An organization performs nightly backups but does not have a formal policy. An IS auditor should FIRST: