Is it appropriate for an IS auditor from a company that is considering outsourcing its IS processing to request
and review a copy of each vendor’s business continuity plan?

A.
Yes, because an IS auditor will evaluate the adequacy of the service bureau’s plan and assist their company
in implementing a complementary plan.

B.
Yes, because based on the plan, an IS auditor will evaluate the financial stability of the service bureau and
its ability to fulfill the contract.

C.
No, because the backup to be provided should be specified adequately in the contract.

D.
No, because the service bureau’s business continuity plan is proprietary information.

Explanation:
The primary responsibility of an IS auditor is to assure that the company assets are being safeguarded. This is
true even if the assets do not reside on the immediate premises. Reputable service bureaus will have a welldesigned and tested business continuity plan.