Which of the following would be MOST important for an IS auditor to verify when conducting a business continuity audit?