With respect to business continuity strategies, an IS auditor interviews key stakeholders in an organization to
determine whether they understand their roles and responsibilities. The IS auditor is attempting to evaluate the:
A.
clarity and simplicity of the business continuity plans.
B.
adequacy of the business continuity plans.
C.
effectiveness of the business continuity plans.
D.
ability of IS and end-user personnel to respond effectively in emergencies.
Explanation:
The IS auditor should interview key stakeholders to evaluate how well they understand their roles and
responsibilities. When all stakeholders have a detailed understanding of their roles and responsibilities in the
event of a disaster, an IS auditor can deem the business continuity plan to be clear and simple. To evaluate
adequacy, the IS auditor should review the plans and compare them to appropriate standards. To evaluate
effectiveness, the IS auditor should review the results from previous tests. This is the best determination for the
evaluation of effectiveness. An understanding of roles and responsibilities by key stakeholders will assist in
ensuring the business continuity plan is effective. To evaluate the response, the IS auditor should review results
of continuity tests. This will provide the IS auditor with assurance that target and recovery times are met.
Emergency procedures and employee training need to be reviewed to determine whether the organization had
implemented plans to allow for the effective response.