While the formal approval of the DRP by senior management (option C) is important for governance and accountability, an outdated DRP poses a more immediate risk to the organization's ability to recover effectively from disasters. Senior management approval ensures commitment and support for the DRP, but an outdated plan undermines its operational effectiveness and reliability. Therefore, ensuring that the DRP has been updated since an IT infrastructure upgrade should be of the GREATEST concern for an IS auditor reviewing an organization's disaster recovery plan.

D means the DRP was never adapted and has gap in the scope. A means DRP lost relevance over time, because the scope have not been adapted. so D is worst, because it never worked, A worked, but not anymore

A DRP should cover not only critical servers but also critical business processes, applications, and data. Focusing only on critical servers may leave other important components of the organization vulnerable during a disaster. The adequacy of recovery procedures for critical business functions is crucial for business continuity.