An IS auditor conducting a review of disaster recovery planning (DRP) at a financial
processing organization has discovered the following:
• The existing disaster recovery plan was compiled two years earlier by a systems analyst in the
organization’s IT department using transaction flow projections from the operations department.

• The plan was presented to the deputy CEO for approval and formal issue, but it is still awaiting
their attention.
• The plan has never been updated, tested or circulated to key management and staff, though
interviews show that each would know what action to take for its area in the event of a disruptive
incident.
The IS auditor’s report should recommend that:

A.
the deputy CEO be censured for their failure to approve the plan.

B.
a board of senior managers is set up to review the existing plan.

C.
the existing plan is approved and circulated to all key management and staff.

D.
a manager coordinates the creation of a new or revised plan within a defined time limit.

Explanation:

The primary concern is to establish a workable disaster recovery plan, which reflects current
processing volumes to protect the organization from any disruptive incident. Censuring the deputy
CEO will not achieve this and is generally not within the scope of an IS auditor to recommend.
Establishing a board to review the plan, which is two years out of date, may achieve an updated
plan, but is not likely to be a speedy operation, and issuing the existing plan would be folly without
first ensuring that it is workable. The best way to achieve a disaster recovery plan in a short time is
to make an experienced manager responsible for coordinating the knowledge of other managers
into a single, formal document within a defined time limit.