An enterprise's current business continuity plan (BCP) fails to consider many common crisis events. What would be MOST helpful to address this situation?

The primary deficiency identified is that the business continuity plan (BCP) fails to consider many common crisis events. The most direct and effective method to remedy this is to engage a broad range of stakeholders in scenario development. Stakeholders from various business units, IT, and support functions possess unique insights into potential threats and impacts relevant to their areas. This collaborative approach ensures that the BCP is built upon a comprehensive and realistic set of potential crisis scenarios, directly addressing the plan's current weakness and enhancing its overall relevance and effectiveness.

B. Review the root cause analysis: This is a reactive process used to analyze past failures. The current need is proactive planning to identify potential future crisis events.
C. Require further walk-through tests: Testing is used to validate an existing plan. It is inefficient to test a plan that is already known to be incomplete; the missing scenarios must be added first.
D. Review and update the crisis communication plan: While a vital component, the crisis communication plan is subordinate to the main BCP. Updating it does not solve the fundamental problem that the overall plan is missing key crisis scenarios.

1. ISACA, CGEIT Review Manual, 8th Edition. Domain 4: Value Optimization, Section 4.4, Business Service Continuity and Availability. The manual emphasizes that the foundation of a BCP is the Business Impact Analysis (BIA), which involves identifying potential threats and their impact. This process requires significant input from business process owners and other stakeholders to ensure all relevant scenarios are considered.

2. ISACA, COBIT 2019 Framework: Governance and Management Objectives. Management Objective APO12, Manage Risk. The framework details the need for risk analysis based on scenarios. Specifically, management practice APO12.03, "Analyze risk," states the need to "Develop a detailed view of the IT risk... including... the use of risk scenarios to estimate the business impact..." This process is informed by data collection (APO12.02), which involves identifying and consulting relevant stakeholders.

3. ISACA, COBIT 2019 Framework: Governance and Management Objectives. Management Objective DSS04, Manage Continuity. Management practice DSS04.02, "Identify and select a business continuity strategy," requires an understanding of business requirements during a disruption. This understanding is derived from a BIA, which is fundamentally based on identifying potential disruptive scenarios with input from business stakeholders.

4. Hiles, A. (2011). The Definitive Handbook of Business Continuity Management. John Wiley & Sons. Chapter 6, "Business Impact Analysis," explains that the BIA process, which is foundational to any BCP, relies on workshops and interviews with key stakeholders to identify critical processes and the threats (scenarios) that could disrupt them. This highlights the central role of stakeholder engagement in defining the scope of the BCP.