 years of age. Individuals

who were not internal auditors, less than 18 and over 65 years, or not working for the

Texas State government were excluded from participating. Participants were selected

without consideration of their gender, age, and race. Following this criterion, the sample

size was 20.

Sample

The purpose of this study was to understand the perceived roles of the internal

auditor in business continuity planning in the government sector. Purposive sampling was

used to identify the individuals who were willing participate. This process entailed

identifying participants who were to share their perspectives and opinions on the subject

under study (Creswell, 2014). The researcher identified each participant by a code name.

Twenty internal auditors in the government sector working for the State of Texas

agencies were invited and considered as participants in this study. As emphasized by

Creswell (2014), qualitative studies require more focus and a smaller number of

participants than quantitative studies do. The researcher initiated contact with potential

participants through a phone. During that phone call, the researcher inquired if the

individual was between 18-65 years of age. If the potential participant met the age

requirement, within 24 hours, the researcher followed up with a recruitment email. Thus,

20 internal auditors were invited with the goal of interviewing 20 internal auditors in

State of Texas agencies. All 20 internal auditors were interviewed. This sample was

sufficient to provide valuable insights that were used to develop an understanding in the

field of research. Semi-structured interviews with the participants provided an

opportunity for obtaining deeper information about the roles of the internal auditor in

business continuity planning in the government sector (Palliyaguru, Amaratunga, &

Haigh, 2010).

Materials/Instruments

The primary instrument for collecting data for this qualitative study was the

researcher (Bryman & Bell, 2011). The researcher conducted one-on-one semi-structured

interviews using a questionnaire. The utilization of a questionnaire enabled the researcher

to collect the data necessary to answer the research question. The aim was to gather the

opinions and experiences of the study participants about the roles of the internal auditor

in business continuity planning in the government sector (Creswell, 2014). The

researcher conducted the interviews with the study participants using open-ended

questions (see Appendix F). The researcher developed the questionnaire after

considering the research questions and the primary focus of the study (Yin, 2009). The

open-ended questions enabled the participants to answer questions in their words on their

perceived roles of the internal auditor in business continuity planning in the government

sector.

The first three questions on the questionnaire addressed the significant negative

impact of disruptions when a government entity failed to mitigate a catastrophic event

due to a lack of proper business continuity planning that considered all risk factors

affecting the organization. The second three questions on the questionnaire addressed the

obstacles that could prevent an organization from properly involving the right expertise in

business continuity planning. The next set of questions in the questionnaire addressed the

major roles internal auditors play in an organization, especially in risk assessment. The

next set of questions addressed the areas in business continuity planning to be excluded

from the internal auditor, if internal auditors were involved in business continuity

planning. The last set of questions addressed how the internal auditor’s involvement in

business continuity planning affect his or her independence and objectivity. The reason

was that internal auditor was expected to audit all transactions of an organization,

including the business continuity planning.

Data Collection, Processing, and Analysis

After obtaining the approval of Institutional Review Board (IRB), the researcher

began initiating contact with the study participants. Using the list of internal auditors

from the website of the Texas State Auditor’s Office, the researcher identified the names,

phone numbers, and email addresses of the State of Texas internal auditors working for

the State of Texas agencies (Texas State Auditor’s Office, 2015). The researcher

purposively selected 20 potential subjects and contacted them via telephone using the

telephone script (see Appendix A). The researcher informed each individual about the

purpose of the study, age requirement, estimated duration of the interview, and that

participation was voluntary. After verifying the participants’ willingness to participate,

the researcher followed-up with an email reiterating what was discussed on the telephone

(see Appendix B). Each participant elected to do the interview via telephone. The

researcher emailed the informed consent form to each participant for signature (see

Appendix D). All 20 subjects contacted met the study criteria and agreed to participate.

Each interview lasted 30-45 minutes. Each participant was given the option of scanning

and emailing or faxing the signed informed consent form. After obtaining the signed

informed consent form, an interview date was scheduled. For each interview, the

researcher went over the questionnaire questions. All interviews were conducted over the

telephone. The research followed the protocol suggested by Yin (2009) regarding data

collection procedures, questions, and guide for the report. The protocol stressed the

reliability, validity, and credibility of the study Yin (2009). The internal auditor is

expected to demonstrate integrity, competence, and due professional care, objective and

free from undue influence (Seago, 2015).

Interviews served as the guide for data collection (Hartel & Latemore, 2011).

Data collected included interview narrative transcripts and code notes. Analysis of the

data help the management, internal auditors, oversight bodies of the government sector

under the perceived roles of the internal auditor in business continuity planning.

Additionally, the researcher prepared memos to ensure proper documentation of data

gathered. Consequently, a coding method for participants ensured confidentiality (Yin,

2009). The data collection lasted approximately 3 months. The researcher created

emergent codes that arose from the analysis of data. The codes were later broken down

into sub-codes. Additionally, the researcher jotted down notes of reactions that emerged

as a result of the interviews. The researcher used descriptive coding due to limited

experience in the use of qualitative data. The second cycle coding used by the researcher

was axial method due to the variety of data forms that emanated from the interview. The

axial coding process allowed the researcher to disaggregate data into themes and

provided an avenue for establishing different linkages and raising new questions for

further research (Elo & Kyngas, 2008).

Data analysis consisted reviewing the data collected via the interview

questionnaire, utilizing inductive content analysis to sort the information into themes,

aligning with the overarching research question, and maintaining internal validity. The

researcher did not use deductive content analysis due to a lack of previous research in this

area. The first phase of the data analysis was sorting data into themes and patterns for the

purposes of coding. The researcher classified, edited, analyzed, and interpreted the

themes to ensure credibility of the research. An Excel spreadsheet was used to

consolidate and categorize data.

Finally, the researcher developed the findings arising from the study which is in

chapter four of this document (Elo & Kyngas, 2008). Additionally, the researcher

interpreted data collected and came up with conclusions. Transcripts of the interviews

were reviewed by the participants and none provided additional comments or identified

issues with the accuracy of the transcript.

Assumptions

A major assumption of the single-case study was that the purposive sampling

from a targeted population could be considered a representative sample of government

internal auditors in the United States and their perceived roles in business continuity

planning. Participants are government internal auditors, and an assumption was that they

were not required by management or those charged with governance to participate in this

study. After selecting the sample size for the study, an assumption was that at all would

participate in this study if they had the time. Furthermore, the assumption was that the

participants would be sincere, credible, and open in responding to the interview

questionnaire; thereby enhancing the validity of the study (Patton, 2002; Yin, 2009). The

researcher, as a CPA and CISA, performed internal auditing outsourcing. As such, there

was an assumption during the analysis about the researcher’s objectivity in interpreting

findings and reducing the investigator’s bias (Yin, 2009). Another assumption was

selecting a qualitative study for the research problem (Yin, 2009), leading to the factors

outlined extensively in the literature review.

