ISACA Certified Information Systems Auditor (CISA) ExamDomain 3: Information Systems Acquisition, Development and ImplementationHard
An IS auditor is reviewing the go-live readiness assessment for a new critical online banking system. The assessment indicates that all functional and performance tests passed, and user acceptance testing (UAT) was signed off. However, the auditor notes that the disaster recovery plan (DRP) for the new system has not yet been fully integrated or tested with the new system's specific configurations. Which of the following is the MOST significant risk to address before go-live?
- AInability to recover the system in the event of a major disruption after go-live.
- BDecreased user confidence if a disaster occurs shortly after launch.
- CNon-compliance with internal audit policies requiring tested DRPs.
- DPotential for increased operational costs due to lack of DRP testing.
Show answer & explanationAnswer & explanation
Correct answer: A. Inability to recover the system in the event of a major disruption after go-live.
For a critical online banking system, the inability to recover from a major disruption (due to an untested DRP for the new system) poses the most significant and immediate threat to business continuity, customer trust, and regulatory obligations post-go-live.
Why the other options are wrong
- B. Decreased user confidence is a significant impact, but it stems from the primary risk of system unavailability.
- C. Non-compliance is a serious issue, but the operational failure to recover is a more direct and severe business risk than the policy violation itself.
- D. Increased operational costs are a consequence, not the primary risk of system failure.
Go-Live DRP Readiness
Go-Live DRP Readiness refers to the state where the disaster recovery plan for a new system has been fully developed, integrated, and validated to ensure the system can be recovered post-implementation.
- DRP must be specific to the new system's architecture.
- Testing is crucial before production deployment.
- Ensures business continuity from day one.
Memory trick: Launch Ready? DRP Ready?