An internal auditor has completed the fieldwork of an assurance engagement on the organization '...

An internal auditor has completed the fieldwork of an assurance engagement on the organization ' s business continuity. The most significant finding is that business requirements were left up to the IT function to decide and implement. As a result, the time to recovery for some critical systems following a disruption is too long, while recovery time of non-critical systems is needlessly prioritized at a significant cost. Which of the following is the most appropriate recommendation to include in the engagement report?