ISACA Certified Information Systems Auditor (CISA) ExamDomain 4: Information Systems Operations and Business ResilienceHard
An IS auditor is evaluating the organization's information systems maintenance program. The auditor discovers that a significant portion of maintenance activities is reactive, focusing on fixing issues after they occur, rather than proactive. Which of the following metrics would BEST highlight the financial impact of this reactive approach?
- ANumber of critical incidents per month.
- BMean Time Between Failures (MTBF).
- CPercentage of planned vs. unplanned downtime.
- DTotal Cost of Ownership (TCO) of IT assets.
Show answer & explanationAnswer & explanation
Correct answer: D. Total Cost of Ownership (TCO) of IT assets.
While other metrics show symptoms, the Total Cost of Ownership (TCO) would best highlight the financial impact. A reactive approach typically leads to higher TCO due to increased emergency repairs, expedited parts, overtime for staff, lost productivity from downtime, and potential reputational damage, all of which are components of TCO.
Why the other options are wrong
- A. The number of incidents highlights operational issues but doesn't quantify the financial cost directly.
- B. MTBF measures reliability, which is a symptom of reactive maintenance, but not a direct financial metric.
- C. Planned vs. unplanned downtime indicates operational efficiency but doesn't directly present the financial impact in monetary terms like TCO does.
Reactive Maintenance Financial Impact
The increased monetary expenditure resulting from solely addressing system failures after they occur, encompassing repair costs, lost productivity, and potential business losses.
- Often more expensive than proactive maintenance.
- Contributes to higher Total Cost of Ownership (TCO).
- Leads to unpredictable expenses and operational disruptions.
Memory trick: Paying for emergency room visits is more expensive than regular check-ups.