mediumMultiple Choice
CISA Practice Question: Implemented a business continuity plan (BCP) that…
An organization implemented a business continuity plan (BCP) that includes manual workarounds. Which of the following is the PRIMARY risk of relying on manual processes during a disruption?
⚠ Common exam trap
CISA often tests the distinction between primary and secondary risks, and candidates may be tempted to choose options that sound plausible but are not the most immediate or critical risk during a disruption, such as cost or recovery time, rather than the inherent unreliability of human performance under stress.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Higher probability of human error under stress
Manual workarounds in a BCP are inherently people-dependent, and during a disruption, staff operate under elevated stress, time pressure, and often with incomplete information. These conditions significantly increase the likelihood of mistakes such as skipped steps, data entry errors, or miscommunication. While manual processes may also be slower or costlier, the primary risk is that human error can cause the workaround itself to fail, potentially compounding the disruption. CISA emphasizes that manual controls are less reliable than automated ones, especially in crisis situations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Higher probability of human error under stress
Why this is correct
Manual workarounds depend on people performing unfamiliar tasks under time pressure, so the dominant risk is slips and mistakes rather than process design flaws. This directly satisfies the stem's concern with reliance on manual processes during disruption, where stress and fatigue sharply increase error rates.
- ✗
Longer recovery time for automated systems
Why it's wrong here
Manual workarounds do not lengthen recovery of automated systems; they substitute for them while systems are restored. The primary risk is that manual processing introduces human error and cannot match automated throughput or control. Recovery-time objectives for automated platforms are addressed through restoration planning, not the manual fallback itself.
- ✗
Higher cost of implementation
Why it's wrong here
Manual workarounds typically cost less to invoke than restoring automated infrastructure, so implementation cost is not the exposure. The real risk is error-prone, capacity-limited human processing during the disruption. Cost of implementation would matter when selecting and funding the continuity strategy itself, not when relying on manual processes.
- ✗
Increased dependency on technology
Why it's wrong here
Manual workarounds reduce reliance on technology, so this reverses the actual exposure. The genuine risk is human error and inconsistency under stress, since manual steps depend on operator judgement and availability. Technology dependency describes the pre-disruption state that automation creates, which is why the option misleads.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.