Limitations

This case study generated a lot of insight about the perceived roles of the internal

auditor in business continuity planning in the government sector. But the inquiry was

limited to those internal auditors working in the State of Texas. Therefore, the study was

inhibited by the experiences, knowledge, and perceptions of the participants. As a result,

the findings of the study might not meet the perceived expectations of past researchers of

reliability, credibility, transferability, and validity in the research design, data collection,

and data analysis process (Patton, 2002). Additionally, the findings might not apply to all

internal auditors in all government sectors. For example, the lack of the involvement of

the internal auditor in business continuity planning could be viewed as an unnecessary

step in risk management. Conversely, the involvement of the internal auditor could be

viewed as a required process to ensure all risks are adequately considered by the entity.

Nevertheless, the primary objective of the case study was not to generalize results across

all government agencies in the United States; rather, to fully understand the roles of the

internal auditor in business continuity planning in the government sector, specifically in

the State of Texas (Yin, 2009). Therefore, the generalization of any findings resulting

from this study would be at the prerogative of future researchers (Jones, 2010). Study

participants answered interview questionnaire representing an individual’s (internal

auditor’s) perception of the roles of the internal auditor in business continuity planning in

the government sector. Twenty participants were purposively sampled from a population

of 253. As a result, the purpose sampling methodology used could be subjective; due to

the small sample size used in gaining an in-depth understanding of the phenomenon

studied and an analysis of large amount of data generated from the research (Yin, 2009).

Delimitations

The study of the roles of the internal auditor in the government sector was a

significant assignment. Delimitations were the boundaries of this research study. They

were vital in narrowing the scope of the research, which was to understand the perceived

roles of the internal auditor in business continuity planning in the government sector. A

delimitation was the single-case study research design using purposive sampling;

judgmentally selecting a sample of individuals from a population (Yin, 2009), a

representative of internal auditors working in the government sector. The choice for data

collection was a questionnaire used in interviewing selected individuals. There was no

effort to try to generalize the findings of the study to larger populations. Therefore, the

context and geographic area of the study was appropriate in understanding the perceived

roles of the internal auditor in business continuity planning in the government sector.

Ethical Assurances

One of the goals of this research was to use measurements that were reliable or

consistent. Since there was no simple or one way to measure the reliability of data

collected, the researcher asked several different questions to try to achieve the object of

the research questions. To promote reliability of information, the researcher asked for

clarification whenever determined necessary, just to make sure that the interviewee’s

response was understood. It was also important to make sure that measurements were

valid or accurate. To ensure that interviews were conducted similarly across different

participants, the researcher ensured each participant was asked the same set of questions.

Thus, semi-structured interviews were used to ensure that the interview process was

guided. Information obtained was reported accurately. The researcher only employed

triangulation whenever necessary by using a variety of mixes such as interviewing,

document analysis, and questionnaires with open-ended questions. The researcher

documented the source of data being collected, how it was collected, and how it was

used. That ensured a proper audit trail. The researcher ensured the credibility of data by

maintaining an extended contact with the respondents. Credibility was improved when

data collected from different sources reflected the same findings (Drost, 2011).

Findings should be valid. To promote this, the researcher tried to avoid being

grounded in own context and personal perspective (Shank, 2006). There was honesty

about personal perspectives and transparency was exhibited as data were collected and

analyzed. To adequately address the research question, a part of validating the work

involved embracing the concept of a representative sample (Drost, 2011).

Obviously, it was not practical to interview everyone about the roles of the

internal auditor in business continuity planning in the government sector. As a result, the

people being targeted were a representative sample of the population affected by the topic

under study. The researcher sampled different groups of people. Drost (2011) argued

that if the same results were obtained, it would be natural to extend the sample to the

population at large. That helped simplify an understanding of the phenomenon under

study and further validated the results of the work.

The idea was to demonstrate that the study can be trusted. Things considered

included consequences of presence in a setting, selective experience, and engaged

subjectivity. Presence in the field was explored including its impact on the credibility of

the research. Other considerations included addressing the necessity of attending to some

things but not others; and managing and monitoring the subjectivity that influenced the

research (Schram, 2006). To ensure the integrity of the research, other possibilities were

explored, and those possibilities were supported by the data collected. The researcher

fully disclosed the purpose of the study. That was one of the ethics and morality of

conducting research. Some researchers believe that the quality of the data gathered may

be enhanced by overtly soliciting the cooperation of everyone associated with the subject

under study. As a result, they argue that the ultimate acceptance and usefulness of

formative information might depend on such prior disclosure and agreement. Related to

full disclosure is confidentiality. The report concealed names, locations, and other

identifying information so that people who had been observed or interviewed was

protected from harm or punitive action. The researcher sought and obtained an Informed

Consent Form or Certificate of Confidentiality (Bryman & Bell, 2011; Rubin & Rubin,

2012).

Prior to interviewing, the researcher for this study outlined a set of issues that

were to be explored with each respondent. That was more of informal, conversational

interviews. The interview guide (see Appendix E) served as a basic checklist during the

interview to make sure that all relevant topics were covered. The researcher was

expected to interview up to 20 people. The researcher interviewed 20 people. Each

interview varied between 30 minutes to 45 minutes, using a questionnaire (see Appendix

F). There were notes as well and memoranda written during the interviews.

Summary

The problem to be addressed by this study was the lack of the use and the limited

understanding of the perceived roles of the internal auditor in business continuity

planning in the government sector. The government sector is required to address any

vulnerabilities that could have a significant impact on operations (Adams, 2008). To

address the research questions posed for this study, a qualitative research method was

employed. The case study approach is used to generate an in-depth, multi-faceted

understanding of a complex issue in its real-life context and it is also intrinsic,

instrumental, and collective (Crowe et al., 2011). This qualitative research is a single-case

study. This case study utilized purposive sampling. The researcher selected, 20 internal

auditors working in the State of Texas agencies to participate in the study. The research

followed the protocol suggested by Yin (2009) regarding data collection procedures,

questions, and guide for the report. The protocol stressed the reliability, validity, and

credibility of the study Yin (2009). Data analysis consisted reviewing the data collected

via the interview questionnaire, utilizing inductive content analysis to sort the

information into themes, aligning with the overarching research question, and

maintaining internal validity. The assumption was that the participants would be sincere,

credible, and open in responding to the interview questionnaire; thereby enhancing the

validity of the study. A limitation of the study was that the inquiry was limited to those

internal auditors working in the State of Texas. Therefore, the study was inhibited by the

experiences, knowledge, and perceptions of the participants. As a result, the findings of

the study might not meet the perceived expectations of past researchers of reliability,

credibility, transferability, and validity in the research design, data collection, and data

analysis process. A delimitation was the single-case study research design using

purposive sampling; judgmentally selecting a sample of individuals from a population

(Yin, 2009), a representative of internal auditors working in the government sector. The

choice for data collection was a questionnaire used in interviewing selected individuals.

