Skip to content

CS Professional · Internal and Forensic Audit · Internal Audit of Specific Functions

A bank's internal auditor reviews the IT general controls over a core system. Users report that the system was down for two days after a server failure, and the recovery took longer than the business tolerates. Backups exist and run nightly, but the recovery procedure has never been tested. Which is the most appropriate audit finding and recommendation?

The finding is that the business continuity and disaster recovery plan is untested. The auditor should recommend periodic testing measured against defined recovery time and recovery point objectives. Existing nightly backups do not prove timely restoration, as the two-day outage showed.

  1. ABackups are adequate; no finding is needed because they run nightly
  2. BIncrease backup frequency to hourly and stop testing recovery to save cost
  3. CReplace all users' passwords with longer ones
  4. DBusiness continuity and disaster recovery plan is untested; recommend periodic testing against defined recovery time and recovery point objectivesCorrect

Explanation

Having backups is not enough; the ability to restore within acceptable time must be proven by testing against recovery time and recovery point objectives. Option A ignores the outage, B drops testing, and C addresses access security, not availability.

Did you get it right without looking?

One question tells you little. A timed set on Internal Audit of Specific Functions shows your real accuracy, how long you take and where you lose marks.

Practise Internal Audit of Specific FunctionsFree diagnostic mock

More Internal Audit of Specific Functions questions