ISACA Certified Information Systems Auditor (CISA) ExamDomain 4: Information Systems Operations and Business ResilienceMedium
An IS auditor is evaluating an organization's business continuity plan (BCP) and disaster recovery plan (DRP). The auditor observes that while the plans are well-documented and have been tested annually, the results of these tests are merely filed away without any formal analysis of lessons learned or updates to the plans themselves. What is the MOST significant risk this practice introduces?
- AKey personnel will lose familiarity with their roles during a disaster.
- BThe organization's BCP/DRP will become outdated and ineffective over time.
- CRegulatory bodies may question the validity of the testing process.
- DTest exercises will consume excessive resources without clear benefits.
Show answer & explanationAnswer & explanation
Correct answer: B. The organization's BCP/DRP will become outdated and ineffective over time.
Without analyzing test results and updating the BCP/DRP, the plans will not evolve to address identified weaknesses, changes in the IT environment, or business processes. This makes them increasingly irrelevant and ineffective, posing the most significant risk.
Why the other options are wrong
- A. Familiarity is maintained through testing, but if the plan itself is flawed, familiarity with a bad plan is not helpful.
- C. Regulatory questioning is a consequence, but the underlying risk is the plan's actual failure to perform during a disaster.
- D. While true that resources are wasted, the 'ineffectiveness' of the plan itself is a more significant risk than just wasted resources.
BCP/DRP Maintenance & Review
The ongoing process of regularly reviewing, updating, and testing business continuity and disaster recovery plans to ensure their continued relevance and effectiveness.
- Incorporates lessons learned from tests and real incidents.
- Adapts to changes in technology, business processes, and risks.
- Ensures the plan remains viable and actionable.
Memory trick: A tested plan, unrefined, is a disaster waiting to unwind.