A financial services organization maintains nightly encrypted backups of its core banking database, replicated to an off-site facility. During an annual audit, the risk manager notes that the backups have never actually been restored to verify usability; the team relies solely on the backup software's success logs. Which action should the risk manager recommend FIRST to address this concern?