An organization performs nightly backups but does not have a formal policy. An IS auditor should FIRST:
A . evaluate current backup procedures
B . escalate to senior management
C . document a policy for the organization
D . recommend automated backup
Answer: A