Data analysis consisted reviewing the data collected via the interview questionnaire,

utilizing inductive content analysis to sort the information into themes, aligning with the

overarching research question, and maintaining internal validity. The researcher fully

disclosed the purpose of the study; one of the ethics and morality of conducting research.

Chapter 4: Findings

The problem this study explored was the lack of the use and the limited

understanding of the perceived roles of the internal auditor in business continuity

planning in the government sector. Governments oftentimes worry about continuity as

they are under pressure to keep up with the citizen’s expectations for optimal services.

As a result, a government agency is expected to implement a plan to be followed should

an emergency arises (Hall et al., 2012). An adequately implemented plan minimizes the

impact of disruption and ensures the quick resumption of operations. Without the

involvement of an independent person who understands risk evaluation during the

development and implementation of business continuity planning, management of a

government agency could assume undesirable business continuity risks. Thus, the

primary focus of this was to understand the use and the perceived roles of the internal

auditor in business continuity planning within the government sector. The single

overarching research question that guided this study was the following:

RQ. What are the perceived use and the roles of the internal auditor in business

continuity planning?

This chapter outlines the findings arising from an analysis of the data collected

with the goal of answering the research question. The subsequent section outlines the

findings noted in relation to the theoretical framework. The next section outlines the

results of the analysis arising from this study and comparison to previous studies.

Finally, an extensive evaluation of the findings arising from this study and its impact on

business continuity planning and internal auditing is presented.

Results

To maintain the anonymity of the study participants, the researcher assigned

unique identifiers to each participant. The individual identifier consists of 1-20 numeric

numbers. The identifier is used to trace data back to the specific participant.

Additionally, the identifier is used to protect the identity of those who participated in the

study.

The research required the reviews of the role of the internal auditor in an

organization as defined by the Institute of Internal Auditor’s International Standards for

the Practice of Internal Auditing, the laws establishing the internal audit function and

business continuity planning, specifically in the State of Texas, and the business

continuity guide published by the Texas State Office of Risk Management. The purpose

of the business continuity guide is to ensure that State of Texas agencies can perform its

essential functions under all conditions.

Obtaining the business continuity planning guide and the law was very simple

owning to the information being publicly available on pertinent websites. The researcher

was also able to obtain the names, phone numbers, and email addresses of the State of

Texas internal auditors from the website of the Texas State Auditor’s Office. A total of

20 participants were interviewed using a questionnaire. Interviews with the participants

were not complicated. Overall, the internal auditors contacted were willing to support the

study, except for a few who had pressing work issues and could not participate.

Additionally, a few other potential participants could not be reached possibly because of

other commitments. Eventually, the researcher was able to interview 20 internal auditors

in the government sector within the State of Texas. While conducting the interviews, the

participants spoke freely and answered all questions without any resistance. The research

identified five themes during the analysis: (a) significant negative impact, (b) obstacles,

auditor’s independence (see Table 1).

Theme 1. The significant negative impact of a lack of proper business continuity

planning for a government sector if a disruption occurs.

Theme 2. The obstacles that might get in the way of dealing with disruptions

successfully.

Theme 3. The major roles the internal auditor plays in an organization, especially

the government.

Theme 4. The areas within business continuity planning the internal auditor

should be excluded, if the internal auditor were to be involved in business continuity

planning.

Theme 5. The threat to the internal auditor’s independence, due to the

involvement in business continuity planning.

Table 1

Themes for Research Question

Theme Frequency Percent

Significant Negative Impact 20 100

Obstacles 18 90

Major Roles 19 95

Areas to Be Excluded From The Internal Auditor 20 100

Internal Auditor’s Independence 20 100

Note: n = 20

Demographic characteristics. All 20 participants are internal auditors in the

government sector in the State of Texas and between the ages of 18 and 65.

Research question. The question that guided the collection and analysis of data

were; “What are the perceived use and the roles of the internal auditor in business

continuity planning. There were 5 themes that arose from the analysis.

Theme 1: Significant negative impact. All participants (20) emphasized that a

disruption of service would have a significant impact on the government sector on

account of federal and statutory mandates. They opined that government agencies are

expected to provide services to the public, under any condition. Additionally, they all

argued that confidential and sensitive data might be lost, and resources such as people

and processing environment and associated costs would be negatively affected if there

was a disruption. Participants believed there was no alternative for business continuity

planning in the government sector and cannot foresee a public sector’s long time success

without business continuity planning. Participant 10 summarized:

As with any business including government agencies, if you don’t have a plan,

then chances are when something goes bad, it will be much harder to get back to

where you are. There should be known consequences on what could potentially

happen and a plan in place on what to do if it does occur. It is much better to be

ahead of the curve instead of reactionary. If prepared, will cost less, will be back

to normal (or as close depending on disruption) sooner, and public perception

could be positive versus potentially negative. (Participant 10, personal

communication, March 15, 2016)

Participant 6 reasoned that disruption could have a significant impact on critical

services, especially “those in healthcare, safety, and state hospitals, and jails.”

Participant 2 affirmed that business continuity planning in the government sector helps to

“shorten the duration of the disruption, have a plan of action for various types of

disruption” and Participant 7 asserted “We are established by the public to provide

services for the public, whether or not there is a disruption.” The planning might include

third party agreements, manual workarounds, systemic redundancies, cross-training,

back-ups, and transfer of risk with insurance policies. But business continuity planning

covers more activities to ensure a government sector succeeds. Participant 8 believed:

An organization needs to prepare for a disruption before it occurs to ensure they

are prepared for that disruption. If an organization is providing critical services to

the public (public safety, protective services, public assistance, etc.), it is not

reasonable to stop providing services until the entire organization is able to

recover. Frequently these critical services must be resumed within a matter of

hours and not days or weeks. (Participant 8, personal communication, March 1,

2016)

Additionally, Participant 12 supplemented:

In addition, with the rise of cyber-attacks, terrorism, and natural disaster, such as

earthquakes, tornadoes, floods, etc, preparing ahead of time has quickly come to

the forefront to ensure the agency has an idea of what might happen to overall

operations and what steps need to be taken to counteract any type of disruption.

(Participant 12, personal communication, March 23, 2016)

Based on the responses from the participants, the researcher identified a sub-

theme related to theme (a):

Sub-theme 1. This referred to the negative impact of a lack of proper business

continuity planning. The negative impact might include the loss of data. Additionally

long-term success of the organization could be hampered. There could be health and

safety issues. Resources such as revenue, people, facility, and equipment might be

affected. The organization might be able to provide critical services, and protective

services and public assistance might impacted, if an organization lacked proper business

continuity planning (see Table 2).

