ISACA Certified Information Systems Auditor (CISA) ExamDomain 2: Governance and Management of ITMedium
An organization's business continuity plan (BCP) includes a comprehensive business impact analysis (BIA) that identifies critical business processes and their associated recovery time objectives (RTOs) and recovery point objectives (RPOs). However, the plan does not specify the roles and responsibilities for activating and managing the BCP during an actual event. What is the MOST significant risk resulting from this omission?
- AInability to accurately assess the financial impact of a disruption.
- BNon-compliance with regulatory reporting requirements.
- CFailure to obtain necessary external resources in a timely manner.
- DConfusion and delays in executing recovery procedures.
Show answer & explanationAnswer & explanation
Correct answer: D. Confusion and delays in executing recovery procedures.
Even with a well-defined BIA and recovery procedures, a lack of clearly assigned roles and responsibilities for BCP activation and management will lead to confusion, duplicated efforts, or critical tasks being overlooked during a crisis. This directly impacts the ability to efficiently and effectively execute the plan, causing significant delays in recovery.
Why the other options are wrong
- A. The BIA already assesses financial impact; this omission doesn't directly affect the assessment itself, but rather the ability to mitigate that impact.
- B. Regulatory reporting is a specific task that might be affected, but the overarching risk is the general inability to activate and manage the entire plan effectively.
- C. While external resource acquisition is important, the immediate and direct impact of undefined roles is internal confusion and execution delays.
BCP Roles & Responsibilities
Clearly defined assignments of duties and authority within a Business Continuity Plan (BCP) to ensure effective activation, coordination, and execution of recovery efforts during a disruption.
- Crucial for efficient response.
- Minimizes confusion and delays.
- Includes incident command structure.
Memory trick: A great plan without clear roles is like a script without actors.