Best Course of Action for Business Continuity Plan Audit

C.

In this scenario, the IS auditor has identified that the business continuity plan (BCP) has not been tested for five years. However, during a recent extended power outage, the plan was successfully activated. Based on this situation, the best course of action for the IS auditor would be to:

Option A: Determine if lessons learned from the activation were incorporated into the plan.

Explanation: It is important to determine if the organization has reviewed the activation of the BCP during the recent power outage and incorporated any lessons learned into the plan. By doing so, the organization can improve its BCP and ensure that it is better prepared for future incidents.

Option B: Determine if the business impact analysis (BIA) is still accurate.

Explanation: The BIA is a critical component of the BCP, as it identifies the key processes and systems that must be recovered in the event of an outage. The IS auditor should review the BIA to determine if it is still accurate and reflects the current state of the organization. If the BIA is no longer accurate, the organization may need to update its BCP accordingly.

Option C: Determine if a follow-up BCP audit is required to identify future gaps.

Explanation: While a follow-up BCP audit may be necessary to identify future gaps, it may not be the best course of action in this scenario. Given that the BCP was successfully activated during the recent power outage, it is unlikely that there are significant gaps in the plan. However, the IS auditor should still review the BCP to identify any areas for improvement.

Option D: Determine if the annual BCP training program is in need of a review.

Explanation: The annual BCP training program is important to ensure that employees are familiar with the BCP and understand their roles and responsibilities during an outage. However, it may not be the best course of action for the IS auditor in this scenario. Instead, the IS auditor should focus on reviewing the BCP itself to ensure that it is effective and up to date. If the BCP is found to be effective, then the IS auditor can consider reviewing the training program as a secondary step.

Overall, option A is the best course of action for the IS auditor in this scenario, as it focuses on improving the BCP based on the lessons learned from the recent activation.