Table 2

Significant negative impact

Negative impact

Loss of data Resources affected

Long-term success hampered Critical services affected

Health and Safety affected Protective services and public assistance

Theme 2: Obstacles. Nineteen of the participants (95%) described the obstacles

that get in the way of dealing with disruptions successfully. Some agencies fail properly

to conduct a complete analysis of potential disruptions or risks, and as a result, are unable

to assess current risk mitigation strategies. As a result, there is little or no consideration

of risks that could impede the government sector’s ability successfully to minimize the

impact of disruptions (Participants 9, 10, 12, 13 & 20). Participant 9 stated, that one of

the obstacles is “all the risks not being considered.” Additionally, the information used in

business impact analysis lacked currency and was not aligned with the agency’s mission

and objectives (Participant 13). Additionally, one of the obstacles was the failure to have

a plan of action in place (Participants 2, 6, 8, 11, 12, 13, 16, & 20). Participant 2

indicated “lack of planning” as an obstacle. Other obstacles included the lack of

adequate resources properly in planning business continuity (Participants 6, 7, 9, 10, 16,

18, & 19). Participant 10 opined obstacles included “high-level staff understanding of

what could happen, perception that it won’t happen so don’t need a plan,” and in

addition, Participant 19 asserted that obstacles included “the perception that disruption

will never happen. Cost, time, and other resources.” Another obstacle mentioned was

the lack of testing of the business continuity plan (Participants 1, 9, 13, & 17).

Participant 17 believed “Continuity of Operation and Disaster Recovery Plans are seldom

fully tested to validate their viability.” Participant 13 summarized that the perceived

elements or lack of elements that get in the way of dealing with disruptions successfully

include:

Improper planning or not having a continuity plan in place, business continuity

procedures not tested at least annually or testing performed is not sufficient, staff

not appropriately training on what to do in the event of a disruption, risk

assessment fails to identify a potential disruption, critical data, systems, or

processes are not defined, and information used in business impact analysis is not

current or does not align with the organization’s mission and objectives.

(Participant 13, personal communication, March 15, 2016)

There is also the lack of commitment and the perception that a disruption will

never happen (Participants 1, 10, 16, & 19). Some organizations do not follow

established communication protocols or are inept at sharing information (Participants 2,

10, & 12). Participant 10 reasoned one of the obstacles was “the lack of communication

with everyone on how, what, when, who is responsible, etc. on if disruption occurs.”

Another major issue was assigning inept personnel to deal with disruptions (Participants

2, 4, 5, & 9). Participant 2 stated that one of the obstacles was ‘the right personnel not

being involved in the process.” Many organizations do not adequately train staff on what

to do in the event of a disruption; critical data, systems, or processes are not defined

(Participants 2, 12, & 13). Some participants reported that some key stakeholders and

process owners do not have business continuity planning as a priority compared to other

business objectives within the government agency (Participants 6, 9, 11, 17, 18).

Two participants believed management would not want the internal auditor to be

involved with business continuity planning owing to threats to independence (Participant

3 & 12). Participant 12 stated, “Management may be concerned that Internal Audit is just

to give them findings or they may be concerned that Internal Audit’s participation could

impair their independence affecting the ability to audit the BCP [business continuation

plan] and processes in the future.” Seven participants (35%) believed management

would be leery about getting the internal auditors’ perspective in the development and

implementation of business continuity planning because they would not provide value

because of knowledge gaps and that the internal auditors would get in their way of their

planning. Another participant reasoned that the internal auditor might not have a strong

working relationship with individuals in different business units just because they are

auditors and are always scavenging for mistakes that could result in future audits.

Participant 2 stated, “Management could want to keep the internal auditor out of the

planning process if there are gaps that management knows exist.” Therefore,

management might not be receptive to the internal auditor’s participation since that might

create more issues. One participant opined that management’s lack of awareness of the

internal auditor’s role in the organization could result in not involving them in business

continuity planning (Participant 12). Participant 12 specifically indicated “top decision

makers are not identified with both roles and appropriate authority defined.”

Sub-theme 2. This referred to the obstacles that get in the way of dealing with

disruptions successfully. There might be failure to conduct analysis of risk affecting the

organization. An organization might have a plan but never practiced it. There could be

sentiment that a disaster would not happen, the internal auditor would be provide value,

there might be knowledge gap between management and staff of an organization and the

internal auditor in terms prioritizing risks affecting the organization. An organization’s

risk assessment might be current or not even have a plan in place. There could be a lack

of resources to implement a plan. There might be lack of training, and inept people

entrusted with plan, lack of communication , poor relationship with staff, and threat to the

independence of the internal auditor (see Table 3).

Table 3

The obstacles that get in the way of dealing with disruptions successfully

Obstacles

Failure to conduct risk analysis Failure to have a plan in place

Plan exists but not practiced Lack of resources to properly plan

Disaster is not going to happen Lack of training

Not high on priority list Threat to independence and other issues

Internal Auditor is not providing value Inept people entrusted to plan

Knowledge of gap Lack of communication

Lack of currency or alignment Poor relationship with staff

Theme 3: Major roles. Nineteen of the participants (95%) believed the internal

auditor should play a major role in business continuity planning in the government sector.

They reasoned that the internal auditor has a broader and more independent view of the

organization and could provide valuable insight on areas that are at risk. Ten of the

participants (50%) indicated that the internal auditor should be involved because of their

experience in risk identification and objectivity in assessing risks (Participants 2, 5, 7, 8,

10, 12, 13, 14, 17, & 18). Participant 2 believed

The internal auditor has a broad view of operations and could provide gap

analysis to ensure all facets are covered. The internal auditor could also provide

insight on areas that have been audited in the past that are at risk for business

continuity planning.

Participant 18 stated,” Internal Audit are control experts and could help identify key

business continuity risk and control gaps.” Participant 12 added:

Internal Audit can assist by reviewing the risk assessment/analysis for overall

adequacy and appropriateness, can assist with BIA, and can audit/evaluate the

plan to identify weaknesses and ensure it is up to date and relevant. Overall,

Internal Audit plays a critical role in offering objective feedback by assessing

whether the program provides effective coverage to protect the agency from harm

before/when a significant disaster occurs. (Participant 12, personal

communication, March 23, 2016)

Six participants (30%) emphasized that internal auditors understand the entire

organization on account of their roles due to their roles. As a result, they understand risks

that might be neglected by management and are in a position to provide some pointers to

management (Participants 1, 2, 5, 7, 10, &14). Participant 7 indicated “Internal Auditor

understands risks that may be overlooked by management. Understands the entire

organization and can provide some pointers to management.”

Several participants also reasoned that the internal auditor position ensures that

the business continuity planning process is adequately planned, in place, and provides for

periodic testing (participants 3, 4, 6, 7, 9, 10, 11, 12, 14, 15, 16, 19 & 20). Participant

asserted “Internal Auditor can provide an unbiased, objective opinion on the risk.” One

participant indicated that the internal auditor should assist management by reviewing the

risk assessment, overall adequacy, and appropriateness of the business continuity plan.

Because of their enterprise-wide risk perspective, the internal auditors can help inform

those charged with governance regarding the government entity’s data, systems, and

processes that are critical and should be protected (Participant 17). One participant

argued that the internal auditor does not necessarily have to participate in the

development of business continuity planning, but reasoned that in the absence of strong

continuity structure, it is the responsibility of the business area to determine risk, but if

the entity does not address the risk then the internal auditor has to identify risk

(Participant 8).

