Section: Protection of Information Assets
Explanation:
Plans are important, but mere plans do not provide reasonable assurance unless tested. References for the alternate site provider and the existence and maintenance of a disaster recovery plan are important, but only tests and drills demonstrate the adequacy of the plans and provide reasonable assurance of an organization's disaster recovery readiness.

The best approach for an IS auditor when preparing to evaluate whether the IT strategy supports the Organization's vision and mission is C. Meet with senior management to understand business goals. According to the ISACA Certified Information Systems Auditor (CISA) Study Guide [1], IS auditors should meet with senior management to understand the organization's vision and mission, and the related business goals, objectives and strategies. This will help the auditor to assess whether the proposed IT strategy is aligned with the organization's overall objectives, and whether the information systems are providing the expected returns. Additionally, the IS auditor should understand the organization's risk appetite and risk management approach, as these will affect the design and implementation of the IT strategy.