An IS auditor can verify that an organizations business continuity plan (BCP) is effective by reviewing the:

A. alignment of the BCP with industry best practices.

B. results of business continuity tests performed by IS and end-user personnel.

C. off-site facility, its contents, security and environmental controls.

D. annual financial cost of the BCP activities versus the expected benefit of implementation of the plan.

Explanation:

The effectiveness of the business continuity plan (BCP) can best be evaluated by reviewing the results from previous business continuity tests for thoroughness and accuracy in accomplishing their stated objectives. All other choices do not provide the assurance of the effectiveness of the BCP.