Which of the following should be of GREATEST concern to an IS auditor reviewing an organization's business continuity plan (BCP)?