Step-by-Step Detailed Explanation:
A . Inform management and request that the plan be tested immediately:
Testing without updating the plan could lead to irrelevant results given the significant changes to the systems.
B . Update the recovery plan for management, as part of the review:
The auditor's role is to assess and recommend, not to perform management's responsibilities.
C . Evaluate the recovery plan and report weaknesses to management:
Evaluation alone does not address the need for an update and testing of the outdated plan.
D . Recommend that management and users update and test the recovery plan:
Correct. This approach addresses the deficiencies in the plan and ensures alignment with current systems.
CIA Exam Syllabus Reference:
Domain II: Risk Management and Control - Disaster Recovery and Business Continuity Planning.