Sub-theme 3. This referred to the reason for the internal audit to play major roles

in business continuity planning. The internal auditor understands the organization well,

risks, and risk assessment, provides assurance to management and board, has a broader of

the organization, and is expected to be objective and independent in his or her view of the

organization (see Table 4).

Table 4

The reason for the internal auditor to play major roles in business continuity planning

Major roles

Understands the organization well Understanding of risks

Objective independent view Assurance to management and board

Understands risk assessment Broad view of organization

Theme 4: Areas to be excluded from the internal auditor. All participants

believed the internal auditor should not be involved in making management decisions

related to business continuity planning. They should only participate in an advisory

capacity. All participants reasoned that the internal auditor could provide an unbiased

opinion during business continuity planning since they are considered control experts.

There were reminders that internal auditors have the expertise in risk assessment and

mitigation owing to their overall knowledge of the organization. As a result, they are in a

position to validate the information provided by various sections of the government

sector by identifying key business risks and control gaps performing an audit process

when necessary, in addition to assisting executive management in identifying priorities

that impact the organization (Participants 2, 5, 7, 8, 10, 12, 13, 14, 17, & 18). Participant

13 stated:

Internal Auditors should be consulted to assist in identifying risk and control

information to perform business impact analysis. In addition, Internal Audit staff

may conduct assurance or advisory engagements before, during, and after an

interruption to assess the effectiveness of business continuity planning.

(Participant 13, personal communication, March 15, 2016)

A participant identified the steps to be considered in the development and

implementation of business continuity planning which might consist of defining critical

functions, identifying risks and strategies for mitigating those risks, prioritization of

critical services, the identification of resources necessary to deploy those services,

evaluating different recovery strategies, implementing, testing and maintaining the plan.

The participant indicated that these could be completed without the assistance of the

internal auditor of the organization, but “probably not the wisest thing to do. The internal

auditor’s input is essential to ensure all risks are considered” (Participant 19, personal

communication, March 17, 2016). Participant 2, 5, 7, and 18 indicated that update and

maintenance of the business continuity plan should be completed by management or staff

other than the internal auditor because they are considered management functions

Participant 5 opined “If the internal auditor should be excluded from any activity, I would

suggest update and maintenance as that is truly an operational activity” and Participant 18

added that internal auditor should be excluded from “update and maintenance of the plan

as internal audit would then become part of control.” Participants 2, 11 and 16 believed

disaster recovery and strategy should be completed by management and staff other than

the internal auditor since they are considered management functions (Participants 2, 11,

& 16). Participant 2 stated,

The internal auditor should be involved in the analysis and testing phases as they

are areas that can provide better objective insight to management. Disaster

recovery plan and update and maintenance are more of a management function

and not an assessment function.

Two participants also believed that the business impact analysis should be completed by

management or staff other than the internal auditors because it is considered a

management function. But the internal auditor should provide critical consulting roles in

these areas to ensure objectivity so that the planning process is more efficient and

effective owing to the wealth of knowledge in performing risk assessment and identifying

risks, and help validate, mitigate, diffuse intra-agency competing interests, and provide

objective information to executive management and those charged with governance

(Participants 4 &17). Participant 17 summarized:

We must ensure our independence by not developing the plans or getting involved

in management decisions. Our role should be one of review and assessment,

providing management with information by which they can make informed

decisions. The biggest risk to an organization for not involving the internal

auditor in business continuity planning is that professional and independent

resources are not taken advantage of. The unbiased, third-party perspective can

help management make informed decisions, and perhaps diffuse internal, cross-

organizational conflict. (Participant 17, personal communication, March 8, 2016)

Sub-theme 4. This referred to the areas in business continuity planning the internal

auditor should be excluded if they were to be involved in business continuity planning.

The internal auditor should be excluded from making management decisions,

participating in business impact analysis, updating and maintenance of the plan, and

disaster recovery and strategy. These areas should be the responsibility of management

(see Table 5).

100

Table 5

The areas the internal auditor should be excluded

Areas to be excluded

Making management decisions Update and maintenance

Business impact analysis Disaster recovery and strategy

Theme 5: Internal auditor’s independence. All participants agreed that the

independence of the internal auditor would not be impaired due to participation in

business continuity planning. They argued, however, that there could be a threat to

independence depending on the role of the internal auditor. They all believe the best

safeguard would be to have an understanding up front with the management of the

government sector outlining the roles of the internal auditor as a consultant, not as

someone making decisions for management, in the process. Participant 2 stated:

One of the necessary safeguards to mitigate the impairment of independence is to

ensure that there is a consulting agreement or Memorandum of Understanding to

identify roles that the internal auditor will play in the process. Ensure that the

internal auditor is providing only assurance services and not participating in

management functions. (Participant 2, personal communication, March 17, 2016)

Additionally, Participant 18 emphasized the importance of instituting necessary

safeguards to ensure mitigation of impairment of independence:

There should be clear statement of work that is documented and communicated to

executive management. Internal Auditor cannot be responsible for the business

continuity plan including being part of the process or determining which business

101

operations should take priority. (Participant 18, personal communication, March

26, 2016)

One participant stated that “the auditor should never direct the group in a specific

direction (make a decision), but instead provide information that the group can use to

make their own decisions” (Participant 6). The participant added that roles should be

“here is the process you should consider performing” in lieu of “here is the process you

should use and here is the format you should use” (Participant 6).

Thirteen participants (65%) believed the reactions of those charged with

governance could be negative or positive, depending on their understanding of the roles

of the internal auditor in business continuity planning within the government sector. But

they suggested that it is the duty of the internal auditor to explain to management and

those charged with governance why the internal auditor should play a role in business

continuity planning (Participants 1, 2, 3, 4, 5, 7, 8, 10, 11, 12, 14, 15,16, & 19).

Participant 5 stated, “Those charged with governance might be surprised because they

have preconceptions about the role of internal audit.” Participant 15 stated “It is up to

Internal Audit to explain to senior management why internal audit should have a role.

They can then agree to what those roles will be if it is an advisory versus an assurance

service.” Participant 16 stated, “It is the duty of the Internal Auditor to point

management and those charged with governance to the Internal Audit Charter which

spells out the responsibilities of the Internal Auditor.” Six participants (30%) believed

those charged with governance should welcome the knowledge of the internal auditor and

the assurance that the plan is appropriate (Participants 1, 9, 12, 16, 17 & 18). On the

other hand, Participant 18 stated: “Those charged with governance would have positive

102

reactions due to the greater level of assurance that the plan is appropriate and sufficient

through an independent assessment.” Participant 12 stated, “They may feel a sense of

assurance that the plan was developed based on relevant risks and analysis, (if audited)

that the plan is complete and adequate, and that they are informed on the progress, etc.”

