When a data center floods, the question is not whether the organization has a disaster recovery plan, it is whether anyone tested that plan before the water arrived. Availability controls exist to ensure systems operate when needed, recover when they fail, and meet the commitments made to customers and stakeholders.
AICPA Representative Tasks (verbatim). 1. Remembering & Understanding, Recall the scope, purpose and key considerations for business resiliency, disaster recovery and business continuity plans. 2. Remembering & Understanding, Explain the objectives of mirroring and replication. 3. Remembering & Understanding, Summarize steps in a business impact analysis. 4. Remembering & Understanding, Recall measures of system availability (e.g., agreed service time, downtime). 5. Application, Determine the appropriateness of the organization's data backup types (e.g., full, incremental, differential) including recovery considerations. 6.
HIGH-FREQUENCY: Business resiliency is the organization's overall ability to anticipate, prepare for, respond to, and adapt to incremental change and sudden disruptions. It encompasses both business continuity and disaster recovery, but extends to organizational culture, supply chain flexibility, and strategic adaptability.
Common mistakes
- Confusing BCP and DRP scope. BCP covers the entire organization and all critical functions; DRP focuses specifically on IT system restoration. An answer addressing only IT when the question asks about business continuity is incomplete.
- Misunderstanding RTO versus RPO. RTO is about time to restore functionality (downtime tolerance). RPO is about data loss tolerance (how much transaction history can be lost). Candidates sometimes invert these or confuse them with backup frequency.
- Calculating incremental recovery incorrectly. Incremental backup recovery requires the last full backup plus ALL incrementals since that full. Missing one incremental in the chain breaks the recovery. Differential recovery requires only the last full plus the SINGLE most recent differential.
Bottom line
- Business continuity planning (BCP) maintains critical operations organization-wide during disruptions; disaster recovery planning (DRP) restores IT systems after failures, and both require documented procedures and regular testing to be effective.
- Mirroring creates real-time identical copies giving zero data loss and immediate failover for local high availability; replication copies data at intervals for geographic redundancy and point-in-time recovery, with potential data lag.
- Business impact analysis (BIA) identifies critical processes, maps dependencies, quantifies downtime impact, and establishes RTO and RPO; it is the foundation for recovery planning.
- RTO defines maximum tolerable downtime; RPO defines maximum tolerable data loss; together they drive infrastructure and backup investment.
Exam shortcut
RTO/RPO mnemonic: RTO = Return To Operations (how long until we're back). RPO = Rewind Point for data (how far back can we go). Time to restore versus time of last good data. Backup chain rule: Incremental = ALL since last full (chain of many). Differential = ONE since last full (single restore). "Incremental" has more letters, requires more restores. Availability nines: Each additional nine divides downtime by 10.
The full lesson (about 3,083 words, 21 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- I.A3
Browse all free CPA ISC lessons or jump into free CPA ISC practice questions.