ISACA Certified Information Systems Auditor (CISA) ExamDomain 4: Information Systems Operations and Business ResilienceMedium
An IS auditor is evaluating an organization's business continuity plan (BCP). The auditor notes that the plan identifies critical business functions and their dependencies but lacks specific procedures for activating and managing a recovery team. What is the MOST significant implication of this deficiency?
- AProlonged disruption of business operations during a disaster.
- BDifficulty in calculating the Recovery Time Objective (RTO) for critical systems.
- CIncreased cost of recovery efforts due to inefficient resource allocation.
- DNon-compliance with regulatory requirements for BCP documentation.
Show answer & explanationAnswer & explanation
Correct answer: A. Prolonged disruption of business operations during a disaster.
Without specific procedures for activating and managing a recovery team, even if critical functions are identified, the actual execution of the recovery process will be disorganized and inefficient. This directly leads to delays and prolonged business disruption, which is the primary objective of a BCP to prevent.
Why the other options are wrong
- B. RTO calculation relies on understanding critical functions, which the plan states it has. Team activation procedures don't directly hinder RTO calculation.
- C. While inefficiency can increase costs, the primary and more severe implication is the failure to recover in a timely manner, impacting business continuity.
- D. Non-compliance is a consequence, but the operational impact of prolonged disruption is the more direct and significant risk to the business.
Recovery Team Activation Risk
The danger that, despite having a BCP, the actual recovery efforts will be hampered by the lack of clear procedures for mobilizing and directing the personnel responsible for execution.
- Critical for effective BCP execution.
- Ensures timely and coordinated response.
- Lack thereof leads to prolonged downtime.
Memory trick: A great recipe needs a chef who knows how to cook.