Discuss Isaca CISA Exam Topic 5 Question 35

During an audit of a disaster recovery plan (DRP) for a critical business area, an IS auditor finds that not all critical systems are covered. What should the auditor do NEXT?

AVerify whether the systems are part of the business impact analysis (BIA).

BEvaluate the impact of not covering the systems.

CEvaluate the prior year's audit results regarding critical system coverage.

DEscalate the finding to senior management.

Suggested Answer: B

Get Premium CISA Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

14 comments · newest first

James 11 months ago

Last year's audit results could provide useful context.

Serita 11 months ago

Escalating to management seems like overkill.

Carin 11 months ago

Surprised they missed critical systems in the first place!

Annice 11 months ago

I think evaluating the impact is more important.

Leontine 11 months ago

Definitely should check the BIA first!

Clement 12 months ago

Escalating to senior management feels a bit drastic at this stage. Shouldn't we gather more information first before taking that step?

Joaquin 12 months ago

I remember a practice question where we had to look at previous audit results. It might be useful to check last year's findings, but I wonder if that's the best immediate action.

Marshall 12 months ago

I'm not entirely sure, but I feel like evaluating the impact of not covering the systems could be important too. It might help prioritize the next steps.

Melissa 1 year ago

I think the first step should be to verify if those systems were included in the BIA. It seems like a logical starting point.

Viva 1 year ago

Ah, I've seen this type of phishing email before. I think the answer is B - authority and urgency. The email is trying to create a sense of importance and time pressure to get the target to click the link.

Sonia 1 year ago

Hmm, I'm not too familiar with the OceanStor 9000 system, so I'll need to think this through carefully. Let me re-read the question and options to make sure I understand the context.

Hailey 1 year ago

Hmm, I'm a bit unsure about this one. I know provisioning has to do with setting aside funds to cover potential loan losses, but I'm not totally clear on how the "coverage ratio" is calculated. I'll need to think this through carefully.

Delsie 1 year ago

This seems like a straightforward question about CAPWAP configuration. I'll review my notes on CAPWAP and active/standby failover to make sure I have the right approach.

Lorean 1 year ago

This question feels familiar, I think we had a similar one on the practice tests—could it really be the highest amount listed?

Isaca CISA Exam - Topic 5 Question 35 Discussion