City of Stockton
Business Continuity &
Disaster Recovery
Audit Committee Meeting
October 7, 2024
Attachment A
Agenda
01 OBJECTIVES AND SCOPE
02 BUSINESS IMPACT ANALYSIS EXPLAINED
03 BIA AND BUSINESS CONTINUITY
04 TRP AND BUSINESS CONTINUITY
05 OBSERVATIONS AND RECOMMENDATIONS
UNLV KPI Facilitation2
Attachment A
Objectives and
Scope
3 The purpose of this effort was to guide the City of
Stockton’s internal departments in completing a
comprehensive Business Impact Analysis (BIA) to help
identify the critical processes and resources essential for operational continuity. This included:
• Conducting workshops with each department’s
representative to review the BIA process an
d
p
rovide guidance on conducting the exercise
• Analyzing results of BIA exercise and providing
fe
edback
• Reviewing the existing Technology Recovery Plan
(owned by the IT Department) and provid
ing
fe
edback on potential GAPs from industry
standards
• Effort was carried out from January to September
of 2024
Attachment A
Business
Impact
Analysis
4 A Business Impact Analysis (BIA) is a process that
helps organization identify and evaluate the potential
effects of disruptions to their operations
Key Components:
• Identify Critical Functions: Determine which
business processes are essential for daily operations
• Assess Impact: Evaluate how disruptions could
affect these functions
• Prioritize Resources: Identify the resources
n
eeded to maintain or quickly restore critical
f
unctions
Attachment A
A Business Impact Analysis (BIA) exercise is an important undertaking to enhancing the organization’s continuity plans. It helps to:
• Inform Planning: The BIA provides valuable insights for creating effective Business Continuity Plans (BCP) and Disaster Recovery Plans (DRP)* • Enhance Preparedness: Th e BIA helps The City of Stockton prepare for potential disruptions by understanding impacts a disrupted process would have on the city • Facilitate Quick Recovery: The BIA identifies the critical processes and their re
quired resources, allowing for faster recovery and minimal downtime • Support Decision-Mak ing: The BIA offers data-driven recommendations for prioritizing actions during a crisis
* The City of Stockton’s DRP is known as the Technology Recovery Plan (TRP) and is managed by the IT Department.
BIA and Business Continuity
5 Attachment A
Disaster Recovery Plans (DRPs) are documented strategies that outlines how an organization will recovery and restore resources that support its critical processes after a disruption event. The City of Stockton’s DRP is known as the Technology Recovery Plan (TRP) and supports continuity by:
• Enhancing Quick Recovery: The TRP provides a clear roadmap for restoring ope
rations, and minimizing downtime
• Protecting Critical Systems: T he TRP contains detailed backup procedures and recovery methods to safeguard important systems
• Enhancing Preparedness: The TRP prepares the city to respond effectively to various disruptions
• Facilitating Communication: The TRP establishes communication protocols to ke
ep stakeholders informed during a disruption
TRP and Disaster Recovery
6 Attachment A
Business Impact Analysis
Finding Disaster recovery plans (DRPs) and business continuity plans (BCPs) are in the preliminary stages of development and have not been fully developed, exercised, or formally tested since last review. Mission-critical financial systems do not have redundancy on site in Stockton and a business impact analysis has not been done, nor has the system been tested for failover.
Recommendation Finish developing the DRP and deploy appropriate associated processes. Each plan must be tested on a periodic basis to ensure that the plan provisions are viable and that they meet the changing needs of the City. Conduct a business impact analysis for all applications, databases, and systems within the City’s enterprise.
Completed Work • Moss Adams collaborated with each department to conduct a Business Impact Analysis (BIA) exercise.
• Each BIA was collected and reviewed by Moss Adams to provide feedback. • Departments identified key processes and required resources to continue to operate. • Each process was ranked according to its criticality for continuity and recovery purposes.
Observation and Recommendations
Business Continuity and Disaster Recovery
7 Attachment A
Disaster Recovery Testing
Finding The City does not have adequate procedures and controls in place in case of an IT emergency, requiring an override of normal controls.
Recommendation Finish developing the disaster recovery plan and deploy appropriate associated processes.
Completed Work • IT Department developed a Technology Recovery Plan (TRP). • Moss Adams reviewed the TRP against industry standards, and provided feedback. • Feedback was incorporated and Moss Adams performed a final review to validate.
Observation and Recommendations
Business Continuity and Disaster Recovery
8 Attachment A
Questions?
Attachment A
The material appearing in this presentation is for informational purposes only and should not be construed as advice of any kind, including, without limitation, legal, accounting, or investment advice. This information is not intended to create, and receipt does not constitute, a legal relationship, including, but not limited to, an accountant-client relationship. Although this information may have been prepared by professionals, it should not be used as a substitute for professional services. If legal, accounting, investment, or other professional advice is required, the services of a professional should be sought.
Assurance, tax, and consulting offered through Moss Adams LLP. Investment advisory offered through Moss Adams Wealth Advisors LLC. 10 Attachment A