APP-11

Control Description

The Company tests its financial backups and transaction audit logs at least annually through documented backup and restoration testing, with results reviewed and retained by IT management."

Risk

Untested backups may fail to recover financial data in a timely manner during actual data loss events, preventing substantiation of transactions and audit compliance.

Implementation Details

• The enterprise maintains a formal procedure to conduct periodic (at least annual) backup restoration and data validation drills.

• Backups are selected and restored into a secure non-production or isolated sandbox/test environment.

• Verification steps are performed to ensure database consistency, data integrity, and the readability of transaction audit logs.

• Detailed test protocols, execution logs, and formal management sign-offs are documented and retained for audit review.

Test Procedures

A) Test of Design (ToD):
Inquire of IT management to understand the annual backup testing policy, the methodology used for restoration drills, and the environment where tests are executed.

B) Test of Operating Effectiveness (ToE):
Inspect the annual backup restoration test report and documentation. Verify that the restoration test was performed within the required timeframe, check that transaction audit logs and data integrity were successfully validated, and confirm that formal sign-off was reviewed and approved by IT management.