Exam CISA topic 1 question 1792 discussion

ChatGPT also agrees D. My first choice was also D. Voting D. Why This is the Best Answer: A disaster recovery plan must remain current and aligned with the organization’s systems, risks, personnel, and infrastructure. If it's outdated, even a perfectly written plan becomes useless during an actual disaster. Why the Other Options Fall Short: A. Documents and distributes the plan 🔸 Necessary, but pointless if the plan is outdated. Distribution doesn’t guarantee accuracy. B. Contracts for warm site services 🔸 Good for recovery infrastructure, but doesn't address the effectiveness of the overall planning process. C. Schedules an annual tabletop exercise 🔸 Testing is important, but it won’t help if the plan is outdated or inaccurate.

The most important factor for the IS auditor to verify is C. Management schedules an annual tabletop exercise. This is because testing directly assesses the DRP’s effectiveness, ensuring it can be executed successfully. The CISA Review Manual supports this in Section 4.16.5: “Testing… validates the contents of the IT DRP” (page 343), making it the strongest indicator of preparedness. While updating the plan (Option D) is a close contender, testing encompasses validation and can trigger updates, giving it precedence in assessing overall effectiveness.