Greatest Concern in Unsuccessful DR Test

CISA By islever Editorial Last updated Sep 7, 2026

Short answer

C The disaster recovery procedures are not up to date.

Question

Which of the following should be of GREATEST concern to an IS auditor reviewing a report of an unsuccessful disaster recovery test?

A root cause analysis was not performed.
The report was not discussed with the IT steering committee.
The disaster recovery procedures are not up to date. Correct Answer
The disaster recovery test was conducted during non-peak hours.

Key Takeaways

The question tests the auditor's ability to distinguish between process improvement gaps (root cause analysis) and fundamental control failures (outdated procedures).

When reviewing an unsuccessful disaster recovery test, the greatest concern is whether the procedures were current, as outdated plans render the test invalid and the organization unprotected.

Common mistake: Candidates often choose A because they focus on continuous improvement, but failing to verify procedure currency before analyzing failure causes is a more critical audit finding.

Expert Analysis

Why the Answer Is Correct

The correct answer is C. An IS auditor's primary objective is to ensure that the organization can recover from disruptions. If the disaster recovery (DR) procedures are not up to date, the test itself is based on flawed assumptions, meaning the results are invalid and the organization is likely unprepared for a real incident. This is a foundational control failure.

Why the Other Options Are Wrong

Option A (lack of root cause analysis) is important for improving the DR program, but it is secondary to ensuring the plan itself is accurate. You cannot effectively analyze the root cause of a failure if the baseline procedures being tested are obsolete. Option B is less critical as steering committee discussion is a governance activity, not a technical control. Option D is irrelevant or even positive, as testing during non-peak hours minimizes business impact and is a best practice.

Community Comment Notes

Comments [1] and [2] correctly identify that outdated procedures undermine the entire recovery effort, making them the priority. Comment [4] highlights the common dilemma between A and C, noting that without current procedures, any test validity is questionable. Comments [3], [5], and [6] incorrectly prioritize root cause analysis over the integrity of the plan itself, missing the fundamental audit principle that the plan must be valid before its performance can be critiqued.

Official Reference

ISACA CISA Review Manual, Chapter 12: Business Continuity Planning

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always check the validity of the asset or plan being tested before evaluating its performance. In IT audit questions, 'up-to-date' or 'current' controls often take precedence over 'process improvements' like root cause analysis when the baseline is compromised.

Frequently Asked Questions

Why is root cause analysis not the greatest concern?

Root cause analysis improves future tests, but if procedures are outdated, the current test is invalid and the organization remains at risk.

Does testing during non-peak hours matter?

No, testing during non-peak hours is a best practice to minimize disruption and is not a concern regarding the test's success or failure.

More CISA FAQ →

Community Votes

57%

43%

57% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

Swallows 👍 2 Answered A

The absence of a root cause analysis poses a greater risk as it may indicate systemic issues that need to be addressed to improve the effectiveness of the disaster recovery program. Therefore, option A is likely of greatest concern to an IS auditor reviewing a report of an unsuccessful disaster recovery test.
RS66 👍 2 Answered C

C. The disaster recovery procedures are not up to date. Not A because the auditor is her to do the analysis so this not a concern.
PurpleParrot 👍 2 Answered C

Understanding the cause is important for improvement, but outdated procedures can undermine the entire recovery process.
a84n 👍 1 Answered A

Answer A while the lack of up-to-date disaster recovery procedures (option C) is a concern, addressing the root causes of the unsuccessful test (option A) takes precedence as the GREATEST concern for an IS auditor to ensure that future disaster recovery tests are successful and the organization's resilience to disruptions is strengthened.
1e71ed5 👍 1

But if procedures are outdated, the entire disaster recovery plan may be ineffective. This is a foundational issue, as current procedures are critical for a successful recovery and Without current procedures, any test (whether root cause analysis is performed or not) may not be valid. So, which one is the correct one - A or C?

Show 1 more comment

MJORGER 👍 1

A. A root cause analysis was not performed. When a disaster recovery test fails, it's crucial to conduct a root cause analysis to understand why the test was unsuccessful.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All CISA Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISA Practice Test →

← Back to CISA Study Guide