High employee turnover (A) poses the greatest risk because it leads to knowledge loss, operational disruptions, and potential security risks from departing employees. A constantly changing workforce can also impact compliance, training, and overall IT stability.
Other options:
Lack of customer satisfaction surveys (B) is a business issue but not a critical IT risk.
Aging staff (C) may be a long-term risk but does not have an immediate impact.
Frequent software upgrades (D) can be beneficial if managed correctly.
Reference: ISACA CISA Review Manual, IT Governance and Management of IT

The primary difference between a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP) lies in their timeframe for activation and overall scope.
BCP (Business Continuity Plan):
Focuses on ensuring that critical business processes continue operating during and after a disruption.
It includes strategies for maintaining operations (e.g., alternative work locations, manual procedures, supplier dependencies).
Activated immediately when a disruption occurs to keep the business running.
DRP (Disaster Recovery Plan):
Primarily focuses on the recovery of IT systems and infrastructure after a disruption.
It includes steps for restoring data, servers, and applications to bring IT operations back to normal.
Activated after the disaster event to restore normal IT operations.
The timeframe for activation is the key difference because:
BCP is implemented immediately to ensure business continuity.
DRP is implemented after the disaster to restore IT operations.
A). The annual testing requirements # Both BCP and DRP require regular testing, so this is not the key differentiator.
B). The focus on system recovery # Only DRP focuses on system recovery, but the BCP covers more than just IT. The key difference is still the timeframe.
D). The involvement of senior management # Senior management is involved in both plans, so this is not the primary distinction.
References:ISACA CISA Review Manual, 28th Edition, Chapter 4: Information Systems Operations and Business Resilience

The best action that audit management should consider first is to reassign the audit to an internal audit subject matter expert. This is because cloud service audits require specialized knowledge and skills to assess the risks and controls associated with the cloud service provider and the cloud service customer. An IS auditor who is unfamiliar with the technologies in use and their associated risks to the business may not be able to perform an effective and efficient audit, and may miss important issues or provide inaccurate recommendations.
Therefore, it is important to ensure that the IS auditor assigned to the cloud service audit has the appropriate competence and experience.
The other options are not as good as reassigning the audit to an internal audit subject matter expert.
Conducting a follow-up audit after a suitable period has elapsed may not address the quality issues of the initial audit, and may also delay the identification and remediation of any problems. Rescheduling the audit assignment for the next financial year may expose the organization to unnecessary risks and may not meet the audit objectives or expectations. Extending the duration of the audit to give the auditor more time may not be feasible or cost-effective, and may not guarantee that the auditor will acquire the necessary knowledge and skills in time.
References:
ISACA, CISA Review Manual, 27th Edition, 2019, p. 1391
ISACA, Cloud Computing: Business Benefits With Security, Governance and Assurance Perspectives, 2009, p. 14

Capacity management tools are primarily used to ensure that available resources are used efficiently and effectively to meet the current and future demands of the business. Capacity management tools can help monitor, analyze and optimize the performance and utilization of IT resources such as CPU, memory, disk, network, etc. The other options are not the primary purpose of capacity management tools, although they may be related or derived from them. References:
ISACA, CISA Review Manual, 27th Edition,chapter 4, section 4.32
ISACA, COBIT 2019 Framework: Introduction and Methodology, section 3.2