An organization outsources its IT function and help desk services.

A business continuity plan should include solutions for recovering critical business functions after a disruption. The plan should identify critical processes, recovery priorities, responsibilities, communication procedures, alternative arrangements, system recovery requirements, and dependencies on outsourced services. Capacity management plans may support operational planning, but they are not the central BCP content. Intellectual property and data protection clauses are contract terms that may be important in outsourcing agreements, but they are not the main recovery content of the continuity plan. Internal audit should verify that outsourced service continuity is aligned with the organization’s recovery time objectives, recovery point objectives, escalation procedures, and service-level commitments. Therefore, Option C is correct.