Sub-theme 5. This referred to the independence of the internal auditors in an

organization. The board welcomes the independence of the internal auditor. Also, the

business continuity plan is usually developed based on risk identification and analysis.

However, there could be a threat to the independence of the internal auditor for

participating in business continuity planning. As a result, the internal auditor’s

participation might or might not resonate well with the board. The internal auditor would

mitigate the impairment of independence by using a Memorandum of Understanding

(M.O.U) signed between management and the internal auditor prior to participating in

business continuity planning (see Table 6).

Table 6

Independence of the internal auditor

Independence

Independence not impaired if M.O.U Threat to independence

Positive reactions by the board Board welcomes independence

Positive and Negative reaction by board Plan developed based on risk

Evaluation of Findings

In this section, the findings arising from this study are evaluated. First, the

findings were appraised in light of current theory. This study and findings were

compared to past research. Finally, how business continuity planning is affected by this

103

research is presented. Analysis of the data resulted in the manifestation of five themes.

The themes were (a) significant negative impact, (b) obstacles, (c) major roles, (d) areas

to be excluded from the internal auditor, and (e) internal auditor’s independence. The

following is an evaluation of theme findings in comparison and contrast with current

research studies.

RQ. What are the perceived use and the roles of the internal auditor in business

continuity planning in the government sector?

Theme 1: Significant negative impact. When a government sector falls short of

implementing the required and appropriate measures to mitigate disruptions, the potential

risks can be great (Hall et al., 2012). This failure might result in an ill-advised response

to an emergency and the possible use of limited resources improperly (DHS, 2006; Ojha

et al., 2013). Evidence from this theme indicates that organizations are concerned about

people, property damage, and monetary loss, but not enough attention is given to

confidential and sensitive information that can potentially lead to negative exposure

(Ojha et al., 2013; Verchick & Hall, 2011).

Sub-theme 1. When asked to about the negative impact of a lack of proper

business continuity planning, some participants indicated that there might be the loss of

data. Additionally, long-term success of the organization could be hampered. There could

be health and safety issues. Resources such as revenue, people, facility, and equipment

might be affected. The organization might be able to provide critical services, and

protective services and public assistance might be impacted, if an organization lacked

proper business continuity planning.

104

Theme 2: Obstacles. Some organizations fail properly to conduct a complete

analysis of potential disruptions or risks, and as a result, they are unable to assess current

risk mitigation strategies event (Raman et al., 2011). The current study found that some

government agencies do not consider risks that could impede the government sector’s

ability to mitigate the impact of disruption successfully. Additionally, one of the

obstacles was the failure to have a plan of action in place and lack of resources to

properly plan business continuity and that business continuity plans are seldom tested

(Chandra et al., 2013).

Sub-theme 2. When asked about the obstacles that get in the way of dealing with

disruptions successfully, findings from the current study also indicated that there is a lack

of commitment, perceptions that disruption will not happen, improper communication,

and inept personnel being assigned to deal with disruptions. Participant 9 stated, “The

right personnel are being involved in business continuity planning.” The findings

additionally indicated that some key stakeholders and process owners did not have

business continuity planning as a main concern compared to other business objectives

within the government agency. Participant 6 opined, “I think some organizations

including government agencies lack planning properly for disruptions and do not regard

business continuity planning as important as other issues.” Additionally, the information

used in business impact analysis lacked currency and was not aligned with the agency’s

mission and objectives. The findings further indicated that management of an

organization including the government sector would not want the internal auditor to be

involved with business continuity planning owing to threats to independence. Finally, the

findings indicated that management would be leery about getting the internal auditors’

105

perspective in the development and implementation of business continuity planning

because they would not provide value because of knowledge gaps and internal auditors

getting in the way of their planning.

Four participants believed management would not want to involve the internal

auditor in business continuity planning because of threats to the internal auditor’s

independence. Another participant reasoned that the internal auditor might not have a

strong working relationship with individuals in different business units just because they

are auditors and are always scavenging for mistakes that could result in future audits.

Therefore, management might not be receptive to the internal auditor’s participation as

that would create more issues. One participant opined that management’s lack of

awareness of the internal auditor’s role in the organization could result in not involving

them in business continuity planning (Kanellou & Spathis, 2011; Soh & Martinov-

Bennie, 2011).

Theme 3: Major roles. Findings indicated that the internal auditor should play a

major role in business continuity planning in the government sector. They reasoned that

the internal auditor has a broader view of the organization and could provide valuable

independent insight to management and those charged with governance in areas that are

at risk (Schneider et al., 2012; Stefaniak et al., 2012; García et al., 2012). The internal

auditor who performs auditing of all the activities of an organization should be in a better

position to understand the functions of the governmental entity and can provide

independent information regarding risks and the effectiveness of the business continuity

plans and whether or not the cost is effective (Chambers, 2014; Dickey et al., 2006; Zain,

106

Zaman, & Mohamed, 2015). As such, the internal auditor is considered a significant part

of an organization’s internal control structure (Wines, 2012; Zerni, 2012).

Sub-theme 3. When asked about the reason for the internal audit to play major

roles in business continuity planning. The participants overwhelming indicated that the

internal auditor understands the organization well, risks, and risk assessment, provides

assurance to management and board, has a broader of the organization, and is expected to

be objective and independent in his or her view of the organization.

Theme 4: Areas to be excluded from the internal auditor. Current research

indicated that there are specific areas in business continuity planning within the

government sector from which the internal auditor should be excluded. They included

identifying risks and strategies for mitigating those risks, prioritization of critical

services, the identification of resources necessary to deploy those services, evaluating

different recovery strategies, implementing, testing and maintaining the plan. In these

cases, the internal auditor should be used as an advisor because of their overall

understanding of the risks facing the organization. In essence, one of the internal

auditor’s primary role is assessing and evaluating risk within the organization (Dickins &

Daughterty, 2012; Novriansa, & Riyanto, 2016). Participant 8 stated, “Internal auditors

should provide options that they are aware of, but should not recommend a specific

option.”

Sub-theme 4. When asked about the areas in business continuity planning the

internal auditor should be excluded if they were to be involved in business continuity

planning. The participant expressed their sentiments that the internal auditor should be

excluded from making management decisions, participating in business impact analysis,

107

updating and maintenance of the plan, and disaster recovery and strategy. These areas

should be the responsibility of management.

Theme 5: Internal auditor’s independence. Findings from the current study

indicated that the independence of the internal auditor would not be impaired on account

of participation in business continuity planning. There could be a threat to the

independence of the internal auditor, however, depending on the role the auditor played

in business continuity planning. As a safeguard against the impairment of the internal

auditor’s independence, there should be an understanding up front with the management

of the government sector outlining roles of the internal auditor as a consultant, not as

someone making decisions for management. In essence, the internal auditor’s role is to

assess and evaluate risks, not making decisions for management which ultimately could

impair the independence of the internal auditor (Abbott, Daugherty, Parker, & Peters,

2016; D’Onza, Selim, Melville, & Allegrini, 2015; Zaharia et al., 2014).

