The greatest risk of using a reciprocal site for disaster recovery is the inability to utilize the site when required. A reciprocal site is an agreement between two organizations to provide backup facilities for each other in case of a disaster. However, this arrangement may not be reliable or enforceable, especially if both organizations are affected by the same disaster or have conflicting priorities. Therefore, the IS auditor should recommend that management consider alternative options for disaster recovery, such as dedicated sites or cloud services12. References:
* CISA Review Manual, 27th Edition, page 3381
* CISA Review Questions, Answers & Explanations Database - 12 Month Subscription

The most significant risk from not testing patches before putting them into production is the lack of system integrity. Patches are software updates that fix bugs, vulnerabilities or performance issues in an application system. However, patches may also introduce new errors, conflicts or compatibility issues that could affect the functionality, reliability or security of the system4. By not testing patches before putting them into production, the organization exposes itself to the risk of system failures, data corruption or unauthorized access. Loss of application support, outdated system documentation and developer access to production are also risks from not testing patches, but they are not as significant as the lack of system integrity. References:
* CISA Review Manual, 27th Edition, page 2951
* CISA Review Questions, Answers & Explanations Database - 12 Month Subscription

Section: Information System Acquisition, Development and Implementation
Explanation/Reference:
Generally, the methods for multiplexing data include the following:
Time-division multiplexing (TDM): information from each data channel is allocated bandwidth based on pre-
assigned time slots, regardless of whether there is data to transmit.
Asynchronous time-division multiplexing (ATDM): information from data channels is allocated bandwidth as
needed, via dynamically assigned time slots.
Frequency division multiplexing (FDM): information from each data channel is allocated bandwidth based
on the signal frequency of the traffic.
Statistical multiplexing: Bandwidth is dynamically allocated to any data channels that have information to
transmit.
Source: Information Systems Audit and Control Association, Certified Information Systems Auditor 2002
review manual, Chapter 3: Technical Infrastructure and Operational Practices (page 114).

Section: Information System Acquisition, Development and Implementation