During a disaster recovery plan review, an IS auditor finds that the plan document is technically comprehensive but the emergency contact list, vendor phone numbers, and named recovery team members have not been updated in over two years, and several listed staff have left the organization. Which of the following is the auditor's GREATEST concern?