ISACA Certified Information Systems Auditor (CISA) ExamDomain 2: Governance and Management of ITMedium
A CISA is auditing an organization's disaster recovery plan (DRP). The CISA notes that while the DRP outlines technical recovery steps, it lacks clear guidance on how to assess the financial and operational impact of a disaster. Which of the following is the MOST significant implication of this omission?
- ARegulatory compliance may be compromised due to insufficient documentation.
- BRecovery efforts may be misaligned with the organization's critical business objectives and priorities.
- CThe organization may not be able to accurately estimate the cost of DRP implementation.
- DThe DRP testing efforts will be difficult to schedule and execute effectively.
Show answer & explanationAnswer & explanation
Correct answer: B. Recovery efforts may be misaligned with the organization's critical business objectives and priorities.
Without clear guidance on assessing financial and operational impact, the DRP cannot effectively prioritize recovery efforts. This directly leads to a misalignment between technical recovery and the organization's overall business objectives, potentially recovering less critical systems first or failing to recover critical ones in a timely manner.
Why the other options are wrong
- A. Regulatory compliance is a concern, but the immediate operational impact of misaligned recovery is more critical for business survival.
- C. While cost estimation is important, the primary goal of DRP is business continuity, which relies on understanding impact to prioritize recovery.
- D. DRP testing can still occur, but without impact assessment, the tests won't accurately validate the plan's effectiveness in meeting business needs.
DRP Business Alignment
A disaster recovery plan must align with the organization's business objectives by prioritizing recovery efforts based on the financial and operational impact of system outages.
- Ensures critical systems are recovered first.
- Minimizes financial and operational losses.
- Requires a Business Impact Analysis (BIA) as a prerequisite.
Memory trick: A good DRP 'impacts' the business positively by knowing its 'priorities'.