Câu 540: CISA: Certified Information Systems Auditor

During an audit of a disaster recovery plan (DRP) for a critical business area, an IS auditor finds that not all critical systems are covered. What should the auditor do NEXT?

1. A. Evaluate the impact of not covering the systems
2. B. Escalate the finding to senior management
3. C. Evaluate the prior year's audit results regarding critical system coverage
4. D. Verify whether the systems are part of the business impact analysis (BIA) — đáp án hiện tại