Skip to content

Cost and Management Audit · Information Systems Security Audit

Business Continuity and Disaster Recovery Planning for CMA Final

Updated 11 October 2026 · Fact-checked

A **Business Continuity Plan (BCP)** keeps critical business functions running during a disruption. A **Disaster Recovery Plan (DRP)** restores IT systems and data after it. To answer questions, state the purpose, identify critical processes, set RTO and RPO, choose backup and recovery site, test the plan, and review it as an auditor.

Understand Business Continuity and Disaster Recovery Planning

Every business depends on systems, data and people. If a fire, flood, cyber attack or power failure stops them, sales, payroll and cost records stop too. Planning for this is part of information systems security.

Business Continuity Plan (BCP) is the wider plan. It covers people, premises, processes, suppliers and IT. Its aim is to keep critical business functions going, even at a reduced level, during a disruption. Disaster Recovery Plan (DRP) is a part of BCP. It is narrower and technical: how to restore IT systems, applications and data after a disaster.

Planning starts with a Business Impact Analysis (BIA). You list critical processes, find how much loss each hour of downtime causes, and rank them. From this you set two targets. Recovery Time Objective (RTO) is the longest time a process or system can stay down. Recovery Point Objective (RPO) is the maximum data loss, measured in time, that the business can accept. Shorter RTO and RPO cost more.

Backups protect data. A full backup copies all selected data. An incremental backup copies only data changed since the last backup of any type. A differential backup copies data changed since the last full backup. Backup copies should be kept off-site or in a secure cloud, and restores must be tested.

Recovery sites give you a place to run after a disaster. A hot site is fully equipped, with current data, and ready in minutes or hours. A warm site has hardware and connectivity but needs data loaded and some setup. A cold site is only space with power and basic facilities; equipment must be brought in, so recovery takes longest and costs least.

Key rules to remember

BCP vs DRP
BCP = whole business continues; DRP = IT systems and data restored
DRP is a subset of BCP. Say this in every comparison answer.
Recovery Time Objective
RTO = maximum acceptable downtime
Decides the type of recovery site you need.
Recovery Point Objective
RPO = maximum acceptable data loss, measured in time
Decides how often backups or replication must run.
Restore sequence: incremental
Last full backup + every incremental taken after it, in order
Faster to back up, slower to restore.
Restore sequence: differential
Last full backup + latest differential only
Slower to back up as days pass, faster to restore.
Recovery site speed and cost
Hot (fastest, costliest) > Warm > Cold (slowest, cheapest)
Match the site to the RTO.

How to solve Business Continuity and Disaster Recovery Planning questions

Use this method for theory, case and audit-style questions on BCP and DRP.

  1. 1Read the question and mark whether it asks for definition, comparison, plan development, testing or audit review.
  2. 2Define BCP and DRP in one line each and show that DRP sits inside BCP.
  3. 3Link the case facts to a Business Impact Analysis: which processes are critical and what downtime costs.
  4. 4Set or read RTO and RPO and choose the backup method and recovery site that meet them.
  5. 5Describe plan content: roles, contacts, escalation, backup locations, recovery steps, communication.
  6. 6Add testing: walkthrough, simulation, parallel and full interruption tests, with documented results.
  7. 7Close with the auditor view: obtain the plan, check approval and currency, test evidence, off-site backups, and report gaps.
  8. 8Give a clear conclusion or recommendation tied to the case.

Quickest way: RTO-RPO-Site shortcut

When to use it: Use it for case-based MCQs and short recommendations when time is tight.

  1. Find the allowed downtime. Minutes or hours points to a hot site; a day or two to a warm site; several days to a cold site.
  2. Find the allowed data loss. Near zero needs continuous replication; a day is fine with nightly backups.
  3. For backup questions, pick incremental for short backup windows and differential for simpler, faster restores.
  4. If the question says 'whole business', answer BCP. If it says 'IT systems and data', answer DRP.
  5. If it says 'auditor', list the documents and tests to verify: plan, approvals, test reports, off-site backup proof.

