An IS auditor notes that the previous year's disaster recovery test was not completed within the scheduled time frame due to insufficient hardware…

A Service Level Agreement (SLA) is a formal, contractual document that defines the specific services, performance metrics, and resource commitments a third-party vendor must provide. Following a failure due to insufficient resources, the most reliable evidence of correction is an updated SLA that explicitly details the required hardware capacity for disaster recovery testing and execution. This contractually obligates the vendor to meet these requirements and typically includes penalties for non-compliance, providing the strongest assurance to the auditor that adequate resources are now formally allocated and legally enforceable.

B. A hardware change management policy is an internal organizational document and does not govern the resource commitments of an external vendor.

C. A vendor memo is an informal communication. It indicates intent but lacks the binding, contractual weight of an SLA, making it weak evidence.

D. A RACI chart clarifies personnel roles and responsibilities but does not provide any assurance regarding the allocation of physical hardware resources.

---

1. ISACA

CISA Review Manual

27th Edition. Domain 4: Information Systems Operations and Business Resilience

Section 4.5.3

"Third-party Service Management." The manual emphasizes that SLAs are critical control mechanisms for managing third-party relationships

defining service levels

and ensuring that vendors meet their contractual obligations

including those for business resilience and resource provision.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives. Management Objective APO10

Managed Vendors. Practice APO10.04

"Manage supplier relationships and contracts

" states the importance of formally defining and agreeing upon service levels

which are documented in SLAs to ensure supplier performance meets organizational requirements.

3. ISACA

ITAF: A Professional Practices Framework for IS Audit/Assurance

4th Edition. Guideline 2402

"Managing the IS Audit Function

" Section 3.6

"Sourcing." This section discusses the need for formal agreements (like SLAs) when sourcing services externally to ensure that performance and delivery meet the organization's needs

which is directly applicable to securing DR resources from a vendor.