Sub-theme 5. When asked how the internal auditor’s independence would be

affected if allowed to participate in business continuity planning, the participants opined

that the independence of the internal auditors is vital in an organization, even though the

business continuity were based on risk identification and analysis . Although the board

welcomes the independence of the internal auditor, there could be a threat to the

independence of the internal auditor for participating in business continuity planning. As

a result, the internal auditor’s participation might or might not resonate well with the

board. The participants expressed confidence that the internal auditor would mitigate the

impairment of independence by using a Memorandum of Understanding (M.O.U) signed

108

between management and the internal auditor prior to participating in business continuity

planning.

Comparison to past research. Past literature supported the importance of

business continuity planning to ensure that the government sector is ready to respond to a

service disruption or emergency. Additionally, the negative effects of a service

disruption or disaster can be significant to the government sector, which might include

casualties or even death, negative public perception, property damage, and monetary loss

(Day, Melnyk, Larson, Davis, & Whybark, 2012; Haddow et al., 2011). Therefore, when

proper skills and knowledge are not used to ensure continuity of business, there is the risk

of unsuccessful response to a disaster, and potentially significant losses (Haque et al.,

2012; Kusumasari et al., 2010).

Findings from the current study also indicated that the government sector does not

consider risks that could impede the government sector’s ability to mitigate the impact of

disruptions successfully. This assertion contrasts with past research which showed that

the government considers different types of risks. Additionally, sometimes staff are not

adequately trained on what to do in the event of an emergency (Chen, & Lee, 2012).

Past research focused on the risks facing organizations today. For example, there

were risks related to natural disasters such as wind, hail tornadoes, and lightning

(Goudsmit, 2012). There were past findings on the need for public asset managers to

mitigate and prepare for future, business continuity planning management in local

governments, an exploration on business continuity planning in Michigan small

businesses, how to ensure continuity of business in general small and medium businesses,

109

and on education technology (Botha & von Solms, 2004; Lasecki, 2009; Mekdeci, 2011;

Smit, 2005; Warren, 2010).

Past research also supported the findings in the current study which included

developing and implementing a business continuity plan to mitigate potential loss

through the identification, prioritization, and safeguarding of critical assets of the

business, not only information technology (Hoong & Marthandan, 2014). Additionally,

there were studies supporting the findings in the current study that internal auditors

understand and have a broader view of potential risks affecting the organization and the

potential impact of any loss (Schneider et al., 2012; Stefaniak et al., 2012). Business

continuity is still an emerging concept (Pelfrey & Kelley, 2013). There was no sufficient

past literature on the perceived roles of the internal auditor in business continuity

planning within the government sector.

Prior studies recognized the expertise of the internal audit identifying and

prioritizing risk, but there was no sufficient work on the perceived roles of the internal

auditor in business continuity planning within the government sector (Schneider et al.,

2012; Stefaniak et al., 2012).

Summary

The purpose of this qualitative single-case study was to understand the use and

the perceived roles of the internal auditor in business continuity planning within the

government sector. The results of the study arose from data analysis of 20 interview

questionnaires derived from a theoretical sample. The steps included a pattern of

response matching, coding, and labeling of themes arising from the analysis. The data

analysis resulted in five themes. The five themes for the overarching research question

110

included: (a) significant negative impact, (b) obstacles, (c) major roles, (d) areas to be

excluded from the internal auditor, and (e) internal auditor’s independence.

The findings arising from the study indicated that potential risks could be great

when a government sector falls short of implementing the required and appropriate

measures to mitigate disruptions, that might result in improper response to an emergency

and possible use of limited resources undesirably. Organizations are concerned about

people, property damage, and monetary loss, but not enough attention is given to

confidential and sensitive information that can potentially lead to negative exposure.

Findings from past literature indicated some similarities with the current study in

terms of the need for government sector implementing certain measures to ensure

mitigation of disasters and other disruptions. Some organizations fail properly to conduct

a complete analysis of potential disruptions or risks, and as a result, they are unable to

assess current risk mitigation strategies. Findings from the current study also indicated

that the government sector does not consider risks that could impede the government

sector’s ability to mitigate successfully the impact of disruptions owing to other

competing priorities and the lack of adequate resources needed to plan business

continuity properly. Additionally, business continuity plans are seldom tested. There is

also the perception that disruption will never happen, a lack of commitment or proper

communication, and unqualified personnel being assigned to deal with disruptions

Additionally, the information used in business impact analysis lacked currency

and was not aligned with the agency’s mission and objectives. The findings also

indicated that some management of organizations, including the government sector

would not want the internal auditor to be involved with business continuity planning

111

because of threats to the internal auditor’s independence. Findings from the current study

also indicated that management would be leery about getting the internal auditors’

perspective in the development and implementation of business continuity planning

because they would not provide value because of the knowledge gaps and that the

internal auditors would get in their way of their planning. Additionally, the internal

auditor might not have a strong working relationship with individuals in different

business units just because they are auditors and are always scavenging for mistakes that

could result in future audits. As a result, management might not be receptive to the

internal auditor’s participation since that might create more issues. Another issue was the

perception that management’s lack of awareness of the internal auditor’s role in the

organization could result in not involving them in business continuity planning.

The findings indicated that the internal auditors should play a major role in

business continuity planning in the government sector because they have a broader view

of the organization and might provide valuable insight on areas that are at risk. Although

there could be a threat to the internal auditor’s independence for participating in the

business continuity planning; as a safeguard and to dilute such perception, there should

be an understanding up front with management of the government sector clarifying that

the roles of the internal auditor would be as a consultant and not as someone making

decisions for management. The internal auditor’s participation would ensure

management and those charged with governance are getting objective information related

to business continuity planning. Such participation could be viewed positively or

negative by those charged with governance, depending on their understanding of the roles

of the internal auditor.

112

The specific areas internal auditors could be involved in business continuity

planning included identifying risks and strategies for mitigating those risks, prioritization

of critical services, the identification of resources necessary to deploy those services,

evaluating different recovery strategies, implementing, testing and maintaining the plan.

In these cases, the internal auditor should be used as an advisor on account of their

overall understanding of the risks facing the organization. Past studies supported the

findings of the current study that internal auditors better understand and have a broader

view of the risks affecting the organization and the potential impact. But there was no

sufficient past literature on the perceived roles of the internal auditor in business

continuity planning within the government sector.

