Which of the following issues should be the GREATEST concern to the IS auditor when reviewing an
IT disaster recovery test?

A.
Due to the limited test time window, only the most essential systems were tested. The other
systems were tested separately during the rest of the year.

B.
During the test it was noticed that some of the backup systems were defective or not working,
causing the test of these systems to fail.

C.
The procedures to shut down and secure the original production site before starting the backup
site required far more time than planned.

D.
Every year, the same employees perform the test. The recovery plan documents are not used
since every step is well known by all participants.

Explanation:
A disaster recovery test should test the plan, processes, people and IT systems. Therefore, if the plan
is not used, its accuracy and adequacy cannot be verified. Disaster recovery should not rely on key
staff since a disaster can occur when they arenot available. It is common that not all systems can be
tested in a limited test time frame. It is important, however, that those systems which are essential
to the business are tested, and that the other systems are eventually tested throughout theyear .
One aim of the test is to identify and replace defective devices so that all systems can be replaced in

the case of a disaster. Choice B would only be a concern if the number of discovered problems is
systematically very high, in a real disaster, there is no need for a clean shutdown of the original
production environment since the first priority is to bring the backup site up.