Common mistakes in Business Continuity and Disaster Recovery Planning

  • Treating BCP and DRP as the same thing.

    Both deal with disasters and the terms are often used loosely.

    Fix: Write that BCP covers the whole business and DRP is the IT recovery part within it.

  • Mixing up incremental and differential backups.

    Both copy changed data and the reference point is easy to forget.

    Fix: Incremental: changes since the last backup of any type. Differential: changes since the last full backup.

  • Swapping warm and cold sites.

    Students memorise names without the equipment detail.

    Fix: Warm has hardware and connectivity ready; cold is just space and power. Hot has live data too.

  • Confusing RTO with RPO.

    Both are recovery targets measured in time.

    Fix: RTO is how long you can be down. RPO is how much data you can lose.

  • Writing an audit answer with no verification steps.

    Students describe the plan but not how the auditor checks it.

    Fix: Add review of approval, currency, test results, off-site storage, training and gaps reported to management.

  • Saying a plan is complete once written.

    Testing and updating are overlooked.

    Fix: State that the plan must be tested regularly and updated after changes in systems, staff or business.

Worked examples

Example 1

A manufacturing company in Pune runs its costing and billing on one server. The management accepts at most 4 hours of downtime and a loss of at most 1 hour of data. Recommend a recovery site and backup approach, with reasons.

Show the solution
  1. Identify targets: RTO is 4 hours and RPO is 1 hour.
  2. A cold site needs equipment to be brought in, so it cannot restore in 4 hours. Reject it.
  3. A warm site needs data loading and setup, which is risky within 4 hours. A hot site is safer for the RTO.
  4. For the 1-hour RPO, nightly backups are not enough. Use frequent replication or hourly backups to the recovery site.
  5. Keep a periodic full backup with hourly incremental copies, stored off-site.
  6. Test the failover and restore regularly.

Answer: Use a hot site (or a warm site proven to restore within 4 hours) with hourly replication or backups, off-site storage and regular restore tests.

Example 2

Explain how an auditor reviews a company's BCP and DRP.

Show the solution
  1. Obtain the BCP and DRP and confirm they are approved by senior management and cover critical processes found in the BIA.
  2. Check that RTO and RPO are defined and that backup frequency and recovery site match them.
  3. Verify roles, contact lists and escalation steps are current and staff are trained.
  4. Inspect backup logs and confirm copies are held off-site and secured.
  5. Review test reports: type of test, date, results, problems found and corrective action.
  6. Check the plan is updated after major changes in systems or operations.
  7. Report gaps and recommend improvements to management.

Answer: The auditor checks that the plans exist, are approved, meet RTO and RPO, are tested and updated, and that backups are secured off-site, then reports weaknesses with recommendations.

Exam tips

  • Compare BCP and DRP in a two-column style using bullet points: scope, focus, owner, example.
  • For hot, warm and cold sites, always mention cost and recovery time together.
  • In case MCQs, read RTO and RPO figures first; they usually decide the answer.
  • In audit questions, list what the auditor inspects, not just what the plan contains.
  • Mention testing and periodic updating in every plan-development answer.

Practice questions from Information Systems Security Audit

Business Continuity and Disaster Recovery Planning in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Business Continuity and Disaster Recovery Planning: frequently asked questions

What is the difference between a business continuity plan and a disaster recovery plan?

A BCP keeps the whole business running during a disruption, covering people, processes, premises and IT. A DRP focuses only on restoring IT systems and data. The DRP is a part of the BCP.

What is the difference between hot, warm and cold sites?

A hot site is fully equipped with current data and recovers fastest at the highest cost. A warm site has hardware and connectivity but needs data and setup. A cold site has only space and power, and is slowest and cheapest.

What is the difference between incremental and differential backup?

An incremental backup copies changes since the last backup of any kind. A differential backup copies changes since the last full backup. Incremental restores need the full backup plus all incrementals; differential needs the full plus the latest differential.

Why must BCP and DRP be tested?

An untested plan may fail when needed. Tests expose gaps in procedures, backups and staff readiness, so they can be fixed before a real disaster.