A financial services company runs nightly automated backups of its production database to a separate cloud region. During a quarterly audit, the compliance team asks for evidence that the backups can actually be used to recover the system within the documented RTO. The operations team confirms backup jobs complete successfully every night with no errors. What is the MOST important additional action the operations team should take to satisfy the auditor and reduce recovery risk?