hardMultiple Choice
CISA Practice Question: An organization's business continuity plan…
An organization's business continuity plan includes a reciprocal agreement with another company. What is the PRIMARY risk of this arrangement?
⚠ Common exam trap
The trap here is that candidates focus on legal or security concerns (options C and D) because they seem like obvious risks, but CISA emphasizes that the fundamental flaw in reciprocal agreements is the lack of geographic separation, which directly violates the principle of diversity in business continuity planning.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Both companies may be affected by the same disaster
The primary risk of a reciprocal agreement is that both organizations may be located in the same geographic area or rely on the same infrastructure (e.g., power grid, network backbone, or transportation). If a regional disaster such as an earthquake, flood, or prolonged power outage occurs, both companies could be incapacitated simultaneously, rendering the agreement useless. This defeats the core purpose of business continuity, which requires geographic diversity and independence of resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The other company may be a competitor
Why it's wrong here
Competitor status does not by itself prevent mutual assistance; confidentiality clauses can address it. The dominant risk is shared geography: a competitor in the same region suffers the same disaster, so its capacity is unavailable. Competitor analysis is relevant when selecting outsourcing partners, not continuity sites.
- ✓
Both companies may be affected by the same disaster
Why this is correct
Reciprocal agreements assume the partner's site remains available. If both organisations sit in the same geographic region, a single disaster such as flooding or a regional outage disables both facilities simultaneously, defeating the arrangement's purpose of providing alternate processing capacity.
- ✗
The agreement may not be legally enforceable
Why it's wrong here
Reciprocal agreements are contracts between two organisations, so enforceability is generally assumed rather than the primary concern. The real exposure is that both parties share the same regional threat, leaving the backup site unavailable. Legal review is the correct control when drafting any formal contract.
- ✗
The other company may not have adequate security
Why it's wrong here
Security posture differences are manageable through contractual controls and audits, so they are secondary. The primary failure mode is that a reciprocal partner in the same disaster area cannot host your workloads when both are affected. Security assessment is the right focus for third-party service providers.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.