ISACA Certified Information Systems Auditor (CISA) ExamDomain 2: Governance and Management of ITMedium
A CISA is auditing an organization's business continuity plan (BCP). The CISA finds that the BCP includes detailed recovery procedures for critical IT systems but lacks clear communication protocols for notifying external stakeholders (e.g., customers, regulators) during a disruption. What is the MOST significant implication of this finding?
- AThe organization's reputation and customer trust could be severely damaged.
- BThe organization may incur significant financial penalties.
- CInternal staff may not understand their roles during an incident.
- DThe recovery time objective (RTO) for critical systems will likely be missed.
Show answer & explanationAnswer & explanation
Correct answer: A. The organization's reputation and customer trust could be severely damaged.
While financial penalties and RTOs are important, the lack of external communication protocols directly impacts the organization's ability to manage public perception and maintain trust during a crisis. Poor communication can quickly erode reputation and customer loyalty, leading to long-term business damage beyond immediate operational or financial impacts.
Why the other options are wrong
- B. Financial penalties are possible, especially from regulators, but the direct and broader impact of poor communication during a crisis is often reputational damage.
- C. Internal communication protocols are distinct from external ones; this option addresses internal roles, not the identified gap.
- D. RTOs relate to the technical recovery of systems; external communication protocols do not directly affect the speed at which systems are brought back online.
BCP Communication Protocols
Predefined procedures within a Business Continuity Plan (BCP) that outline how an organization will communicate with internal and external stakeholders during and after a business disruption.
- Crucial for managing stakeholder expectations.
- Helps maintain public trust and reputation.
- Includes contact lists, messaging, and communication channels.
Memory trick: In a crisis, speak clearly, or your reputation will disappear yearly.