IT operations for a large organization have been outsourced. An IS auditor reviewing the
outsourced operation should be MOST concerned about which of the following findings?

A.
The outsourcing contract does not cover disaster recovery for the outsourced IT operations.

B.
The service provider does not have incident handling procedures.

C.
Recently a corrupted database could not be recovered because of library management
problems.

D.
incident logs are not being reviewed.

Explanation:

The lack of a disaster recovery provision presents a major business risk. Incorporating such a
provision into the contract will provide the outsourcing organization leverage over the service
provider. Choices B, C and D are problems that should be addressed by the service provider, but
are not as important as contract requirements for disaster recovery.