An organization outsourced its IS functions to meet its responsibility for disaster recovery, the organization should:

When an organization outsources its information systems functions, it transfers the operational activities but retains ultimate accountability for governance and meeting business objectives, including disaster recovery. The organization must ensure that the vendor's disaster recovery plan (DRP) aligns with its own business requirements, such as Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO). This requires ongoing collaboration, oversight, and joint administration to ensure the plan is adequate, tested, and effectively integrated with the organization's overall business continuity strategy. Abdicating this responsibility introduces significant risk.

A. Discontinuing maintenance of the DRP is a dereliction of duty. Outsourcing transfers execution, not the ultimate responsibility for ensuring business resilience.

C. While a third-party evaluation can provide assurance, delegating the entire evaluation function is not the primary responsibility; management must own and oversee the process.

D. Delegating evaluation to internal audit would impair their independence. Internal audit's role is to provide objective assurance, not to perform management's functions.

---

1. ISACA

CISA Review Manual

27th Edition. Chapter 4: Information Systems Operations and Business Resilience

Section 4.6

"Outsourced IS Environments." The manual states

"When services are outsourced

the organization is ultimately responsible for ensuring that the third party’s BCP meets its business requirements... The IS auditor should verify that the organization has a process for monitoring the third party’s BCP." This monitoring and verification process necessitates coordination.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives. Management Objective DSS04

"Managed Continuity." Practice DSS04.05

"Test and review the BCP

" specifies the need to "Include relevant external parties (e.g.

service providers

business partners

customers) in the tests where appropriate." This inclusion directly implies coordination with the outsourcing vendor.

3. ISACA

COBIT 2019 Framework: Governance and Management Objectives. Management Objective APO10

"Managed Vendors." Practice APO10.05

"Monitor vendor performance and compliance

" states that the organization should "Periodically review vendor performance... against contracted service levels

and ensure compliance with requirements." This includes requirements for disaster recovery capabilities.

4. Hsu

C.

Lee

J.

& Wu

C. (2013). An empirical study of the impact of IT outsourcing on information system disaster recovery planning. Information & Management

50(6)

306-315. This study emphasizes that successful DR in an outsourced environment depends on strong contract management and continuous monitoring

which are forms of coordination and administration between the client and the vendor. (DOI: https://doi.org/10.1016/j.im.2012.08.005)