CRISC Information Technology and Security Practice Question
A risk practitioner at a healthcare payer is reviewing the organization's disaster recovery (DR) strategy for its core claims adjudication system. The business owner has stated that the maximum tolerable downtime is 4 hours, but the current DR plan relies on restoring from nightly tape backups, which would take at least 30 hours. Which of the following is the MOST appropriate action for the risk practitioner to take FIRST?
⚠ Common exam trap
The trap here is assuming the risk practitioner should immediately fix the technical shortfall or adjust the objective, rather than escalate the risk for a business decision.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Document the gap between the recovery time objective and the achievable recovery time, and escalate it to the business owner and IT leadership for a risk decision.
The core issue is a mismatch between the business-required recovery time objective and what the current DR strategy can deliver. The risk practitioner must first document and escalate this gap so the business owner can make an informed risk decision. Directly purchasing technology or rewriting the objective without approval would circumvent governance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform a full business impact analysis to determine whether the 4-hour maximum tolerable downtime is still valid.
Why it's wrong here
A business impact analysis is valuable, but the scenario already provides a stated maximum tolerable downtime from the business owner. The immediate gap is between that requirement and the technical capability. Conducting another BIA delays the necessary risk escalation and does not address the known shortfall in recovery capability.
- ✓
Document the gap between the recovery time objective and the achievable recovery time, and escalate it to the business owner and IT leadership for a risk decision.
Why this is correct
The practitioner's role is to identify and communicate the misalignment between the stated maximum tolerable downtime and the actual recovery capability, then escalate for a formal risk decision. Documenting and escalating ensures the business owner understands the residual risk and can approve, mitigate, or transfer it, which is the core of risk governance.
- ✗
Update the DR plan to state that the recovery time objective is 30 hours, because that is what the current infrastructure can achieve.
Why it's wrong here
Changing the recovery time objective to match current capability without business approval ignores the stated business requirement and effectively accepts a risk the business owner has not agreed to. The RTO should be driven by business needs, not by technical limitations. This action would mask the risk rather than manage it.
- ✗
Immediately purchase a real-time replication solution to meet the 4-hour requirement and inform the business owner after implementation.
Why it's wrong here
Unilaterally purchasing a solution bypasses the risk governance process and may not be the most cost-effective or aligned with business priorities. The risk practitioner's role is to advise and facilitate, not to make unilateral spending decisions. This action also fails to address whether the business owner accepts the risk or prefers a different mitigation.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.