AUDITING INCIDENT RESPONSE AND DISASTER RECOVERY PLANS IN THE EVENT OF A MASS DATA BREACH OF EPF-I IDENTIFICATION DATA

Abstract

Over the last 15 years, Islamic financial institutions in Malaysia have changed a lot due to new technology and digitalization. While this brings many benefits to EPF-i members, it also creates new risks. One of the biggest problems today is cybersecurity, specifically large-scale data breaches and identity theft caused by phishing links. This study evaluates the operational effectiveness of EPF-i’s Incident Response Plan (IRP) and Disaster Recovery Plan (DRP) from an Information Systems Audit perspective. The research uses a conceptual design, mapping institutional resilience against the ISO 22301:2019 standard, COBIT 2019, and COSO 2017 ERM frameworks, while integrating the Islamic principle of Hifz al-Mal (preservation of wealth). Critical audit evaluations reveal that EPF-i’s current plans are partially effective due to significant weaknesses in the system and only respond to threats after they happen, instead of catching or preventing them. The main findings highlight a lack of real time automated fraud controls and practicing for the wrong emergency scenario, where recovery protocols prioritize physical infrastructure over protecting critical identity registries. This creates a paper compliance risk where untested plans may accidentally restore polluted data during an identity crisis. To build better resilience, the study recommends three main actions, the adoption of specialized mass-credential playbooks, automated transaction holds, and mandatory identity revalidation procedures. Finally, sustained board oversight and executive commitment are essential to maintain public trust and protecting the retirement savings of millions.