To optimize an organization’s business contingency plan (BCP), an IS auditor should
recommend conducting a business impact analysis (BlA) in order to determine:

A.
the business processes that generate the most financial value for the organization and
therefore must be recovered first.

B.
the priorities and order for recovery to ensure alignment with the organization’s business
strategy.

C.
the business processes that must be recovered following a disaster to ensure the organization’s
survival.

D.
the priorities and order of recovery which will recover the greatest number of systems in the
shortest time frame.

Explanation:

To ensure the organization’s survival following a disaster, it is important to recover the most critical
business processes first, it is a common mistake to overemphasize value (A) rather than urgency.
For example, while the processing of incoming mortgage loan payments is important from a
financial perspective, it could be delayed for a few days in the event of a disaster. On the other
hand, wiring funds to close on a loan, while not generating direct revenue, is far more critical
because of the possibility of regulatory problems, customer complaints and reputation issues.
Choices B and D are not correct because neither the long-term business strategy nor the mere
number of recovered systems has a direct impact at this point in time.