During a review of a business continuity plan, an IS auditor noticed that the point at which a situation is declared
to be a crisis has not been defined. The MAJOR risk associated with this is that:
A.
assessment of the situation may be delayed.
B.
execution of the disaster recovery plan could be impacted.
C.
notification of the teams might not occur.
D.
potential crisis recognition might be ineffective.
Explanation:
Execution of the business continuity plan would be impacted if the organization does not know when to declare
a crisis. Choices A, C and D are steps that must be performed to know whether to declare a crisis. Problem
and severity assessment would provide information necessary in declaring a disaster. Once a potential crisis is
recognized, the teams responsible for crisis management need to be notified. Delaying this step until a disaster
has been declared would negate the effect of having response teams. Potential crisis recognition is the first
step in responding to a disaster.