CISA Tabletop exercise Practice Question
A business continuity plan (BCP) includes a tabletop exercise once a year. An IS auditor finds that the exercise only involves IT staff. Which of the following is the BEST recommendation?
⚠ Common exam trap
CISA often tests the auditor's ability to recommend the most appropriate improvement, and candidates may choose technical fixes (like failover tests) instead of addressing the governance and business involvement gap.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Invite business process owners to participate in future exercises
The best recommendation is to invite business process owners to participate in future exercises because BCP is a business-wide initiative, not just IT. Their involvement ensures that business impact, recovery priorities, and cross-functional dependencies are properly tested. This addresses the auditor's finding that the exercise only involves IT staff.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform a failover test of the production environment
Why it's wrong here
A failover test validates technical recovery, not the business-wide coordination the exercise lacks, so it does not address the missing non-IT participants. It is tempting because failover testing is a genuine BCP assurance activity, and it would be correct where recovery capability itself, rather than participant coverage, is unproven.
- ✗
Increase the frequency of IT-only exercises
Why it's wrong here
More frequent IT-only exercises repeat the same coverage gap, leaving business units untested, so the recommendation does not resolve the finding. It is tempting because frequency is a common audit remedy, and it would be correct where exercises are adequate in scope but too infrequent to maintain readiness.
- ✓
Invite business process owners to participate in future exercises
Why this is correct
Involving business process owners directly addresses the stem's constraint: the exercise excludes non-IT stakeholders. Business continuity depends on process recovery, not just infrastructure restoration, so owners validate recovery time objectives and interdependencies that IT staff cannot assess alone. Their participation tests cross-functional coordination, which is the exercise's core purpose.
- ✗
Include a data restoration test in the exercise
Why it's wrong here
Adding a restoration test deepens technical validation but still excludes business process owners, so the participation gap remains. It is tempting because restoration testing is a valid BCP component, and it would be correct where backup recoverability, rather than cross-functional involvement, is the identified weakness.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.