An IS auditor is reviewing an organization's business continuity plan (BCP) following a change in organizational structure with significant impact to business processes. Which of the following finding

The correct answer is D. The most recent business impact analysis (BIA) was performed two years before the. A business impact analysis (BIA) must reflect the current organizational structure and business processes. Since the reorganization significantly changed operations, relying on an outdated BIA means that critical processes, dependencies, and recovery priorities may no longer be a

Submitted by joshua94· Apr 18, 2026Information Systems Operations and Business Resilience

Question

An IS auditor is reviewing an organization's business continuity plan (BCP) following a change in organizational structure with significant impact to business processes. Which of the following findings should be the auditor's GREATEST concern?

Options

AKey business process end users did not participate in the business impact analysis (BIA).
BA call tree exercise has not been completed in the last two years.
CCopies of the BCP have not been distributed to new business unit end users since the
DThe most recent business impact analysis (BIA) was performed two years before the

How the community answered

(25 responses)

A
24% (6)
B
8% (2)
C
16% (4)
D
52% (13)

Explanation

A business impact analysis (BIA) must reflect the current organizational structure and business processes. Since the reorganization significantly changed operations, relying on an outdated BIA means that critical processes, dependencies, and recovery priorities may no longer be accurate - posing the greatest risk to business continuity effectiveness.

Topics

#Business Continuity Plan (BCP)#Business Impact Analysis (BIA)#IS Audit Findings#Organizational Change Impact

Community Discussion

No community discussion yet for this question.

Full CISA Practice