113

Chapter 5: Implications, Recommendations, and Conclusions

The purpose of this qualitative single-case case study was to understand the use

and the perceived roles of the internal auditor in business continuity planning within the

government sector (Hall et al., 2012). But without the involvement of those with the

expertise related to risk assessment and evaluation, management of a government agency

could assume undesirable business continuity risks. An internal auditor is an independent

person who has a broader view of the organization and understands risk evaluation. This

position reports directly to those charged with governance and also ensures a decision has

been adequately documented (García et al., 2012). The internal auditor’s qualifications

are essential in determining the ability to perform his or her duties adequately, which

includes at least a four-year degree, certifications as Certified Internal Auditor, Certified

Public Accountant, or Certified Information Systems Auditor. Internal auditors are

required to participate in continuing professional education (Abbass & Aleqab, 2013;

Kamel & Elkhatib, 2013). There is no sufficient literature on the perceived roles of the

internal auditor in business continuity planning in the government sector.

Governments oftentimes are ill-prepared to handle disasters because of a lack of

adequate resources, other competing issues, and improper preparation for catastrophic

events (Donahue, Cunnion, Balaban, & Sochats, 2012; Jensen, 2011; Renaud, 2012).

Therefore, they apply their resources on more critical issues. Even the Nationwide Plan

Review conducted by the Department of Homeland Security determined that only 10% of

business continuity plans are adequate to mitigate the effect of disasters (DHS, 2006).

The shortcomings identified included a lack of proper documentation of risks and the

probability of occurrence and consideration of critical segments of the public (DHS,

114

2006). The lack of adequate preparation could pose a significant challenge to the

government should an event occur (Ericksson, 2009). Furthermore, these shortcomings

could overtax the needed resources that are earmarked for mitigating the effect of

catastrophic events and possibly the loss of revenue. Additionally, catastrophic events

could result in unnecessary distress, harm, and the public perception of the government

could plummet abysmally (Kusumasari et al., 2010; Shughart, 2011). These

shortcomings are usually because of the lack of planning properly. Proper planning

includes proper identification of risks, the probability of occurrence, impact analysis,

consideration of response alternatives, and testing and maintenance (Kruger, 2009;

Kusumasari et al., 2010). Consequently, the problem addressed by this study was the

lack of the use and the limited understanding of the perceived roles of the internal auditor

in business continuity planning in the government sector.

Governments are usually concerned about continuity since they are under pressure

to keep up with the citizen’s expectations for optimal services. Additionally,

globalization and technological advancements have changed how governments do

business (Nasim & Sushil, 2010). For example, Malaysia had never experienced a

tsunami until its occurrence in 2006 and because of the lack of proper planning,

experience, and expertise, the government was not prepared to mitigate the disruption

arising from that event (Raman et al., 2011). Potential risks to the government might

include the loss of mission critical data, displacement of workers, and unavailability of

facilities due to catastrophic events (Gourio, 2012).

The purpose of this qualitative single-case study was to understand the use and

the perceived roles of the internal auditor in business continuity planning within the

115

government sector. The study identified the obstacles that could negatively affect the

resumption of service when there is a disruption. The focus of this case study was

examining the roles of internal auditors in the governmental sector, specifically, for the

State of Texas in the United States. The study was a single case qualitative research with

an embedded unit of analysis that comprised 20 internal auditors in the government

sector, specifically, the State of Texas. The study utilized an interpretive approach and

theoretical sampling (Patton, 2002; Suri, 2011; Yin, 2009). Data sources utilized for this

case study were document reviews and interviews. Five themes surfaced from data

analysis: (a) significant negative impact, (b) obstacles, (c) major roles, (d) area to be

excluded from the internal auditor, and (e) internal auditor’s independence.

But the inquiry was limited to those internal auditors working in the State of

Texas. Therefore, the study was inhibited by the experiences, knowledge, and perceptions

of the participants. As a result, the findings of the study might not meet the perceived

expectations of past researchers of reliability, credibility, transferability, and validity in

the research design, data collection, and data analysis process (Patton, 2002).

Additionally, the findings might not apply to all internal auditors in all government

sectors.

A limitation of this study was that the inquiry was made only to internal auditors

working in the State of Texas. Therefore, the study was inhibited by the experience,

knowledge, and perceptions of the study participants. As a result, the findings of the

study might not meet the perceived expectations of past researchers of reliability,

credibility, transferability, and validity in the research design, data collection, and data

analysis. Additionally, the findings might not apply to all internal auditors in all

116

government agencies. but that was not the objective of this study. Rather, the goal was

fully to understand the roles of the internal auditor in the government sector, specifically

the State of Texas. Nevertheless, the research design could apply to other government

agencies in the United States with the reasonable expectation of achieving similar results.

For example, involving the internal auditor in business continuity planning could be

viewed as a needless step in business risks evaluation by management. On the other

hand, soliciting the expertise of the internal auditor could be viewed as a necessary

process to mitigate adequately the risks considered by management. However, the

generalization of research findings would be at the discretion of future researchers (Jones,

2010).

There were measures in place during the research to ensure ethical assurances

throughout the research. The researcher began collecting data after obtaining the

approval of the IRB for the current study. Each participant signed an Informed Consent

form indicating agreement to participate in the study. A questionnaire was utilized for

the interview. All participants were briefed about the purpose of the study and data

collection (APA, 2010, Hicks, 2011). Additionally, all participants were informed of

their rights not to participate or to terminate at any time without any negative

ramifications (Paul, 2012).

The participants’ privacy and confidentiality were deemed very important; as a

result, fictitious names of people and government agencies were used. No identifiable

information was utilized throughout the study (Hicks, 2011). The researcher was the

only one that had access to the list linking participants and their specific government

agencies. Data obtained during this study were kept in a password-protected computer

117

and in a locked cabinet, and only the researcher has access to it. All data will be deleted

and destroyed seven years after the completion of the study. Additionally, the researcher

has made sure the dissertation manuscript includes no identifying information; (Matuk &

Young, 2011). Therefore, there is minimal risk of harm resulting from this research

(Arwood & Panicker, 2011).

The documentation and reporting of research results included the necessary

information. Additionally, data were not exploited, and there was no evidence of bias in

analysis and reporting of findings (APA, 2010). The researcher was able to achieve this

by carefully reviewing the information obtained during the research study which included

tracing back to the appropriate source documents and cross-referencing to report. This

procedure provided reasonable assurance that errors would be prevented or detected and

that findings were presented accurately (APA, 2010; Hicks, 2011).

This chapter includes a discussion of implications, recommendations, and

conclusion of the research study. Implications include discussions on the results of the

study in relation to the purpose and problem that warranted the study. Additionally,

recommendations are structured around theoretical contribution and practical application,

best practices, and proposals for future research. Finally, the conclusions arising from

this study are presented.

Implications

The implications arising from the results of this study were addressed below. The

overarching research question is stated again, followed by (a) any potential limitations

that affected the interpretation of the results; (b) the significance of the findings and the

118

response to the study problem and purpose using the five themes identified in the

analysis; and (c) how the study contributes to the existing literature.

Research question. What are the perceived types and possible impacts of service

disruptions within the government sector, obstacles that could negatively affect the

resumption of service when a disaster occurs and the roles of the internal auditor in

business continuity planning? The themes that arose from this study addressed the

overarching research question. The results from this study depicted several key points