CISA Practice Question: Information Systems Operations and Business Resilience
An IS auditor is assessing the business impact analysis (BIA) for a critical business function. The BIA identifies a maximum tolerable downtime (MTD) of 8 hours and a recovery time objective (RTO) of 4 hours. The current disaster recovery plan (DRP) states that the recovery of this function will take 6 hours. What should the IS auditor conclude?
⚠ Common exam trap
A common mix-up: candidates confuse the MTD with the RTO and assuming that as long as recovery is within the MTD, the plan is acceptable, when in fact the RTO is the critical target.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The DRP is inadequate because the recovery time exceeds the RTO.
The recovery time objective (RTO) defines the maximum acceptable time to restore a business function after a disruption. The disaster recovery plan's recovery time of 6 hours exceeds the RTO of 4 hours, meaning the plan cannot meet the business requirement. Although the recovery time is within the maximum tolerable downtime (MTD), the RTO is the target that must be met to avoid unacceptable impact. Therefore, the auditor should conclude the DRP is inadequate and recommend improvements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DRP is adequate because the recovery time is within the MTD, and the RTO is only a guideline.
Why it's wrong here
The RTO is not merely a guideline; it is a critical business requirement derived from the BIA. Exceeding the RTO means the organization may suffer unacceptable losses. The MTD is the absolute maximum, but the RTO is the target. Therefore, the DRP is not adequate.
- ✓
The DRP is inadequate because the recovery time exceeds the RTO.
Why this is correct
This is correct because the RTO is the maximum acceptable time to restore the function after a disruption. The DRP's recovery time of 6 hours exceeds the RTO of 4 hours, indicating that the plan does not meet the business requirement. The auditor should report this as a gap.
- ✗
The DRP is inadequate because the MTD is greater than the RTO, indicating a misalignment.
Why it's wrong here
Having an MTD greater than the RTO is normal and expected; the RTO should be less than the MTD to provide a buffer. The issue is not the relationship between MTD and RTO, but that the actual recovery time exceeds the RTO. So this conclusion is incorrect.
- ✗
The DRP is adequate because the recovery time is less than the MTD.
Why it's wrong here
While the recovery time of 6 hours is less than the MTD of 8 hours, it exceeds the RTO of 4 hours. The RTO is the target time for resuming operations, and failing to meet it could still result in unacceptable business impact. Therefore, the DRP is not fully adequate.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.