An IS auditor can verify that an organization’s business continuity plan (BCP) is effective by reviewing the:

A.
alignment of the BCP with industry best practices.

B.
results of business continuity tests performed by IS and end-user personnel.

C.
off-site facility, its contents, security and environmental controls.

D.
annual financial cost of the BCP activities versus the expected benefit of implementation of the plan.

Explanation:
The effectiveness of the business continuity plan (BCP) can best be evaluated by reviewing the results from
previous business continuity tests for thoroughness and accuracy in accomplishing their stated objectives. All
other choices do not provide the assurance of the effectiveness of the BCP.